I noticed today that the email address we have set up to take inquires and message regarding our twitter account has been hit with a few spam emails that clearly phishing emails. I thought I would share them here for your amusement and enjoyment. Please do NOT click on any links or visit these websites as they main contain harmful content. If you receive emails such as these do not click on any links or download, preview or click on any attachments. Mark them as junk or spam in your mail and delete. If you wish, you may report them to the FBI’s Internet Crime Complaint Center at ic3.gov

***

From: HSBC Support Holding plc [helpdesk@hsbc.co.uk]

Subject: YOUR ONLINE ACCOUNT HAS BEEN DEACTIVATED

Dear customer:

After the week verification of your online activity we have determined to suspend your online account.

Your online account has been deactivated (reason: suspicious activity on this account).

Even if your online services has been disabled, the data may still be available for up to 10 days, after which it will be deleted.

If you feel this deactivation is in error, please fill the active contact customer form as soon as possible at the next link: http://www.hsbc.co.uk.hsbc-deactivated.com/1/2/

Thank you,

HSBC Support Holding plc

http://www.hsbc.co.uk

helpdesk@hsbc.co.uk

Toll-Free: 08457 400 004

***

From: HM Revenue & Customs [help.desk@hmrc.notify-online.co.uk]

Subject: HM Revenue & Customs [help.desk@hmrc.notify-online.co.uk]

NOTE: There is an attachment called “attached_form.pdf.html” 24KB

TAX RETURN FOR THE YEAR 2009

RECALCULATION OF YOUR TAX REFUND

HMRC 2008-2009

LOCAL OFFICE No. 3819

TAX CREDIT OFFICER: David Craig

TAX REFUND ID NUMBER: 381716209

REFUND AMOUNT: 327.54 GBP

Dear Applicant,

I am sending this email to announce: After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of 327.54 GBP

You have attached the tax return form with the TAX REFUND NUMBER ID: 381716209, complete the tax return form attached to this message.

After completing the form, please submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.

Our head office address can be found on our web site at http://www.hmrc.co.uk/

Sincerely,

David Craig

HMRC Tax Credit Office

Preston

PR1 0SB

http://www.hmrc.co.uk/

ID Experts on KATU News:

A few news stories have been circulating about the looming identity theft threat to couples who have decided to tie the knot. Thieves prey on our deepest and strongest emotions, and two people madly in love and about to take the plunge are certainly full of emotions and stress. Stress makes us more apt to decide quickly, without thinking the situation through. The sense of relief we feel may encourage us to accept an offer that seems “too good to be true” when we might otherwise hesitate. Our families and friends may also be targeted, for much the same reasons. Think like a thief- on average weddings cost over $20,000 and guest gifts range between $50-150 each. That places a rather large bulls-eye on anyone involved. Here is just a small list of the kinds of scams that are lurking out there:

• Fake vendors- these are identity thieves or card frauders. They are online, at bridal shows, and call individuals out of the blue. You may be even approaching them for a genuine service advertised in the classifieds or a bridal magazine, or it may be a “sweepstakes”. As part of the “contract” or “application” you answer personal questions in great detail or provide a credit card number that is later used to defraud you.

• Fraud vendors- this category is not technically identity theft, but still leaves you stung. Often you are promised a “free” sample and hand over your credit card for shipping and handling, and then find yourself with outrageous charges. Vendors take a deposit for renting you an item as pictured on their site, and when the big day comes, nothing arrives or what arrives bears little resemblance to the model. Sweepstakes and Giveaways should be especially scrutinized if you get a call and you “won” – there may be strings attached.

• Crooks- these people take advantage of the fact you share so much about your event. They may rob your house while you’re exchanging rings, or wait until you’re away on honeymoon. While everyone at the reception is distracted, they snatch purses or sneak into hotel rooms. Honeymooners are easily targeted by pickpockets, camera snatchers, and hustlers.

• Disappearing act- this can be anything from a deposit you paid disappearing from the books to a company suddenly going bankrupt. Bankruptcies are up 47% from last year, so this is a big concern. While insurance can help protect you, it is important to purchase coverage carefully.

• Malware – There are tons of “free” applications out there to help out couples. Cost calculators, dress design software, websites, countdown clocks, reminders, calendars, the list goes on… Then there are the flash animations and videos of weddings, decorations, crafts, flowers and more. However, some of these may contain harmful code that could harvest your information and place you at risk for identity theft and fraud.

• Robocalls and junk mail – While shopping around online or in person, you’re often asked to leave your contact information. This can result in an increase in junk mail offers and robocalls. Some of these are likely phishing attempts, and are cleverly disguised. Another risk with increased junk mail is the possibility of mail theft going unnoticed for a longer period of time. Pre-approved credit card offers may inflate your mailbox, also increasing your risk of fraud.

• “In distress” scam- this is commonly used while a couple is on honeymoon, but can strike at any time. Fraudsters may call, email, or take over your email or social networking accounts to contact your friends and family claiming to need emergency money. Excuses range from medical emergencies, to being kidnapped. Often they have “been robbed” and need the money to get home. The rest is ALWAYS to wire money or send Western Union.

• YOU – of all the threats, YOU might be your own worst enemy. Many couples have wedding announcements; send emails, e-vites, wedding websites, social networking pages, online gift registries with their personal information, personal details, family details, and wedding, reception and honeymoon specifics available to the public at large. Brides and grooms alike tend to become excited and may share greater detail about themselves, their partners and the event with coworkers and friends… and florists, photographers, DJs (or anyone else who will listen).

With a few minor changes and some awareness, you can still have all the bells and whistles to your big day while keeping your friends, family and your identity safe.

• Assume the numbers and addresses you are using to contact vendors, get quotes, order catalogs are going to be stolen, traded and sold over and over. Set up a PO Box and a separate number to use for your contact information.

• Contact the Better Business Bureau in your area about any vendor, sweepstakes, or service you are going to fork over a large amount of money to, or that you are unfamiliar with. Do this before you provide them any personal or contact information.

• Always assume that calls you receive are compromised and never reveal any personal information. You may trust calls you initiate to a trusted business more, but still exercise caution.

• Read ALL fine print carefully. TWICE.

• Keep all receipts; require everything in writing and document, document, document. Go over all your credit card and bank statements monthly and notify your financial institution right away if you notice any unusual activity.

• Quarantine. Don’t use the same passwords or email account for your social networking sites, registry, and wedding webpage. You should never attach your “trusted” email account you have been using to communicate with your friends and family to another site. A compromise of a social networking site can easily lead to an email compromise, and makes it easier for fraudsters to contact your entire address book for money. If your quarantined email is hacked and messages sent to all your friends, they should be more cautious since it is a different email than they are used to communicating with you. This will buy you enough time that you can then use your “trusted” email account to notify them all of the fraud (or better yet- call them!).

• Never send money Western Union- this is one of the few ways you can send money and never get it back. Provide contact information to their nearest consulate if you are met with this scam online.

• Limit access to personal information- If you are going to list the details of your big day and honeymoon, look for websites that allow you to create a wedding website for friends only, or that is password protected so you can control who has access.

• Be careful of accidentally revealing personal information like your mother’s maiden name (which may be derived from guest lists or online friend list on social networking sites) and your date or place of birth. Also, you will be asked a lot of questions so people can “get to know you” before your big day- make sure none of these questions and answers correspond to the security questions of any account you have. Go through each online account and determine what questions are asked if you click “I forgot my password”. You may wish to change those answers.

• Find gift registries that allow you to control privacy, and insist on revealing as little about yourself as possible. Gift registries often offer a disturbing amount of detail about you, and often are generally open to the public.

Check your credit reports regularly with www.annualcreditreport.com or by calling 1-877-322-8228.  If you do experiance fraud or a scam, report it to your Better Business Bureau and the FTC and place fraud alerts with the major credit bureaus.

The newest phishing attack to hit Twitter yesterday was a type of cyberscam called typo-squatting. This falls under a more generic term, cybersquatting. This attack took advantage of the similarities between a double v (tvvitter) and a w (twitter) to scam you into revealing your login information.Other typo-squatting simply takes advantage of the pay-per-click system to rack in money that should be coming to your organization. According to a recent independent report, cybersquatting increased by 248% in the past year.

Fairwinds Partners, an internet strategy consulting firm, estimates that a company such as Myspace, who has 5.94 % of its traffic being diverted to its top ten typo pages stands to “lose the marketing equivalent of between $400,000 and $700,000 each month”. Although the Anticybersquatting Consumer Protection Act (ACPA) was intended to protect against these scams, they are still common enough to present a real danger to customers and companies.

There are several ways that users can try to protect themselves against typo-squatting. Microsoft has suggested settings to enhance your browser. They have even developed a download called Typo-Patrol. More simply, you can avoid clicking on links to navigate to websites and type carefully each web address you visit. As an organization, there are several companies that will help you prosecute typo-squatters and monitor for cybersquatting. You may also may use the Uniform Domain-Name Dispute-Resolution Policy website to lodge a dispute. You may also wish to visit the Coalition Against Domain Name Abuse for more resources.

You’re in the scene- you’ve got the Facebook, MySpace, LinkedIn and Twitter accounts active and updated. You juggle to remember which friend requests have been added where, and then you suddenly decide to sign up for another social media site such as Yelp, Plaxo, Ning, FriendFeed, Orkut, or iLike. What a pain to add all those friends all over again! Then you see a advertisement for a wonderful service provided by the company- all you have to do is provide your email username and password, and all your friends will be automatically added to your social network. Sounds great, right?

Wrong. This leaves the door wide open for numerous types of fraud. Most people do not take the security precaution of creating different user names and passwords for the sites they visit. They may be handing over their address books, and financial and email accounts. You must also consider that a large database of user names and passwords are VERY attractive to potential hackers and identity thieves, and is much more likely to be targeted than individual accounts.

As reported on TechRadar, Twitter’s API lead Alex Payne said “We’ve always advised users to only give their passwords to websites they feel they can trust. Any website runs the risk of compromise, so giving out your credentials is always a gamble. There’s little risk in using a desktop Twitter client, but we’ve cautioned users against handing out their passwords to web-based services that are higher-value targets to attackers.”

Even if you trust the service not to delve into your personal information, you are providing a third party website with security information. A habit that identity theft and security professionals have been trying to break for years. As handing out your security information from one site to another site becomes commonplace, the easier it will become to convince users to continue the practice. As Jeremy Keith, technical director of user experience consultancy Clearleft points out, “…it teaches people how to be phished.”

There is always a security trade-off for convenience. Before you click on that free download, try the new service, or ask a computer to remember your password ask yourself- Is this worth it? Is the increased risk of attack and theft worth the convenience I am trading it for? Remember to use different usernames and passwords for your accounts, so that any single compromise does not result in total loss of your personal and finacial information. Never provide account information on a third party site, and be cautious of any requests for password or account information by email, website or phone.

A new scam attempt, aimed at playing on our greatest fears, is making it’s way around cyberspace. ComputerWorld reports that hackers are using this trick to try to get you to download malware onto your computer. They are being so clever, that customize the scam to your location! A email comes to you with headlines such as “Bomb Blast in (your town)” or “At Least 18 Killed (in your city)” and leads to a fake Reuters news service site. Using a familiar ploy, the site then directs you to download the latest version of a flash player so you can see the details. However, instead of a flash player, you get a nice big download of malware.

This reminds us to be suspicious and vigilent. Scam artists are getting very refined in their methods, and some of the attacks are incredibly sophisticated to try to fool you. Don’t let fear keep you from practing the utmost caution when you recieve emails. Always be skeptical of updates to your flash player from third party sites. Go to the website for your player directly to ensure that you have the latest version.

Straight from their alerts page:

added March 4, 2009 at 11:53 am

“US-CERT is aware of public reports of malicious code spreading via popular social networking sites including myspace.com, facebook.com, hi5.com, friendster.com, myyearbook.com, bebo.com, and livejournal.com. The reports indicate that the malware, named Koobface, is spreading through invitations from a user’s contact that include a link to view a video. If the users click on the link in this invitation, they are prompted to update Adobe Flash Player. This update is not a legitimate Adobe Flash Player update, it is malicious code.

Additionally, some of the reports indicate that there are multiple bogus Facebook applications being used to obtain users’ private information.

US-CERT encourages users and administrators to do the following to help mitigate the risks:

• Install antivirus software and keep the virus signature files up to date.
• Do not follow unsolicited links.
• Use caution when downloading and installing applications.
• Obtain software applications and updates directly from the vendor’s website.
• Refer to the Staying Safe on Social Networking Sites document for more information on safe use of social networking sites.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks. “

This is a reminder to us all that while we may trust the websites themselves, the applications available for download or the media shared on these sites are not usually examined for malicious code. Even if you trust the “friend” who sent it to you, that person may not be in control of their own account.

~Rachel James, Intake Specialist

Recently, I was contacted by one of our members regarding some frightening email he received. We all have received spam and phishing attempts in our inboxes, but this message is much more sinister. This scam comes in the form of a death threat, resembling an assassination notification.

This email scam has touched many people, including Florida State Rep. Rob Schenck. You can find the article about it here. Schenck’s commented; “When you read something that disturbing, for a moment you do get concerned. No matter whether it’s fake or not, if someone talks about killing your family, it’s unsettling.”

The message warns of certain death unless the reader sends in large sums of money. The email also states that contacting anyone, including the authorities, will extend the death contract to your family. Some versions of the message even indicate that they will provide you proof of the person who hired the assassin to kill you once you provide them with the money.

This is just scam, if a very frightening one. The sheriff’s office reminds people that “you have to be a willing victim to fall victim… this is just a new scare tactic to get money out of people.” Authorities recommend that you do not click any links or respond to the message, and simply delete it entirely from your mail.

This is a reminder to us all how aggressive and clever identity thieves are. We must remain vigilant, and always scrutinize messages we receive by email, phone, text message, or mail. Trust your instincts and if something doesn’t feel right, listen to that feeling.

Rachel James- Intake Specialist

by Doug Pollack

We all hear about how more and more identity theft is now being done with the internet. What you don’t hear as much about is how an increasing percentage of US-based identity theft is perpetrated by organized crime overseas.

A recent FBI press release titled “38 Individuals in US and Romania Charged in Two Related Cases of Computer Fraud Involving International Organized Crime” describes a frightening phishing scheme that:

“uses the Internet to target large numbers of unwary individuals, using fraud and deceit to obtain private personal and financial information such as names, addresses, bank account numbers, credit card numbers and Social Security numbers.  Phishing schemes often work by sending out large numbers of counterfeit e-mail messages, which are made to appear as if they originated from legitimate banks, financial institutions or other companies.”

The level of organization of this criminal enterprise and effectiveness of their efforts is remarkable.  According to the indictment:

“The Romania-based members of the enterprise obtained thousands of credit and debit card accounts and related personal information by phishing, with more than 1.3 million spam emails sent in one phishing attack.  Once directed to a bogus site, victims were then prompted at those sites to enter access device and personal information.  The Romanian “suppliers” collected the victims’ information and sent the data to U.S.-based “cashiers” via Internet “chat” messages.  The domestic cashiers used hardware called encoders to record the fraudulently obtained information onto the magnetic strips on the back of credit and debit cards, and similar cards such as hotel keys.  Cashiers then directed “runners” to test the fraudulent cards by checking balances or withdrawing small amounts of money at ATMs.  The cards that were successfully tested, known as “cashable” cards, were used to withdraw money from ATMs or point of sale terminals that the cashiers had determined permitted the highest withdrawal limits.  A portion of the proceeds was then wire transferred to the supplier who had provided the access device information.”

As organized crime becomes increasingly sophisticated in using our affinity for online commerce to their advantage, we should all be extra cautious, especially in watching out for something that has become as commonplace as the phishing scam.