Posts Tagged: ‘Phishing’

Scam of the day – May 19, 2013 – Fidelity phishing scam

May 19, 2013 Posted by Steven Weisman, Esq.

Phishing, as I have described on Scamicide and in my book “50 Ways to Protect Your Identity in a Digital Age” is the name for the tactic used by identity thieves by which you are lured to a phony website to provide information used to make you a victim of identity theft.  Phishing often starts with an email from a company with you do business or a federal or state agency.  The email indicates that there is some problem or other matter to which you must give your immediate attention and a link is provided for you to purportedly go to the website of the company or agency, however, in fact, you are either sent to a phony website for the company or agency where information is solicited that will be used to make you a victim of identity theft or, even worse, by clicking on the link you download a keystroke logging malware program that steals all of the information from your computer including your Social Security number, credit card number, passwords and other information used to also make you a victim of identity theft.

Recently, I received an email purportedly from Fidelity Investments.  As phishing attempts go, this one was pretty flawed.  The email address from which it came was not an email address of Fidelity Investments.  In fact, it was that of a private person who most likely was a part of a botnet by which his computer was being manipulated by an identity thief.  If you want more information about botnets, you can check out the archives of Scamicide or read about them in my book “50 Ways to Protect Your Identity in a Digital Age.”  Other flaws in the phishing email were the lack of my name appearing anywhere which indicates that it is just a general phishing email sent out to many people by the identity thief, and the lack of a Fidelity logo.

Here is a copy of the email I received.  DO NOT CLICK ON THE LINK.

“Account Status NotificationWe have noticed unusual activity on your account. Due to this, we need you to verify your account information for more efficient use of our Banking system: Please confirm your account information today by clicking on the link below: https://fidelity.secure.com/Logon.aspx?LOB=RBGLogon=user=&email&Security Adviser
©

Fidelity Brokerage Services LLC. All rights reserved”

TIPS
Never click on links in emails unless you are sure they are legitimate.  Unfortunately, you can never be sure when you receive an email if the email is legitimate so you should always be skeptical and make it a habit not to click on links until you have verified that they are legitimate by contacting the company or agency that is indicated as having sent the email to confirm whether or not the email and link are legitimate.  Look for the telltale signs that it is a phony, such as an email address for the sender that is not that of the real company or agency and the failure to direct the email to you directly by name.  You can contact the company or agency by phone or email directly to confirm whether or not the email you receive was legitimate.  Finally keep your Firewall and security software up to date to help protect you from viruses and malware.  Security software is certainly not perfect, but it does help.

April 25, 2013 – Associated Press hack attack – what it means to you

April 25, 2013 Posted by Steven Weisman, Esq.

On Tuesday, the Twitter account of the Associated Press (AP) was hacked into and a phony message describing a terrorist attack on the White House was sent out to the close to two million followers of AP’s Twitter account.  Immediately thereafter the Dow Jones Industrial Average lost 140 points as computerized program trading reacted automatically to the news without any verification of the truth of the report.  The phony tweet was corrected within minutes and the market recovered just as quickly as it went down, however the problem exposed by this hacking still remains.  In May of 2010 the Dow Jones Industrial average quickly lost almost 1,000 points due to a glitch in the computerized trading programs used on Wall Street.  Problems with computerized programmed trading which automatically order trades in response to perceived information are quite significant.  However, another problem is the hacking into the sources of our information.  The AP hacking is only the most recent hacking of a major provider of information.  Just last week the CBS news programs “60 Minutes” and “48 Hours” were hacked.  Also recently NPR and the BBC had their Twitter accounts hacked.   But it is not just the media that is being hacked.   Hacking is a major problem for all companies.  A recent study by Verizon indicated that 75% of the hacks were done last year by criminals seeking financial gain.  Sometimes it is to gain trade secrets, but other times it is to steal information about customers to make them victims of identity theft.  In 76% of the data breaches, according to the Verizon report, the hackers were able to exploit weak passwords.  In 29% of the hacks, tactics such as “spear phishing” were used to install keystroke logging malware on to the hacked companies’ computers to steal their data.   Spear phishing is a targeted phishing attack, often done through phony emails purporting to be from employees’ friends or business partners of the companies that contain the malware.

TIPS

Both government entities and companies are not doing what they need to do to properly protect their data from hacking.  The Associated Press Twitter account should have been protected by two-factor authentication when logging in so that even if a password is obtained by a hacker, he still would not be able to access the account.  Two-factor authentication requires not just a password, but also a code that is sent to a person’s cell phone.  Some companies such as Apple already use this technique.  The problem is that even if you and I do all we can to protect ourselves from identity theft, we are only as safe as the company or governmental agency with the worse security holding information about us.  Therefore you should try to limit as much as possible the places that hold your personal information and we all should impress upon the government and private industry the absolute necessity for better data protection.  The technology is available.  It just has to be used.

Scam of the day – April 17, 2013 – Smartphone credit card scam

April 17, 2013 Posted by Steven Weisman, Esq.

Many scams are merely updates of older scams.  The Nigerian letter of today is actually just the most recent incarnation of a scam that was being done in the 1500s when it was referred to as the “Spanish Prisoner Scam.”  Smartphones and other portable devices have made our lives easier and we all depend on them, however, they have also made the lives of identity thieves and scammers easier too as they use them to foist old scams on you by way of new technology.  The FBI has recently issued a new warning about a text message that people are receiving that purports to be from the issuer of your credit card telling you that your card has been deactivated.  You are then told to call a specific telephone number and provide your personal information including your name, credit card number and other personal information in order to reactivate your card.  Although this scam is being used by identity thieves around the country, the FBI warning dealt with calls coming from the 907 area code which is Alaska.  But even if you don’t live in Alaska, you may well be receiving a text message from your own local area.  This impersonation of your credit card issuer in order to get you to provide the identity thief with information that the identity thief can use to make you a victim of identity theft is called “phishing.”

TIPS

Never, and I do mean never, respond to a text requesting personal information unless you have confirmed that the message to you is legitimate.  In this case, if you have even the slightest concern that the text message may be from your credit card issuer, you should call your credit card issuer at the number indicated on the back of your credit card to confirm whether or not the text message you received was legitimate.  Then you will find out for sure that it was a scam.  You can never be sure when you receive a telephone call, email or text message who is sending you the message.  The risk of providing personal information to an identity thief is too high for you to trust any such communication.

I also urge you to pick up a copy of my book “50 Ways to Protect Your Identity in a Digital Age” which provides you with a wealth of specific steps you can take to make yourself safer on your smartphone, tablet or other portable devices.  You can click on the picture of the book on the right hand side of this page to go to Amazon where you can purchase the book at a discount.

Scam of the day – March 23, 2013 – Delta Airlines scam

March 23, 2013 Posted by Steven Weisman, Esq.

Many people have been reporting receiving an email that appears to come from Delta Airlines that either confirms an airline ticket, indicates a credit card has been charged or an invoice is attached.  Contained within the phony email that did not originate with Delta Airlines are links that the email says are provided if you need to contact Delta about anything regarding the information contained in the email.  The temptation, of course is to immediately click on the link to contact Delta to correct whatever mistake was made.  This, however, would be a real mistake because by clicking on the link in the phony email, you would either unwittingly download a keystroke logging malware program that will steal all of the information on your computer and make you a victim of identity theft or it will take you to another website through a technique called “phishing” where you would be asked for personal information that would be used to make you a victim of identity theft.

TIPS

Never click on a link in an email or download an attachment unless you are absolutely positive that it is legitimate.  In this case, Delta is advising its customers who receive such an email to change their SkyMiles account and PIN as well as to monitor their account for signs of hacking.  If you ever receive an email such as this, you can never be sure of from whom the email came so if you have any questions whatsoever, you should contact Delta or whatever other company from which you receive a similar email to confirm the legitimacy or in this case, the phoniness of the email.

Scam of the day – March 6, 2013 – Evernote hacking danger

March 5, 2013 Posted by Steven Weisman, Esq.

Evernote is a popular on line service that helps you store notes, files, web pages and images on all of your electronic devices.  It has both a free and a premium service for which you pay.  Unfortunately Evernote is also popular with identity thieves as evidenced by its being hacked.  Evernote announced the hacking a couple of days ago.  According to Evernote, the hackers managed to steal the names, email addresses and encrypted passwords of its customers.  Evernote is confident that its encryption program will protect the passwords of its users, but only time will tell.  Evernote also stated that it did not believe that credit card numbers used by its premium customers had been accessed.  Again, however, premium users of Evernote should be particularly vigilant in monitoring their credit cards.  Despite its position that no passwords had been stolen, Evernote is requiring all of its customers to obtain new passwords.  The ONLY place to do this is on Evernote’s website at www.evernote.com.

TIPS

Users of Evernote should be particularly wary of an identity theft tactic called “spear phishing.”  Spear phishing occurs when you get an email that lures you to a phony website or link where you either become victimized by providing information that is used to make you a victim of identity theft or causes a keystroke logging malware program to be downloaded when you click on the link or download tainted material that steals all of the information from your computer including bank account numbers, Social Security number, credit card numbers and other information that makes you a quick victim of identity theft.  What makes spear phishing particularly insidious is that unlike most phishing emails which never use your name, spear phishing is directed to you by name which makes many people more trusting of the email.  As I always say, “Trust me, you can’t trust anyone.”  Identity thieves will be contacting people by email posing as Evernote and telling them that they need to change their password by clicking on a link contained in the email or by providing other information.  Do not fall for this ruse.  Evernote is not contacting people by email, but the identity thieves who stole their email list will be.  The only place to change your password is www.evernote.com.  This is also another good example of the fact that your security is only as safe as the weakest place that holds your information.  Limit the places that do have personal information about you as much as possible.

Scam of the day – January 7, 2013 – Most dangerous websites

January 7, 2013 Posted by Steven Weisman, Esq.

Phishing is the name of the scam whereby you are lured to a phony website that appears to be legitimate, however when you click on links in these phony websites, download material from these websites or provide information to these websites, you put yourself in danger of identity theft or of downloading dangerous keystroke logging malware that can steal all of the information on your computer including credit card numbers, your Social Security number, passwords and various account information.  In addition, you may unwittingly have your computer taken over as a part of a botnet (for more information about botnets, check out other postings on scamicide.com or in “50 Ways to Protect Your Identity in a Digital Age”) whereby your computer is made part of the botnet circulating scams around the world.

TIPS

Recently Trend Micro issued a list of the most common websites that were the subjects of phony phishing websites during the past month.  The top ten websites of which you should be particularly wary of to make sure that you are dealing with the legitimate company are:  PayPal, Wells Fargo, Visa, Citibank, Bank of America, Aol, Yahoo, Hotmail, Gmail and Mastercard.  Things to look out for to avoid phishing websites are when you are directed to a website through an email that does not refer to you by name or if the email contains spelling errors or poor grammar that may indicate the email is coming from a foreign scammer (or a poorly educated American scammer).  A good rule to follow is to not click on links in emails or text messages to go to a website.  If you consider the email or message worth following up on, go to the website of the legitimate company by typing the URL that you know is correct into your browser.

Scam of the day – December 27, 2012 – Visa security program scam

December 27, 2012 Posted by Steven Weisman, Esq.

The most effective scams are, of course, the scams that most closely resemble real business transactions.  I recently received an email which is copied below that purported to be from VISA indicating that I could activate a free Visa Security Program merely by enrolling through providing information in an attached form.  The phony email also mentions a legitimate VISA security program entitled “Verified by Visa” as a way of making the recipient of the email trust the email even more.  However, don’t trust the email and don’t download the form and provide the information requested.  If you do provide the information requested all that will happen is that you will end up providing information to an identity thief who will indeed use that information to steal your identity.

TIPS

If you are interested in the extra security program that VISA provides click on this link (which you can trust) to go to VISA’s webpage for directions to enroll.  http://usa.visa.com/personal/security/visa_security_program/vbv/verified_by_visa_faq.html#anchor_10.

Whenever you receive such an email that may interest you, you must remember that you never can be sure of the source of any email.  If you are interested and think that the email may be legitimate, go directly on your own to the company’s website.  Don’t go to the website through a click on a link in the email because you can’t trust it.

Here is a copy of the email that I received:

“You can learn about the other ways Visa is committed to ensuring your safety by
activation the Visa Security Program.
1. Visa monitors for unusual activity Visa’s fraud-screening solutions constantly scan for suspicious activity and will alert your financial institution to questionable transactions.
2. Charges may be put on hold To safeguard your security, your financial institution may temporarily put suspicious charges on hold.
3. You will be notified as soon as possible Visa works with your financial institution to notify you as soon as possible to verify the legitimacy of questionable charges.
Important: In addition to our other ways of preventing, detecting, and resolving fraud, we offer Verified by Visa, a free, simple-to-use service that confirms your identity with an extra password when you make an online transaction.
Actively monitoring the activity on your account to protect from fraud, you need to activate Visa Security Program.
To activate the program, you need to download and fill the registration form that we sent in this email.
© Copyright 1996-2012 Visa. All Rights Reserved.”