Cyber Security
Share
Tweet
Hacker’s Brief 8/29/2022
Hacker's Brief outlines recent scams reported by residents in Wyoming.
Please be aware of these and many other scam
Laura Baker, CISM, MBA, ARM, BS Marketing
Executive Director, CyberWyoming
President, CyberWyoming Alliance
Watch Out for Rogue Tut.com Email Addresses: While we have notified the legitimate tut.com organization, fake emails continue to be reported by Wyomingites. The latest impersonated Costco and the three different credit reporting agencies.
Urgent Business Proposal from Citibank: A Sheridan citizen reported an email with the subject line of “For your information” from Mr. John C. Gerspach at a Gmail address claiming he works for Citibank and has an urgent business proposal worth 26 million British pounds. Don’t reply back to the scammer, they probably want to steal your personal information.
Harry’s Razors: While Harry’s razors and shaving accessories are real, like any legitimate company they can be impersonated. A Sheridan citizen reported a suspicious email advertisement featuring a low cost trial for Harry’s razor blades. The email links were to popctrivia.com which redirected to another site that wasn’t Harry’s. If this email is legit, it is a lesson for marketers to be transparent with their links, but we think it is probably fake.
Laughable Grammar – Are You Even Alive?: If you receive an email saying “We received a call from Mike Williams that you’re dead and he is your next of king with some of information where we can delivery the funds to him, kindly get back to us if you’re alive God blee you” remember that poor grammar and spelling is a sign that it is a scam email. This email was reported by a Sheridan citizen and had the subject line of “Ms. Linda A Williams” from a Gmail address. The sender claims they work for “Bank of American.”
Mine malware: You probably know that a lot of people are making a lot of money by mining Bitcoin cryptocurrency. But maybe you're not sure exactly what mining is and how to do it. Scammers have caught on to this by posting YouTube videos that make the whole process look easy and offer free downloadable mining software. But it's not what they say; it's data-stealing malware called PennyWise. It's clever, faking authenticity by using download password protection and a trust certificate. Your antivirus should spot it, but your best protection is not to download files from people you don't know. Brought to you by scambusters.org.
Voicemail phishing: Fake voicemail notifications to Microsoft 365 and Outlook users are being used to phish for account sign-on information. Scammers know victims are far more likely to click on an email attachment that seems to be a voicemail rather than regular attachments. To add to their credibility, they also spoof the name of the sender, often pretending to be the victim's employer. Don't click! Brought to you by scambusters.org.
No giveaways: Recent publicity for big number lottery prizes has tempted crooks to revive a longstanding scam in which they pretend to be winners wanting to give away some of their winnings to random people. Using SMS texts and emails, they usually spoof the names of actual winners so it looks like their offer is legit. Recipients are told to call an untraceable number where they're instructed to pay "processing fees," which can run into thousands of dollars. Remember that, while many lottery winners have chosen to donate to worthy causes, there's no record of any of them ever giving away money at random. You're just not going to be that lucky! Brought to you by scambusters.org.
Virtual School? Watch for apps collecting data. According to the Washington Post, one learning app used by 60,000 US schools contained code capable of identifying a student's unique ID from their phone or school-issued device, which could then be used to track them, learn what they were interested in buying, and push ads to them for these products. A Human Rights Watch study found that nearly 90 percent of the remote education tools they investigated were designed to send data about classes and individual students to advertising technology firms, including Google and Facebook. This would enable them to discover students' interests and buying behaviors. What to do? Review the privacy settings in the teaching application that your children use and contact your local school district if you have concerns. Brought to you by scambusters.org.
Scambusters Voice Cloning Alert: High-tech scammers have started using voice cloning to make their imposter calls sound more realistic than ever. They're using the technology to imitate the voices of friends and relatives for distress calls like those used for grandparent scams or fake kidnap messages. Security experts have feared this development for some time and now there's evidence crooks are using stolen voice clips from online videos and even telemarketing calls to mimic people supposedly caught up in some sort of emergency. Before, the crooks would only use very short statements when posing as someone else to avoid victims recognizing that the voice wasn't genuine. Now, they're able to string together longer statements. In the not-too-distant future, they'll be able to use the technology to answer questions from suspicious call recipients.
Scambusters Tips if you get a distressed call:
• Use another phone to call the individual or someone who should know where they are, to check on their location and safety.
• Have a secret family password that you can ask the supposed victim for, to check it's really them.
• Ask other questions. At this stage, voice cloning is not advanced enough to respond immediately and there's usually a time lag before the reply comes.
Weird Text Messages: Are you receiving texts that come from someone who seems to know you but you don't know them, asking a question like "What time are we meeting?" Or they may refer to an incident, like an undelivered package, with a link to click. Your first instinct might be to reply or click. Don't. In the first case, spammers are harvesting names and numbers of people who respond to messages. In the second, they're phishing for personal account info. Brought to you by scambusters.org.
Don't Pay: Fake invoices from genuine PayPal accounts are surging. Crooks open a free PayPal account and then fire off the invoices, knowing they stand a good chance of evading security software. If you don't recognize the supposed order or don't have a relationship with the sender, don't pay. If you do owe them money, double check with their known contact information - but don't click on links or use phone numbers provided in the invoice. Brought to you by scambusters.org.
FTC Alert Peer to Peer Car Sharing: If you’re looking for a way to make some extra money, you might be thinking about renting out your car through a peer-to-peer (P2P) app like Getaround, Turo, or HyreCar. But renting your car out on these platforms can also be risky. Some people who’ve listed their cars have reported having them damaged, stolen, or used by someone to commit a crime. Even if the company has policies for dealing with these types of situations, they can take a lot of time and money to resolve. Before deciding to rent your car think about these items. 1. The general location of your car will be available to the public. 2. Lockboxes for keys, software that lets the company immobilize your car’s engine remotely or software that locks/unlocks your car doors are no guarantee that your car will be safe. 3. Insurance may not cover everything you expect it to. If you’ve had a bad experience with a P2P app, report it to the FTC at Reportraud.ftc.gov.
FTC Alert Student Loan Payment Pause: Scammers often take advantage of current events. With the extension granted until December 31, 2022 to pause student loan payments, remember that you don’t need to do anything or pay anybody to sign up for the new program or the pause. No one can get you in early, help you jump the line or guarantee eligibility. Just check with your federal loan servicer.
FTC Free COVID Test Scam: Scammers have been targeting Medicare recipients with a fake offer to get “free COVID tests.” They’re calling and running websites, online and television ads to try to convince people to give their Medicare information. But if you give them your information, they’ll bill fraudulent charges to Medicare and often, the tests never arrive. While Medicare does offer 8 free COVID-19 tests a month, no one from Medicare will contact you. Follow this link for more information: https://www.medicare.gov/coverage/coronavirus-disease-2019-covid-19-diagnostic-tests
FTC Grocery Cost Alert: With the cost of groceries, housing, and many other things rising, you might be looking for ways to cut costs. Remember that scams may target this desire. If the offer is too good to be true, it is probably fake and remember that the government won’t contact you out of the blue about grants or programs.
FTC Alert – Watch for Back to School Shopping Scams: Many people like the convenience of online school shopping, but what happens if something goes wrong with your order or the website turns out to be a scam? Before you drop items in your shopping cart, remember this advice: check refund and return policies, use a credit card for online purchases, save your receipts/confirmation emails, remember that if the shipper hasn’t shipped within the promised timeframe you can cancel your order for a full refund, and when on the website watch for pre-checked boxes that may get you to agree to something that puts you more at risk.
FTC Natural Disaster Alert: Remember that scammers take advantage of natural disasters like the California fires and the Kentucky floods, only donate to reputable, known organizations and double check the website URL to make sure you are really donating to their true website.
MS-ISAC and CISA Patch Now Alert: The Multi-State Information Sharing and Analysis Center (MS-ISAC) or the Cybersecurity & Infrastructure Security Agency (CISA) has published a patch now (update your software) alert for Cisco, Mozilla’s Firefox, Firefox ESR and Thunderbird, and VMWare products. If you use these products, make sure the software (or firmware) is updated.
Please report scams you may experience to [email protected] to alert your friends and neighbors.
Other ways to report a scam:
● Better Business Bureau Scam Tracker: http://www.bbb.org/scamtracker/us/reportscam
● Wyoming Attorney General’s Office, Consumer Protection 307-777-6397, 800-438-5799 or [email protected]
● File a complaint with the Federal Trade Commission at https://reportfraud.ftc.gov/#/
● Report your scam to the FBI at https://www.ic3.gov/Home/FileComplaint
● Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at https://www.donotcall.gov/report.html or call 1-888-382-1222, option 3
● Office of the Inspector General: https://oig.ssa.gov/
● AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
● IRS: report email scams impersonating the IRS to [email protected]
● Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit http://www.aarp.org/fraudsupport to learn more about the free program and register.
