Scam of the day – August 22, 2014 – UPS becomes latest hacking victim

August 21, 2014 Posted by Steven Weisman, Esq.

United Parcel Service (UPS) has just announced that 51 of its franchised UPS stores in 24 states were hacked by identity thieves using a malware referred to as “Backoff” which was used to infiltrate remote desktop software such as Microsoft’s Remote Desktop, Apple’s Remote Desktop, Chrome’s Remote Desktop, Splashtop, Pulseway and LogMein that allow the convenience of logging into a computer from a remote location.   A warning about Backoff and its targeting of Point-of-sale credit and debit card processing at retailers was issued by the Department of Homeland Security on July 31st.  In response to this warning, UPS was able to find that it had been hacked starting on January 2, 2014.  It was able to remove the malware on August 11, 2014.  An estimated 105,000 credit card and debit card transactions were affected and the data from those cards was stolen, placing the cardholders in extreme danger of identity theft.

TIPS

Here is a link to the UPS website page that lists which stores were affected http://www.theupsstore.com/security/Pages/default.aspx

UPS is offering identity theft protection and credit monitoring services free for a year to any customer who used a credit card or debit card at any of the hacked stores during the relevant period.  In order to get more information about obtaining these services contact UPS at 855-731-6016 or go to their website at http://www.theupsstore.com/security/Pages/default.aspx

It is important to note that the laws protecting you from fraudulent use of your debit card are not as strong as those protecting you from fraudulent use of your credit card.  Don’t use your debit card for anything other than an ATM card.  It is also important for everyone to monitor their credit card use regularly to promptly identify any fraudulent use.

Scam of the day – August 21, 2014 – Community Health Systems data breach update

August 20, 2014 Posted by Steven Weisman, Esq.

A couple of days ago I told you about the massive data breach at Community Health Systems a hospital chain with hospitals in 29 states.  This data breach, which was done by Chinese hackers resulted in personal data on 4.5 million patients of Community Health Systems being stolen.  The data included names, addresses, birth dates and Social Security numbers which puts the affected individuals in serious jeopardy of identity theft.  Community Health Systems is in the process of notifying the affected individuals and offering credit monitoring services.  Now however, Trusted Sec LLC, a security company is indiacting that the hacking of Community Health Systems was accomplished by the first known exploitation of the Heartbleed security flaw.  Heartbleed is the name of the security flaw in the Open SSL encryption security technology discovered last April that is used by up to 2/3 of websites on the Internet.  Although the Heartbleed flaw was promptly patched, there was a period during which the users of this technology were left vulnerable and it appears that during this period was when the Chinese hackers managed to steal data from Community Health Systems.  It is not unusual for hackings and data breaches to remain undiscovered for significant periods of time.  This data breach may be the first major data breach connected to Community Health Systems, but it is most likely not going to be the last.

TIPS

It has been said that the price of liberty is eternal vigilance and that is also important in maintaining your own personal security.  People who did not change their passwords following the Heartbleed security flaw first being uncovered should take this as a wake up call to do so now.  You should also consider putting a credit freeze on your credit report.  You can find instructions as to how to do this in the “credit freeze” link on the right hand side of this page.  This will protect your credit from being accessed by someone who may otherwise have enough personal information of yours to access your credit report in an effort to use your credit.  Finally, you should monitor all of your financial accounts regularly for indications of fraudulent use.  Remember, you are only as safe as the places that hold your personal information and some of them have poor security.

Scam of the day – August 20, 2014 – Nigerian letter scam Iraqi style

August 20, 2014 Posted by Steven Weisman, Esq.

Although it may seem as if this scam only began in earnest with the invention of email, in fact, the scam itself is just a variation of a scam that is more than four hundred years old when it was called the Spanish Prisoner Con.  At that time a letter was sent to the targeted victim purportedly from someone on behalf of a wealthy aristocrat who was imprisoned in Spain under a false name.  The identity of the nobleman was not revealed for security reasons, but the victim was asked to help raise money to obtain the release of the aristocrat, who, it was promised, would reward the money-contributing victim with great sums of money and, in some versions of the con, the Spanish prisoner’s beautiful daughter in marriage.

In the more recent incarnations of this scam, you receive an email in which you are promised great sums of money if you assist a Nigerian in his effort to transfer money out of his country.  Other variations include the movement of embezzled funds by corrupt officials, a dying gentleman who wants to make charitable gifts or a minor bank official who is trying to move the money of deceased foreigners out of his bank without the government taking it.  Similar scams have managed to keep up with the news by appearing to originate in China or, in this case, Iraq.

What all of these scams have in common is that soon after agreeing to help, you learn that money is needed to be sent by you for lawyer fees, bribes, insurance and other costs.  The reward is always just around the corner and the fees keep mounting.

Here is an example of an email I recently received.

“Dear Sir

With much sincerity of purpose, I make this contract with you after satisfactory information we gathered from the Chamber of Commerce here in Iraq.

I am a private staff for Haider J. Hamza a Senior Accountant back in my country with various influence at the Ministry of oil; I believe my proposal will interest you.
My boss have decided and instruct me to contact you secretly in view of transferring the sum of US$55.5M [Fifty Five Million Five Hundred Thousand United States Dollars] only to your Company or Personal Account through the remittance banks used by our country scattered all over the western countries and some A-list banks in Asia.

However total confidential and legal arrangement requires to be smoothly executed to have funds either transferred or as to be determine by factors as our communication progresses.This particular funds is projected from an over invoiced contracted award to a foreign company who has long been paid and the over invoice remains dormant for many years now.Since the completion and payment has far exceed the period of six years; the constitution allows my principal to use his discretion and his candid returns in the past was turn in for personal gains by far superiors, hence he intend doing something for himself this time.

As persons under government pay roll, it is indicting to openly take possession of such funds which is where your assistance as the foreign contactor is highly required.
Among others; my principal we ensure :
Payment approval from relevant offices for the release of the contract sum in favour of your Personal / Company details.
You are expected to furnish us with necessary details such as:
Your personal name in full.
Name and Address of your Company.
Proof of tax paid in your country for a minimum period of 1yr. (Personal tax payment proof or company tax payment proof) is acceptable.

The sharing mode as proposed by my principal is 35% for your company and 65% for him
I anxiously wait to hear from you.
Zaher AbdulKarrem.
email: zaherabkarrem@yandex.com”

TIP

There are a number of ways to confirm that the email you are receiving is a scam including a careful review of the email address, however, you do not need to even go that far in your considerations.  Although you may want to open the email (so long as you do not click on to any links) for sheer entertainment purposes, all of these scenarios are scams.  Just ask yourself, why are you being singled out for this email?  You are not.  The emails are sent out all over the Internet.  Don’t be a victim.  Do not respond to the email in any fashion.  If you do, you will be hounded.

Scam of the day – August 19, 2014 – Major data breach at hospital group

August 18, 2014 Posted by Steven Weisman, Esq.

In a filing yesterday with the Securities and Exchange Commission, Community Health Systems, Inc. a major hospital group company with 206 hospitals in 29 states disclosed that it had suffered a major data breach in which the names, addresses, birth dates, Telephone numbers and Social Security numbers of 4.5 million of its patients who had done business with Community Health Systems during the past five years.  The hacking originated in China and followed a familiar pattern whereby information gathering malware was surreptitiously installed on the computers of Community Health Systems.  This information places the affected individuals in serious danger of identity theft.  The health care industry has increasingly in the last six months become a frequent target for large scale hacking and data breaches as the security in general for many of the companies that make up this industry is extremely lax.  In fact, in April, the FBI warned the health care industry specifically that its cybersecurity was not sufficient to protect the personal information it stores.

TIPS

If you were a patient at any of the hospitals of Community Health Systems during the past five years, you should be particularly concerned, but even if you have not, your turn will come as more and more companies and industries continue to suffer major data breaches.  So what can you do?  The first thing is to limit, as much as possible, the information that you provide to the companies with which you do business.  Don’t store your credit card number with an online merchant merely for convenience because it puts you in danger of identity theft if the company is hacked.  You also should monitor all of your financial accounts closely for fraudulent activities.  You also may wish to consider putting a credit freeze on your credit report to block an identity thief from accessing your credit report and your credit even if he or she has your personal information.  For more specific tips on what you can do to protect yourself, I urge you to get a copy of my new book, “Identity Theft Alert” which can be purchased from Amazon by clicking on the link on the right hand side of this page.

Scam of the day – August 18, 2014 – IRS issues new warning about phony collection calls

August 18, 2014 Posted by Steven Weisman, Esq.

Although I have been warning you about this particular scam for a long time, most recently in my Scam of the Day for March 1, 2014, another warning is warranted in the light of the IRS and the Treasury Inspector General for Tax Administration disclosing that so far in 2014 there have been more than 90,000 complaints to the IRS about scam telephone calls in which a scam artist calls an unwary victim and pretends that the scammer is calling from the IRS.  The person receiving the telephone call is told that he or she must pay an overdue tax amount immediately by way of credit card, debit card, cash card or wired funds or there will be harsh penalties including jail time.   Already this year, this scam has cost American taxpayers millions of dollars.

TIPS

This scam is easy to spot.   The IRS will never initiate communications with a taxpayer by phone so if someone calls you purporting to be from the IRS in an initial effort to collect overdue taxes, you should hang up because it is a scam.   Even if your Caller ID appears to show that the call is from the IRS, this does not mean that the call actually is from the IRS.  Through a technique called “spoofing” a scammer can make the call appear to be legitimate, but it is not.  The IRS will never demand payment by credit card, debit card, cash card or wired funds through an initial telephone call.  If you think that you really may owe taxes, call the IRS at 800-829-1040 to speak to a real IRS employee.  If you receive a scam call, you may wish to report the call to the Treasury Inspector General for Tax Administration at 800-366-4484.

Scam of the day – August 17, 2014 – Data breach at Supervalu stores

August 16, 2014 Posted by Steven Weisman, Esq.

The Supermarket chain Supervalu Inc. has disclosed that it has joined the growing list of major companies suffering a major data breach.  Although the breach apparently occurred between June 22nd and July 17th, it was only disclosed a few days ago.  Supervalu operates stores under a number of different names including Cub Foods, Hornbacher’s, Shop ‘n Save, Shoppers Food & Pharmacy and Farm Fresh.  In addition, the data breach also apparently affected stores that it sold in 2013, but still supplied the information technology services that were the Achilles heel in this data breaches.  Those stores go under the names Albertsons Acme (not necessarily the same one used by Wylie Coyote) Jewel-Osco, Shaw’s and Star Market.  All in all the data breach may have reached as many as 1,000 stores.  It has been confirmed that the breach which, as in the case of the Target data breach occurred at the point of sale card registers included account numbers, expiration dates and cardholder names.

TIPS

Supervalu has set up a call center for consumers to call for further information.  The number is 855-731-6018.  Additional information may also be obtained by going to Supervalu’s website, www.supervalu.com and go to the Consumer Security Advisory section where information can be obtained about complimentary consumer identify protection services.  Consumers who may have shopped at any of the affected stores should carefully monitor their credit card account for fraudulent use and if you used a debit card, you should strictly monitor your bank account for evidence of fraud.  Establishing a credit freeze at each of the three major credit reporting bureaus is also a good idea.  You can get information as to how to put a credit freeze on your credit report by going to the Credit Freeze section of Scamicide as listed on the right hand side of this page.  Finally, this should again be a lesson to consumers to not use debit cards for retail transactions.  The risk is too great.

Scam of the day – August 16, 2014 – Treasury Department says IRS puts taxpayers in danger of identity theft

August 16, 2014 Posted by Steven Weisman, Esq.

An audit performed by the Inspector General for the Treasury Department has found that the IRS does not consistently perform background checks on contractors with which it does business putting millions of Americans in danger of identity theft.  According to the report, the IRS failed to perform proper background checks in more than half of the contracts reviewed by the Inspector General.  Many of these contractors failed to perform any criminal or credit background checks on their employees despite the fact that these employees would be handling sensitive personal information.  In one instance, the IRS provided a printing services contractor with a compact disk with names, addresses and Social Security numbers of 1.4 million taxpayers with not a single person working on this matter having been screened by way of a criminal background check or credit check.  In other instances, former criminals with lengthy records were found to have access to IRS records containing personal information that could be used for identity theft purposes.  This is not the first time that the IRS has been found negligent in this regard.  A previous investigation in 2013 uncovered the same problems of a lack of sufficient background checks for people with access to sensitive IRS information.  The IRS has said that it will now make changes in its policies to require such background checks in the future, but at the moment, that is just lip service.

TIPS

This is just another example of how you are only as safe from identity theft as the places with the weakest security that hold your personal information.  One takeaway from this is that as much as possible, you should limit the places that do hold your personal information.  When a business asks for your Social Security number as an identifying number, which they still may do under the law, offer them something else such as your driver’s license number which is not likely to be of use to an identity thief.

Scam of the day – August 15, 2014 – Accused Russian hacker arraigned

August 14, 2014 Posted by Steven Weisman, Esq.

In my Scam of the day for July 12th I told you about the arrest in Guam of Roman Seleznev, a Russian accused of hacking into the point of sale systems of the Broadway Grill in Washington DC and retail establishments throughout the country between 2009 and 2011.  Now, Seleznev has been extradited to the United States and he was arraigned in federal court in Seattle a few days ago.   According to his indictment, Seleznev scanned the computers of retailers throughout the United States looking for vulnerabilities which he exploited through malware that he would interject into the computer systems of these vulnerable retailers, which would capture credit card data which Seleznev would then sell online to other criminals.  The Secret Service says that he stole the data from more than 200,000 credit cards and made more than two million dollars selling this card data on black market websites.  Complicating the situation is that Seleznev is the son of a prominent Russian politician.  The Russian government is calling the arrest an illegal kidnapping.

TIPS

What does this arrest mean to you and me?  It is more of a reminder of how large the problem is.  Hacking into retailers at point of sale terminals in stores has become a relatively easy task to accomplish and not only is it easy to accomplish, it does not even have to be done at the store.  It can be done totally over the Internet by hackers anywhere in the world.  Credit card fraud is worse in the United States than in most of the rest of the world because we still have not adopted the smart card technology by which credit cards carry a computer chip that issues a new identifying number every time it is used which makes the stealing of the number used at any particular transaction worthless.  The hacking of point of sale terminals will be an exercise in futility when we finally start using smart cards in large numbers.  However, it is not expected that this will be done in the United States until October of 2015 when, through a change in the rules governing credit card usage, companies, whose point of sale terminals are hacked, will be responsible for data thefts.  Until that time, the best you can do is to refrain from using your debit card for retail purchases so that your bank account is not at risk in a hacking attack.  You also should monitor your credit card’s use regularly to note any fraudulent use so that you can limit the damage.

Scam of the day – August 14, 2014 – Latest security updates from the Department of Homeland Security

August 14, 2014 Posted by Steven Weisman, Esq.

Constant updating of the software we all use with the latest security patches and updates is a critical part of avoiding scams and identity theft threats.  Whenever new security updates and patches are issued, we provide access to these so that you can update your software to provide better security on your computers, smartphones, laptops and other electronic devices.  Updating your software with the latest security patches and updates as soon as possible is important because identity thieves and scammers are always finding and exploiting vulnerabilities in the software that we all use.  Delay in updating your software could lead to disastrous results.  However, it is also important to be sure that you are downloading legitimate patches and updates rather than being tricked by an identity thief or scammer into downloading malware under the guise of downloading a security patch or update.  That is why we provide links to the necessary patches and updates as provided by the Department of Homeland Security and the companies directly.  Today’s updates provide critical security updates that will help protect against the SQL attack used by the Russian hackers recently to steal data on more than a billion people.

TIPS

Here is the link to the latest security updates as issued by the Department of Homeland Security: https://www.us-cert.gov/ncas/bulletins/SB14-223

Scam of the day – August 13, 2014 – Robin Williams death scams

August 13, 2014 Posted by Steven Weisman, Esq.

You can always count on scammers and identity thieves to capitalize on every tragic event that captures the public’s imagination.  Celebrity deaths seem to be of particular interest to many people.  Following the deaths of celebrities in recent years such as Whitney Houston, Amy Winehouse and Paul Walker, scammers and identity thieves set up scams and identity theft schemes to take advantage of the curiosity of the public about the deaths of these celebrities.  The sad passing of Robin Williams by suicide is bringing new scams and identity theft schemes.   Some of these scams  start with a post on your Facebook page, which often can appear to come from someone you know, when in fact, it is really from an identity thief who hacked into the Facebook account of a friend of yours.  The post provides a link to be able to view photographs of Robin Williams purported to be police photographs that have not appeared in the news.  Unfortunately, if you fall for this bait by clicking on the link, one of two things can happen, both of which are bad.  In one scam, you are led to a survey that you need to complete before you can view the video. In fact, there is no such video and by providing the survey information, you have enabled the scammer to get paid by advertisers for collecting completed surveys.  However, the problem is worse because by completing the survey, you have turned over valuable information to a scammer who can use that information to target you for phishing and identity theft threats.  Even worse though in another variation of this scam is when click on the link and unwittingly download a keystroke logging malware program that will steal all of the information from your computer including credit card numbers, passwords and bank account information and use that information to make you a victim of identity theft.

TIPS

Remember my mantra, “trust me, you can’t trust anyone.”  Merely because a post on your Facebook page appears to come from someone you trust is no reason to consider it reliable.    The posting could be merely from someone who has hacked your friend’s Facebook account.  Other times, the posting may indeed be from your real friend, however, that real friend may unwittingly be passing on tainted links that they have received.    For news matters, you should only rely on legitimate news sources, such as the websites of the major network news stations such as CNN.  In matters such as rare celebrity footage, you should limit your sources to only those that you know are legitimate and can trust such as www.tmz.com.  If it isn’t on TMZ, then it doesn’t really exist.  It is a scam.  Also, make sure that you keep your anti-malware software up to date with the latest security patches.