
Summary
This rule is designed to detect suspicious messages containing promotional credit card offers that may be linked to fraudulent activities. The detection focuses on messages and their subject lines mentioning terms commonly associated with promotional credit cards, such as 'credit card offer', 'promotional credit', and 'free credit card'. The rule also analyzes the content of attachments for Personally Identifiable Information (PII) templates by looking for at least three indicators like 'Credit Card Application', 'Date of Birth', and 'Email'. Additionally, it checks for mentions of WhatsApp within the messages or attachments, as such communication methods are atypical for genuine financial institution interactions. The combination of these checks helps identify potential scams targeting personal financial information.
Categories
- Web
- Endpoint
- Cloud
- Mobile
- Identity Management
Data Sources
- User Account
- Web Credential
- File
- Process
Created: 2025-11-21