Contact Form Fraud: How Cybercriminals Use Your Website Against You
Cybercriminals are constantly devising new methods to steal information and infiltrate business networks. In a particularly clever fraud, attackers have found a way to use the contact forms on company websites to bypass email security filters and deliver malware directly to employees. This technique, known as contact form fraud, exploits the trust that businesses place in enquiries from potential customers.
How Contact Form Fraud Works
The attack begins with something that looks entirely routine: a prospective client fills in the contact form on a company's website, requesting a quotation or expressing interest in services. On the surface, it appears to be a legitimate business enquiry. However, the person behind the form is a cybercriminal, and the entire interaction is designed to deliver malware.
In the initial submission, the cybercriminal provides plausible details -- a name, a company name, and often a fake domain crafted to look like a genuine business. This attention to detail makes the enquiry appear authentic and trustworthy. The form submission triggers an automated notification to the company, or a staff member reviews the enquiry manually and responds.
Here is where the trap is sprung. Because the employee is responding to what appears to be a genuine customer enquiry, most email security filters treat the subsequent conversation as legitimate. The exchange does not match the patterns that spam and phishing filters typically flag. When the cybercriminal replies to the employee's response, they include a link to a file-sharing service such as Google Drive, Dropbox, or OneDrive, claiming it contains project specifications, design files, or other materials relevant to the quotation request.
If the employee opens the shared file, malware is installed on their computer. From there, the cybercriminal can potentially gain access to the entire organisation's network, steal sensitive data, deploy ransomware, or use the compromised system as a launching point for further attacks.
Why This Attack Is So Effective
Contact form fraud succeeds because it exploits several layers of trust simultaneously:
- Business context. Employees expect to receive enquiries from unknown companies. A request for a quotation is entirely normal and does not raise suspicion.
- Email filter bypass. Because the employee initiates the email conversation by replying to the contact form submission, the exchange is flagged as a legitimate business interaction. Most email security tools are designed to catch inbound threats, not threats that emerge from ongoing conversations.
- File-sharing legitimacy. The malicious file is hosted on a reputable file-sharing platform, which most antivirus tools and email filters treat as safe. The file itself may be a password-protected archive, further evading automated scanning.
- Professional presentation. Cybercriminals often invest effort in making their communications look professional, using proper grammar, industry-specific terminology, and realistic company details.
Warning Signs to Watch For
Although contact form fraud is designed to look legitimate, several red flags can help you identify a potential attack:
- Vague or generic enquiries. If a quotation request lacks specific details about the project or service needed, it may be a pretext to start a conversation rather than a genuine business need.
- Unusual timing. Messages submitted outside of normal business hours, particularly from companies in the same time zone, may warrant additional scrutiny.
- Rapid escalation to file sharing. If the "client" quickly moves the conversation to file-sharing platforms rather than discussing requirements through email, proceed with caution.
- Spelling and grammar inconsistencies. Whilst not always present, a higher-than-normal number of errors in supposedly professional communications can indicate that the sender is not who they claim to be.
- Domains that do not match. If the contact provides a company name and website, take a moment to verify that the website exists, looks professional, and has been registered for more than a few weeks. Newly registered domains are a common indicator of fraud.
How to Protect Your Business
Do not let contact form fraud catch your team off guard. Follow these guidelines to stay safe:
- Treat every inbound enquiry with healthy scepticism. When you receive an email or contact form submission, take a moment to assess it for red flags before responding. Check for unusual timing, generic language, and domains that do not match the supposed sender's business.
- Be cautious with file-sharing links. Keep an eye out for attachments or links shared through file-sharing services, especially early in a business relationship. Cybercriminals use these platforms specifically because they can bypass antivirus protections. If you must open a shared file, scan it with your security software first and avoid enabling macros or running executable files.
- Verify the sender's identity independently. Even if an email appears to have been sent from a legitimate source, remember that domains can be spoofed. If you need to confirm that an enquiry is real, attempt to contact the sender directly through a phone call or by visiting their official website and using the contact details listed there.
- Implement CAPTCHA on contact forms. Adding CAPTCHA or similar challenge mechanisms to your website's contact forms can reduce the volume of automated and fraudulent submissions.
- Train your team. Ensure that all employees who handle inbound enquiries are aware of this type of fraud and know how to recognise the warning signs.
Securing Your Website and Network
Contact form fraud is a reminder that your website is not just a marketing tool -- it is a potential entry point for attackers. Keeping your website secure with SSL certificates, regular software updates, and proper access controls reduces the overall attack surface. Professional website maintenance ensures that your contact forms, plugins, and server configurations are kept up to date and monitored for suspicious activity.
If your business lacks the in-house expertise to evaluate and strengthen its security posture, Faciotech's consulting and advisory services can help you identify vulnerabilities and implement practical protections. For more on how cybercriminals exploit trusted platforms to deliver malware, read our article on QakBot malware and email hijacking.
Stop, look, and think. Don't be fooled by the scammers.
