Scam of the day – August 25, 2016 – Another Chase phishing email

August 24, 2016 Posted by Steven Weisman, Esq.

Phishing emails, by which scammers and identity thieves attempt to lure you into either clicking on links contained within the email which will download malware or providing personal information that will be used to make you a victim of identity theft, are nothing new.   They are a staple of identity thieves and scammers and with good reason because they work.  Reproduced below is a copy of a new phishing email that is presently circulating that appears to come from Chase bank.  DO NOT CLICK ON THE LINK.  Like so many phishing emails, this one attempts to lure you into responding by making you think there is an emergency to which you must respond.  As phishing emails go, this one is pretty good.  It looks legitimate.  However, the email address from which it was sent is that of an individual totally unrelated to Chase and is most likely the address of an email account of someone whose email account was hacked and made a part of a botnet of computers used by scammers to send out phishing emails.   The grammar and spelling is good, but as so often is the case, the email is not directed to you by name and does not contain your account number in the email.  It carries a legitimate looking Chase logo, but that is easy to counterfeit.

Chase logo

Dear Chase OnlineSM Customer,
Please confirm that you or someone authorized to use your account made
the following transaction(s) on your account:

Your online account will be fully restored and protected after the verification process.
Thank you for being a valued customer.

Customer Service Center.
JPMorgan Chase & Co ©2016


There are a number of indications that this is not a legitimate email from Chase, but instead is a phishing email. Legitimate credit card companies would refer to your specific account number in the email.  They also would not use the generic greeting “Dear Chase  OnlineSM Customer,” but would rather specifically direct the email to you by your name.  As with all phishing emails, two things can happen if you click on the links provided.  Either you will be sent to a legitimate looking, but phony webpage where you will be prompted to input personal information that will be used to make you a victim of identity theft or, even worse, merely by clicking on the link, you may download keystroke logging malware that will steal all of your personal information from your computer and use it to make you a victim of identity theft.  If you receive an email like this and think it may possibly be legitimate, merely call the customer service number on the back of your credit card where you can confirm that it is a scam, but make sure that you dial the telephone number correctly because scammers have been known to buy phone numbers that are just a digit off of the legitimate numbers for financial companies, such as Chase to trap you if you make a mistake in dialing the real number.


Scam of the day – August 24, 2016 – Nigerian cybercrime ringleader arrested

August 24, 2016 Posted by Steven Weisman, Esq.

It was recently announced that Interpol and Nigerian law enforcement, in a cooperative effort, arrested a Nigerian man considered by Interpol to be the mastermind behind a network of forty cybercriminals operating in Nigeria, Malaysia and South Africa who had been perpetrating Internet fraud and cybercrimes throughout the world.  Estimates of the amount of money stolen by these cybercriminals is as high as sixty million dollars.  Two of the primary scams operated by these criminals were the CEO email fraud and the business email compromise.  I have written about both of these scams in previous Scams of the day. In the CEO email fraud, the scammers hack the email account of a CEO or other corporate executive and then send an email to someone who handles payments for the company, requesting funds be wired into an account controlled by the scammers.  In the other scam, it is the email account of a business is hacked and an email containing a bill is sent to one of that business’ legitimate customers with instructions to wire the money to an account controlled by the scammers.  Earlier this year the FBI in a warning about these types of scams said that over the last couple of years, these scams have cost companies billions of dollars.


Both of these scams are both sophisticated and quite simple.  They also are relatively easy to defend against.  Hacking an email account is not a terribly difficult thing to do so, whenever an email appears from someone in a corporation requesting that money be wired anywhere, a simple security measure to take is to not send any payment until the legitimacy of the transaction has been confirmed by phone or text message.  As for bills from companies with which you do business, the key thing is to not only confirm the accuracy of bills before payments are authorized, but also to confirm the accuracy of the bill before sending out such checks particularly by way of wire transfers to make sure that they are being sent to the bank account to which funds have been legitimately sent in the past.  If the funds are being requested to be sent to a new or different bank account, the legitimacy of the billing should be confirmed before any payments are made.

Scam of the day – August 23, 2016 – Gold scammer sentenced

August 23, 2016 Posted by Steven Weisman, Esq.

All that glitters definitely wasn’t the gold that investors thought they were receiving when they purchased gold as an investment from Bruce R. Sands Jr. who recently was sentenced to eleven years in prison for his multi-million dollar scam by which he purported to sell gold coins, bullion and other precious metals to unwary investors who paid him millions of dollars and got absolutely nothing in return.  Investors were lured to Sands through his advertisements on radio, television and the Internet.


An essential rule of investing is to never invest in anything that you don’t fully understand.  Sands not only never provided the gold purchased to his clients, but also sold the gold at prices significantly higher than the fair market value of the gold, which would have been apparent to anyone who had done their homework.  Another important thing to remember is that merely because an advertisement appears in legitimate media, such as television and radio does not mean that the company doing the advertising is legitimate.  Most media do little or no investigation into whether or not an advertiser is scamming the public.

Specifically for prospective gold purchasers, you should make sure that the dealer selling you gold is a reputable dealer which you can do by checking out the dealer with the American Numismatic Association at its website  Also do not have the dealer store your gold for you.  Always take delivery of the gold yourself.  Finally, only do business with dealers that offer a buy-back guarantee within 72 hours.

Scam of the day – August 22, 2016 – Louisiana flood charity scams

August 21, 2016 Posted by Steven Weisman, Esq.

Louisiana Attorney General Jeff Landry is warning the public about charity scams following the recent devastating floods across Louisiana.  This kind of natural disaster  brings out the best in our fellow citizens, many of whom desire to give to charities to help the victims of disasters like this.  Unfortunately, it also brings out the worst in scammers  who are quick to take advantage of the generosity of people by contacting them, posing as charities, but instead of collecting funds to help the victims of these natural disasters, the scam artists steal the money for themselves under false pretenses.   Charities are not subject to the federal Do Not Call List so even if you are enrolled in the Do Not Call List, legitimate charities are able to contact you.  The problem is that whenever you are contacted on the phone, you can never be sure as to who is really calling you so you may be contacted either by a phony charity or a scammer posing as a legitimate charity.  Similarly, when you are solicited for a charitable contribution by email or text message, you cannot be sure as to whether the person contacting you is legitimate or not.


Never provide credit card information over the phone to anyone whom you have not called or in response to an email or text message.  Before you give to any charity, you may wish to check out the charity with where you can learn whether or not the charity itself is a scam.  You can also see how much of the money that the charity collects actually goes toward its charitable purposes and how much it uses for fund raising and administrative costs.  If you do wish to make a donation to a charity, go to the real charity’s website or call them at a telephone number that you know is accurate in order to make your donation rather than responding to a telephone call or electronic communication. lists some highly rated charities involved with Louisiana flood relief, which you may wish to consider if you are thinking about making such a charitable gift.  They are the American Red Cross, Convoy of Hope and the United Way of Southeast Louisiana.  Below are links to their pages on that describes the charities in detail as well as provide a link to make a donation if you are so inclined.

Scam of the day – August 21, 2016 – FTC refunding money to victims of credit card fraud

August 21, 2016 Posted by Steven Weisman, Esq.

The FTC first took action against J. K. Publications, Inc in 1998.  J.K. Publications  purchased access to the account numbers of more than three million Visa and MasterCard holders from a California bank purportedly to confirm that the customers had valid credit cards and debit cards.  Instead, they made illegal charges on the cards for X-rated Websites.  Some of the people who had these charges put on their bills didn’t even own computers at that time.  The charges appeared under the names “Netfill,” “N-Bill,” “MJD ServiceCorp,” and “Webtel.”  The FTC managed to quickly shut down the scam, but J.K. Publications and the people involved in the scam managed to hide millions of the fraudulently obtained dollars in off-shore banks.  Fortunately, over time the FTC has been successful in getting the money back and is now mailing out checks to the victims of the scam.


The FTC is presently mailing 322,000 checks to victims of this scam.  If you have questions about this scam or were a victim of this scam, you can go to the top of this page to the tab entitled “FTC scam refunds” for more information.

Scam of the day – August 20, 2016 – Guilty plea in insider trading hacking case

August 19, 2016 Posted by Steven Weisman, Esq.

I have been reporting to you about developments in this ingenious and massive stock fraud for a year since when the story first broke.   Forty-three people were charged both civilly and criminally in the largest hacking and securities fraud enterprise in American history.  The defendants were made up of rogue stock traders including hedge fund manager and former Morgan Stanley employee Vitaly Korchevsky along with computer hackers based in the Ukraine.  The hackers used simple phishing tactics to gain access to more than 150,000 press releases issued by Marketwired, PR Newswire in New York and Business Wire of San Francisco on behalf of numerous American companies including Panera, Caterpillar, Inc and Align Technology that contained earnings and other corporate information prior to their public release.  This enabled the rogue stock traders to make trades based on this inside information before it became known to the public.  Trades using this stolen information were made by traders in Russia, Ukraine, Malta, Cyprus, France and here in the United States in Georgia, New York and Pennsylvania  It is estimated that between 2010 and 2015, the defendants made profits of as much as 100 million dollars on 800 trades during this time.  A number of the civil defendants have already pleaded guilty to charges related to this scam and now Leonid Momotok, a Russian naturalized American citizen pleaded guilty to conspiracy to commit wire fraud in regard to this scam.  According to prosecutors, Momotok made more than 1.2 million dollars in illegal profits by trading Panera Bread Co. and DealerTrackTechnologies based upon the stolen inside information.

The cornerstone of this scam as so many cyberscams was the ability to hack into the company computers of Marketwired, PR Newswire and Business Wire by hacking into social media sites where they stole the passwords of employees of these companies who used the same passwords at work.  The scammers also used spear phishing emails to gain the further access they needed to infiltrate the computers of the targeted companies.


One of the biggest takeaways from this case is how easy it is to still use spear phishing emails to lure people into clicking on links tainted with malware that permits hackers to steal a person’s or company’s data. Apparently corporations still have not learned to sufficiently train their employees to recognize phishing emails nor have they learned to encrypt and segregate sensitive data from hackers.   This is important to all of us as individuals because identity thieves and hackers use the same phishing techniques to hack into the computers of us as individuals and steal our personal information.  Never click on links in emails regardless of from whom they appear to come unless you are absolutely sure that the link is legitimate.  It well could contain keystroke logging malware that will steal all of the information from your computer.  Also, it is important to remember that you cannot rely on your anti-malware software to protect you because the best anti-malware software is always at least a month behind the latest malware.  However, it is still important to have security software on all of your electronic devices and keep that software up to date with the latest security patches because many scammers use older versions of malware for which there are defenses.

Finally, this case also reminds us to use unique passwords for all of our accounts so that if our password is compromised at a company with lax security, our own security at other places where we use passwords is not threatened.   Although it may seem difficult to have to remember so many different password, an easy way to deal with this is to have a strong base password that contains capital letters, small letters and symbols and adapt that base password for each of your accounts.  Using an easily remembered phrase as the base password such as IDon’tLikePasswords is effective.  Make it even better by adding a couple of symbols at the end such as IDon’tLikePasswords!!! and then adapt it for each of your accounts so, for instance, your Amazon account password would be IDon’tLikePasswords!!!AMA.

Scam of the day – August 19, 2016 – AT&T penalized 7.75 million dollars over cramming charges

August 18, 2016 Posted by Steven Weisman, Esq.

It was just two years ago that AT &T paid a 105 million dollar settlement related to cramming on cell phone bills.  Cramming is the name for adding unauthorized third party charges to a consumer’s telephone bill without the knowledge or approval of the consumer.  This has long been a problem with landline phones and recently has become a major problem with cellular service.  There are many ways that these unauthorized charges make their way to a victim’s phone.   Sometimes, consumers unknowingly sign up for premium texting services that may be for things such as flirting tips, horoscopes or celebrity gossip when entering a contest or lottery.  Whatever the source of the charges, they are fraudulent and typically cost about $9.99 per month and continue to appear for months without end.  Recently, while conducting a drug and money laundering investigation, the Drug Enforcement Agency (DEA) discovered two companies, Discount Directory, Inc. and Enhanced Telecommunications Services that were sham companies established for the sole purpose of cramming nine dollar monthly directory service charges on to AT&T landline bills.  While AT&T was not aware these charges were fraudulent when they agreed to add these charges to consumers’ bills, neither did they ask for any proof that their customers had actually signed up for these services.  Meanwhile, AT&T got a share of every monthly crammed payment.  According to the FTC, AT&T “ignored a number of red flags that the charges were unauthorized, including thousands of charges submitted by the Companies for nonexistent, disconnected, or otherwise ‘unbillable’ accounts.”

Pursuant to the new settlement, AT&T will refund all the fees it collected on behalf of the two companies as well as pay a $950,000 fine.  They have also agreed not to bill for most third-party services on landlines. AT&T has indicated that they will be sending refund checks to their defrauded customers within the next 90 days.


Even if you are not an AT&T customer  this case is another reminder that you should carefully review your phone bill each month to make sure that there are no unauthorized charges.  Telephone bills can be long and complicated to read, but is important to make sure that you understand every charge that appears on your bill because sometimes crammers make the charges appear to be legitimate.  If you find a charge for a service you did not order, contact your phone service provider to have the charges removed.

Scam of the day – August 18, 2016 – Major data breach at health care provider

August 18, 2016 Posted by Steven Weisman, Esq.

Recently a Ukranian hacking group called “Pravyy Sector” managed to hack into the server of the Central Ohio Urology Group, which includes twenty-four clinics and posted online literally hundreds of thousands of files that included massive amounts of personal information that could be exploited for identity theft and other illegal purposes.  While you may not be a patient of Central Ohio Urology Group and therefore may not consider this to be a serious matter, but it is very serious because it is just another example of the pervasive lack of security in the health care industry.

As I warned everyone in my USA Today column in which I made my cyberpredictions for 2015, the health care industry is tremendously vulnerable to data breaches and we can expect these data breaches to continue.  Here is a link to that column.

An audit of health care companies and insurers showed that more than 81% of these companies have suffered a data breach in the last two years alone and that number only relates to the data breaches that have been discovered.  There may have been more that remain undiscovered.   The health care industry is the perfect storm for data breaches.  It is a highly digitized industry that has massive amounts of personal information that it shares with numerous offices and institutions and yet has not, in many instances instituted the necessary security precautions to protect the information stored.

The potential consequences of medical company data breaches can be tremendous to affected individuals.  The medical records of an identity thief accessing your medical insurance can become intermingled with your medical records such that you can mistakenly receive improper treatment, such as a potentially deadly blood transfusion of the wrong blood type.  Other information such as your Social Security number which may be stored by a health care provider can be stolen and used for purposes of more traditional identity theft. Finally, the vulnerability of the computer systems of health care providers has made them prime targets for successful ransomware attacks.


The health care industry has got to recognize that it is a prime target of hackers and identity thieves.  Encryption of all data should be the rule and not the exception for health care providers.  Authorization authentication to access records from both on-site and particularly off-site should be enhanced.  As for us as the patients, we should limit the amount of personal information given to health care providers if they do not have a need for it.  Health care providers do not need our Social Security numbers.  Don’t give it to them.  We also should demand that they institute better data security measures.

Scam of the day – August 17, 2016 – Latest security update from the Department of Homeland Security

August 16, 2016 Posted by Steven Weisman, Esq.

Constant updating of the software we all use with the latest security patches and updates is a critical part of avoiding scams and identity theft threats.  Whenever new security updates and patches are issued, we provide access to these so that you can update your software to provide better security on your computers, smartphones, laptops and other electronic devices.  Updating your software with the latest security patches and updates as soon as possible is important because identity thieves and scammers are always finding and exploiting vulnerabilities in the software that we all use.  Delay in updating your software could lead to disastrous results.  However, it is also important to be sure that you are downloading legitimate patches and updates rather than being tricked by an identity thief or scammer into downloading malware under the guise of downloading a security patch or update.  These new updates in today’s Scam of the day from the Department of Homeland Security include critical new updates to  the Android operating system to correct vulnerabilities threatening the security of millions of cell phone users about which I wrote in a recent Scam of the day.  Also included are important security updates for Microsoft 10, Microsoft Edge, Internet Explorer, and Google Chrome.


Here are the links to  the recent security updates as posted by the Department of Homeland Security:

Scam of the day – August 16, 2016 – More hotel data breaches

August 16, 2016 Posted by Steven Weisman, Esq.

Yesterday, HEI Hotels and Resorts, a company that manages hotels operating under  brand names such as Marriott, Hyatt and InterContinental, announced that 20 of its hotels suffered a data breach that resulted in hackers stealing customer names, credit and debit card account numbers, expiration dates and three digit verification codes for tens of thousands of transactions going back as far as March of 2015.

It is not known yet whether the data breach is related to the hacking by the Russian organized crime group Carbanak, that, as reported recently by Brian Krebs managed to install malware into the credit and debit card processing equipment manufactured by MICROS used in hotels around the world.

The primary reasons for the continuing problem of data breaches at hotel chains are the weak cybersecurity of many hotel chains coupled with these companies still using credit card and debit card processors for cards with magnetic strips rather than the safer smart EMV chip cards.  Regulations effective October 1, 2015  mandated credit card issuers and retailers switch over to the new smart EMV chip cards or risk increased legal liability, but unfortunately, many companies have been slow to switch to the new card processing equipment.  If smart EMV chip cards had been used at HEI’s hotels, the card information that was stolen would have been worthless, but since they still used the old fashioned magnetic strip cards, Kimpton and its customers face financial problems from this data breach.


Until credit card issuing companies and brick and mortar stores and businesses that take credit cards switch to the new smart EMV chip cards, this story will, as I predicted  more than a year ago, continue to occur again and again.  As for us, as consumers, the best we can do is to refrain from using our debit cards for anything other than an ATM card because consumers whose debit card security has been breached are not protected as much as when a credit card is used for fraudulent purchases.  In addition, if you do not already have a new smart EMV chip card, you should demand one from your credit card company.  You also should regularly monitor your credit card statements for indications of fraudulent use.

Here is a link to which you can go to find out which hotels were affected by the data breach and when the data was compromised.