Phishing email sent to me within a few hours after a related incident, what should I do?

Question

A few hours ago I was helping a family member pay for something on a government website with one of his credit cards, but for whatever reason it didn't go through, so we used another card and it worked fine. I also put in one of my email accounts for the receipt and payment confirmation, which I got in a minute after paying.

Two hours later I get a phishing email sent to my 'main' email account from a different provider (ie, not the one I put in previously) that pretended to be the credit card company of the card that didn't go through, saying that there was unusual activity in my account and they declined payments, click the link, etc. (I did accidentally open the link on my Blackberry 10 phone before checking the email address that sent it which was stupid of me)

Am I compromised in some way and how does this usually happen? I assume I should change my passwords.

Answer 1

Best thing to do is to contact your credit card provider and to block the card.

Answer 2

First of all, contact your credit card provider. If the email send for "unusual activity" is legit and has been send by them, they should be able to guide you through their process of mitigation. In this case, you don't have to worry about the email being a phishing attempt. On the other hand, it could mean that the government site you were in is a fake, has been compromised, or is somewhat blacklisted by your bank.

If they did not sent you this email, make them aware your card might be compromised and maybe do a review of the last operations with them.

Spam, or phishing emails might be used for multiple purposes, such as:

• assess whether the email is valid (if someone opens a link or load an image from that email)
• dupe users to provide information such as credit card number

So as long as you did not provided your credit card number after clicking the email link and on the assumption that you reach and used the government website in a secured manner (Valid SSL certificate etc.) your credit card information should be ok (you might have to deal with more spam/phishing in the next days since they probably know your email is a valid one though).

Depending on the legal regulations in your country, your bank might be in the obligation to reimburse you if any fraud happens on your bank account using internet services. In that case you might be willing to "wait and see". If you find that evidence clearly points to a the card being compromised, then issuing a revocation is the best thing to do.

As a conclusion, you need to assess where was the real security breach (if any) and deal with the relevant consequences.