Holiday scams — annual alert

 Computer  Comments Off on Holiday scams — annual alert
Nov 222016
 

This time of year brings, as usual, the need to be particularly alert for cybercrime. PC World’s article “10 sneaky holiday phishing scams to watch out for” lists some common scams.

  • Fake purchase invoices
  • Fake shipping notifications (with malware links)
  • Unexpected deals or product promotions from stores or sellers you have never dealt with
  • Phishing — false claims and spoofs asking for personal information (with bogus links and Web page addresses)
  • Fake surveys

These scams rely on you being distracted and conned by coincidence. For example, “if you just placed an order that shipped via UPS, and then you get a zipped virus with the vague wording about your recent order being delayed, you may be more likely to click it.”

Other scams which I see regularly involve offers of free gift cards from a major retailer. Such messages are sent out by the millions. You may even have made a recent purchase from the presented retailer, with a hook like “Congratulations on your recent [retailer name] purchase.”

Other scams involve surveys, sometimes regarding a supposed purchase. Remember that when you reveal personal information, scammers can use that information for even more genuine-looking phishing messages.

Survey emails sent out promising some sort of money or gift card in exchange for completing it can end up being a scam. Often the surveys are very short and generic, but at the end they may ask for some personal information. This can be what the attackers are really after. By gathering this information, they can use it to further a more advanced phishing attack.

As always, monitoring your bank accounts for recent transactions is good practice.

So, if you’re having a hectic day and checking your email, pause a moment when any message deals with the above situations. Reality check vaguely worded subjects or generic messages asking for personal information. Don’t assume a connection which may not be there — to a recent purchase or contact.

PC World’s article “11 security basics that keep you safe from holiday tech dangers” also offers some helpful tips.

Email spoofing — a reminder to be alert

 Computer  Comments Off on Email spoofing — a reminder to be alert
Jun 162016
 

Malwarebytes Labs’ blog recently posted an article about email spoofing. It’s a good reminder about following best practices — ways to avoid scams.

Email spoofing basically comes down to sending emails with a false sender address. This can be used in various ways by threat actors. Obviously pretending to be someone else can have its advantages especially if that someone else holds a position of power or trust with regards to the receiver.

Phishing campaigns use email spoofing. The article lists other reasons for spoofing as well. Scammers and criminal organizations have different business models (typically to generate revenue) and use cons that have been around for centuries.

There are technical procedures to confirm a spoofed message, but these are not practical for most people. Sometimes I get messages claiming to be from a client. I am immediately suspicious because of the subject of the message (or the lack of a subject). Examination of the raw message usually reveals that it was indeed a spoof and sent to a bunch of addresses stolen from the alleged sender’s address book.

The industry has been working on technical countermeasures to detect and stop spoofed messages. Your Internet Service Provider (ISP) may use some. But they are not foolproof.

Remember that email was designed much like the delivery of paper letters by the United States Postal Service (USPS). Anyone can write any “to” and “from” addresses they like on the envelope. There’s no authentication by the USPS.

Spoofers also rely on “look alike” or “sound alike” names and other words, which can trick anyone not paying close attention.

And remember that Caller ID on your phone may be spoofed as well.

IRS “Dirty Dozen” tax scams — phone and email fraud

 Computer  Comments Off on IRS “Dirty Dozen” tax scams — phone and email fraud
Mar 072016
 

1. Phone tax scams top the IRS’ so-called “Dirty Dozen” for this filing season. Read the full article for what to do and not to do.

Aggressive and threatening phone calls by criminals impersonating IRS agents remain a major threat to taxpayers, headlining the annual “Dirty Dozen” list of tax scams for the 2016 filing season, … The IRS has seen a surge of these phone scams as scam artists threaten police arrest, deportation, license revocation and other things. The IRS reminds taxpayers to guard against all sorts of con games that arise during any filing season.

Scammers make unsolicited calls claiming to be IRS officials. They demand that the victim pay a bogus tax bill. They con the victim into sending cash, usually through a prepaid debit card or wire transfer. They may also leave “urgent” callback requests through phone “robo-calls,” or via a phishing email.

Many phone scams use threats to intimidate and bully a victim into paying. They may even threaten to arrest, deport or revoke the license of their victim if they don’t get the money.

Scammers often alter caller ID numbers to make it look like the IRS or another agency is calling. The callers use IRS titles and fake badge numbers to appear legitimate. They may use the victim’s name, address and other personal information to make the call sound official.

2. Email tax scams … The Internal Revenue Service (IRS) reports an approximate 400 percent surge in phishing and malware incidents so far this tax season. Read the full article for what to look for in these scams.

The emails are designed to trick taxpayers into thinking these are official communications from the IRS or others in the tax industry, including tax software companies. The phishing schemes can ask taxpayers about a wide range of topics. E-mails can seek information related to refunds, filing status, confirming personal information, ordering transcripts and verifying PIN information.

When people click on these email links, they are taken to sites designed to imitate an official-looking website, such as IRS.gov. The sites ask for Social Security numbers and other personal information. The sites also may carry malware, which can infect people’s computers and allow criminals to access your files or track your keystrokes to gain information.

Tax scams — email phishing

 Computer  Comments Off on Tax scams — email phishing
Feb 202016
 

Tax scams are nothing new. The digital age has made such scams even more common. So, I received a phishing email message today claiming to be from “irs.online.services@irs.gov” with “Update Your E-file Records For 2015 Tax Return” as the subject. A detailed examination revealed that the message was not in fact from the IRS (no surprise) and contained a (malicious) link to probably a hijacked web site in Spain:

http://www.[removed].es/themes/default/img/irs/irs/irs/irs/irs/irs/irs/irs/i=rs/irs/IRS.html

Here’s the (plain text) content:

This is an automatic message by the system to let you know that we are yet to confirm your account information ,You need to confirm your account information within 24 hours. Your account has been deactivated , Kindly click the link below to Activate your E-file Records for 2015 Tax Return.

Failure to do this would result in delay/refusal of your refund.
Activate Your E-file Records For 2015 Tax Return

Sincerely,
Internal Revenue Service.

Why should you be immediately suspicious if you receive such an email message? As pointed on on this IRS web page:

The IRS doesn’t initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information. This includes requests for PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts.

Phishing is a scam typically carried out through unsolicited email and/or websites that pose as legitimate sites and lure unsuspecting victims to provide personal and financial information.

This USA Today article summarizes the increase in electronic scams:

Email and texting scams designed to trick U.S. taxpayers into providing personal data have surged 400% so far this year, the IRS warned Thursday in a renewed consumer alert.

The schemes involve so-called phishing messages designed to trick taxpayers into believing the emails and texts represent official communications from the IRS, tax software companies or others in the tax industry.

These scams take many forms. Standard advice: Do not reply, do not open any attachments, do not click on any web links, delete the message. Note that many modern, simplified email apps make checking links problematical — checking the actual addresses of links in such messages.

Valentine’s Day — scams as usual

 Computer  Comments Off on Valentine’s Day — scams as usual
Feb 082016
 

As I’ve noted in previous posts, while holidays are times to celebrate, they also are opportunities for scammers to trick you. The latest issue of VIPRE Security News reminds us of 5 common scams.

5 Scams Designed to Break Your Heart:

  1. Lovely Email or Unlovely Malware?
  2. Infected e-cards
  3. Google-based Traps
  4. Social Media Frauds
  5. Sales-related Scams

Read the full article for a description of these scams and what to do (and not do).

Jul 212015
 

The July 2015 issue of VIPRE Security News notes that: “Retail and finance call centre phone scamming in the US is up 30 percent according to research from Pindrop Security, a phone security company.”

Attackers call across international borders at 10x the rate of legitimate callers. Spoofing technology allows attackers to hide their true automatic number identification and appear as a local call on Caller ID.

Scammers are increasingly using VoIP and robodialers to mask incoming phone numbers and better target consumers. VoIP has minimized or eliminated the cost of phone calls, both domestic and international.

What’s the most common scam? As I’ve noted in other posts — phony technical support calls.

Credit Score Scams — a scam that hasn’t changed about score changes

 Computer  Comments Off on Credit Score Scams — a scam that hasn’t changed about score changes
Jun 142015
 

If your email address has been “harvested” by scammers, then at some point you’ll probably get an email message with a subject like “Your credit score has changed,” or “Your Equifax score has been modified” or something similar, possibly referring to Experian or TransUnion as well. From “Score Advisor” or something similar.

These scam spam messages try to get you to reveal private information. Scammers want you to click on a link in the message to “verify” your credit score. The message may include a bogus “Reference Number” and then a link to “Review And Confirm.” The message is signed by the “CreditReportingTeam” or something similar, and may include the name and address of a legitimate free-score service.

The link in the message, however, actually goes to a web page that does not match the sender’s claim and which has nothing to do with any of the legitimate credit-score services.

US News posted an article in October, 2014, “Watch Out for These Credit Score Scams” which summarized these types of scams.

Shortly after signing up to get my free credit score at one of the popular websites that offers the service, I received an email alerting me that my score had recently changed and that I should log into the site provided to check on it. Since I had recently signed up for my free score, I almost fell for the scam and followed the link, which could have compromised my personal information.

The information technology team at U.S. News reports that our company received about 140 spam messages in the last week with the words “score changes” in the subject line.

The article outlines 6 ways to protect yourself. One of the most important skills is knowing how to check the domain name in the address of any links with that of the sender’s and that of the company asserted by the sender.

Skepticism about any email regarding your credit score is a good policy. Links in such emails also can take you to web sites which may infect your computer with malware.

P.S.

As a technical note, the “.com” host IP address in the (raw) complete message header can be bogus itself. Just another cyber criminal trick.

Fake Shipping Notifications — an annual email scam

 Computer  Comments Off on Fake Shipping Notifications — an annual email scam
Dec 162014
 

Yes, it’s that time of year again. Fake shipping notifications — email messages purporting to be from mainstream shippers (FedEx, UPS, etc.) saying that delivery of a parcel / package was attempted — directing you to open an attachment or click on a link.

As pointed out in last year’s post “Holiday Cyber Risks” (December 15, 2013), spoofed emails are all too common this time of year.

The latest scam that I’ve seen claims to be from “FedEx First Overnight” with a subject “Ship Notification.” Of course, the sender’s email address (which probably’s spoofed) is bogus, as well as the return path (meaningless also). The scam declares that “To receive your parcel, print this label and go to the nearest office.” The message contains an encoded link to a malicious Web site.

Remember, you can always go to the shipper’s Web site directly (in your favorite Web browser) or call to check status.

Also watch out for fake e-card and gift card scams.

Fake Gift Card Surveys — another email scam

 Computer  Comments Off on Fake Gift Card Surveys — another email scam
Dec 112014
 

Fake gift card surveys. I’ve seen more of these scams the last month or two. The email messages claimed to be from Amazon with “Amazon Coupons” as the subject. Examination of the messages revealed sender addresses having nothing to do with Amazon. Like from amazon@someothersite.com. Encoded (indecipherable) links in the bodies of the messages went to strange sites. Message bodies contained gibberish.

These survey scams appear on social media sites as well, e.g., on Facebook. There’s also a CVS survey / coupons scam.

How can you tell if the message is a scam? Well, there’s the tease itself — something for nothing, eh. If the promotion really was from Amazon, you’d see the offer when logged into your Amazon account. If you impulsively open such a message, at least check any embedded links (you know how to do this, correct?).

Getting your personal information isn’t the only downside to these scams, as they can involve other bogus offers, malicious Web sites, and malware.

And regarding malware. It’s not always easy to tell if your PC’s been infected, but this PC World article provides some tips: “Does your computer have malware? Here are the telltale signs.”

Fake order confirmations — another email scam

 Computer  Comments Off on Fake order confirmations — another email scam
Dec 082014
 

Fake order confirmations. I’ve seen a lot of these the last couple of weeks. Particularly repeated email messages claiming to be from Costco (Walgreens, etc.) with “Order Confirmation” as the subject. Of course, I never placed any such order(s). Examination of the messages (without actually opening them in an email app) revealed various sender addresses having nothing to do with Costco. Links in the bodies of the messages went to various Web addresses, sometimes indecipherable. Some used attachments, bogus receipts or order confirmations, as well.

Some of these scams are crude self-declarations. Just one or two sentences. But others are artfully crafted to look legitimate — well written copies of legitimate order or shipping notices from well-known companies.

I hope that most people will be suspicious of such email messages, resist the impulse to open them, and just delete them immediately. Many of these scams use Web beacons which notify the scammers that your email address viewed their message (which means that you’ll keep getting more spam scams). But clicking on an embedded link or opening an attachment is worse, possibly infecting your PC with malware.

This holiday season these scams are in full swing once again. As PC World summarized in their article “Beware this online shopping scam: Fake order confirmations” (12/8/2014):

Brian Krebs, a respected authority on security and all-things-cybercrime, wrote a cautionary post earlier this week. “If you receive an email this holiday season asking you to ‘confirm’ an online e-commerce order or package shipment, please resist the urge to click the included link or attachment: Malware purveyors and spammers are blasting these missives by the millions each day in a bid to trick people into giving up control over their computers and identities.”

Remmember, if you have an online account with the vendor, you always can login and check your order status. Some vendors also have customer service phone numbers.

Malicious email — warning signs

 Computer  Comments Off on Malicious email — warning signs
Sep 202014
 

So, you’re careful when looking at your email inbox’s message list. You delete messages from strangers. You delete obvious promotions and ads. Yet, some messages appear okay. You open those messages. Here’re some things to check, as noted in a recent PC World “Three warning signs that email is malicious” article:

1. Dear customer
2. That link is crazy
3. It has an attachment

I see “Dear” spam every week. But checking any links in the body of a message is particularly important. While the text of a link may look valid, the actual link can be “crazy.” Lately I’ve seen quite a few TinyURL-style links in messages that cloak their malicious character. Just delete those messages!

So stay alert.

Sep 052014
 

So, one day you’re really busy. You get an unsolicited call from someone claiming they’re “Microsoft Support” or a company associated with Microsoft or your PC manufacturer (like Dell or HP). They claim that there’s a problem with your PC: “Your PC is infected!” They use technical terms. They’ll help. They ask you to use the mouse or keyboard to do some things on your PC. You’re asked to give them a special ID and /or number code. They’ll then show you the problems. Your PC screen starts changing. You start feeling anxious, even scared. Something’s not right, but … When asked, you give them your credit card number.

Later, you find several hundred dollars were billed to your credit card. You suspect a scam.

Yes, as pointed out in the latest VIPRE Security News (Issue 7, September 2014), such phony computer support calls remain a common scam. Especially among seniors, as I’ve witnessed first hand. As pointed out in their “Don’t Trust Unsolicited Calls From ‘Computer Support Technicians’” article:

Typically, scammers say they’ve detected viruses or other malware on your computer to trick you into giving them remote access or paying for software you don’t need, … The latest version of the scam begins with a phone call. …

Once they have you on the phone, they often try to gain your trust by pretending to be associated with well-known companies or confusing you with a barrage of technical terms. They may ask you to go to your computer and perform a series of complex tasks. Sometimes, they target legitimate computer files and claim that they are viruses. Their tactics are designed to scare you into believing they can help fix your “problem.”

Lessons:

1. Be aware that these scams are common. Whether via an email message or a phone call, anyone can contact you and claim to be anyone, even providing fake credentials and phone numbers. (And, by the way, Caller IDs can be spoofed as well — you may even get a call from yourself — the Caller ID shows your name and phone number!)

2. If you’re scared (or were already really stressed, distracted, or super busy), defer any action by hanging up or declining any offer. Or, just shutdown the computer. Sadly, rational action’s unlikely if you already panicked.

3. Never let anyone remotely control your computer unless you’ve had independent, multiple verification — or at least called a number on a valid service support contract that came with your computer. If that person was at your front door, would you let them in just on the basis of their self-declarations?

4. The same cautions apply to signing up for a computer support or maintenance contract. In a few minutes some of these scams start spending money using your credit card information.

5. The emotional toll can be severe.

Mother’s Day Scams – Be careful

 Computer  Comments Off on Mother’s Day Scams – Be careful
May 062014
 

The latest issue of Vipre Security News reminds us that Mother’s Day is a favorite occasion for scammers.

Watch out for these scams:

The Fake Flower Shop
The Famous but Fake Website
The Malware-infested Mother’s Day E-Card
Fake Gift Card

The article includes tips on how to avoid these scams. As always, be suspicious of links in any email message (and, if necessary, learn how to check if links go to the genuine locations) and attachments claiming to be entry forms, invoices, receipts, or failed-delivery notices. Also beware of an impersonal “To” address and generic subject.

AARP Fraud Watch Network

 Computer, News  Comments Off on AARP Fraud Watch Network
Apr 102014
 

As noted in the latest VIPRE Security News, AARP created a Fraud Watch Network site:

an interactive, national campaign to fight fraud and identity theft and give Americans access to information about how to protect themselves and their families.

The new site’s mission is:

Fight Back Against Scams in Your State

AARP’s Fraud Watch Network links you with experts, law enforcement and people like you who are on the lookout for scams. Check out the latest alerts from state Attorneys General and other local officials, read what people are reporting in your state, and let us know about any suspicious emails, phone calls or other scams you’ve seen in your area. We’ll add your experience to the map so others know what to watch out for!

Also, see their report, “Caught In The Scammer’s Net: Risk Factors That May Lead to Becoming an Internet Fraud Victim, AARP Survey of American Adults Age 18 and Older.”

It’s the mo-o-o-ost dangerous time of the year

 Computer, News  Comments Off on It’s the mo-o-o-ost dangerous time of the year
Dec 152013
 

A recent PC World article reminded us that “Tech threats abound beyond spam, malware during holidays.”

Cyber criminals are all over social media sites, trying to get you to click on links from your “friends,” or to open up fake e-cards. Or, they’re trying to scam you into purchasing fraudulent gift cards for unbelievably low prices.

But there’re also things to watch out for at point-of-purchase devices.

Holiday Cyber Risks

 Computer, News  Comments Off on Holiday Cyber Risks
Dec 152013
 

IDG’s CSO* recently posted an article titled “5 risks to avoid for the holidays” summarizing scams and risks to beware of for the holidays. In particular, watch out for spoofed emails purportedly from shippers and payment processing agents. Also fake e-cards.

Fake messages frequently include instructions to open an attachment or click on a link. Ignore the message completely, don’t open anything or follow any links. Head to the company’s website directly, or call them if needed.

* CSO provides news, analysis and research on a broad range of security and risk management topics.

Prof’s Hack Challenge Revealing

 Computer, News  Comments Off on Prof’s Hack Challenge Revealing
Dec 092013
 

PC World summarized the results of a New York University Professor’s challenge to conduct a personal “pen test” on him.

And the answer, at least in his case, is that knowing that they were out to get him didn’t stop them. He got hacked. As he wrote, in an account of the project last month, while conducting a class at NYU, “without warning, my computer freezes. …”

This article may be viewed at: http://www.pcworld.com/article/2070671/anatomy-of-a-hack-team-meets-a-professors-challenge.html.

Of particular note was that social engineering was key to the attack, “hacking someone’s head” versus clever tech. A phish email was used. As has been recommended many times, beware of emails with links to view something, although prima facie the message appears authentic, from someone you know. Check that link first!

The article concluded with some general advice.

Phishing Attacks August 2013

 Computer, News  Comments Off on Phishing Attacks August 2013
Sep 242013
 

PC World summarized a Kaspersky Lab’s study that noted:

Spam volumes took a usual seasonal drop in August, but phishing spiked, including a noticeable interest in hijacking Apple accounts.

This article may be viewed at: www.pcworld.com/article/2049287/apple-is-a-tempting-phishing-target-for-scammers.html#tk.rss_all

Of particular note was the resurgence of some old malware which infects your email contact list. Phishing attacks continued as well — email scams purportedly from a company which you have an account with, claiming that your account requires action by clicking on a link.