Personal Protecting Yourself in a Digital World 210.229.1128 MyGenFCU.org 1
Identifying Fraud The world is now more connected than any other time in our history. In this era of smartphones, we can text, email, use a tablet vs. a laptop, engage on social media, play games and even pay our dinner tab on our phone without ever interacting with a person. This interconnectivity has become such a normal, accepted part of our daily lives that many of us would hardly bat an eye or question the authenticity of a text, email or a website we visit. This auto-response mode of trust increases the chances that we may fall victim to identify theft. There are many ways fraudsters can deceive you. Sophistication and convenience are the main tactics fraudsters employ to capture your private information. To help you stay protected and informed, we ve put together this resource of common fraud methods and practices. Phone and Mail Fraud Despite the digital age, many fraudsters still send out legitimate-looking mail or place official-sounding phone calls because of their high success rate. According to the FBI, one of the most common types of identity fraud pervading both the phones and mailboxes is telemarketing fraud. Fortunately, this type of fraud tends to follow a familiar pattern of making all sorts of grand promises, including work-at-home offers, property taxes, inheritance claims, health and medical products and more. Prevention is the best policy to avoid being taken by one of these scams. Remember: Don t buy from an unfamiliar company - A legitimate business understands you want more information about their company and will be happy to provide it. Always ask for written material about any offer or charity - beware, not everything written down is true. Always check out unfamiliar companies - Some sources you should check are your local consumer protection agency, the Better Business Bureau, the state attorney general and the National Consumer League. Obtain a salesperson s name, business identity, telephone number, street address, mailing address and business license number - Verify the accuracy of these items. Don t pay in advance for services - Pay for services only after they are delivered. Be wary of companies that want to send a messenger to your home to pick up. Don t pay for a free prize - This practice is a violation of federal law, even if you re told it s for taxes or shipping and handling. Source: FBI.gov 2
Email Fraud For scammers, email provides an easy way to commit mass fraud while maintaining a safe distance from local law enforcement. Often, scammers lure victims using the baitand-switch method with look -alike emails that mirror legitimate organizations. These fraudulent emails usually send visitors to a fraudulent but authentic-looking website to get them to divulge their sensitive information. To protect yourself from these scams, you should understand what they are, what they look like and how they work. Here are some common fraud schemes initiated through email: Sophistication and convenience are the two main tactics fraudsters employ to capture your private information. 1. Bogus Business Opportunities These scams promise the opportunity to make a great deal of money with very little effort, with proclamations of: Work only 10 hours a week Set your own hours Work from home In most cases, the email gives very little detail about the nature of the business opportunity and provides a website address from which visitors can, for a fee, obtain an information kit about the opportunity. 2. Health and Diet Scams This type of scam preys on the insecurities victims have about the state of their wellbeing. Consumers are lured with promises of quick fixes, amazing results, discount pricing, fast delivery, waived prescription requirements and discreet packaging. 3. Discount Software Offers These scams offer promises of cheap versions of software, such as Microsoft Windows or the Adobe Creative Suite. Unfortunately, if any software is delivered, it is usually an illegal, pirated version preloaded with a virus to exploit your computer and the sensitive information it contains. 4. 419 Scheme aka The Nigerian Letter Named after the section of the Nigerian penal code that addresses fraud, 419 scams are the most recognizable by their subject lines, which frequently: Call for an urgent response (URGENT REPLY NEEDED) Refer to a personal introduction (Re: Pleased to meet you!) Use African or African-inspired sender names 3
Although the exact email may vary, overall it usually proposes a complicated arrangement to secure and split funds in a foreign land. Despite the outlandishness of these schemes, they hook many victims. 5. Phising Email These emails are crafted to look as if they are sent from a legitimate financial institution, such as a major bank or credit union and then instruct you into either: visit a bogus website that looks like the real thing, or download viruses or software intended to compromise your computer and reveal personal information. Although most email applications include spam-filtering features, it s impossible for these features to filter out everything, especially if the scammers use subtle spelling mistakes to circumvent spam filters looking for certain commonly used keywords. A healthy dose of suspicion, combined with the following practices will ensure you stay protected: Don t trust unsolicited email Remember, many viruses spread themselves by scanning the victim s computer for email addresses and sending emails to those addresses in the guise of an email from the owner of the infected computer. Treat email attachments with caution Email attachments are commonly used to sneak a virus onto your computer, steal important information from your computer, open your computer to further attack and abuse, or convert your computer into a bot for use in denial-ofservice attacks and other online-crimes. Install anti-virus software and keep it up to date Install anti-virus software on your computer that has an automatic update feature and includes an email scanning option. Configure your email client for optimal security There are many ways you can configure your email client to make you less susceptible to email scams. For instance, configuring your email program to view email as text only. Source: US-CERT 4
Online Fraud Beyond email, general online fraud is a growing hazard that exploits security vulnerabilities through the use of malware to install malicious software into a user s computer. Some f the most common examples of malware include: Keyloggers and Screenloggers -- programs that install themselves into a web browser or as a device driver that monitors data being input and sends it to a phishing server. Redirectors - programs that intercept outgoing emails or instant messages and send an additional copy to a secret address. Session Hijackers - programs that monitor browser activities, particularly when the user logs into a financial account. Once the user s credentials are established, the software performs malicious actions. Web Trojans - programs that pop up over login screens to collect credentials. These appear to originate from a legitimate website, but are being entered locally into the program and then transmitted out. Cyber crime is a crime of opportunity that doesn t discriminate between a home user and a big Fortune 500 company. If hackers find a vulnerability that presents an opportunity for fraud, they will take it. Follow the steps below to stay protected: Choose a secure password - Don t base them on personal information (e.g. mother s maiden name, social security number, birthdays, etc.) and use a combination of upper/lowercase letters, numbers and special characters that are at least eight characters long. Check the security of online merchants - The secure status of a website will be shown in one of the bottom corners of your browser window through the display of some sort of padlock icon. Also, the website s URL address should begin with the secured prefix https rather than the unsecured http. Make sure the web address is spelled correctly- Often, scammers will create websites that duplicate legitimate ones with a similar URL address that simply transpose or duplicate a letter in the site address. Do not click on links to other websites - If uncertain about links contained within a website, leave the site and conduct a separate search for that page. Disconnect your computer from the Internet when you aren t using it- Even with firewall and anti-virus software, it is possible for hackers to gain access to your computer if your Internet is connected. Evaluate your security settings- Check your security settings within your browser options and ensure it is set to at least the minimum level recommended by the browser software makers. Back up all your data- In the event that your computer is infected with a virus that wipes out your data, ensuring an up-to-date backup copy is available will allow you to restore your system much quicker. Source: Department of Homeland Security 45
Smishing Smishing -- a combination of SMS texting and phising -- is a criminal practice wherein criminals set up an automated dialing system to text people in a particular region or area code with messages similar to: There s a problem with your account, or Your ATM card needs to be reactivated. This message is usually followed by a link to a website or a phone number where the recipient is asked to verify their identity by providing personal information. Armed with that information, criminals can steal from victims bank accounts, charge purchases on their credit card or even create ATM cards connected to these accounts. Again, a healthy sense of skepticism is necessary to protect yourself. Also, following these commonsense practices can help: Alert your financial institutions or agencies, such as the IRS, when you receive a suspicious message - Alerting the proper authorities of possible scams allows them to work toward stopping this activity and/or notifying the general public to prevent them from becoming the victims of a scam. Only provide personal or financial information through an organization s secured website- If you typed in the web address yourself and you see signals that the site is secure, like a URL that begins https (the s stands for secure) and the VeriSign padlock icon in the right of the web address box, the chances of fraud are minimal, but no indicator is foolproof. Only download mobile apps from trusted sources - When downloading mobile smartphone or tablet apps to your device, be sure the app is coming from a trusted source. You should always treat mobile apps the same way you treat websites: with caution. Make sure you fully trust the source before downloading or sharing info. Install an anti-virus program to your mobile device - In the same way many people install anti-virus programs on their desktop computers for added protection, consider installing a similar program to your smartphone or tablet if available for your device. Ask questions- If the message doesn t give you his or her name, a call back number and a valid reason for the request, the message may be attempting to phish for your personal information. Review credit card and bank account statements as soon as you receive them - Check these statements closely for unauthorized charges. If your statement is late by more than a couple of days, call your financial institutions to confirm billing address and account balance information. Be cautious about opening attachments and downloading files- Regardless of who sent them, these files can contain viruses or other malware that can compromise your phone s security. Never share Personal Identification Numbers (PINs)- Your financial institution will never ask you for your PIN. 65
Repairing the Damage If you ve fallen victim to one of these types of fraud and feel your identity may be at risk, you must take swift action. If you suspect your identity has been stolen, take the following steps: 1. File a report with your local police or the police in the community where the identity theft took place. 2. Contact one of the three major credit reporting bureaus (TransUnion, Equifax and Experian) and place a fraud alert on your credit report and review your credit reports for unauthorized charges. Contact Information: TransUnion: 1-800-680-7289; www.transunion.com; Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790 Equifax: 1-800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241 Experian: 1-888-EXPERIAN (397-3742); www.experian.com; P.O. Box 9554, Allen, TX 75013 3. Check your credit card and financial account statements for suspicious activity. Ask your credit card providers to flag your accounts to require phone authorization for new charges. 4. Close the accounts that you know, or believe, have been tampered with or opened fraudulently. 5. File a complaint with the Federal Trade Commission. You can file a complaint online at www.ftc.gov/idtheft, by phone at 1-877-IDTHEFT (438-4338); TTY: 1-866-653-4261, or by mail: Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. Staying Protected While this interconnected world may present a play land to criminals, there are steps you can take to protect yourself. In addition to a healthy dose of skepticism and commonsense, staying informed of the practices previously discussed will take you even further to ensure your identity stays secure. P.O. BOX 791870 SAN ANTONIO, TX 78279-1870 WWW.MYGENFCU.ORG 7