Take the Course!

Our Personalized Financial Wellness Program Enrich, has a course on: "Protecting yourself from identity theft and scams".  You can take this course and many others FREE, through Snocope.Enrich.org

To learn more about this course, click here.  There is 8 minutes of video and 2 exercises to complete with an action plan.

Stay up-to-date on hacker plots and new scams with our Scam of the Week.

Visit our Facebook Page and each Monday you'll see a new entry on the Scam of the Week to watch for.

December 23, 2024 Christmas Scam of the Week:  Christmas Apps

BBB Tip: Is that holiday app safe? Better check it twice

Apple's App Store and Google Play offer a range of holiday-themed apps for your enjoyment. For Christmas, kids can engage in live video chats with Santa, witness a reindeer feeding, or monitor Santa's sleigh. For Hannukah, kids can illuminate a virtual menorah and play a dreidel game. For Kwanzaa, there are games to learn the principles, light a kinara and count down the days until the holiday. It's evident that apps will continue to play a significant role during the holiday season. However, before permitting your child to download any app, it's essential to understand the data it may collect and establish appropriate permission settings.

The Children's Advertising Review Unit (CARU) recommends these tips to keep in mind.

Know your privacy rights

The Children's Online Privacy Protection Act (COPPA) gives parents control over who collects information from their children online. COPPA applies to all mobile apps and websites (or portions thereof) directed to kids. COPPA was designed to ensure that parents affirmatively consent to the collection of personal information from children under the age of 13 prior to collection. Personal information includes names and addresses, email addresses, photographs, or precise geolocation information, among others.

Tips for parents when selecting apps for your child:

Here are some improved guidelines for a safer and more informed app selection process:

• Review the privacy policy: Responsible apps designed for children should offer a clear and accessible privacy policy. Apps and websites provide links to their privacy policy in the app store or on its homepage. If you can't find a privacy policy, it's a warning sign that its privacy and data collection practices may not comply with COPPA, and you should carefully consider whether you want to download that app. A comprehensive privacy policy should include information on who collects personal data, the types of data collected, its intended use, storage procedures, data access, parental rights, and opt-out options.
• Understand data collection: Online services for children cannot collect photos, videos, or voice recordings from children under 13 without first obtaining parental consent. Apps must also obtain parental approval before children share personal information publicly. Prior to your child downloading an app, investigate what kind of data it may collect, using resources like Apple's Privacy Details section in the App Store.
• Set permission controls: Many free apps may include in-app purchases that children can access once they are downloaded with parental consent. Ensure that your child's device requires a password for each download.
• Exercise caution with free apps: Most free apps tend to feature more advertising than those with a nominal fee. Free apps, including educational ones, may incorporate deceptive or inappropriate advertising practices. Ads can be frequent and mandatory to advance in a game, sometimes tempting children to purchase in-game items. Apps meant for both children and parents may display ads intended for older audiences. Even free apps without visible ads may still collect data for future ad targeting. Adjust your device settings to mitigate surreptitious ad targeting. To avoid furtive ad targeting, make sure to adjust your iOS or Android device settings.
• Think before downloading: Be cautious about downloading apps, as some free apps may contain malware. To ensure the safety of your device, make sure the app store page includes a privacy policy link, contact information, and the publisher's address details. Use common sense to assess the apps' credibility, as crude designs or imitations of well-known characters may indicate potential issues.
• Read reviews: Services such as Common Sense Media can help you determine whether the app's content is suitable for your child.

By following these guidelines, you can make more informed decisions when selecting apps for your child, ensuring their online experiences are safe and enjoyable.

CARU asks parents who encounter an app or other online service that they think violates COPPA to file an anonymous consumer complaint on the CARU website.

For more information about CARU and keeping children safe online, please visit BBB National Programs.

November 18, 2024 Scam of the Week: Social Media Holiday Scam

During the holidays, you might see promotions or contests on social media sites offering gift cards or vouchers in exchange for simply completing an online survey. Unfortunately, the survey usually isn’t legitimate. It’s only a means of capturing your personal information to commit identity fraud or other types of cybercrime.

Or you might be offered a prize for just liking or sharing a social media post. But doing either could infect your device with malware.

The bottom line? Be extra cautious during the holidays on social media, especially with enticing offers that seem unusually generous. There are legitimate review sites like truereview.com or brandwatch.com but you'll see many pop up during the holidays that only have bad intentions. Please check the company before doing any survey or solicited review.

November 12, 2024 Not my SmartTV!

Scammers have a new target: Smart TVs

Just like any other device connected to the internet, TV’s can be a vector for scammers to use to try and steal money or personal information from their victims. There has been a recent burst of reports regarding fraudsters finding victims through smart televisions.

The scam works like this: When connecting a smart TV to a streaming service like Hulu, Netflix, or HBOMax, consumers are often required to go to an activation URL (e.g. www.streamingservice.com/activate) on their smartphone or computer. Once there, they are usually required to enter the code that appears on their smart TV to link the device to a streaming account.

Capitalizing on this, scammers are setting up lookalike sites with a URL nearly identical to the authentic one—sometimes with just one character difference. When a consumer makes a typo in attempting to access the genuine website displayed on their streaming device, they are instead taken to the fraudulent page. Once on this copycat website, fraudsters will receive any login credentials, personal information, credit card numbers, and payments that the consumer may provide.

In other cases, the scam appears to begin when a consumer uses a search engine to look up activation information for their smart TV (e.g. “Roku activation”). Scammers buy ads or otherwise get their fake activation websites to appear high in search results. When the consumer clicks on the bogus link, they may be directed to a website or receive a pop-up asking the user to pay an activation fee. To be clear, Roku and most other streaming device creators do not charge activation or setup fees.

Scammers also use pop-ups to direct the consumer to call a phone number, usually claiming it’s to finish setting up the user’s account, resolve an error, or fix network issues. This often results in another charge to the consumer, a request for personal information, or both. Furthermore, once fraudsters have a potential victim’s phone number, they are relentless in their pursuit to either complete a scam or conduct another if the first attempt was successful. It is very common for consumers to receive multiple, sometimes dozens, of calls following initial contact.

Here are a few tips to stay safe while navigating your smart TV:

• Scrutinize fees. Whether it’s an activation fee for your Roku (which doesn’t actually require a setup fee) or an alert to resubscribe for a service, fraudsters are always looking for clever ways to charge money. Double check whether the fee matches what the real service charges, or if there is even a charge at all. Additionally, you can log in to a streaming account on another device to check if the subscription has lapsed and take the appropriate steps once you’re sure you have reached an authentic website.
• Ensure the URL for the website you’re accessing is spelled correctly. Whether on your TV, phone, or laptop, just one wrong letter can take you to a fraudulent website. Since these copycat sites can look very similar (or identical) to the true destination you were expecting, carefully inspect that the URL you’re going to is the right one.
• Double check any phone numbers that appear on your screen. Customer support numbers should be easy to find on genuine companies’ websites.
• Don’t let strangers control your device. While this mostly applies to computers, providing control to strangers over your device gives them access to personal and financial information. No authentic support will request remote access to your smart TV.

November 4, 2024 What is Malvertising?

What is Malvertising

Malvertising is a malicious attack that involves injecting harmful code into legitimate online advertising networks. These deceptive ads are then unknowingly displayed to users, leading them to unsafe destinations. The embedded malicious code often redirects users to harmful websites, risking their online security.  Malvertising can be highly profitable for cybercriminals, as it’s difficult to track and often goes unnoticed. The malicious code is usually embedded in online ads, which users may encounter while browsing. Attackers place These ads on legitimate sites to reach a larger audience.

How Does Malvertising Work?

The online advertising ecosystem is a complex network that includes publisher sites, ad exchanges, ad servers, retargeting networks, and content delivery networks (CDNs). Multiple redirects exist between different servers when a user clicks on an ad. Malicious actors exploit this intricacy to surreptitiously insert harmful content in unexpected locations that publishers and ad networks are least prepared for.

When a website visitor clicks on malvertising, they may unknowingly trigger the release of malicious code on their device. Once installed, the malware is delivered through malvertising functions like any other malware. It has the potential to damage files, exfiltrate data, establish hidden access points, or monitor the user’s activity. The malware can also manipulate, block, delete, copy, or leak data, which can then be held for ransom or sold on the dark web.

Malvertising attacks can also deploy an exploit kit, a type of malware that is designed to probe a system and take advantage of security gaps or vulnerabilities.

What’s the Difference Between Malvertising vs. Ad Malware?

Malvertising is often mistaken for ad malware or adware, which are other types of malware that impact online advertisements. Adware is a program that runs on a user’s computer. It is typically bundled with legitimate software or installed without the user’s knowledge. Adware showcases unwanted advertisements, redirects search requests to advertising websites and collects user data to facilitate targeted advertising.

When comparing malvertising and ad malware, there are distinct differences to consider:

Malvertising entails the deployment of malicious code on a publisher’s web page, specifically targeting individual users. On the other hand, adware is designed to target individual users without initially being deployed on a publisher’s web page.

Furthermore, malvertising only impacts users who view an infected webpage, whereas adware, once installed, operates continuously on a user’s computer.

In summary, malvertising and ad malware differ in their approach and impact, with malvertising relying on infected web pages and adware persistently operating on a user’s computer.

How Do Malvertisements Affect Users?

Malvertising can impact users who view malicious ads, even without clicking on them. These include:

1. “Drive-by download” attacks: These occur when malware or adware is automatically installed on a user’s computer due to vulnerabilities in their browser.
2. Forced browser redirects: Users may be redirected to malicious websites against their will, exposing them to potential threats.
3. Unauthorized display of unwanted advertising, malicious content, or pop-ups: Malvertisements may execute Javascript to show additional ads or content that goes beyond what is legitimately displayed by the ad network.

When users click on a malicious ad, malvertising can compromise their security:

1. Installation of malware or adware: Clicking on a malicious ad can trigger the execution of code that installs harmful software on the user’s computer.
2. Redirect to a malicious website: Instead of reaching the intended destination suggested by the ad, users may be redirected to a site that threatens their online safety.
3. Phishing attacks: Malicious ads may redirect users to websites that closely resemble legitimate sites, aiming to deceive and trick users into divulging sensitive information.

How To Avoid And Prevent Malvertising

Malvertising is an attack that is difficult to detect and mitigate and requires action by end users and publishers.

How Users Can Avoid Malvertising

Protecting yourself from malvertising involves a combination of good online hygiene, keeping software updated, and using various security tools:

1. Keep Software Updated: Regularly update your browser, operating system, and plugins to ensure that you have the latest security patches. Outdated software often has vulnerabilities that can be exploited by malware.
2. Use an Ad-blocker: Ad-blockers can prevent many types of malvertising by blocking the actual ads from loading on web pages.
3. Disable Javascript and Flash: Javascript and Flash are often used to deliver malicious payloads. Disabling these can prevent many types of malvertising attacks, although it may also affect the functionality of some websites.
4. Be Cautious with Pop-Ups: Don’t click on pop-up ads or windows. Instead, close them by clicking on the “X” or through the task manager.
5. Use Antivirus Software: Good antivirus software can detect and neutralize many types of malware. Make sure your antivirus software is kept up-to-date.
6. Enable Click-to-play: Click-to-play requires user intervention to play multimedia content. This can prevent the automatic execution of malicious code.

For a quick video about Malvertising watch this YouTube video (click here)

October 28, 2024:  Copycat bank fraud prevention alerts
Scammers text to verify transactions or call about suspicious activity, then ask you to give them your bank account number to “recover” the money from a transaction you didn’t make; they then transfer money out of your account.

How to protect yourself from copycat fraud prevention alerts: Banks will never charge you a fee to recover money from a transaction you didn’t make, and they already know your bank account number. If you get a text from your bank or credit card company to verify a charge, do not reply. Instead, call the bank or company on a number you trust to verify the legitimacy of the fraud prevention call.

The best protection against fraudulent charges is to review your online banking account often to check for unauthorized transactions.

October 21, 2024:  Amazon Package QR Scam

This week's Scam of the Week is the "Amazon Package QR Scam": This is timely as we head into the holiday season...You come home and there is an Amazon package at your door, nothing unusual there. But, you don't remember ordering anything - maybe it was your spouse/partner. So you open the package and nothing makes sense, but there's a paper inside with a QR code and some text like "Have questions about your order, we're here to help - scan here" or "Need to return a purchase - scan here". And...as soon as you scan the QR, the scammers have you. They have now sent malware to your phone and are harvesting your data, your contacts, your payment information in your digital wallet, your geo location and other personal information. So, use caution. If you didn't order it, don't arbitrarily scan a QR code. Check your Amazon account in a secure setting and see if you should have something and follow their procedures for returns and questions. There's a funny video on this scam here: https://www.facebook.com/reel/3849231468686882

October 14, 2024: Card Decline Scam

The Scam of the Week is the "Card Decline Scam" and simply put if you are shopping on line and your card comes back declined, but you know there's money on your credit card to cover your purchase, the worst thing you can do is try another card. If you're shopping on the CORRECT site, and they have your profile, and maybe have your card on file, there is no reason to enter your card information again, by doing so, you've given the scammer the card information. If you try another card because the first was declined, then you've given them two card credentials. And, as you look at the purchases for your card(s) you'll instantly see fraudulent charges.

For more information, watch this video from an East Coast news broadcast (via Facebook): //www.facebook.com/reel/8286155804796244

October 7, 2024:  WalMart Wish List Scams

Shopping online or attempting to get in touch with a store is a little bit like walking on a minefield: you might get lucky or take a wrong step and get scammed.

Case in point, a malicious ad campaign is abusing Walmart Lists, a kind of virtual shopping list customers can share with family and friends, by embedding rogue customer service phone numbers with the appearance and branding of the official Walmart site.

The scam ends in accusations of money laundering, threats of arrest warrant, and pressure to transfer money into a Bitcoin wallet.

In this blog, we walk through the different parts of this well executed scheme and provide helpful tips to avoid falling for this scam. We have already reported the malicious Google ads and informed Walmart of the abuse of its customer’s shopping lists.

Malicious Google ads

When searching for Walmart’s phone number, the top result on Google is for an ad (sponsored). Unless you manually checked “My Ad Center”, you would have no idea who the ad belongs to.

More importantly, because the ad snippet shows the https://www.walmart.com address, you might wrongly assume that it is a genuine advert from Walmart.

Walmart Lists

In previous cases, we have seen malicious advertisers impersonate brands by displaying their official website in the ad URL. However, this is a little bit different as the ad’s final URL actually belongs to Walmart.

On mobile, due to space limitations in the address bar, users will see walmart.com, while on desktop they will see the full URL. In both instances, this is a strong indicator of legitimacy, one which people have been trained to check for years. This is not an impostor website, it is the real one, so one might think that whatever is shown on the page must also be legitimate.

Lists is a feature that registered Walmart customers can use to add items they might be interested in purchasing. To create a list, you first need to register for an account, but it is free and does not require any form of authentication or payment method.

The scammers have created several accounts and fake lists where they can instead add custom text. Their goal is to trick people thinking this is a contact page for Walmart customer service. This is exactly what they do by using fake names like “Mr Walmart S.” and entering their own phone number in the page.

Finally, they can use a link to share this list with others, and this is the link they will use for the Google ads. As such, the ad actually does not violate Google’s policy per se since the branded ad does go to the brand’s website. But, as we know, this is all fake.

What happens next?

People who dial any of those supposed customer service phone numbers shown on the Walmart lists will be directed to a call center in Asia. On the other end of the line scammers impersonating Walmart will get their information (name, email address) before reviewing their details.

As it happens, victims will be told that a large purchase was recently made on their account. That’s the scare tactic that will allow scammers to request more personal information related to their banking, and even social security number.

The call centre uses several different people, all who play a different role to process victims:

• the Walmart customer service representative
• the higher authority or “supervisor”
• a fake bank employee
• a fake FTC investigator

When we called, the scammers claimed that our account had been used to transfer huge amounts of money to narco trafficking countries:

Now, all the banking found which was created using your personal information are transferring huge amounts of money to the narco trafficking countries such as Columbia, Mexico, some Saudi Arabia countries and Columbia.

As a result, we were told that there was an active arrest warrant against us:

Otherwise we have to take you under the custody for [inaudible] purpose, because there is an active arrest warrant also available on your name.

We were threatened several times and warned to go to our bank to withdraw as much money as the bank would allow in order to transferring those funds into a Bitcoin wallet. Oddly enough, the scammer mentions there won’t be any taxes on the transaction, which really would be the last concern on someone’s about to be arrested:

Yes, I know Sir, it’s not a checking account, it’s a Bitcoin wallet. The machines are… is installed by the [inaudible] for the anti money laundering charges. So you don’t, like, get any taxes on it as well as, the transactions done are anti money laundering. So you have to create your own wallet on that machine. How you can create it using your personal information, I will guide you step by step. I will be on the line with you all the time, you don’t need to worry about that. OK?

It’s quite scary to see how anyone can go from wanting to return an item or speak to a Walmart associate, to being falsely accused of crimes and pressured to transfer money. It’s also a reality check that scammers are constantly preying on the vulnerability of innocent people.

How to avoid falling for scams

In a fast paced world where technology can be abused, it is important to keep certain things in mind.

• Sponsored results, or ads can be dangerous due to ongoing and relentless malvertising campaigns. Learn to spot a regular search result from an ad, and if possible avoid clicking on ads.
• Even if you are on an official website, the content you see may not be legitimate. This is a particularly hard one because people will naturally trust that the brand’s own site will be safe. But scammers and spammers can inject content in comments, or custom pages.
• Scare tactics and pressure to act quickly are almost always malicious. Unfortunately, most brands also have these promotions that expire soon and customers believe they need to buy the product now or they will lose on a deal. Having said that, your local store will never threaten you on the phone with an arrest warrant.
• Scammers will often tell their victims to keep everything confidential and not discuss it with other family members or bank clerks. This is only in the scammers’ interest to not be exposed; by all means you should ask for clarification and seek help from others.

September 16, 2024:  FTC warns consumers about college tuition billing scam

For college students and parents, paying tuition is often at the top of the to-do list each semester. Imagine getting a call from someone who supposedly works at your school, saying you haven’t paid the bill. They threaten to drop your classes unless you send money right away. The call might raise alarm bells, but slow down — you might end up paying a scammer instead of the real tuition and fees.

Scammers pretend to be from places like a school’s financial aid or bursar’s office. They might call and say financial aid fell through and that you or your child can’t start classes until you pay the full balance right away (not true). Or that school transcripts are on hold until you pay up (also not true). A school won’t call and scare you into paying them over the phone — but a scammer will.

If you get a call like this, don’t panic. Instead:

• Resist the pressure to act quickly. If someone calls and demands that you give them your bank or credit card information immediately, don’t do it. That’s a scam. And only scammers demand payment with crypto, a wire transfer service like Western Union or MoneyGram, a payment app, or a gift card.
• Don’t trust your caller ID. Scammers fake caller ID numbers — sometimes even “spoofing” the first six digits to make it look like the call came from on-campus. Block unwanted calls.
• Check it out. Most schools use secure student portals to post your bill and let you pay safely. Check any tuition balance there first. Or call the financial aid or billing office directly using a number you know is legit. They’ll help you verify any outstanding balances and when you need to pay.

If you get a call like this, chances are, you’re not the only one. Share this blog post to spread the word and help others spot and avoid the scam. Then, tell the FTC at ReportFraud.ftc.gov.

September 9, 2024:  Fraud Victims Hit Again by Scammers Promising to Recover Stolen Cash"

Getting scammed is a life-shattering event. What could possibly make it worse? How about getting scammed again while trying to recover your losses?

That’s the idea behind a fraud refund scam or fraud recovery scam. It works like this: Scammers contact fraud victims offering to help them regain their stolen money. To recover the funds, the criminals will charge a fee, which they may call a retainer fee, a processing fee or an administrative charge.

They may claim to provide certain services (such as filing complaint paperwork on your behalf) or promise to speed up your reimbursement, the Federal Trade Commission (FTC) warns. They may also request your Social Security number or financial account information, which they need, they say, to deposit your refund (they might also claim to be holding your money for you).

Frequently, they disguise themselves as legitimate entities, from law firms to consumer advocacy organizations to government agencies.

The FBI warned in June that fake law firms have been targeting victims of cryptocurrency scams in particular, noting that between February 2023 and February 2024, cryptocurrency scam victims who were then victimized by fictitious law firms reported losing a total of more than $9.9 million.

Many other authorities have issued warnings about fraud recovery scams, including the FTC, the Financial Industry Regulatory Authority (FINRA), the Commodity Futures Trading Commission (CFTC) and financial institutions such as Ameriprise.

“Recovery offers can be tempting, especially if you’ve already lost a large sum of money and are anxious to reclaim any amount you can,” FINRA notes. “But engaging with these scams will only further your losses.”

“That’s what makes this so insidious,” says Elsie Kappler, an attorney in the FTC’s Division of Marketing Practices. “They know these people have already been scammed, so they know they’re really good targets.”

How fraud recovery scammers find victims

How does a scammer know you’re a fraud victim? Sometimes, the criminals who scammed you the first time may re-target you, claiming they can help you recover your losses. Frequently, however, your status as a fraud victim lands you on a list. Just as a real estate agent might create a list of potential homebuyers, scammers often do the same, building databases and buying, selling and trading information about victims. That info can include your name, address and phone number; the type of scam that victimized you; and the amount of money you paid, the FTC reports.

“Information is shared within criminal networks,” says Robert Mascio, director of FINRA’s Investor Education Outreach. “There’s a network of individuals that might know you’ve already been victimized, and they can come back to that individual to try and extract more money.”

Because criminals have data about your case, their recovery appeals can sound legit. They also know that victims are probably still reeling from the first fraud, which makes them susceptible to a follow-up. Strong emotions — embarrassment, grief, anger, shame, depression — are normal responses after you’ve been robbed, Mascio says. But your raw emotional state can affect your judgment, which scammers can exploit.

“Sometimes, people just don’t want to let go of the idea that they’re going to get that money back,” Kappler says. A recovery scam “takes advantage of human nature and our tendency to follow through on something we’re invested in, and to keep investing more time and emotional energy.”

How to protect yourself from fraud recovery scam?s

Ignore unsolicited offers. This is true of many scams. “If something is coming to you out of the blue — in this case, the chance for recovery — and you didn’t actively seek it, that’s definitely a red flag,” Mascio says. Start by not answering calls from unknown numbers.

Expect pressure tactics. Scammers often say you need to act fast to recover your funds. “Victims might think, ?'?Well, if I don’t act quick, I’ll lose even more money,'” Mascio says. “Whenever you’re given a short amount of time to do something, we get emotional, we get nervous, we start thinking, ‘OK, we have to do this quick?.?' And when that happens, rational thinking can go out the window.” ?

Pressure tactics are a clear warning sign, Kappler adds.

“If you’re entitled to have money back, there’s absolutely no reason why you need to act now or rush to wire them money,” she says.?

Watch for phony checks. Sometimes, the scammers will send a counterfeit check, often for more than what you lost, and tell you to deposit it, the FTC notes. Then they’ll say they overpaid and instruct you to return the balance.

“If somebody is giving you money and telling you to send them money back — or if somebody is asking you to pay to get money back — it’s a scam, plain and simple,” Kappler says. And once your bank discovers that you deposited a counterfeit check, “the bank may come knocking at your door asking for the money they lost,” she says.

Beware of up-front fees. Scammers may charge a fee to recover your money and ask you to pay it via a wire transfer, gift cards or a service such as Venmo. “If anybody’s asking for money up-front,” Mascio says, “that’s a clear indicator that it’s a scam.”

Research supposed credentials. Recovery fraud scammers pose as legitimate entities — from law firms to consumer watchdogs — to gain your trust. It’s a common tactic: Impostor scams, where a criminal pretends to be someone trustworthy, were the most common type of consumer fraud reported to the FTC in 2023, representing 33 percent of all complaints.

To uncover a scammer’s identity, start by using a search engine. If a supposed law firm contacts you, for example, enter the firm’s name with keywords such as “scam,” “fraud” or “complaint.” FINRA offers an online service called BrokerCheck to help you research financial institutions and professionals. You can also contact your state attorney general and inquire about complaints involving a particular company.

Understand how the feds work. Federal officials will never contact you through a personal or web-based email account. “If the government needs to reach you, they will send official documentation in the mail,” states the CFTC, a federal regulatory agency that has shared information on recovery fraud scams. Adds Kappler: “Neither the government nor any legitimate organization is going to call and say they want to give you money, but you have to pay them money. And they won’t ask for personal information.”

Report the fraud. If you’ve lost money in a recovery scam?, or you have information about the scammer, report it to the FBI’s Internet Crime Complaint Center (IC3.gov), and your state attorney general. Not every complaint leads to enforcement action, Kappler says, but the information can help officials to spot trends and sometimes identify scammers. ?

August 28, 2024:  When a QR Code Goes Bad - "Quishing!"

For today's Scam of the Week we bring in another new word into the scamuniverse - "Quishing". Not to be confused with Phishing which we have talked about in great detail. Quishing is using QR codes for malicious intent. We have introduced other forms of phishing that you should be aware of, like "vishing" (voice phishing – phone calls) and "smishing" (text messaging – SMS texting). The and now we have "quishing", the use of QR codes as phishbait. .

QR code phishing or quishing is a type of phishing attack that uses QR codes to lure victims into revealing sensitive information. Threat actors create a QR code that looks legitimate, such as one that appears to offer a discount or special offer, but in fact, it directs the victim to a fake website controlled by the attacker.

Once on the fake website, the victim is prompted to enter sensitive information such as login credentials or credit card information, which is then stolen by the attacker. Quishing attacks can be hard to spot, as the attackers create legitimate-looking websites and logos impersonating known brands. Delivery of these QR codes happens via email, social media, or even physical flyers.

Red flags to look for include:

• Check the destination site of the QR code: Check for mistakes and misspelled words, shoddy design, low-quality photos, and insecure URLs as indicators that you’ve landed on a bogus website. Sites that are “secure” will use HTTPS rather than HTTP and will have a padlock icon next to their URL.
• Preview the URL before accessing the link: Before directing you to the intended page, your phone will tell you the destination of the QR code. Check the URL to see if it seems safe. If the URL is shortened or unreadable, be extra cautious
• Be cautious with QR codes in public places or in the mail: A public QR code or one you receive in the mail could have been added there by a threat actor or be easily altered. Avoid scanning these as much as possible to minimize the risk of infection

What should you do if you realize you scanned a fake QR code?

• Change your passwords and secure your online accounts: Make sure you use strong passwords for your accounts, and to add an extra layer of security, enable two-factor authentication (2FA)
• Disconnect from your Wi-Fi or cellular network: If you downloaded malware onto your device turn off any internet connection as soon as you realize the file might be corrupt. There is less of a risk that the malware may send your sensitive information to a hacker if there is no connection
• Backup your important files: If your device is compromised, threat actors may steal private information like images or papers, or they may even encrypt your drive and demand a ransom. To be extra cautious, make a backup of your files on an external disk
• Set up a fraud alert for your cards: If you entered your financial information, notify the credit bureaus as soon as possible. Fraud alerts and credit freezes make it more difficult for con artists to open credit cards or commit loan fraud

August 20, 2024 - Say YES Scam:

Scam of the Week "The say "YES" scam:

With all the robo-callers and unknown callers people are still asking folks on the other end of the line if they can hear them. But now it’s often scammers doing the asking, according to the Federal Communications Commission (FCC), which has warned consumers about so-called “can you hear me” scams — also known as “say yes” scams.

How it works: A criminal calls someone and asks a straightforward question like, “Can you hear me?” or, “Is this so-and-so?” in order to record the person saying “yes.” In theory, the scammer can later use the recording for nefarious purposes.

Finish reading Say YES Scam from AARP:   Click here

August 12, 2024 - Travel Scams taking advantage of CrowdStrike Outage

This week's Scam of the Week shows how scammers are taking advantage of the recent disaster of the CrowdStrike outage that wiped out IT services worldwide. Systems were affected globally, resulting in delayed flights, business closures, and more. However, what may be bad news for you could be good news for cybercriminals. Cybercriminals often seek to turn major events to their advantage by sending out phishing emails or text messages related to the event. By using a major event that you are familiar with, they hope that they can trick you into clicking on malicious links or attachments.

Shortly after the outage, cybercriminals began creating fake websites. The websites claim to belong to IT workers who can assist with troubleshooting the outage and restoring access to affected computers. There are files on the fake websites that appear to be software updates for Windows computers. However, these files actually contain malware. If you download them, malicious software can be installed on your computer, giving cybercriminals access to your personal data!

Follow these tips to avoid falling victim to any CrowdStrike-related scams:

This specific scam involves fake websites, but remember that cybercriminals will exploit this event in different ways. Be on the lookout for any suspicious activity related to the CrowdStrike outage.

Delta Airlines continues to report scammers offering rebates and free flights with fake emails weeks later.

Don’t download any files or attachments from websites or emails. Any troubleshooting related to the CrowdStrike outage should be addressed by your organization’s IT team.

Be cautious of unexpected calls, emails, or text messages that seem urgent to respond to. Cybercriminals will try to use this outage to trick you into acting impulsively.

August 8, 205 - Using Bitcoin ATMs to Move Money

Bitcoin ATM Imposter Scam

This week's Scam of the Week involves Bit Coin. I'm sure you've heard about it by now and it's become a favorite way for Scammers to get to your real money.

Is there a legit reason for someone to send you to a Bitcoin ATM? The short answer is NO. Will someone from the government send you to a Bitcoin ATM? NEVER.

Scammers succeed because they’re good at what they do — which is lying. So, if someone calls and says you have to act now because your money is at risk, you might listen if they’re convincing. They’ll scare you into keeping it a secret — even from your closest loved ones. Once they have you alarmed and alone, they’ll give you the solution to the problem they just created: “protect your money by moving it.” And that’s when they’ll send you to a Bitcoin ATM to “secure” your money. “Problem” solved? Not even close.

That’s because neither Bitcoin nor the ATM will protect your money. In fact, no cryptocurrency will. No matter what the caller says, there’s no such thing as a government Bitcoin account or digital wallet. There are no Bitcoin federal safety lockers. And only a scammer will give you a QR code to “help” you deposit your life savings in a Bitcoin ATM.

What they’re doing is trying to rush you into something you can’t reverse: giving your money to a scammer. So, if you get a call like this, remember:

Never move or transfer your money to “protect it.” Your money is fine where it is, no matter what they say or how urgently they say it.  Worried? Call your real bank, broker, or investment advisor. Use the number you find on your account statements. Don’t use the number the caller gives you. That’ll take you to the scammer.
Report it. Tell our bank or fund right away. Especially if you moved money. Then tell the FTC at www.ReportFraud.ftc.gov.

Then share this post with one person today? Scammers love this approach right now. But if we all tell one person, and they tell one person, we can make sure more people know how to stop this scam.

July 29, 2024 - Use Caution with FlowCode QR Codes

This week's Scam of the Week is about a relatively new type of QR code known as a Flowcode. This is part of our Fraud and Cybersecurity video that talks about Flowcodes. To see the information that can be harvested from your device see the Flowcode Privacy Statement attached. To attend the upcoming Fraud and Cybersecurity webinar in September, visit our website:

To view the video, click here

To view FlowCode Privacy Statement, click here

July 8, 2024 - Tolls Trouble Scam

Today's Scam of the week is one that utilizes our very own Washington State Good To Go program, and other toll programs across the Country. I got a text telling me my trip on I-405 Express Lanes cost me $4.15. I don't remember taking those lanes, but they are suggesting additional late fees if I don't follow the link to pay it.

Problems:

• Anyone can steal the WSDOT Good To Go logo and a picture of the Narrows Bridge to make it look legit.
• Look at the link they want me to go to, that's not a Washington State Finance website
• The phone number this came from is Montreal Canada
• Good To Go doesn't text. They send you an invoice for your tolls or you have a sticker on your vehicle and an active balance
• If you typed in the URL address of the link, it doesn't go anywhere, meaning that the real URL is camouflaged in the link

If you clicked on the link under the pressure tactic to avoid late fees, you could give these scammers your credentials and payment methods. Below is the text from my phone so you can see what it looked like and maybe avoid something yourself.

June 3, 2024 - Look-a-Like Documents Made Easy

This week's Scam of the Week is a bit more involved, and from a graphic designer's point-of-view, very concerning. Available to everyone now is online graphic design software with thousands of professional templates called Canva and Adobe Express and they can create almost anything, including fake documents and bad links (a continuation of last week's fake log in scam).

Cybercriminals often use legitimate websites like this in their phishing attacks as a way to get around the security systems that your organization has in place. A recent example of this is Cybercriminals are using Canva to create an official-looking document that contains a clickable, malicious link. Creating and storing this document on Canva allows the attackers to get through security measures because Canva is a legitimate website.

Once the scammers have created and stored their file on Canva or Adobe Express, they will send you an email that includes a link to this malicious file. The email claims the link leads to an important document that needs your attention. However, if you click this link, you are taken to the Canva/Express file and prompted to click another link in order to view the document mentioned in the email. Clicking this second link will redirect you to a phony login page for your email provider. Any information entered on this page will be sent directly to the scammers. Don’t be fooled!

Remember these tips:

• Never click a link in an email that you were not expecting.
• Call the sender to be sure the email and link are legitimate. Do not call the phone number provided within the email as it may be a fake number.
• When you’re asked to log in to an account or online service, navigate to the official website and log in. That way, you can ensure you’re logging in to the real site and not a phony look-a-like.

May 28, 2024 - Fake Log In

This week's scam of the week, just happened to hit close to home with a family member this last week, so I thought I'd share. Scammers frequently try to trick you into clicking on malicious links in emails and texts by making them appear legitimate. In a recent scam, they are trying to trick you with an email that appears to be related to your Microsoft account. The email/text says that there has been some unusual activity on your account and that many of your account’s features have been locked (or the whole account is locked to protect your information). There is a link in the email or text, along with instructions to click it so that you can review all activity on your account.

If you click the link, you’ll be taken to what appears to be a authentic Microsoft login page. However, the login page is actually fake, and you won’t be taken to your Microsoft account if you enter your login information here. Instead, entering your user credentials on this page will allow cybercriminals to steal them. Once they have your username and password, they can use them to access your account and steal your personal information, sometimes this can contain your payment information for Window 365 and other products.

Follow these tips to avoid falling victim to this and other phishing scams:

• Scammers will often try to scare you into acting impulsively, telling you or showing you how "urgent" something is or that you might "loose all your information". Always stop and think before clicking, especially if an email or text is instructing you to act quickly.
• Pay attention to the details of the email/text. Phishing emails will often contain spelling and grammatical errors, or the wording of the email may seem unusual, use caution with abbreviations in texts.
• Navigate to the official website in your browser, separate from the email or text being sent. Check your account status from the native home page that you went to direct

May 20 - Fake USPS Stamps

This week's Scam of the Week is about a popular topic on Facebook regarding USPS stamps that are on sale at huge discounts. Well, here's your first clue that something's wrong - a sale at the post office. But these posts make it sound so appealing and the Facebook comments sure make it sound legit. Well, they are either counterfeit or stolen. Counterfeit stamps are often sold in bulk quantities at a significant discount–anywhere from 20 to 50 percent of their face value. That’s a tell-tale sign they’re bogus. If you get caught using the bad stamps, you could be charged with a felony. But there's something worse - you've now given this shady group your credit card information (hopefully not your debit card) and goodness knows what they will do with it. As it turns out, a great many of these "for sale stamps" groups are based in China and is a front for hacking and account take over. So stay clear of these offers, if it's too good to be true, it likely is.

Watch a video on counterfeit stamps from USPS:  https://www.youtube.com/watch?v=MPzNdcJPLL4&t=3s

Watch a video from the postal inspector on how the USPS fights counterfeit postage: https://www.youtube.com/watch?v=Sq1hLWELs4w

To read more on this topic or how to report postage fraud, read this article: https://www.uspis.gov/u-s-postal-inspection-service-warns...

May 6, 2024 - Elder Abuse

This week's Scam of the Week is a few thoughts on elder abuse, something we see more and more of, so we want to share some things to look out for:

Financial Elder Abuse: The statistics are staggering for this type of financial crime. With persons 60 and older being the fastest growing segment of the population, one if four seniors will fall victim, with an estimated loss of over $40 billion each year.

Why are seniors at a higher risk? Several reasons make them a prime target for financial abuse. Older adults have bigger retirement accounts and are less aware of financial fraud dangers and scams. Those two, compounded with in-home caretakers or even family members that can easily steal and onset of dementia or Alzheimer’s increases the risk of poor financial decisions. Scammers are looking for someone that can be manipulated; which also makes loneliness a prime opportunity for them to gain trust and friendship from their victim.

Elder abuse is not limited to a certain social status, ethnic group or even health conditions; studies do show that women are at a higher risk.

Possible Warning Signs of Financial Abuse:

• – Unpaid bills when they should have means to pay
• – Out-of-character spending behavior
• – New “best friends” who do not have the persons best interests at heart
• – Sudden changes in an elder’s legal documents (will, trust, accounts)
• – Abrupt or unexplained transfers of assets
• – Confusion about recent financial arrangements or changes

General Prevention Tips:

• – Talk about finances with your elder parents. Get assistance from a third-party resource; such as friends, financial professionals or online sources. We are happy to be that source of information for you.
• – When possible, use checks and credit cards instead of cash
• – Teach them to exercise caution when discussing their finances and other personal information over the phone, internet or someone they don’t know
• – Always ask for more information in writing and get a second opinion before changing your power of attorney, wills, trusts or financial information
• – If you suspect fraud or misuse, please contact us immediately