Scam of the day – December 9, 2015 – Is the letter you received from OPM real or a scam?

As you all know by now and as I first reported to you in 2014 and again last summer, the federal Office of Personnel Management (OPM) was hacked by Chinese hackers who stole personal information of more than 21 million present and former federal employees as well as non-employees whose information was gathered by the OPM during the course of background investigations of federal employees.  In October, the OPM began notifying victims of the massive data breach about the identity theft protection services the government will make available to them for the next three years.  The notification process is taking about three months with many notification letters only recently having been sent.  I have been contacted by clients of mine inquiring as to whether the notices they received are real.   It is important to remember that the official notice is only being sent by regular mail.  No email notices will be sent so if you get an email that purports to be from the OPM, it is a scam.   The federal government has chosen Identity Theft Guard Solutions to provide  three years of identity theft protection to victims. In the notification letter you are urged to contact the OPM’s security website to enroll in the free identity monitoring program and you are provided a PIN to use in order to enroll.

Identity thieves have been copying the letter and changing the website address where you are directed to go to enroll in the identity theft protection services, directing people to a phony website where they will be prompted to provide personal information purportedly to enroll in the program.  If you provide personal information to these scammers, you will end up a victim of identity theft.  Here is a link to the official website for enrolling in the credit monitoring services being offered by the OPM:

Once there you will be prompted to input your PIN and only the last four digits of your Social Security number.


If you were a victim of the OPM data breach, you should be on the lookout for a notification letter with information about how to apply for benefits under the program.  The OPM is only notifying people by regular mail.  If you have been notified by email, text message or telephone, the notice is a scam and you should ignore it.  Even if you receive a letter, you should make sure that the web address you go to is accurate.  For convenience, you can use the web address I have indicated above.  In any event, remember, the legitimate website will not ask for your complete Social Security number.  It is important to remember that no identity theft protection company can prevent you from becoming a victim of identity theft.  The best they can do is notify you earlier that you have become a victim.    In fact, the OPM is offering these services a year after the data breach actually occurred so the danger of identity theft has increased.   None of the identity theft protection companies help you with the one best step you can take to protect yourself from identity theft which is to put a credit freeze on your credit report.  With a credit freeze on your credit report, even if someone has your personal information including your Social Security number, they cannot access your credit report for purposes of gaining credit or loans in your name.  You can find information about how to put a credit freeze on your credit reports at each of the three major credit reporting agencies by going to the Archives section of Scamicide and putting in the words “credit freeze.”

Scam of the day – December 1, 2015 – Email security update scam

Today’s Scam of the day comes from the inbox for my own email.  It is a common phishing scam that attempts to lure the victim into clicking on a link contained in the email.  If the intended victim clicks on the link, he or she will unwittingly download keystroke logging malware that will enable the scammer to steal all of the personal information from your computer or smartphone and use it to make you a victim of identity theft.  This particular phishing email follows a common pattern at educational institutions or businesses where the email is made to appear as if it originated with your school’s or company’s IT department requiring you to verify your account in order to continue to use your email account. It appears to be legitimate, but it is not. Here is a copy of the email.  DO NOT CLICK ON THE LINK.

“To All Faulty\Staff
We currently upgraded our Server to 50GB inbox space. Please verify your account to validate E-space.
​Your emails won’t be delivered by our server, unless email account is verified. Protecting your email account is our primary priority. For account verification  Click on Outlook Web Access
should you have any questions please contact the IT Helpdesk.
Copyright ©2015 ITS Help Desk.”
Whenever you receive an email or a text message, you can never be sure who is actually sending you the email or text message.  Even if the email address of the sender is one that you know is from someone or some company you know, their email account may have been hacked and being used by the hacker to send out phishing emails.  It is just too risky to click on a link in any email or text message until you have independently confirmed that it is legitimate and, of course, you should always keep your anti-virus and anti-malware software up to date with the latest patches on all of your electronic devices, however, it is important to remember that you cannot totally depend on your security software because the best security software is always at least thirty days behind the newest malware.

Scam of the day – July 27, 2015 – Medical Informatics Engineering hacked

Although the name Medical Informatics Engineering MIE or even its cloud service NoMoreClipBoard may not be familiar to you, it should be.  The company operates more than 300 medical centers in 38 states.  On May 26th it discovered that it had been hacked since May 7th.  Unfortunately the personal information compromised in the data breach was very significant including names, telephone numbers, mailing addresses, usernames, password security questions and answers, spousal information, email addresses, birth dates, Social Security numbers, health insurance policy information and more all of which puts the victims of the data breach in serious jeopardy of traditional and medical identity theft.  The company started notifying affected victims whose personal information was hacked by traditional mail in June and July.  For a list of the medical facility clients of Medical Informatics Engineering, go to the list contained in this press release of MIE.


If you are concerned that you might have been a victim of this data breach, call MIE’s toll-free hotline at 866-328-1987.  You should also carefully monitor all of your financial accounts and check your medical records to make sure that someone has not accessed your health insurance and made you a victim of medical identity theft.  You should also put a credit freeze on your credit report.  You can find out how to put a credit freeze on your credit report by going to the Archives of Scamicide.  Be wary of any emails that you receive purporting to be from MIE because you can expect identity thieves to be sending out these as phishing email posing as MIE seeking to have you provide personal information or click on links containing malware.

Scam of the day – February 28, 2015 – Carnegie Mellon phishing scam

Carnegie Mellon University is one of the country’s foremost universities in various areas of technology, but that does not mean that Carnegie Mellon employees are any better than anyone else at recognizing phishing emails.  Phishing remains the primary way that many major data breaches are initiated when employees of a company receive a legitimate appearing email that prompts the person receiving the email to click on a link under various guises.  Unfortunately, what happens in many instances is that by clicking on the link, malware becomes installed that enables the hacker to steal information and data from the computer data banks of the company.  This simple technique was how the Sony hacking and the recent billion dollar hacking of a hundred banks around the world was accomplished.  Another way that phishing works is by luring the victims to enter their usernames and passwords into legitimate appearing communications thus providing that information to hackers and identity thieves.   That is what happened to an undetermined number of Carnegie Mellon employees who  were lured into providing their log-in information when they responded to an email entitled “Your Salary Raise Information.”


This phishing scam is particularly noteworthy because it once again shows that sophisticated, technologically savvy people can fall for the lures of phishing emails, which is why everyone should always be skeptical before responding to any email or text message that requires you to provide personal information or click on a link.  In either situation, you can never be sure when you receive an email or text message that the communication is legitimate.  So along with maintaining the latest security software on your electronic devices, it is important to make it a habit to never to provide personal information or click on links in response to text messages or emails until you have absolutely confirmed that the communication is legitimate.

Scam of the day – February 22, 2015 – IRS warns tax preparers of phishing emails

Income tax identity theft is a huge problem that costs the taxpayers more than 5 billion dollars a year.  Identity thieves armed with an unwary victim’s Social Security number files, generally electronically, a phony tax return on behalf of the victim with a fake W-2 that shows a substantial fraudulent refund due.  If the legitimate taxpayer files his or her income tax return after the identity thief, the real income tax return will be flagged and a long investigation will occur before the real taxpayer is able to receive his or her legitimate refund.

Now the IRS is issuing a warning to accountants and other tax preparers about a phishing scam where the tax preparer receives what appears to be an email from the IRS asking the tax preparer to update their IRS e-services portal information and Electronic Filing Identification Numbers (EFINs).  Links are provided in the email for entering the tax preparer’s username and password which is what the identity thief sending this phishing email is seeking.  Once the identity thief has this information, it is easier for him or her to file phony tax returns.  The IRS is advising anyone who receives one of these emails to delete it after forwarding it to the IRS at


As I have warned you many times, you can avoid phishing emails regardless of how clever they may be or how legitimate they may appear if you make it a practice to never click on links in emails, download attachments or provide personal information until you have absolutely confirmed that the communication is legitimate.  In this case, it is easy to call the IRS to confirm that this is a scam.  Even if the email or text message appears to have come from a trusted source, your trusted source may have had his or her email account or smartphone hacked so it is always necessary to confirm that any communication you receive is legitimate before clicking on links, downloading attachments or providing personal information.  Clicking on tainted links or downloading tainted attachments can result in keystroke logging malware being installed on your computer or other electronic device that will steal personal information from your computer or other electronic device and use it to make you a victim of identity theft.  Remember my motto, “trust me, you can’t trust anyone.”

Scam of the day – August 9, 2014 – Identity thieves defeat two-factor identification at banks

In the battle to prevent identity thieves from being able to access online the bank accounts of their victims, many banks in Austria, Japan, Sweden and Switzerland have gone beyond the simple password to the more secure (supposedly) two-factor identification.  With two-factor identification, in order to access their accounts bank customers must enter a second one-time password that has been emailed or texted to the customer.  The thought was that by requiring this second password, identity thieves who may have hacked the customer’s password still would not be able to access the customer’s account because the identity thief would not have the required second password sent by the bank to the customer’s smartphone.  However, now it has been uncovered by computer security company Trend Micro that identity thieves have found a way to defeat two-factor identification.  As with so many identity thefts, this one starts when the customer unwittingly clicks on a link in a phishing email or downloads an attachment in a phishing email that appears to be from a legitimate source.  Unfortunately, when the victim clicks on the link or downloads the attachment, he or she is actually downloading malware that sends the victim to a phony bank website when the customer attempts to do online banking.  Once at the phony website, the victim is prompted to enter their account details, passwords and personal identification number.  They are then prompted to download a mobile application found in Google’s Android store that is represented to provide enhanced security, but in actuality permits the identity thief to intercept the second password that banks would send to the customer.  Armed with all of this data, the identity thief is able to gain full access to the victim’s bank account and empty it.


Although two-factor identification is an improvement over the present password system used by many financial institutions in the United States and other parts of the world, it is still vulnerable.  Business and government must come up with better authentication protocols.  Meanwhile as with so many of these complex identity theft schemes, this one requires the victim to download the necessary malware that makes the identity theft possible.  The solution is a simple one.  As I have warned you many times.  Never click on a link in an email or download an attachment in an email unless you are absolutely sure that it is legitimate and the only way to do this is to independently call or email the real company or person purportedly sending the email at an address or telephone number that you know is accurate.  For even greater security, you may wish to have a separate computer for financial transactions where you do no emails and click on no links and download no attachments.

Scam of the day – January 7, 2014 – Latest AOL scam

Phishing scams often take the form of emails that you receive that appear to be legitimate and require you to click on a link contained in the email for various reasons which also may appear legitimate.  However, in the case of phishing emails, if you click on the link, you will only succeed in doing one of two things, both of which are bad.  In one type of email, you will be taken to another page where you will be prompted to provide personal information which will then be used to make you a victim of identity theft.  The second bad thing that can happen if you click on a link in a phishing email is that by clicking on the link, you will unwittingly download keystroke logging malware that can steal all of the information from your computer, laptop, smartphone, tablet or other device and use that information to make you a victim of identity theft.

Here is a phishing email that is presently being sent that purports to be from America Online (AOL), but it is not.  It is a phishing scam.  DO NOT CLICK ON THE LINK.


Your two incoming mails were placed on pending status due to the recent upgrade to our database,
In order to receive the messages Click here to login and wait for responds from Aol Team.
We apologies for any inconvenience and appreciate your understanding.
Regards, Aol Team.


There are a couple of telltale signs that this is a scam.  People receiving this email do not have their name appear in the salutation and if you click on the details section of your email, you will see that the email did not come from AOL, but instead came from a botnet which is a network of zombie computers taken over by hackers to spread this type of material.  Check the archives of Scamicide or “50 Ways to Protect Your Identity in a Digital Age” for more information about botnets.

In any event, as I have told you many times, even if you think the email is legitimate, you should never click on a link in an email unless you are absolutely sure that it is, in fact, legitimate.  Because you can never be sure who is actually sending you an email, if you are an AOL subscriber who has the slightest thought that this email might be legitimate, call AOL at a customer service number that you know is accurate to confirm that it is merely a scam.

Scam of the day – July 11, 2013 – Email box exceeding capacity scam

On occasion I will repeat a warning about a particular scam as it resurfaces and today is one of those days.  I have warned you previously about the scam in which you receive an email such as the two that are reproduced below that I personally received in my email box today in which you are told that you have exceeded your capacity and that if you do not click on the link included with the email to remedy the problem, your email account will be shut down.  This is a scam and like many scams, it relies on fear.  The truth is that your account will not be shut down for exceeding a specific number of emails.  Most importantly you should never click on a link, such as contained in this particular email because if you do, you will only end up unwittingly downloading a keystroke logging malware program that will steal all of your personal information from your computer and use that information to make you a victim of identity theft.  Merely delete the email.  If you have any questions as to the email’s legitimacy, call or email your email provider at a telephone number or email address that you know is accurate to find out the truth.

Here are copies of the two emails that I recently received.  DO NOT CLICK ON THE LINKS.

“Dear User,

Your e-mail account has exceeded its limit & needs to be verified, if not verified within 12hrs, we shall deactivate your account.

Validate Here



“Mailbox Quota size has exceeded its Quota limit for the month of June.QUOTA-SIZE: 89.00%
NOTE: You will be unable to send and receive messages at 92.8 % .
For mailbox cleanup CLICK HERE Management Page.Admin Help-desk.
© Copyright 2013″


These scam emails are both pretty shoddy.  They carry no logo of my email carrier.  The first has poor grammar.  Neither is signed and neither even indicate the name of my email carrier.  Never click on links in emails that you receive unless you are absolutely sure that the email is not a phony and never provide information to anyone who contacts you in an email unless you are sure that they are both legitimate and have a need for the information.  Even if the email appears to be legitimate, it may be a phony phishing email sent by an identity thief who has hacked someone’s legitimate email account.