Friday, July 20, 2018

What they're up to - Summer 2018



The latest in fraud and cybercrime.

Military romances
The United States military has been obligated to publish an alert on the rising number of catfish scams where which the scammers claim to be active members of the US military.

The way these work is that once the scammers make sure that they have the victim’s trust,
Image: Obed Hernandez - Unsplash.
they start asking for a very small amounts of money -something to tide them over the weekend, for example, $20 or $30; and they return that money right away in order to establish a sense of trust. Soon thereafter, they start asking to borrow much larger amount of money -we're talking hundreds and sometimes even thousands of dollars.

They always claim the need for money is that because when they’re on active duty, their bank or credit union has frozen their money. Let me clarify: neither the U.S. government nor any financial institutions ever freeze the money of servicemembers on active duty; that would be against the law.

Typical traits that it's a scam may include:

  • The romantic relationship is established extremely quickly; 
  • The cybercriminals have social media profiles that are very new that don't have family activity and they don't seem to have friends in the military (odd, considering their supposed line of work); 
  • They tend to make comments about how unfairly they are treated in the military; 
  • They have several excuses when asking for money: sometimes it's to get back home, for family emergencies, or for a repair back home. 
  • Victims have sometimes been contacted by the “commanding officer” on behalf of these soldiers to make the requests seem more legitimate. 
  • They claim to be moved all around, and very commonly in Africa, where they ask for money to be sent; 
  • They say they have been on active duty for two, three years (the longest active duty is 15 months); 
  • They can never talk to you over the phone and they cannot provide you with an email address where you can send them a letter. 
  • They have very convincing-looking documents that support their claims. 
Just so that you are aware, there’s a way to query people’s pictures online to verify their identity, via the Google image search. You upload a photo or a link, and it tells you who or what it is (as long as there are records of that image online). Google photo search has been able to help detect multiple accounts belonging to scammers who are trying to defraud people over different social media. If you run into a fraudster, the best thing you can do is
warn the social media administrators so that those accounts can be shut down.

To look up a picture on Google go to Images. On the search bar you will see a small icon on
Image: Kristina Flour - Unsplash.
the right side, which looks like a camera. Click on it, and you’ll get a menu where you can either enter a link or upload a picture to look up. 


Secret shopper scams
The victim receives by mail a check with a letter with an employment offer to work as a secret shopper in one or several companies. The person is supposed to deposit the check into his/her account and then go as a secret shopper (under the pretense checking on the quality of service) to a money transfer company such as Western Union; there, they’re supposed to send some money to somebody using part of the funds that they received by check. The catch? The check is a fake, and a few days later it will be returned. In the meantime the person has already sent the money.

Vacation property rental scams

During the holiday season it's very easy to go online and look for a place to rent. Scammers abound on the online rental sites, so be aware. Here are a few pieces of advice to help you protect yourself:

  • Never rush into a decision to book a property. Cybercriminals count on hurrying you, in order to get you to commit and pay; 
  • Never pay for a vacation property using a wire transfer or a gift card, as these two types of payments are almost impossible to get back if something goes wrong; 
  • When a property has a price that is much lower than market, too good to be true, that’s just it: not true; 
  • Always, always read the contract thoroughly before committing and making a
    Image: Parker Amstutz.
    payment. 
About making payments with gift cards
If somebody asks you to pay for something being online or over the phone using a gift card from any store or any company, please don't. Gift cards are for what their very name indicates: to make gifts. If you’ve lost money because you made a payment with a gift card, contact the company that owns the card and make a claim. They have detailed information about the person or persons who received the funds and in some cases they might be able to get your money back. Furthermore, it's good to let them know so that they’re aware of the names of the scammers. 

Scams related to the European Union General Data Protection Regulation
These past couple of months it's likely that you received emails from the companies you use online, asking you to agree to their privacy policies. The reason for this is that there’s a new privacy protection law in the European Union. Even though this law only affects the rights of people in the EU, businesses worldwide seem to have decided that it’s good time to update and resend their policies again to everyone, anyway. Taking advantage of this, there are smart cybercriminals sending phishing scam emails in the guise of privacy policies from trusted companies.

Whenever you receive an emailed update to a privacy policy, it pays to make sure that it's a legitimate email from the company before you click on any links.

How to make sure a link is legitimate without clicking it
Mouse over the link without clicking it and you will see, floating above, the actual link you will be opening if you click:
  • Watch for discrepancies, such as seeing a link named www.trustycompany.com but, once you hover says www.anythingelse.com and you will know it’s a fake.
    Image: Chris Ried - Unsplash.
  • Your link contains ending codes with words or country codes that don’t correspond to the country or type of business contacting you. For example, a message from OAS FCU would not link the address www.oasfcu.eu. 
  • Examine the address content very carefully. It isn’t the same to go to http://www.1acaixa.com than https://www.lacaixa.com. In the first address, the first letter in La Caixa is a 1, not an L. 
  • Does your address have “https://” at the beginning? It used to be that this made an address safe, because that s at the end meant it was secure. Not anymore; now you can have a scam link that comes with its own secure connection that installs malware to your computer, just the same! 
  • If you’re looking at a condensed link that starts with something like or bit.ly, buf.ly and you don’t know what’s behind it: the first logical assumption is that companies like Spotify or iTunes wouldn’t be sending you condensed links. But if you want to double-check, there’s a website to see what hides behind a condensed link without ever clicking it. It’s Get Link Info, a free service. You can copy and paste any condensed link and it will tell you. 
If after this, you still aren’t sure, look up that company’s name online and compare the two addresses.

No comments :