NEWS / Scammers exploit LastPass “digital will” function by referencing phony death certificate

A number of users have been receiving e-mails from scammers claiming to represent online password storage platform LastPass. The e-mail claims that the given recipient’s death certificate has been uploaded to the platform and offers an option to correct this matter. Once the recipient attempts to correct the issue by proving they are, in fact alive, scammers are able to intercept their username and password, thereby having access to all their other passwords.

According to PC World, scammers are able to spoof the e-mail address alerts@lastpass.com and then direct victims to “lastpassrecovery[dot]com,” a bogus website supposedly containing an image of the fake death certificate. Some scammers go as far as to call potential victims on the phone pretending to be LastPass employees and telling them to login to the LastPass website to correct the issue.

LastPass has issued a warning that this new phishing attack has been ongoing since mid-October and is associated with the CryptoChameleon group, which targets login and cryptocurrrency wallets, particularly the Binance, Coinbase, Kraken, and Gemini platforms.

LastPass allows users to store passwords to multiple online account and offers a “digital will” function that grants access to these passwords to a given beneficiary in the event of that user’s death, as evidenced by their death certificate. LastPass noted that it’s own servers have not, in any way, been compromised, and that the phishing attack was more of a masterful case of social engineering.

If you require assistance retrieving a certified copy of a death certificate and getting it apostilled or authenticated for use abroad, feel free to reach out to us via e-mail info@apostille.us or by phone at (212) 233-7061. You can also place an order on our website.