Posts

Inside The Nigerian 419 Scam

/in /by

The Nigerian 419 Scam is a form of advance-fee fraud, a confidence trick in which the target is persuaded to advance sums of money in the hope of realizing a significantly larger gain. “419″ refers to the article of the Nigerian Criminal Code that deals with fraud.

Almost everyone has been targeted by this type of scam at some point. Most would be surprised by how many different versions of this scam exist and how reasonably intelligent people have been fooled into participating in them. Entire cities have had their bank balances drained, and families have lost their life savings.

Recently a close friend called to tell me that he had sold a $22,000 piano on a specialty site specifically for piano sales. His piano, which he had sold to an out of town buyer, was to be picked up by a mover. He called me because the buyer was sending $26,000, $4,000 above the asking price. My friend was to pay the movers with this extra $4,000. He was a little concerned about this plan, and so he asked me for my thoughts.

I explained that this was a scam. The $4,000 that he was supposed to wire to a mover accounted for the “advanced fee” element of the scam. Once my friend wired the money, the scammer would probably ask for more. In advance-fee fraud, the promised money from the scammer never happens. The scammer relies on the fact that, by the time the victim realizes this, the victim may have sent thousands of dollars of their own money, sometimes millions, to the scammer via an untraceable and/or irreversible means such as wire transfer.

My friend reminded me that the buyer had negotiated the price, requested more pictures, was adamant about the quality of the piano, and seemed legitimate. At this point, my friend became argumentative. He didn’t want to believe me, and insisted that I was wrong and that he would go through with the sale.

I reminded my friend that he’d called me based on an instinct that something was fishy, and he calmed down and agreed that I was right, after all. Nobody likes to admit that they are wrong. In this case, my friend was right when he sensed something suspicious.

This is a simple but vicious scam that can easily take you by surprise. This scam can have many different twists and varieties, and you must avoid being taken in by any of them. The simplest solution is to never send money, for any reason, to anyone, in response to a phone call or email.

Identity theft protection will not help you here. But becoming informed by visiting CounterIdentityTheft.com can help.

Identity theft can happen to anyone. McAfee Identity Protection offers proactive identity surveillance, lost wallet protection, and alerts when suspicious activity is detected on your accounts. McAfee Identity Protection provides live access to fraud resolution agents who work with victims to help restore their identities.

Robert Siciliano is a McAfee consultant and identity theft expert. See him discuss scam baiting on Fox News. (Disclosures)

Who Is Really Knocking On Your Door?

/in /by

The door bell rings and a man is standing in the doorway with a clip board, measuring tape and he is wearing a tool belt, a green jumpsuit and has a badge saying he is from the local water company. The homeowner, a woman says “Hello, how can I help you?” and he informs the homeowner that he is with the water company and needs to come inside to check the “colorization” and PH of the person’s water.

The homeowner lets him in, he runs the faucet, she goes and takes care of the baby who is crying, and he sees a wallet sitting on the kitchen table.

The woman comes back about 3 minutes later, he produces a vile of water and says “everything is fine, sorry for the inconvenience, have a nice day.”

Was he with the water company? NO. Did he steal the wallet? NO. Do you know why he didn’t steal the wallet? Because the man with the clip board, measuring tape, wearing a tool belt, in a green jumpsuit with a badge saying he is from the local water company was ME. Watch it HERE.

I did this on the Montel Williams Show to prove a point. This is a common trick a burglar may use to invade your home in the daytime.  The biggest problem you face is that you are too nice. When the doorbell rings, most people’s first inclination is “how can I help you?” We want to help, we want to accommodate and when someone knocks on the door, it becomes personal to us.

We are a kind, trusting and civil species. We trust by default. We want to help, we want to accommodate and we don’t ever want to think “bad” is on the other side of the door or “bad” will ever happens to us.

The bad-guy knows this and he targets you, your mom, grandmother, grandfather and anyone else who answers the door. He may have shiny white teeth and even fresh minty breath. Beware.

Robert Siciliano personal security expert to Home Security Source discussing Home Invasions on Montel Williams.

How the Grandparent Scam Works

/in /by

Remember when you were a kid, before “caller ID” (I’m showing my age here), you and your friends would make prank calls by picking up the phone and dialing any number and eventually someone would pick up the phone, you’d hang up, and laugh hard? Then do it another dozen times and with each call you would infuriate the caller, then laugh harder?

You learned that if you make enough calls, eventually you will get someone on the phone that was gullible and you could get a good laugh out of them over and over.

This same process/philosophy is what plays into telephone fraud scams. One of the easiest and most vile scams on the block is the “Grandparent Scam”.

The phone rings and an elderly person answers the phone. They may be slightly hard of hearing, and the caller says either “Grammy, Granny, Grandma, Nana, Nonna, Papa, Baba or Grandpa?”  The elderly person says ‘Yes” and the caller states “It’s your grandson!” When the elderly person responds and rattles off a name of a grandchild and says “Robby is that you”, the scammer responds “YES!” and knows he’s got a fish on the hook.

Now that the “relationship” has been established the scammer proceeds to prey upon the good nature of the grandparent and uses their love of their grandchild against them. The scammer begins to hem and haw that they’ve been arrested or are stranded or car broke down or lost their wallet and need the grandparent to wire some money to them. Once the grandparent agrees they instruct the victim to go the address of the local check cashing place that wires money and the scammer siphons as much as possible out of their victim.

This scam works so well because the victim is hooked within the first minute of the call. Once the predator sinks their teeth into their victim they will work on them until they have no money left in the world.

If there is someone in your life that could possibly, even remotely fall for this scam you need to educate them on what to look for. Put systems in place to make it difficult for them to make financial withdrawals without a cosigner.

Robert Siciliano personal security expert to Home Security Source discussing home security and identity theft on TBS Movie and a Makeover.

Typosquatting Scams in Social Media

/in /by

Typosquatting, or URL hijacking, is a form of cybersquatting that targets Internet users who accidentally type a website address into their web browser incorrectly. When users make a typographical error while entering the website address, they may be led to an alternative website owned by a cybersquatter or criminal hacker.

In a new twist, some typosquatters have begun using these domains to advertise deceptive promotions, offering gift cards or iPads to lure visitors.

“Twiter.com,” for example, redirects all the would-be Twitter users who missed one “t” to http://twitter.com-survey2010.virtuousads.com/survey.html. Notice that this copycat page’s URL begins with “http://twitter.com,” but clearly is not part of Twitter. Mistyping “youube.com” or “acebook.com” will send you to similar pages, which are designed to resemble YouTube and Facebook.

This scam benefits affiliate marketers who get paid when users click links and fill out forms. The shadiness of these sites, and the misleading techniques of their operators, indicates that any information you provide will most likely be misused, leading to annoyance and possibly fraud.

Typos are a common occurrence with no solution. But users who do find themselves on one of these alternate pages need to check the address bar and use common sense. Familiar colors, fonts, and logos may imply that you’re at the right website, but pay closer attention to be sure you’re not heading down a rabbit hole of spam and scams.

With more than 11 million victims just last year, identity theft is a serious concern. McAfee Identity Protection offers proactive identity surveillance, lost wallet protection, and alerts when suspicious activity is detected on your financial accounts. Please educate and protect yourself by visiting www.counteridentitytheft.com.

Robert Siciliano is a McAfee consultant and identity theft expert. See him discuss an identity theft pandemic on CNBC. (Disclosures)

This Holiday Season, Beware of Phantom Websites

/in , /by

A “fly by night” business is one that quickly appears and disappears, without concern for the quality of their product or service, or for legal regulations. These untrustworthy businesses often operate fraudulently. On the Internet, a fly by night business is called a “phantom website.”

Phantom websites exist to collect personal and credit card information. They can appear online any time of the year, but the holidays are prime time. They imitate the look and feel of a legitimate website, and many simply copy the web code from well-known online retailers, right down to the names and logos. They may also purchase domain names that resemble those of legitimate retailers, “typosquatting” to take advantage of mistyped searches.

Criminals may direct you to phantom websites using advertisements, even on major search engines like Yahoo and Google. These links or clickable graphics can either send you to a phantom site, or they may even directly infect your computer with malware.

Hackers and scammers also rely on black hat SEO to get their phantom websites ranked on the first or second page of search results, using the same search engine optimization techniques as legitimate vendors.

However, these scammers also game the system using techniques like “link farms,” “keyword stuffing,” and “article spinning,” which are frowned upon by search engines. Using these techniques to lure visitors will get them banned within a month or two, but that’s plenty of time to establish an online presence and scam plenty of victims.

And of course, phishing is in season all year long. Scammers send emails offering deals too good to be true, in order to draw visitors to their phantom sites. They’ll often take advantage of major holidays and significant world events to create an enticing offer. These emails are designed to trick recipients into entering account credentials, which allows the scammers to take over existing accounts or open new ones.

Protect yourself from phantom websites by only doing business with legitimate online retailers you know, like, and trust. Go directly to their websites, rather than relying on search engines, which may lead you astray. But do use search engines to check out a company’s name and look for ratings sites where customers have posted their experiences with a particular company. If you can’t find anything aside from the company’s own website, be suspicious.

And, never click on links in unsolicited emails. Just hit delete.

Use SiteAdvisor or a similar service to scan for infected links.

And invest in identity theft protection, because when all else fails, it’s nice to have a service watching your back. McAfee Identity Protection includes proactive identity surveillance to monitor subscribers’ credit and personal information, as well as access to live fraud resolution agents who can help subscribers work through the process of resolving identity theft issues. For additional tips, please visit CounterIdentityTheft.com.

Robert Siciliano is a McAfee consultant and identity theft expert. See him discuss how a person becomes an identity theft victim on CounterIdentityTheft.com. (Disclosures)

How to Prevent Door to Door Scams

/in , , , /by

A close friend called to tell me a man knocked on her door to sell her on repaving her driveway. In the process, he requested she invite him in to discuss it further and go over different options. The man was persistent and if my friend was anyone else, he may have gotten in. However, she is savvier than that and reminded him that her German Shepherd would not appreciate anyone coming in the house.

Call them con men, grifters, scammers, or thieves. Or simply call them liars. Lying is what they do best. Face to face, via email or over the phone they lie through their teeth. They do it casually and with such conviction that we have no reason not to believe them.

These people will stand in your doorway and, in some cases, keep you talking until you buy something or persist till they get into your home. Remember, whatever you tell them can be used against you.

For example, if they act as a home alarm salesman and find out you don’t have an alarm, they may break into your house. If you tell them who your home alarm is with, they may call you at a later date posing as that alarm company and request “updated credit card numbers”.

This “request” is best resolved by not answering any questions at all, or telling the person at the front door (while you speak to them through the locked door) you are not interested. No matter what, never give them Social Security or credit card numbers, or tell them whether or not you have a home alarm.

The key is to stop being so nice and SAY NO as quickly as possible and always do it through a locked door.

Robert Siciliano personal security expert to Home Security Source discussing scammers and thieves on The Big Idea with Donnie Deutsch.

Are You Protected From Zeus?

/in , , , /by

In Greek mythology, Zeus is the father of all gods and men. Today in the tech world, Zeus is the father of all computer viruses. The Zeus Trojan virus, which has been around since 2007, has been described as one of the most powerful, sophisticated, and evasive viruses ever. Many antivirus programs have had difficulty defeating it. Experts believe that millions of computers may have the virus without users having noticed.

Zeus behaves like many other viruses in that it may lure the PC user into clicking an infected link in the body of an email, then instantly downloads the virus, which quietly installs itself in the background. Sometimes that link may point to an infected website, which injects the virus in the form of a “drive-by download.” Once Zeus has been installed, it works as spyware, recording keystrokes as the user types.

Last month, the FBI broke up a hacking ring that had used the Zeus virus to steal more than $70 million. More than 100 people were charged or detained, including code writers in the Ukraine and “mule-network operators” throughout the United States, the United Kingdom, and Ukraine. The ring primarily targeted U.S. bank accounts, as well as some in the U.K., the Netherlands, and Mexico.

Zeus is designed to steal bank account login credentials. It has traditionally targeted PCs, but has now been updated to attack cell phones as well, with one version of the malware apparently “intercepting SMS confirmations sent by banks to customers, and defeating the fund transfer authorization codes.”

Protect yourself from this and other viruses by running free operating system updates from Microsoft. Click “Start,” then “All Programs,” and then scroll up the menu and select “Windows Update” or “Microsoft Update.”

You should also install antivirus software. Most PCs come bundled with antivirus software that is free for the first year or six months. Just renew the license whenever it expires. Most antivirus software categorizes spyware as a virus now, but it’s also a good idea to run a spyware removal program daily. You should also install a firewall. Microsoft’s operating system has one built in, but it is not sufficient. Use a third party firewall that comes prepackaged with antivirus software.

And don’t be a fool. Scammers consider you, the target, “simple minded.” They’ll use 1001 different techniques to trick you into divulging your data. They attempt to gain your trust by lying, sending misleading emails, or planting pop-up ads that try to convince you to download software for your own protection. Just hit delete.

Robert Siciliano, personal security expert contributor to Just Ask Gemalto, discusses phishing on NBC Boston. (Disclosures)

Holiday Shopping: Beware of Unethical Online Merchants

/in , , , , /by

We have all encountered a sales clerk who was rude, a customer service representative who was incompetent and an online purchase that went south. Even I’ve been scammed out of an entire order and spent dozens of hours trying to get a return on another.

But when it comes to outrageous and shocking, including threats of violence and outright fraud, this story takes the cake.  An online merchant based in Brooklyn New York retailing designer sunglasses, some counterfeit and some real, thrives on bad customer service, over charging, making threats, stalking and abusing clients into giving up the fight over what’s right.

The merchant prides himself on getting negative feedback on consumer advocacy and review sites such as Get Satisfaction, ComplaintsBoard.com, ConsumerAffairs.com, RipoffReport.com, Yelp and Epinions.

He thrives on – for example “DO NOT ORDER ANYTHING FROM THIS COMPANY. This has been the most horrific experience EVER. I have extensive knowledge of website management and customer service, and they pretty much break every rule imagined. They are a total scam”

The strategy of negativity gets this merchants website ranked high on search when listed with all the different opinion sites. Google and other search engines often rank a website to show on the first page of search based on how many links point to it from other prominent sites. So even though all the negative links are pointing to the unethical site from opinion sites, it still ranks on the first page of search helping its sales.

Beware of making purchases on any website based on how they rank in search. Even a first page organic hit can lead to a scammy company.

Learn from others bad experiences. ALWAYS search “Name Of Company” in Google before you make a purchase. The review sites almost always show on the first page of search when “Name Of Company” has been blacklisted.

More on THIS STORY.

Robert Siciliano personal security expert to Home Security Source discussing scammers and thieves on The Big Idea with Donnie Deutsch.

Spear Phishers Know Your Name

/in , /by

“Spear phishing” refers to phishing scams that are directed at a specific target. Like when Tom Hanks was stranded on the island in the movie Cast Away. He whittled a spear and targeted specific fish, rather than dropping a line with bait and catching whatever came by. When phishing attacks are directed at company officers or senior executives, it’s called “whaling,” appropriately enough. I don’t know who sits around and coins this stuff but it makes analogical sense.

Spear phishers target their victims in a number of ways.

They may select a specific industry, target specific employees with a specific rank, and pull a ruse that has been successful in the past. For example, a spear phisher might choose a human resources employee whose information is available on the company website. The phisher could then create an email that seems to come from the company’s favorite charity, assuming this information is also available online, requesting that the targeted employee post a donation link on the company’s intranet. If the target falls for the scam, the scammer has now bypassed the company’s firewall. When employees click on the malicious link, the company’s servers will be infected and antivirus software may be overridden.

Lawyers are popular targets, since they are often responsible for holding funds in escrow. A spear phisher might contact a lawyer by name, leading him or her to believe that the scammer is an American businessperson who needs help moving money while overseas.

I was recently targeted in a spear phishing scam, one aimed specifically at professional speakers. The scammers requested that I present a program in England, and once my fee was agreed upon, I was asked to get a “work permit,” which costs $850.

People who are not be targeted based on their professions may be targeted based on their use of social media. Facebook, Twitter and LinkedIn are known playgrounds for spear phishers, who obtain users’ email addresses and create email templates that mimic those sent by the social networking website. Scammers may even weave in names of your contacts, making the ruse appear that much more legitimate.

Knowing how spear phishers operate allows you to understand how to avoid being phished. Never click on links within the body of an email, for any reason. Bypass the links and go directly to the website responsible for the message. Any unsolicited email should be suspect. If you manage employees, test their ability to recognize a phishing email, show them how they got hooked, and then test them again.

Robert Siciliano, personal security expert contributor to Just Ask Gemalto, discusses phishing on NBC Boston. Disclosures

Internal Revenue Service Identity Theft Scams

/in , , , /by

There have been many articles written about scammers who pose as representatives of government agencies. But perhaps the most inventive are the scams that appear to originate from the IRS. It makes perfect sense for the IRS to reach out regarding your finances. And regardless of the season, the IRS is really always in business.

I’ve never received a call or an email from the IRS. As far as I know, they do not make calls or send emails. Emails that seem to come from the IRS will often have a name, title, and even “IRS” at the beginning or end of the email address. However, email addresses can easily be spoofed.

Unless you are actively engaged in dialog with an IRS agent, do not respond to emails or phone calls supposedly coming from the IRS.

If a scammer posing as an IRS agent ever contacts you, they may already have some of your personal information, which they can use to try to convince you that they are actually from the IRS. This data could come from public records or even your trash. The scammer will often put pressure on you to comply with their request, or even offer you a tax refund.

If you ever receive documentation in the mail indicating earned income that you are not aware of, it may mean that someone else has used your Social Security number to gain employment.

If, when filing your tax return, you receive a letter from the IRS saying that you have already filed, it almost certainly means that someone else has filed a fraudulent return on your behalf in order to steal your refund.

If you are ever a victim of an identity theft issue related to an IRS scam, you may be very disappointed in the way it is handled via the various government agencies. They simply don’t allocate the resources to fix this problem proactively, nor are they adept at responding once it has occurred. The biggest issue is the thief’s privacy. Even if you have an idea who may have done it, the IRS or any other government agency will not release that information. Either way, knowing who did it won’t help you.

All you can do in the event of tax related identity theft is to follow the IRS’s instructions for contacting an agent and resolving the issue. Just be patient, as rectifying the issue may take many hours.

McAfee Identity Protection includes proactive identity surveillance to monitor subscribers’ credit and personal information and access to live fraud resolution agents who can help subscribers work through the process of resolving identity theft issues. For additional tips, please visit http://www.counteridentitytheft.com

Robert Siciliano is a McAfee consultant and identity theft expert. See him discuss IRS related identity theft on Fox News. (Disclosures)