Beware of Coronavirus (COVID-19) Phishing Scams

by in , , , , , , , , , , , 0


Most of us have seen and read in the news about the Coronavirus outbreak, currently known as SARS-CoV-2 or Coronavirus Disease 2019 (COVID-19). We wanted to remind you that during media intense events like this, cyber attackers take advantage of this opportunity and attempt to scam you or launch phishing attacks that attempt to get you to click on malicious links or open infected email attachments. Here are some of the most common indicators that the phone call or email you received is most likely a scam or attack (additional information on identifying scam phone calls and emails may be found at the Federal Trade Commission Consumer Information website).
  • Any messages that communicates a tremendous sense of urgency. The bad guys are trying to rush you into making a mistake.
  • Any message that pressures you into bypassing or ignoring our security policies and procedures.
  • Any message that promotes miracle cures, such as vaccines or medicine that will protect you. If it sounds too good to be true, it probably is.
  • Be very suspicious of any phone call or message that pretends to be an official or government organization urging you to take immediate action. 

For the latest updates consider visiting the World Health Organization website on Health and Disease Control, the Center for Disease Control website, or our own CSUCI Coronavirus (COVID-19) Information website. Please keep in mind Coronavirus scams and attacks can happen at work or at home, via email, text messaging or even over the phone. Don’t fall victim to bad guys playing on your emotions. 

If you feel you have received a phishing attack at work, simply delete the message or if you have concerns report it to your information security team.

Information Resources: 



Scammers create fake emergencies to get your money

by in , , , , , , , , , , , 0

July 3, 2018
by Carol Kando-Pineda
Attorney, Division of Consumer and Business Education

“I lost my wallet and ID. I’m stranded — please wire money.”

“Your grandson is being held in jail. He needs bail money right away.”

Scammers try to trick you into thinking a loved one is in trouble. They call, text, email, or send messages on social media about a supposed emergency with a family member or friend. They ask you to send money immediately. To make their story seem real, they may claim to be an authority figure, like a lawyer or police officer; they may have or guess at facts about your loved one. These imposters may insist that you keep quiet about their demand for money to keep you from checking out their story and identifying them as imposters.But no matter how real or urgent this seems — it’s a scam.

If you get a call or message like this, what to do?
  • Check it out before you act. Look up that friend or family’s phone number yourself. Call them or another family member to see what’s happening. Even if the person who contacted you told you not to.
  • Don’t pay. Don’t wire money, send a check, overnight a money order, or pay with a gift card or cash reload card. Anyone who demands payment in these ways is always, always, always a scammer. These payment methods are like giving cash — and nearly untraceable, unless you act almost immediately.
  • If you sent money to a family emergency scammer, contact the company you used to send the money (wire transfer service, bank, gift card company, or cash reload card company) and tell them it was a fraudulent transaction. Ask to have the transaction reversed, if possible.
  • Report the message or call at FTC.gov/complaint.

Share this video to help servicemembers and their families avoid family imposter scams.


Additional information on Scam Alerts may be found at  https://www.consumer.ftc.gov/features/scam-alerts 

Equifax Breach Advisory

by in , , , , , , , , , , , , , , , 0

Given the recent announcement regarding the data exposure at Equifax we wanted to share some good “cyber hygiene” and some resources with you. With 143 million U.S. consumers affected it’s a good chance many of us are impacted.

Equifax has said there is no evidence of unauthorized activity in their credit reporting data bases but that there was potentially unauthorized access to information it stored from mid-May to July of this year. That information included social security number (SSN), dates of birth (DOB), addresses and in some cases Driver’s License numbers. Also reported is that approximately 209,000 consumers credit card numbers were exposed as well as other “dispute documents” for 182,000 consumers.

What can you do?
  1. One of the first things typically suggested after a breach is to access credit reporting agencies and request your records to be sure there are no unauthorized accounts or charges. In this case you may want to consider the other agencies, Experian and TransUnion. Also check your online and credit card accounts for suspicious activity. You can check free credit reports from annualcreditreport.com. Check for any accounts or charges you don't recognize.
  2. Be extra wary of scam emails and links. Avoid clicking on links or downloading attachments from suspicious emails. Equifax will send paper mail to consumersbut hackers are sure to use this to conduct Phishing campaigns.
  3. Change your passwords, especially if you have/had an account with Equifax and use similar or the same password elsewhere.
  4. You can check at Equifax here to get information and to check and see if your records are impacted. You can also access your Equifax credit report here which is probably a good idea so you can compare with the ones you get from Experian and/or TransUnion.

1 Million GMail Users Impacted by Google Docs Phishing Attack

by in , , , , , , , , , , , , 0

Reported from ThreatPost May 4, 2017

Google said that up to 1 million Gmail users were victimized by yesterday’s Google Docs phishing scam that spread quickly for a short period of time.

In a statement, Google said that fewer than 0.1 percent of Gmail users were affected; as of last February, Google said it had one billion active Gmail users.

Google took measures to protect its users by disabling offending accounts, and removing phony pages and malicious applications involved in the attacks. Other security measures were pushed out in updates to Gmail, Safe Browsing and other in-house systems.

Additional information by ThreatPost can be found here or on CI's Information Security web site.


Is the IRS really calling/emailing/texting me?

by in , , , , , , , , , , , , , , , , 0


Just like clockwork it happens every year around April. No, I’m not talking about April Fool’s Day or the annual appearance of the Easter Bunny. I’m talking about IRS tax scams.

Every year during the months of February through April tax scammers focus their sights on us whether, at work or at home, and attempt to solicit us to offer up personally identifiable information (PII) such as social security numbers and/or birthdates, or attempt to convince us to send them money directly via credit card or wire transfer.

Some tax scams occur when fraudulent tax returns are filed in the target’s name while other variants occur when the malicious actors call the target and pretend to be Internal Revenue Service (IRS) agents. In addition, there are malicious actors who use the tax season to spread malware and phishing emails.

Of these various types of tax scams, in one type, a return is filed in the victim’s name include identity theft, identity fraud, and tax fraud. This scenario occurs when the malicious actor uses information about the tax filer such as their name, address, date of birth, and Social Security Number to file a false tax return as the target claiming as many deductions as they can to gain the largest refund amount.

In a second type of tax scam, the malicious actor contacts the target by phone and tries to convince the target to do something, such as immediately paying a fine or providing their financial information so a refund can be issued. In these instances, the malicious actor uses what they know about the victim, often information gained from a previously occurred data breach or social networking website, to convince the victim that the caller has access to the victim’s tax information. Frequently during these calls the caller will pretend to be an IRS agent.

In the third type of tax scam, malicious actors use tax related spam, phishing emails, and fraudulent websites to trick victims into providing login names, passwords, or additional information, which can be used in further fraud. Other emails or websites may download malware onto the victim’s computer.

Some things you should look out for:

  • Look for “spoofed” (copied) websites that look like the official website but are not. 
  • Don’t be fooled by unsolicited calls. The IRS will never contact you by phone, email, text or social media, and the IRS will never demand an immediate payment or require you to use a specific payment method such as pre-loaded debit or credit cards, or wire transfers. They will never claim anything is “urgent” or due immediately, nor will they request payment over the phone.
  • The IRS will not be hostile, insulting, or threatening, nor will they threaten to involve law enforcement in order to have you arrested or deported. 
  • Sometimes malicious actors change their Caller ID to say they are the IRS. If you’re not sure, ask for the agent’s name, hang up, and call the IRS (or your state tax agency) back using a phone number from their official website. 
Recommendations

If you believe you are the victim of identity theft or identity fraud, there are a couple of steps you should take:
  1. File a report with your local law enforcement agency. 
  2. File a report with the Federal Trade Commission (FTC) at www.identitytheft.gov
  3. File a report with the three major credit bureaus and request a “fraud alert” for your account (Equifax – www.equifax.com, Experian – www.experian.com, TransUnion – www.transunion.com).
If you receive any spam or a phishing email about your taxes, do not click on the links or open any attachments, instead forward the email to phishing@irs.gov. Other tax scams or frauds can be reported according to the directions on these pages referenced below:

References:

Cloudbleed Bug: What you should know.

by in , , , , , , , , , , 0

Cloudbleed, the latest internet bug that put leaked users private information, was made public late last Thursday, 2/23.  There's still quite a bit of confusion regarding the full impact on people's information, but here are few links to help you unfold what occurred.

Blog article from Cloudflare, the affected source.
CNET's Article
Additional CNET information
Fortune Magazine
Is this web service affected?

The bottom line of all this is you should change all of your passwords for all of the web services you subscribe to.  It's better to be safe in a situation such as this than sorry.

Today's Tip: Is That App Giving Away Your Privacy?

by in , , , , , , , , , 1

Be careful when you install apps on your mobile device. Many apps want more permissions than actually needed for their function. For example, some flashlight apps want access to your contacts. Why? Usually for marketing purposes to build a better profile on you and your friends. Don't install apps that require excessive permissions.

Also, always install apps from a trusted source. This helps ensure the app isn't fake or malicious.