• Any messages that communicates a tremendous sense of urgency. The bad guys are trying to rush you into making a mistake.
• Any message that pressures you into bypassing or ignoring our security policies and procedures.
• Any message that promotes miracle cures, such as vaccines or medicine that will protect you. If it sounds too good to be true, it probably is.
• Be very suspicious of any phone call or message that pretends to be an official or government organization urging you to take immediate action. 

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Just like clockwork it happens every year around April. No, I’m not talking about April Fool’s Day or the annual appearance of the Easter Bunny. I’m talking about IRS tax scams.

Every year during the months of February through April tax scammers focus their sights on us whether, at work or at home, and attempt to solicit us to offer up personally identifiable information (PII) such as social security numbers and/or birthdates, or attempt to convince us to send them money directly via credit card or wire transfer.

Some tax scams occur when fraudulent tax returns are filed in the target’s name while other variants occur when the malicious actors call the target and pretend to be Internal Revenue Service (IRS) agents. In addition, there are malicious actors who use the tax season to spread malware and phishing emails.

Of these various types of tax scams, in one type, a return is filed in the victim’s name include identity theft, identity fraud, and tax fraud. This scenario occurs when the malicious actor uses information about the tax filer such as their name, address, date of birth, and Social Security Number to file a false tax return as the target claiming as many deductions as they can to gain the largest refund amount.

In a second type of tax scam, the malicious actor contacts the target by phone and tries to convince the target to do something, such as immediately paying a fine or providing their financial information so a refund can be issued. In these instances, the malicious actor uses what they know about the victim, often information gained from a previously occurred data breach or social networking website, to convince the victim that the caller has access to the victim’s tax information. Frequently during these calls the caller will pretend to be an IRS agent.

In the third type of tax scam, malicious actors use tax related spam, phishing emails, and fraudulent websites to trick victims into providing login names, passwords, or additional information, which can be used in further fraud. Other emails or websites may download malware onto the victim’s computer.

Some things you should look out for:

• Look for “spoofed” (copied) websites that look like the official website but are not. 
• Don’t be fooled by unsolicited calls. The IRS will never contact you by phone, email, text or social media, and the IRS will never demand an immediate payment or require you to use a specific payment method such as pre-loaded debit or credit cards, or wire transfers. They will never claim anything is “urgent” or due immediately, nor will they request payment over the phone.
• The IRS will not be hostile, insulting, or threatening, nor will they threaten to involve law enforcement in order to have you arrested or deported. 
• Sometimes malicious actors change their Caller ID to say they are the IRS. If you’re not sure, ask for the agent’s name, hang up, and call the IRS (or your state tax agency) back using a phone number from their official website. 

1. File a report with your local law enforcement agency. 
2. File a report with the Federal Trade Commission (FTC) at www.identitytheft.gov. 
3. File a report with the three major credit bureaus and request a “fraud alert” for your account (Equifax – www.equifax.com, Experian – www.experian.com, TransUnion – www.transunion.com).

• IRS Tax Scams and Consumer Alerts: https://www.irs.gov/uac/tax-scams-consumer-alerts
• IRS Tax Fraud Alerts: https://www.irs.gov/uac/tax-fraud-alerts
• IRS Report Phishing and Online SCAMS: https://www.irs.gov/uac/report-phishing
• IRS Security Awareness for Taxpayers: https://www.irs.gov/pub/irs-pdf/p4524.pdf

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

With Phishing and Spearphishing on the rise people need to pay close attention to the email they receive.   The research firm AppRiver is reported a new PayPal phishing scam is making the rounds with this version using a phony security message to obtain personal identifiable information. 

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

It’s tax season again, which means it’s also time for tax scams. Some tax scams occur when fraudulent tax returns are filed in the victim’s name while other variants occur when the malicious actors call the victim and pretend to be Internal Revenue Service (IRS) agents. In addition, there are malicious actors who use the tax season to spread malware and phishing emails.

Tax scams where the malicious actor files the return in the victim’s name include both identity theft and identity fraud, as well as tax fraud. This scenario occurs when the malicious actor finds or receives information about the tax filer, including the filer’s name, address, date of birth, and Social Security Number. The malicious actor then uses this information to file a malicious tax return, citing as many deductions as possible, in order to create as large a tax return as possible.

The other variant of tax scams occur when the malicious actor contacts the victim and tries to convince the victim to do something, such as immediately paying a fine or providing their financial information so a refund can be issued. In these instances the malicious actor uses what they know about the victim, often information gained for a data breach or social networking website, to convince the victim that the caller has access to the victim’s tax information. Frequently during these calls the caller will pretend to be an IRS agent.

In the third type of tax scam, malicious actors use tax related spam, phishing emails, and fraudulent websites to trick victims into providing login names, passwords, or additional information, which can be used in further fraud. Other emails or websites may download malware onto the victim’s computer.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Continuing our blog series targeted at protecting yourself against cyber threats, today's blog topic covers Mobile Devices.

Today's guest blog contributor is Eric Varela. Eric is a student here at CSU Channel Islands majoring in Information Technology with a minor in Security Systems Engineering.


What is a “Mobile Device”? 

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

On December 24, 2015, RateMyProfessors.com observed suspicious activity on one of its backend systems and promptly investigated. As a result of that investigation, RateMyProfessors.com believes that on or about November 26, 2015, hackers gained access to one of the backend systems of RateMyProfessors.com through a decommissioned version of the RateMyProfessors.com website. These hackers acquired email addresses and passwords for some registered users of the active RateMyProfessors.com website (“Site”). We have not seen indications that the compromised information has been used without authorization or that ratings submitted to the Site were implicated in the incident.

It is important to note that, if you used RateMyProfessors.com only as a non-registered user, no information about you and no ratings you submitted were implicated in the incident.

Additional information may be found on the RateMyProfessor site at http://www.ratemyprofessors.com/securityFAQs.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Two Ways Tax Scammers Might Target You

Tax identity theft

• more than one tax return was filed in your name, or
• IRS records show wages from an employer you don’t know

IRS imposter scams

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

What is social engineering?  What are some of the most common tactics used.  Here's a short guide on how you lessen your likelihood of becoming a social engineering statistic.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

For many people, the holidays means a dramatic spike in email traffic. There is more communication between family and friends, more solicitations from retailers pitching holiday bargains, and more online shopping confirmations and shipping notifications. It’s also a time of year when cyber-criminals try to take advantage of the overwhelming volume of email communications to catch unwitting victims off guard with phishing scams. Hopefully you would be able to spot a fake malicious email and avoid getting compromised, but don’t be too sure.  For additional information on how to stay safe please read on.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

We all get offers that seem too good to be true. Whether they come by email or appear on web sites, they are often clever schemes designed to dupe the gullible. Don't be tricked by Internet Fraud. For more information see http://www.lookstoogoodtobetrue.com.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

An email with the subject “important” tells recipients that they must sign into Dropbox in order to view a document too big to be sent via regular email, but clicking on the link included in the message brings people to a fake Dropbox login page that is actually hosted on Dropbox. 

Link to the rest of this SC Magazine article to find out more about this new scam.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Reusing passwords or using the same password all over the place is like carrying one key that unlocks your house, your car, your office, your briefcase, and your safety deposit box. If you reuse passwords for more than one computer, account, website, or other secure system, keep in mind that all of those computers, accounts, websites and secure systems will be only as secure as the least secure system on which you have used that password. Don't enter your password on untrusted systems. One lost key could let a thief unlock all the doors. Remember: Change your passwords on a schedule to keep them fresh.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

You know that little padlock icon you look for to ensure your Web traffic is encrypted and secure? It turns out that you might not be as secure as you think thanks to a vulnerability that was accidentally introduced into the code of OpenSSL.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

In a recent news release by US-CERT, the United States Computer Emergency Readiness Team, US-CERT stated they are aware of a malware campaign that surfaced in 2013 and is associated with an increasing number of ransomware infections. CryptoLocker, a new variant of ransomware, restricts access to infected computers and demands the victim provide a payment to the attackers in order to decrypt and recover their files.  As of this time the primary means of infection appears to be phishing emails containing malicious attachments.

Everyone who makes use of computer systems, including email, should be on guard for these types of malware infection attempts.  In many cases the email will appear to be legitimate and harmless but you need to ask yourself if you were expecting this communication, and if not, contact the sender to make sure it's legitimate.

To help mitigate any loss of data should you fall victim to this infection, you should take regular backups of your system and store your important files onto your file server which is backed up regularly.

To get more information about CryptoLocker, follow this link to the US_CERT website and think before you click!

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

By responding to these messages, you're only confirming that your email address is active. Another thing you shouldn't do is click the "remove me" link in the message. Links in email can point to an IP address other than what is being represented or referenced. The best thing you can do is delete the message. 

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

Credit card and online banking sites are convenient and easy ways to purchase and handle your financial transactions. They are also the most frequently spoofed or "faked" sites for phishing scams. Information you provide to online banking and shopping sites should be encrypted and the site's URL should begin with https. Some browsers may also have an icon representing a lock at the lower right of the browser window. 

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

As we near "Tax Day 2013", many spamming and phishing groups are increasing their attempts to try and get at your personal information.  Please be sure to execute caution before responding to any email claiming to be from the IRS or any other government group and think before clicking that link.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

A wireless hotspot is an wireless network that is made available (open) to everyone. A good example of an open wireless hotspot would be the wireless network offered at your favorite coffee shop. These wireless networks hook computers into the public Internet — very handy, but dangerous. Because wireless hotspots are for open use, they don't provide much security protection for your data while on them. Some tips to keep in mind before you start using a wireless hotspot include:

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

The Internal Revenue Service today issued its annual “Dirty Dozen” list of tax scams, reminding taxpayers to use caution during tax season to protect themselves against a wide range of schemes ranging from identity theft to return preparer fraud.

The Dirty Dozen listing, compiled by the IRS each year, lists a variety of common scams taxpayers can encounter at any point during the year. But many of these schemes peak during filing season as people prepare their tax returns.

"This tax season, the IRS has stepped up its efforts to protect taxpayers from a wide range of schemes, including moving aggressively to combat identity theft and refund fraud," said IRS Acting Commissioner Steven T. Miller. "The Dirty Dozen list shows that scams come in many forms during filing season. Don't let a scam artist steal from you or talk you into doing something you will regret later."

Illegal scams can lead to significant penalties and interest and possible criminal prosecution. IRS Criminal Investigation works closely with the Department of Justice (DOJ) to shutdown scams and prosecute the criminals behind them.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest

If you receive an email asking you to call an 800 number related to a banking or credit card issue, don't call the number. Your credit card has a phone number on the back as do your bank account statements. Be safe, don't call a phone number listed in an email; instead look up the number on your credit card or account statements. There's a new attack called Vishing, designed to have you call a fake, automated answering system, and get you to enter your account number and other sensitive information.  Don't be a victim.

Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest