Congress Breached via P2P Filesharing…AGAIN!

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Congress is still considering the Informed P2P User Act, a law that would supposedly make it safer to use peer-to-peer file sharing software, an effort that is similar to banning mosquitoes from sucking blood. It just isn’t happening. The only foolproof way to prevent accidental data leaks via file sharing programs is for IT administrators to lock down networks and prevent the installation of rogue software.

Congress suffered another embarrassing P2P breach last week, after a confidential memo regarding an ethics investigation into the conduct of thirty House members was leaked, thanks to file sharing software installed by a junior staff member. This follows similar leaks that occurred earlier this year, which revealed sensitive details regarding the security of the First Family. House leaders have ordered an “immediate and comprehensive assessment” of congressional cybersecurity policies. Rep. Zoe Lofgren, chairman of the ethics committee, pointed out that “individual error and sloppiness is always the Trojan horse of cybersecurity.”

Peer-to-peer file sharing allows users to access each other’s computers in order to share music, movies, software, and other files. Unfortunately, many people don’t set up their P2P programs correctly, and they unintentionally end up sharing their most important and sensitive files, including bank records, tax files, health records, and passwords. (This is the same P2P software that allows users to download pirated music, movies and software.) This can result in data breaches, credit card fraud and identity theft. I’ve seen numerous reports of government agencies, drug companies, mortgage brokers, and others discovering P2P software on their networks after sensitive data was leaked.

Savvy users lock down their file sharing software to prevent others from tooling around with their settings. If your IT abilities are scant, you should take the following precautions:

  • Don’t install P2P software on your computer.
  • If you aren’t sure whether a family member or employee has installed P2P software, check to see whether anything unfamiliar has been installed. A look at your “All Programs Menu” will show nearly every program on your computer. If you find an unfamiliar program, do an online search to see what it is.
  • Set administrative privileges to prevent the installation of new software without your knowledge.
  • If you must use P2P software, be sure that you don’t share your entire hard drive. When you install and configure the software, don’t let the P2P program select data for you.
  • Make sure your PC has recently updated Internet security software. P2P networks are riddled with viruses.
  • Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name.

Robert Siciliano, identity theft speaker, discusses P2P hacks on Fox Boston.

10 Ways to Prevent Social Media Scams

/in , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

For the past year, I’ve been screaming about the trouble with social media as it relates to identity theft, brand hijacking, privacy issues, and the opportunity social media creates for criminals to “friend” their potential victims in order to create a false sense of trust and use that against their victims in phishing or other scams. I predicted long ago that the problem will get a lot worse before it gets better and there’s no question about it, criminal hackers have taken hold and are in full force.

We hear about a new Twitter phishing scam almost daily, whether it’s via direct messaging or a shortened URL. My spam folder is filled with emails from Facebook phishers, requesting new login credentials, or a “friend” who’s sending me a video that’s actually a virus.

Not too long ago, it was big news when someone had their Facebook account jacked by someone who impersonated the victim, claiming to have lost their wallet in the UK and begging for a money wire. Lately, I see another story about another victim every week.

Last time I checked, Facebook had more than 400 million users and Twitter has more than 50 million. These numbers jump exponentially every month, and old and new users are still being victimized.

James Carnall, manager of the cyberintelligence division at security monitoring firm Cyveillance, says, “Social media cybersquatting is where domain name cybersquatting was ten years ago”.

Scammers aren’t just stealing identities and spreading malware. They are brand jacking in ways that are hurting companies’ bottom lines. While many may not have sympathy for the bottoms lines of billion dollar corporations, this hurts the little guy, too. Knock off software, hardware, merchandise, and movies ultimately cost legitimate taxpayers jobs and hurt the economy when the money is heading to criminal hackers elsewhere in the world. Liz Miller, vice president of the Chief Marketing Officer Council, says, “Counterfeiting operations are highly organized, are very global and are picking up steam because of the economy.”

MarkMonitor, a company that tracks online threats for its clients, determined that phishing attacks on social networking sites increased by 164% over the past year. And in a CMO Council survey of 4,500 senior marketing executives, nearly 20% of the respondents said they had been affected by online scams and phishing schemes that had hijacked brand names. These statistics undeniably point to organized crime syndicates.

Protect yourself from social media identity theft.

  1. Register your full name and those of your spouse and kids on the most trafficked social media sites, blogs, domains or web based email accounts. If your name is already gone, include your middle initial, a period or a hyphen. It’s up to you to decide whether or not to plug in your picture and basic bio, but consider leaving out your age or birthday. You can do this manually or by using a very cost effective service called Knowem.com.
  2. Register all your officers, company names and branded products on every social media site you can find to prevent Twitter squatting and cybersquatting.
  3. Get free alerts. Set up Google alerts for your name and get an email every time your name pops up online. Set up a free StepRep account for your name. StepRep is an online reputation manager that does a better job than Google does of fetching your name on the web.
  4. Implement policies. Social media is a great platform for connecting with existing and potential clients. However, without some type of policy in place that regulates employee access and guidelines for appropriate behavior, social media may eventually be completely banned from every corporate network. Teach effective use by provide training on proper use and especially what not do to.
  5. Encourage URL decoding. Before clicking on shortened URLs, find out where they lead by pasting them into a URL lengthening service like TinyURL Decoder or Untiny.
  6. Limit social networks. In my own research, I’ve found 300-400 operable social networks serving numerous uses from music to movies, from friending to fornicating. Some are more or less appropriate and others even less secure. Knowem has a mind blowing list of 4600 as of this writing.
  7. Train IT personnel. Effective policies begin from the top down. Those responsible for managing technology need to be fully up to speed.
  8. Maintain updated security. Whether hardware or software, anti-virus or critical security patches, make sure you are up to date.
  9. Lock down settings. Most social networks have privacy settings that need to be administered to the highest level. Default settings generally leave the networks wide open for attack.
  10. Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk. “Disclosures”

Robert Siciliano Identity Theft Speaker with ID Analytics discussing Social Media Identity Theft on Fox Boston

Identity Theft Myths Part 3of3 During PYIW

/in , , , , , , /by

Identity Theft Expert Robert Siciliano

The National Foundation for Credit Counselors, which sponsors Protect Your Identity Week, has compiled a number of identity theft myths. To support their efforts, the Santa Fe Group Vendor Council Awareness and Education Subcommittee has helped to clarify some common misinformation with regards to this increasingly common crime. This is the third and final post on the subject.

Myth #8: I don’t use the Internet, so my personal information is not exposed online.

Your personal information appears in more places than you might realize, whether it’s your medical records, a job application, or a school emergency contact form. Many of these records are kept in electronic databases and transmitted online. Social networking sites are another good source of personal information for identity thieves. Even if you do not use them yourself, your friends or members of your family may be sharing personal information about you. Not using the Internet may offer some protection, but it won’t keep you safe from online criminals.

The identity theft resource center has compiled a list of high profile data breaches.
Get Safe Online offers tips on safe social networking.

Myth #9: Social networking is safe.

Social networking sites like Facebook, MySpace, and Twitter can be fun to use. But they can be dangerous when it comes to your identity. These sites are used by thieves and others to steal information, trick people and promote a variety of scams. To protect yourself, avoid making personal information available to large groups of “friends,” take advantage of the privacy controls offered by most of these sites, and use common sense.

I blogged about social networking websites for the Huffington Post.

Myth #10: It is not safe to shop or bank online.

Like social networking, shopping and banking online are safe as long as you use common sense and make good choices about where and how you do it. Most importantly, always take care to confirm a site is legitimate before you use it, watch out for copycat sites, and keep your computer safe from viruses.

Get Safe Online offers tips on safe online shopping.
The FDIC offers tips on safe Internet banking.

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk.

Robert Siciliano “Disclosures” Identity Theft Speaker discussing hacked email on Fox News

Identity Theft Myths Part 2of3 During PYIW

/in , , , , , , , /by

Identity Theft Expert Robert Siciliano

The National Foundation for Credit Counselors, which sponsors Protect Your Identity Week, has compiled a number of identity theft myths. To support their efforts, the Santa Fe Group Vendor Council Awareness and Education Subcommittee has helped to clarify some common misinformation with regards to this increasingly common crime. We’ve already discussed a few of these myths, and will continue to do so throughout this week.

Myth #5: Checking your credit report periodically or using a credit monitoring service is all you need to do to protect yourself from identity theft.

There are many useful and effective credit monitoring services available. However, no monitoring service is 100% effective, and many do little to protect your identity. If you want to be vigilant about identity theft, you should check your credit report periodically, but you should also keep accurate financial records, review your bank and credit card statements frequently for unauthorized charges, and follow the FTC’s tips for minimizing your risk.

You can obtain one free credit report per year from each of the three credit bureaus from AnnualCreditReport.com. Many consumer groups suggest that you stagger your free reports throughout the year, rather than ordering all three at once.

The FTC offers facts for consumers regarding identity theft protection services, which take additional steps beyond the level of protection offered by credit monitoring services.

The FDIC offers tips for safe Internet banking.

Myth #6: My personal contact information (mailing address, telephone number, email address, etc.) is not valuable to an identity thief.

Any information that could be used by a thief to impersonate you should be protected. For example, many people use their email address as a user ID for online accounts. Consider making your information available on a need-to-know basis only. Often, businesses ask for personal information they really don’t need, and will simply omit information you’re not willing to give.

The U.S. Department of Justice answers the question, “What should I do to avoid becoming a victim of identity theft?”

Myth #7: Shredding my mail and other personal documents will keep me safe.

Shredding documents that contain personal information before you throw them away is a great way to protect yourself from “dumpster diving,” which occurs when thieves search the trash for personal information. But relying on your shredder alone to protect you is like locking one window while leaving the rest of your house wide open. Think defensively: secure your personal information in your home, your car, and at work, and always use safe online security practices.

Get Safe Online offers tips on safe social networking.

The FTC answers the question, “How do thieves steal an identity?”

Robert Siciliano, identity theft speaker, discusses data theft on Fox News.

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk.

Robert Siciliano “Disclosures” Identity Theft Speaker discussing data theft on Fox News

Identity Theft Myths Part 1of3 During PYIW

/in , , , , , , , /by

Identity Theft Expert Robert Siciliano

The National Foundation for Credit Counselors, which sponsors Protect Your Identity Week, has compiled a number of identity theft myths. To support their efforts, the Santa Fe Group Vendor Council Awareness and Education Subcommittee has helped to clarify some common misinformation with regards to this increasingly common crime.

Myth #1: There’s no way to protect yourself from identity theft.

Identity theft is preventable. As with any other crime, the risk will always be there. But there are many things people can do to minimize that risk, both online and offline. Preventative measures include keeping financial records protected and private, shredding junk mail, and tracking who sees your personal information. An identity theft protection service uses a variety of techniques to prevent, detect, and, if necessary, resolve identity theft.

http://www.ftc.gov/bcp/edu/microsites/idtheft/consumers/deter.html
http://www.onguardonline.gov/topics/computer-security.aspx

Myth #2: Identity theft is only a financial crime.

While financial identity theft (theft of information for financial gain) is most prevalent, other types of identity theft can be equally dangerous, potentially costly, and time consuming to resolve. For example, with medical identity theft, personal medical records are used to access medical treatment or drugs, or to make false insurance claims. With criminal identity theft, a person uses faulty or stolen identification to avoid prosecution by law enforcement.

Medical identity theft: http://www.worldprivacyforum.org/pdf/wpf_medicalidtheft2006.pdf
Criminal identity theft: http://www.privacyrights.org/fs/fs17g-CrimIdTheft.htm
Employment fraud: http://www.idtheftcenter.org/artman2/publish/v_art_solutions/Solution_27_-_Someone_Working_as_You.shtml

Myth #3: It’s my bank’s fault if I became a victim of identity theft.

Some identity crime does originate with the theft of bank records or is perpetuated by lax security practices. However, the majority of identity theft begins elsewhere. Personal information may be stolen with low tech tools such as a lost or stolen wallet, checkbook, or a debit or credit card, or more high tech methods, such as skimming, phishing, and hacking.

http://www.onguardonline.gov/topics/computer-security.aspx
http://www.ftc.gov/bcp/edu/microsites/idtheft/consumers/about-identitytheft.html#whatdothievesdowithastolenidentity

Myth #4: It is safe to give your personal information over the phone if your caller ID confirms that it is your bank.

It is never safe to give personal information to unsolicited callers, no matter who they say they are. Caller IDs are easily spoofed. If you believe the caller is legitimate, hang up and call the bank back at its listed phone number.

http://www.ncpc.org/programs/catalyst-newsletter/catalyst-newsletter-
2009/volume-30-number-1/vishing-a-new-twist-on-identity-theft-threatensconsumers
http://www.onguardonline.gov/topics/computer-security.aspx

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk.

Robert Siciliano “Disclosures” Identity Theft Speaker discussing Social Media Identity Theft on Fox Boston

12 Awful Reasons Why Impostors Commit Social Media Identity Theft

/in , , , , , , , , /by

Imagine if someone used your name and image, or the name and logo of a business you own, to create a profile on Facebook, Twitter, or any other social networking website. Then they start posting blogs and sending out links while pretending to be you. They may contact your acquaintances, colleagues, or clients, or they may simply show up when others search for your name. Either way, their intentions are fraudulent. Establishing an online presence using someone else’s identity creates unlimited opportunities for a scammer.

Traditional phishing, in which scammers send a fake email that appears to come from a trusted entity, is no longer as successful as it used to be. So identity thieves are taking advantage of social networking sites to build a home base. Once established, they seem as legitimate as any other user. There are few, if any, checks and balances to prevent this.

Social media identity theft occurs for a number of reasons:

  1. An impersonator may be attempting to steal your clients or potential clients.
  2. He or she could be squatting on your name or brand, hoping to profit by selling it back to you or preventing you from using it.
  3. They could be criminal hackers posting infected links that, if clicked on, will infect the victim’s PC or network with a virus that gives hackers backdoor access.
  4. An impersonator may intentionally pose as you, and even blog as you, in order to damage your name or brand. Anything they say to the world that is libelous, defamatory, or just plain wrong hurts your reputation and can even make you the target of a lawsuit.
  5. He or she may be using your identity to harass someone you nkow.
  6. The impersonator may wish to harass you, perhaps as revenge over a percieved slight or because you sold them a defective product or service.
  7. They may wish to use a name or brand that has leverage, such as a celebrity or Fortune 500 company, as a form of social engineering, to obtain priveledged access.
  8. If you or your business sell products or services, identity thieves might pose as you and offer deals with links to spoofed websites, in order to extract credit cards numbers.
  9. They may pose as a government entity for the purpose of extracting data and committing new account fraud.
  10. An impostor may be obsessed with you or your brand, and simply want to be associated with you. Posing as you could yield attention and satisfaction.
  11. They could be parodying you or your brand, by creating a tongue in cheek website that might be funny and obvious, but will most likely not be funny to you.
  12. They could be posing as you to elicit contact from others for the purposes of a relationship, sexual or otherwise, either in person or virtually. A young man was recently caught posing as an attractive girl in his school. He contacted guys in his class through a fake Facebook account and requested naked photos of them. When he revealed who he was, he used the incriminating photos to extort sex from them.

Social media is just a baby. All of the above stems from real world examples over the past few years. Unfortunately, this list is going to keep growing. Varieties of fraud that can occur via social media are only up to the imagination of the thief. Submit your own findings. Let’s hear what other whacked out social media identity thieves are doing.

To prevent social media identity theft, register all your officers, company names and branded products on every social media site you can find to prevent Twitter squatting and cybersquatting. You can do this manually or by using a very cost effective service called Knowem.com.

Robert Siciliano is an Online Security Expert to McAfee. See him discussing identity theft on YouTube. (Disclosures)

Identity Theft Is Really No Big Deal. Idiot.

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

I make a portion of my living talking about identity theft. Admittedly, I profit from the crime. I don’t steal identities of course, but I get paid because others steal. I’m not FBI, CIA, Secret Service or a cop. But you wouldn’t disparage any of those entities for doing their jobs to protect you from bad guys.

I talk about this issue all day, every day to whoever will listen. I’m obsessed with this and all issues regarding personal security. It’s what I do, and it seems to be “my purpose.” I may sometimes go a bit overboard in my take on these issues and what people need to do to protect themselves, but sometimes that’s what it takes for people who think it can’t happen to them get off their duff and be proactive.

All that said, it bothers the heck out of me when someone looks me straight in the eye and tells me that identity theft is no big deal, that I should get over it. That’s exactly what Julia Angwin does in this Wall Street Journal article. And she uses a prominent industry professional as the anchor of her article, to confirm her beliefs and trivialize this heinous crime.

The fact is, crime happens all day, every day. Some crimes are more or less common. Some are more or less invasive. All crimes have victims and all victims suffer the consequences of others actions. To trivialize those victims and make little of their burden is a completely incomprehensible act.

I responded to this article with the following comment:

“The author hides under the guise of The Decoder and will not give her name in this article. In another article she is Julia Angwin at julia.angwin@wsj.com. Why not sign your name here?? [Angwin’s name now appears under the article.]

A person is more likely to be a victim of some form of identity theft than to be injured in a motor vehicle accident. But I’ll bet she wears a seat belt and doesn’t trivialize that. A person is more likely to be a victim of identity theft than have their home broken into or car stolen. But I’ll bet she locks up. A person is more likely to be victim of identity theft than be sexually assaulted. But she dare not trivialize that. A person is more likely to be a victim of identity theft than have their child abducted. But I’ll bet she watches her kids close at the park. Sister, just because you don’t understand something doesn’t give you the right to make little of it. Identity theft victims suffer the consequences of fraud every day. Some much more than others. For the victims, identity theft is a living hell. I wouldn’t wish any of the above on anyone and hope identity theft never happens to you. If it does you will sing a different tune and be appropriately empathetic to the victims of this heinous crime.

And Bruce, really, the contrarian thing is very obvious. To say you’re not worried and don’t do anything is a slap in the face to everyone who has been victimized and everyone who cares to prevent it. Your credibility just slipped a notch in this fan’s opinion.”

And because I care and because I’m being paid and because I believe in the following, I’m going to make a couple suggestions to you as to how you should protect yourself. But really, identity theft is no big deal.

1. Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

2. Invest in Intelius Identity Theft Prevention and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano Identity Theft Speaker discussing identity theft on the rise on Fox News.

How to Prevent Phishing Scams

/in , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Recent reports abound of consumers email account being phished and American and Egyptian authorities arresting  dozens of people in an online fraud crackdown for phishing scams.  Its time to revisit the fundamentals of how to prevent phishing. Nobody can do this better than the Anti Phishing Work Group

Phishing Defined

Phishing is a criminal mechanism employing both social engineering and technical subterfuge to steal consumers’ personal identity data and financial account credentials. Social‐engineering schemes use spoofed e‐mails purporting to be from legitimate businesses and agencies to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as usernames and passwords. Technical‐subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using systems to intercept consumers online account user names and passwords ‐ and to corrupt local navigational infrastructures to misdirect consumers to counterfeit websites (or authentic websites through phisher‐controlled proxies used to monitor and intercept consumers’ keystrokes).

How to Avoid Phishing Scams

The number and sophistication of phishing scams sent out to consumers is continuing to increase dramatically. While online banking and e-commerce is very safe, as a general rule you should be careful about giving out your personal financial information over the Internet. The Anti-Phishing Working Group has compiled a list of recommendations below that you can use to avoid becoming a victim of these scams.

  • Be suspicious of any email with urgent requests for personal financial information
    • unless the email is digitally signed, you can’t be sure it wasn’t forged or ‘spoofed’
    • phishers typically include upsetting or exciting (but false) statements in their emails to get people to react immediately
    • they typically ask for information such as usernames, passwords, credit card numbers, social security numbers, date of birth, etc.
    • phisher emails are typically NOT personalized, but they can be. Valid messages from your bank or e-commerce company generally are personalized, but always call to check if you are unsure
  • Don’t use the links in an email, instant message, or chat to get to any web page if you suspect the message might not be authentic or you don’t know the sender or user’s handle
    • instead, call the company on the telephone, or log onto the website directly by typing in the Web adress in your browser
  • Avoid filling out forms in email messages that ask for personal financial information
    • you should only communicate information such as credit card numbers or account information via a secure website or the telephone
  • Always ensure that you’re using a secure website when submitting credit card or other sensitive information via your Web browser
    • Phishers are now able to ‘spoof,’ or forge BOTH the “https://” that you normally see when you’re on a secure Web server AND a legitimate-looking address. You may even see both in the link of a scam email. Again, make it a habit to enter the address of any banking, shopping, auction, or financial transaction website yourself and not depend on displayed links.
    • Phishers may also forge the yellow lock you would normally see near the bottom of your screen on a secure site. The lock has usually been considered as another indicator that you are on a ‘safe’ site. The lock, when double-clicked, displays the security certificate for the site. If you get any warnings displayed that the address of the site you have displayed does NOT match the certificate, do not continue.
  • Remember not all scam sites will try to show the “https://” and/or the security lock. Get in the habit of looking at the address line, too. Were you directed to PayPal? Does the address line display something different like “http://www.gotyouscammed.com/paypal/login.htm?” Be aware of where you are going.
  • Consider installing a Web browser tool bar to help protect you from known fraudulent websites. These toolbars match where you are going with lists of known phisher Web sites and will alert you.
    • The newer version of Internet Explorer version 7 includes this tool bar as does FireFox version 2
    • EarthLink ScamBlocker is part of a browser toolbar that is free to all Internet users – download at http://www.earthlink.net/earthlinktoolbar
  • Regularly log into your online accounts
    • don’t leave it for as long as a month before you check each account
  • Regularly check your bank, credit and debit card satements to ensure that all transactions are legitimate
    • if anything is suspicious or you don’t recognize the transaction, contact your bank and all card issuers
  • Ensure that your browser is up to date and security patches applied
  • Always report “phishing” or “spoofed” e-mails to the following groups:
    • forward the email to reportphishing@antiphishing.org
    • forward the email to the Federal Trade Commission at spam@uce.gov
    • forward the email to the “abuse” email address at the company that is being spoofed (e.g. “spoof@ebay.com”)
    • when forwarding spoofed messages, always include the entire original email with its original header information intact
    • notify The Internet Crime Complaint Center of the FBI by filing a complaint on their website: www.ic3.gov/

In addition you must:1. Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

2. Invest in Intelius Identity Theft Prevention and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano Identity Theft Speaker discussing identity theft on the rise on Fox News

Operation Phish Phry Nabs 100 Identity Thieves

/in , , , , , , , /by

Identity Theft Expert Robert Siciliano

US and Egyptian officials have charged 100 people with orchestrating a phishing scam that robbed a$1.5m from Bank of America and Wells Fargo customers.

53 criminals from CA, NV and NC were named in an indictment. This is the largest ever charged in a cybercrime case. Officials in Egypt nabbed another 47 people.

Egyptian criminals phished account numbers and accessed bank accounts. The Egyptians and the US phishers transferred money into mules accounts.

This is an example of the sophistication of criminal identity theft rings and organized global web mobs fully ramped up and knocking off victims by the thousands.

“The sophistication with which Phish Phry defendants operated represents an evolving and troubling paradigm in the way identity theft is now committed,” said the FBI in Los Angeles.

The New York Times recently reported the bust of a vast conspiracy known as the Western Express Cybercrime Group, which trafficked in stolen credit card information through the Internet and used it to create forged credit cards and to sell goods on eBay. They used digital currencies like e-gold and Webmoney to launder their proceeds.

It’s great seeing criminals getting busted. And the fact remains there are lots more cybercriminals than there are law enforcement. But keep up the good work guys/gals!!

  1. Check your credit card statements often. Refute unauthorized charged within 60 days to be made whole by the issuing bank.
  2. Anytime you ever receive an email asking for personal information, credit information, banking etc, do not enter it. Just hit delete. Often victims will receive and email from what looks like a trusted source but is actually a phish.
  3. Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name. This makes your Social Security number useless to a potential identity thief.
  4. Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk.

Robert Siciliano identity theft speaker discussing money mules on Fox News

Up to 1 Million email Accounts Phished for Identity Theft

/in , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Hotmail, Earthlink, Google, Yahoo, Comcast and other web-based email users have been giving up al their login details to phishers and current estimates are as many as 1 million accounts may have been compromised.

News of the scam broke when technology blog neowin.net reported an anonymous user had published confidential details on pastebin.com. Internet users are urged to change their passwords regularly and ensure anti-virus software is up to date to protect themselves from fraudsters.

While phishing emails keep pouring in, their methods are changing rapidly. Posing as a Nigerian prince is still common, but not as effective. Even posing as a known bank or Paypal, asking to update an account for various reasons and requesting a potential victim’s user name and password is not as effective as it used to be.

Much of the phishing that occurs today is targeted “spear phishing,” in which the spammers are after a localized target. Going after a CEO is called “whaling.” Who better to take down than the biggest phish of them all? Most corporate websites offer plenty of data on the company officers and administrative contacts, which makes it relatively easy to create a sucker list. If scammers send an email blast to the entire company, eventually someone is likely to cough up enough data to allow the scammers to tap into the company’s intranet. Once the scammers have accessed the intranet, all further phishing emails will appear to be coming from a trusted, internal source.

Perhaps the most insidious type of phishing occurs when a recipient clicks a link, either in the body of an email or on the spoofed website linked in the email, and a download begins. That download is almost always a virus with a remote control component , which gives the phisher full access to the user’s data, including usernames and passwords, credit cards details, banking and Social Security numbers. Often, that same virus makes the victim’s PC part of a botnet.

How to avoid becoming a victim? Delete.

Change passwords often. Combine uppercase and lowercase letters, as well as numbers and characters. Don’t use consecutive letters or numbers, and never use names of pets, family members, or close friends. Instead use the first letters of phrases

Never click links in the body of an email that are coming from a bank, Paypal or any enterprise that may be leading to a request to enter data. Go to your favorites menu or manually type the address in.

Pay attention to phishing filters. Most updated browsers have built-in phish filters that toss up a red flag warning of a potential ruse.

1. Protecting yourself from new account fraud requires effort. You can attempt to protect your own identity, by getting yourself a credit freeze, or setting up your own fraud alerts. There are pros and cons to each.

2. Invest in Intelius Identity Protection and Prevention. Because when all else fails you’ll have someone watching your back.

Robert Siciliano, identity theft speaker, discusses hacked email on FOX & Friends.