10 Tips to Secure Online Holiday Shopping

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

UK officials shut down an amazing 1200 online retailers who scammed millions from unsuspecting shoppers. Most of the sites originated from identity thieves in Asia who tricked victims into believing they were legitimate sites.  Victims then lost money by entered their credit card data, sending checks or giving up banking details.

The sites sold high end designer items from Tiffany & Co, Ugg and jewelry. In some cases the victims actually received the items, but were counterfeit. Like Mom said, if it’s too good to be true it probably is. Of course nobody running the fake sites has been caught.

Criminals set up fake websites and then go through the same process legitimate eTailers do in regards to search engine optimization, search engine marketing and online advertising via adwords. They use key words to boost their rankings on Internet searches to show up along side legitimate sites. These same processes are also being used to infect unsuspecting users with malware.

Many victims who end up on scam sites generally get there via phish emails with offers for high end products for little money.

  1. It’s easy enough to avoid spoofed websites where phishing is the gateway. Common sense says any time you receive an offer via an email automatically be suspect. The same goes with offers via tweets and messages received in any social media. Scammers are committing social media identity theft every day.
  2. If you aren’t familiar with the eTailer don’t even bother clicking the links, especially if it’s a too good to be true offer.
  3. If it’s a known site sending the email and you decide to click links, make sure the address you end up at is in fact the actual domain of the eTailer. Beware of cybersquatting and typosquatting which may look like the domain of the legitimate eTailer.
  4. When placing an order always look for HttpS is the address bar signifying it’s a secure page. Scammer generally won’t take the time to set up secure sites. Note the closed padlock in your browser to back up the HttpS.
  5. Beware of emails coming for eBay scammers. I’m getting 10 a day. The fact is it’s difficult to tell a real from a fake. If you are seeking deals on eBay go right to the site and don’t bother responding to emails. If there is a deal you see in an email search it on eBay.
  6. Whenever you decide to make an eBay purchase look at the eBayers history. eBay is set up on the honor system and if the eBayer is an established seller with great feedback then they should be legitimate.
  7. Don’t worry about credit card fraud. But do pay close attention to your statements. Check them every two weeks online and refute unauthorized charges within 2 billing cycles, otherwise you will pay for an identity thieves gifts.
  8. Don’t use a debit-card online. If your debit card is compromised thats money out of your bank account. Credit cards have more protection and less liability.
  9. Avoid paying by check online/Mailorder. In person is OK. But to an unfamiliar virtual site is not. Once the money is taken from your account and you don’t receive the goods, you are going to have a difficult if not impossible task of getting it back. Use a uniball gel pen that prevents check-washing.
  10. Do business with those you know like and trust. I for one am guilty of buying from eTailers who have the best deals. But I only buy low ticket items from them, generally under $50.00. It’s best to buy high ticket items from eTailers that also have a brick and mortar locations.

Robert Siciliano identity theft speaker discussing holiday scams on Foxes Mike and Juliet Show

Holiday Temps Make The Best Identity Thieves

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

This is the absolute best time of the year to be a dishonest temporary worker. Holiday hustle and bustle overwhelms managers and supervisors and they can’t possibly see everything their employees are doing. It has been said that only 10% of employees are honest, 10% of employees will always steal and 80% will steal based on circumstances. Hiring temps during the holidays becomes the perfect storm for employee theft.

Estimates reveal that 40-50% of all business losses are due to employee theft. Employers need to first vet potential hires so as not to invite a thief into the workplace.

Prescreening

  • Either use a prescreening service or become a master interviewer. Watch for incongruities.
  • Resumes are often “false advertising,” sometimes including outright lies. Look for red-flags and exaggerations.
  • Appearance is telling. To be disheveled and unkempt at an interview is a reflection of one’s character.
  • Interviewees who are well-spoken and ace the interview process may have had lots and lots of jobs.
  • Use employment applications, and check and verify everything.
  • Background checks are only one small, but necessary, element of the screening process.
  • Criminal records checks are insufficient and do not detect employee theft unless prosecuted and convicted.
  • Juvenile convictions do not show on a criminal records check.
  • Drug and alcohol testing.
  • Reference checks.
  • Credit reports.
  • Physical exams.

Hire honest people.

Honest people live by the golden rule, “Do as to others as you would have them do unto you.” Honest people see stealing as demeaning. Honest people believe in karma. Honest people think of the consequences of their actions over a lifetime, not just in the moment. Hire honest people.

Perception is reality.

Assume that after an apparently honest person has been hired, there is still potential for stealing to begin. Orientation is the first place to discourage this behavior. Policies must be openly discussed. Employees are shown aspects of loss prevention and physical security in place. They are further told incidences of theft will be prosecuted under the fullest extent of the law. They are reminded that previous employees were caught and the expenses in fines and to lawyers in a criminal defense cost far more than the goods or cash that were stolen. In Singapore, Iran, Saudi Arabia, they put an average of 500 people a year to death for various nonviolent crimes. That’s perception equaling reality.

Understand the theft probability equation.

Chance of getting caught + consequences of action taken = Level of risk & probability of theft.

  • Low risk: high probability of theft
  • High risk: low probability of theft
  • A reputation for non-action breeds theft. If you fire thieves without prosecution, you will hire thieves in the future.

Increase technology to reduce threats.

ComputerWorld suggests bolstering physical security around temporary cash registers and handheld scanners. It’s easy to install a card-skimming device on a satellite register. Install additional video cameras to monitor the use of such devices.

Review log data daily. System and transaction logs can reveal a lot of information about the security of a payment system. Check them daily for red flags.

Implement “hard” firewall policies. Use a white list of known good addresses to preclude the possibility of card and payment data going anywhere outside the enterprise firewall except to your payment processor.

For your own good, protect your identity. Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name. This makes your Social Security number useless to a potential identity thief.

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk. “Disclosures”

Robert Siciliano identity theft speaker discussing holiday scams on Foxes Mike and Juliet Show

MIT Says Handing Over Your Identity Data Protects You

/in , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Identity is a simple concept that has become a complex problem. It has become complex due to fraud. Fraud, motivated by money and the ease of obtaining credit and taking over an account. Because identity has yet to be effectively established, anyone can be you.

Currently, identity is generally established when a person provides a single source of data such as a Social Security number, password, credit card number and so forth. Complicating things further, in the U.S. we have as many as 200 forms of ID circulating from state to state, plus another 14,000 birth certificates and 49 versions of the Social Security card. We use “for profit” third party information brokers and the lowly vital statistics agency that works for each state to manage the data.

According to a new proposal in New Scientist, our digital identities will be more secure if they are based on data from our everyday life, culled from cell phones and online transactions. The idea comes from the Massachusetts Institute of Technology’s Human Dynamics Laboratory. The lab is a pioneer of “reality mining,” which is the practice of studying how people behave by using the crumbs of digital data our actions produce.

Reality mining is “what you do and who you do it with.” Or in MIT-over-my-head-speak: “Reality Mining defines the collection of machine-sensed environmental data pertaining to human social behavior. This new paradigm of data mining makes possible the modeling of conversation context, proximity sensing, and temporospatial location throughout large communities of individuals. Mobile phones are used for data collection, opening social network analysis to new methods of empirical (information gained by means of observation) stochastic (random) modeling.”

Even Google can’t define the word “temporospatial.” Find it. I dare you.

The research is based on the use of mobile phones to provide insight into individual and group behavior. They captured communication, proximity, location, and activity information from 100 subjects at MIT over a year. This data represents over 350,000 hours (~40 years) of continuous data on human behavior. Some of the research questions include:

  • How do social networks evolve over time?
  • How predictable are most people’s lives?
  • How does information flow?

The idea is to capture and harness all this information that represents “what you do and who you do it with.” Managing this would consist of the creation of a central body, supported by a combination of cellphone networks, banks and government bodies. The bank, being one of the supporters, could provide “slices” of data to third parties that want to check a person’s identity.

This is different than “who you are and what you know.” Currently, positive ID is only possible by using a biometric. A biometric can be either static (anatomical, physiological) or dynamic (behavioral). Examples static biometrics include your iris, fingerprint, face, and DNA. Dynamic biometrics include your signature gesture, voice, keyboard, and perhaps gait. Also referred to as something you are. Verification is used when the identity of a person cannot be definitely established. Technologies used provide real time assessment of the validity of an asserted identity. We don’t know who the individual is but we try to get as close as we can to verify his or her asserted identity. Included in this class are out of wallet questions, PINS, passwords, tokens, cards, IP addresses, behavioral based trend data, credit cards, etc. These usually fall into the realm of something you have or something you know.

Currently, identity isn’t established. There is no accountability. That’s why we have identity theft. Anyone can become you just by saying so. In the meantime, until the big heads at MIT figure this out, protect your identity.

Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name. This makes your Social Security number useless to a potential identity thief.

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk. “Disclosures”

Robert Siciliano, identity theft speaker, discusses Social Security numbers on Fox News

Handwritten Signature is Stupid Authorization

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Ever forge your husband’s signature? Wife’s? Parent’s? Client’s? Do you think the clerk behind the counter at Walmart is skilled in handwriting analysis? I’ve always viewed a signature as a totally ridiculous form of authentication and a total waste of my time. Signing my name has always been burden and a frustrating task.

Nobody seems to know when a handwritten signature became a form of authorization. From what I can gather, it seems the modern signature was born when kings signed declarations. Eventually, villagers began signing their names to acknowledge accountability. So the signature was born during a time when we had kings and queens, moats, wizards, and dragons. And we continue to rely on this today. Not too smart.

My signature has evolved from a time intensive, physically demanding, well thought out, legible spelling of my first name, middle initial, and last name, to a first initial, middle initial and last name, then to a quick scribe of what might look like an R, and S, and a squiggly line in place of my last name. Today, my signature tends to be a straight line. Who the heck came up with electronic signature pads? Stupid!

Between my driver’s license, credit cards, checks, e-signature pads, and whatever contracts I fill out on a yearly basis, my signature is completely different on each document. Total inconsistency.

I spoke with Robert Baier, a forensic document examiner and handwriting analysis expert, and told him about my inconsistent signatures. Between his facial expression, shaking head and other body language, and his verbal response, I got the message that this is a bad thing. Bob is what I call the “Document Whisperer.” He has savant-like talents and can size a person up by their signature. Which means I probably disturb Bob.

I don’t really care about a signature. I don’t know if it’s because I find handwritten signatures so ridiculous or because I’m lazy with this task. The fact is, a handwritten signature provides zero proactive security. The way I see it, signing your name to any document ultimately assigns liability. If someone signs your name to a check and you call the bank and say it wasn’t you, they look at the signature and determine whether it’s yours or not. From there they assign liability. That’s dumb.

Other than at the teller line, most banks don’t actually view signature cards until there’s a problem. Same with credit card issuers etc. There are a few companies that actually have given validity to the handwritten signature. One such company is Orbograph, an image-based fraud detection company north of Boston that actually looks at previous signatures and recognizes potential document fraud before loss occurs. If we are going to rely on signatures, this type of technology needs to be implemented everywhere.

Many smaller credit card purchases no longer require a hand written signature. Visa recently announced it would mandate a move to chip and PIN technology for all Australian Visa cardholders over the next four years, with signatures no longer accepted at the check-out by 2013. This means all card holders will have a password, as opposed to a signature.

Even though passwords aren’t all that secure to begin with, a signature is even less secure, unless of course we provide the signature some credibility by implementing image-based fraud detection system-wide, or putting guys like Bob in a booth in every business district on the planet to review the legitimacy of the signature. That ain’t happening. Yet we have plenty of coffee shops on every corner. Seems like our priorities are a bit skewed.

Because the system is insecure, you must protect your identity.

Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name. This makes your Social Security number useless to a potential identity thief.

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk. “Disclosures”

Robert Siciliano identity theft expert discussing all kinds of security issues on TBS Movie and a Makeover

The Twelve Scams of Christmas,” or Popular Online Attacks This Holiday Season Pt IV of IV

/in , , , , , , , , /by

Robert Siciliano identity theft expert

Cybercriminals Take Advantage of the Holiday Season, Aiming to Steal Consumers’ Money, Identities and Financial Information

As cybercriminals begin to take advantage of the holiday season, McAfee, Inc. revealed the “Twelve Scams of Christmas” – the twelve most dangerous online scams that computer users should be cautious of this holiday season. According to Consumer Reports’ 2009 State of the Net Survey, cybercriminals have bilked $8 billion from consumers in the past two years, and McAfee warns consumers not to fall victim to the top scams this year.

Being that I’m on McAfee’s Consumer Advisory Board, I’m advising you to adhere to the following:

Previous first 3 of Twelve Scams of Christmas here. McAfee’s 3 more of Twelve Scams of Christmas below.

Scam X: Password Stealing Scams

Password theft is rampant during the holidays, as thieves use low-cost tools to uncover a person’s password and send out malware to record keystrokes, called keylogging. Once criminals have access to one or more passwords, they gain vast access to consumers’ bank and credit card details and clean out accounts within minutes. They also commonly send out spam from a user’s account to their contacts.

Scam XI: E-Mail Banking Scams

Cybercriminals trick consumers into divulging their bank details by sending official-looking e-mails from financial institutions. They ask users to confirm their account information, including a user name and password, with a warning that their account will become invalid if they do not comply. Then they often sell this information through an underground online black market.

McAfee Labs believes cybercriminals are more actively scamming consumers with this tactic during the holidays since people are monitoring their purchases closely.

Scam XII: Your Files for Ransom – Ransomware Scams

Hackers gain control of people’s computers through several of these holiday scams. They then act as virtual kidnappers to hijack computer files and encrypt them, making them unreadable and inaccessible. The scammer holds the user’s files ransom by demanding payment in exchange for getting them back.

McAfee advises Internet users to follow these five tips to protect their computers and personal information:

1. Never Click on Links in E-Mails: Go directly to a company or charity’s Web site by typing in the address or using a search engine. Never click on a link in an e-mail.

2. Use Updated Security Software: Protect your computer from malware, spyware, viruses and other threats with updated security suites. McAfee® Total Protection software provides fully-featured protection from current and emerging threats. It also comes built in with McAfee SiteAdvisor® technology, a safe search toolbar to warn consumers of a Web site’s safety rating as well as phishing protection. It uses intuitive red, yellow and green checkmarks to rate potentially dangerous Web sites when searched on Google, Yahoo! or Bing.

3. Shop and Bank on Secure Networks: Only check bank accounts or shop online on secure networks at home or work, wired or wireless. Wi-Fi networks should always be password-protected so hackers cannot gain access to them and spy on online activity.

Also, remember to only shop on Web sites that begin with https://, instead of http://, and seek out Web sites with security trustmarks, like McAfee SECURE™.

4. Use Different Passwords: Never use the same passwords for several online accounts. Diversify passwords and use a complex combination of letters, numbers and symbols.

5. Use Common Sense: If you are ever in doubt that an offer or product is not legitimate, do not click on it. Cybercriminals are behind many of the seemingly “good” deals on the Web, so exercise caution when searching and buying.

If you think you may be a victim of cybercrime, visit McAfee’s Cybercrime Response Unit to assess your risks and learn what to do next at www.mcafee.com/cru.

Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

Invest in Intelius Identity Theft Protection and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano, identity theft speaker, discusses Cyber Monday on Mike and Juliet

The Twelve Scams of Christmas,” or Popular Online Attacks This Holiday Season Pt III of IV

/in , , , , , , , , /by

Robert Siciliano identity theft expert

Cybercriminals Take Advantage of the Holiday Season, Aiming to Steal Consumers’ Money, Identities and Financial Information

As cybercriminals begin to take advantage of the holiday season, McAfee, Inc. revealed the “Twelve Scams of Christmas” – the twelve most dangerous online scams that computer users should be cautious of this holiday season. According to Consumer Reports’ 2009 State of the Net Survey, cybercriminals have bilked $8 billion from consumers in the past two years, and McAfee warns consumers not to fall victim to the top scams this year.

Being that I’m on McAfee’s Consumer Advisory Board, I’m advising you to adhere to the following:

Previous first 3 of Twelve Scams of Christmas here. McAfee’s 3 more of Twelve Scams of Christmas below.

Scam VII: Christmas Carol Lyrics Can Be Dangerous – Risky Holiday Searches

During the holidays, hackers create fraudulent holiday-related Web sites for people searching for a holiday ringtone or wallpaper, Christmas carol lyrics or a festive screensaver. Downloading holiday-themed files may infect one’s computer with spyware, adware or other malware. McAfee found one Christmas carol download site that led searchers to adware, spyware and other potentially unwanted programs.

Scam VIII: Out of Work – Job-Related E-mail Scams

The U.S. unemployment rate recently spiked to 10.2 per cent, the highest level since 1983. Scammers are preying on desperate job-seekers in the poor economy, with the promise of high-paying jobs and work-from-home moneymaking opportunities. Once interested persons submit their information and pay their “set-up” fee, hackers steal their money instead of following through on the promised employment opportunity.

Scam IX: Outbidding for Crime – Auction Site Fraud

Scammers often lurk on auction sites during the holiday season. Buyers should beware of auction deals that appear too good to be true, because often times these purchases never reach their new owner.

Stay tuned to part IV.

Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

Invest in Intelius Identity Theft Protection and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano, identity theft speaker, discusses Viruses in Christmas Gifts on FOX News

The Twelve Scams of Christmas,” or Popular Online Attacks This Holiday Season Pt I of IV

/in , , , , , , , , /by

Robert Siciliano identity theft expert

Cybercriminals Take Advantage of the Holiday Season, Aiming to Steal Consumers’ Money, Identities and Financial Information

As cybercriminals begin to take advantage of the holiday season, McAfee, Inc. revealed the “Twelve Scams of Christmas” – the twelve most dangerous online scams that computer users should be cautious of this holiday season. According to Consumer Reports’ 2009 State of the Net Survey, cybercriminals have bilked $8 billion from consumers in the past two years, and McAfee warns consumers not to fall victim to the top scams this year.

“Cybercriminals’ use their best schemes during the holidays to steal people’s money, credit card information, social security number and identity,” said Jeff Green, senior vice president of McAfee Labs. “These thieves follow seasonal trends and create holiday-related Web sites, scams and other convincing e-mails that can trick even the most cautious users.”

Being that I’m on McAfee’s Consumer Advisory Board, I’m advising you to adhere to the following:

McAfee’s 3 of Twelve Scams of Christmas

Scam I: Charity Phishing Scams – Be Careful Who You Give To

During the holiday season, hackers take advantage of citizens’ generosity by sending e-mails that appear to be from legitimate charitable organizations. In reality, they are fake Web sites designed to steal donations, credit card information and the identities of donors.

Scam II: Fake Invoices from Delivery Services to Steal Your Money

During the holidays, cybercriminals often send fake invoices and delivery notifications appearing to be from Federal Express, UPS or the U.S. Customs Service. They e-mail consumers asking for credit card details to credit back the account, or require users to open an online invoice or customs form to receive the package. Once completed, the person’s information is stolen or malware is automatically installed on their computer.

Scam III: Social Networking – A Cybercriminal “Wants to be Your Friend”

Cybercriminals take advantage of this social time of the year by sending authentic-looking “New Friend Request” e-mails from social networking sites. Internet users should beware that clicking on links in these e-mails can automatically install malware on computers and steal personal information.

Stay tuned to parts II, III & IV.

Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

Invest in Intelius Identity Theft Protection and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano, identity theft speaker, discusses Christmas Holiday Scams on Mike and Juliet.

The Twelve Scams of Christmas,” or Popular Online Attacks This Holiday Season Pt II of IV

/in , , , , , , , , /by

Robert Siciliano identity theft expert

Cybercriminals Take Advantage of the Holiday Season, Aiming to Steal Consumers’ Money, Identities and Financial Information

As cybercriminals begin to take advantage of the holiday season, McAfee, Inc. revealed the “Twelve Scams of Christmas” – the twelve most dangerous online scams that computer users should be cautious of this holiday season. According to Consumer Reports’ 2009 State of the Net Survey, cybercriminals have bilked $8 billion from consumers in the past two years, and McAfee warns consumers not to fall victim to the top scams this year.

Being that I’m on McAfee’s Consumer Advisory Board, I’m advising you to adhere to the following:

Previous first 3 of Twelve Scams of Christmas here. McAfee’s 3 more of Twelve Scams of Christmas below.

Scam IV: The Dangers of Holiday E-Cards

Cyber thieves cash in on consumers who send holiday e-cards in an effort to be environmentally conscious. Last holiday season, McAfee Labs discovered a worm masked as Hallmark e-cards and McDonald’s and Coca-Cola holiday promotions. Holiday-themed PowerPoint e-mail attachments are also popular among cybercriminals. Be careful what you click on.

Scam V: “Luxury” Holiday Jewelry Comes at a High Price

McAfee Labs recently uncovered a new holiday campaign that leads shoppers to malware-ridden sites offering “discounted” luxury gifts from Cartier, Gucci, and Tag Heuer. Cybercriminals even use fraudulent logos of the Better Business Bureau to trick shoppers into buying products they never receive.

Scam VI: Practice Safe Holiday Shopping – Online Identity Theft on the Rise

Forrester Research Inc. predicts online holiday sales will increase this year, as more bargain hunters turn to the Web for deals. While users shop and surf on open hotspots, hackers can spy on their activity in an attempt to steal their personal information. McAfee tells users never to shop online from a public computer or on an open Wi-Fi network.

Stay tuned to parts III & IV.

Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

Invest in Intelius Identity Theft Protection and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano, identity theft speaker, discusses Black Friday and Cyber Monday on FOX Boston

SWATting, Using Technology To Hurt

/in , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Swatting is making prank calls to emergency services. In the field of information security, swatting is an attempt to trick an emergency service (such as a 911 operator) to dispatch an emergency response team, generally a SWAT team. SWAT is (Special Weapons and Tactics).

Caller ID spoofing technologies are used to send law officers on bogus calls along with, social engineering, and phone phreaking techniques combined. 911 systems (including telephony and human operators) have been tricked by calls placed from cities hundreds of miles away.

Caller ID spoofing is the practice of causing the telephone network to display a number on the recipient’s caller ID display which is not that of the actual originating caller. Similar to e-mail spoofing which can make it appear that a message came from any e-mail address the sender chooses, caller ID spoofing can make a call appear to have come from any phone number. Most people trust caller ID and are unaware of caller ID spoofing. This is obviously a flawed system ripe for fraud.

MSNBC reports Doug Bates and his wife, Stacey, were in bed around 10 p.m., their 2-year-old daughters asleep in a nearby room. Suddenly they were shaken awake by the wail of police sirens and the rumble of a helicopter above their suburban Southern California home. A criminal must be on the loose, they thought.

Doug Bates got up to lock the doors and grabbed a knife. A beam from a flashlight hit him. He peeked into the backyard. A swarm of police, assault rifles drawn, ordered him out of the house. Bates emerged, frightened and with the knife in his hand, as his wife frantically dialed 911. They were handcuffed and ordered to the ground while officers stormed the house.

They were victims of swatting that exploits a weakness in the way the 911 system handles calls from Internet-based phone services.

Dallas News reports a group of people met on telephone chat lines who harassed people through swatting. They would pick a target and their caller ID information to make it appear they were calling from that person’s house.

They would phone that person’s local police and pretend they were about to go on a killing spree, triggering a SWAT or patrol officer response. The group pulled this scam across the country.

There were some reports of injuries by police storming houses of innocent, unsuspecting people whom police thought were holding hostages at gunpoint.

This is difficult to prevent. Unlisting your home phone number can help. Not having a home phone number and being mobile based is even better. In the off chance you are ever selected to be swatted, the best response is to “show your hands”. Law enforcements concern is a weapon.

While completely unrelated, protect your identity too.

Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name. This makes your Social Security number useless to a potential identity thief.

Invest in Intelius identity theft protection and prevention. Not all forms of identity theft protection can be prevented, but identity theft protection services can dramatically reduce your risk. “Disclosures”

Hackers Indicted for Jacking Comcast

/in , , , , , , , , /by

Robert Siciliano identity theft expert

A single hacked email address led to the defacement of Comcast’s homepage. When the hackers called Comcast’s technical contact to let him know that the Comcast homepage and all 200 Comcast domain names were vulnerable, he hung up on them.

It has not been disclosed how the email was compromised, but there are many ways it could be. According to the indictment, the hackers got control of the domain with two phone calls, and an email was sent to the company’s domain registrar, Network Solutions, from a hacked Comcast email account. That gave them entry to the Network Solutions control panel for Comcast’s 200 domains.

The hackers, 19 and 20 at the time, known as Defiant and EBK from a group calling themselves Kryogeniks, scrawled, “KRYOGENIKS EBK and DEFIANT RoXed COMCAST sHouTz To VIRUS Warlock elul21 coll1er seven” across Comcast’s homepage after they were rebuffed by Comcast’s technical administrator. Their one mistake was changing the contact information for the Comcast.net domain to Defiant’s email address. Not a smart move from these brilliant hackers.

One method of compromising email accounts is simply going to the “forgot password” section of your email provider’s website and responding to a preselected personal question that you answered when signing up for the account. With a little research, the hacker has a good shot at finding the correct answer. Some of the current questions could be answered using information found on a user’s social networking profile, or through a website like Ancestry.com or Genealogy.com

I suggest that you check out the “forgot password” section on your own web-based email account, to see your current personal question. If it’s easy to answer, or would only require a little research to solve, update the question with one that you create based on opinion, as opposed to fact.

You should also beef up your password. Combine uppercase and lowercase letters, as well as numbers. Don’t use consecutive numbers, and never use names of pets, family members, or close friends.

1. Get a credit freeze. Go online now and search “credit freeze” or “security freeze” and go to consumersunion.org and follow the steps for the state you live in. This is an absolutely necessary tool to secure your credit. In most cases it prevents new accounts from being opened in your name. This makes the SSN useless to the thief.

2. Invest in Intelius Identity Theft Protection and Protection. While not all forms of identity theft can be prevented, you can effectively manage your personal identifying information by knowing what’s buzzing out there in regards to YOU.

Robert Siciliano, identity theft speaker, discusses hacked email on FOX & Friends.