Phishing & Identity Protection
The information on this page was written with computers in mind, but most of the warnings also apply to smart phones.
The CRTC fined five companies (three operating in Canada, two in India) $643,500.
While this is a good beginning, in my opinion the fines may effectively be more a cost of doing business than a true deterrent (depending upon the revenue generated during the commission of this criminal activity) and appears to do nothing to compensate the victims.
- These companies engaged in large-scale fraud (more than $5,000) and a breach of trust (“they falsely identified themselves as representatives of Microsoft Inc., the U.S. Department of Homeland Security or Government of Canada officials”).
- They abused the National Do Not Call List by phoning numbers on that list and by not registering their companies as telemarketers.
- It potentially cost the victims hundreds of dollars to restore their computers (never mind the fees paid for the bogus “anti-virus” program, identity theft recovery and the invasion of their privacy).
Emphasis on general deterrence is required to discourage people who would be tempted to defraud others because the offence can be easy to commit and quite profitable. Similarly, general deterrence is also strongly emphasized in cases where the fraud (large-scale or not) involves a breach of trust. — Ontario Department of Justice
As cybercrime begins to overtake physical offenses for the first time, we need to realize that as our world continues to be dominated by technology so is organized crime. There is a common misconception that these out of sight online attacks are victimless crimes or are not treated with the same level of importance as those that occur offline, and this needs to change. — Daniel Burrus
From bogus “computer support” calls to “free” vacations to fake charities to unexpected “government” calls (even threats of pending arrest warrants) scams are perpetrated on innocent victims every day.
Any of these warning signs should you that you're probably dealing with a bogus caller:
- A robo-call telling you that you've been randomly selected for a special discount, offering credit card debt relief or to win a prize is almost certainly a scam.
- Scammers say they are from or are associated with a well-known company or government agency. This is transfer of trust.
- They ask to confirm your account number or other details they should already have on file. Remember, they called you! It's their identity that is unconfirmed.
- They ask for remote access to your computer or want you to install “antivirus” software.
Don't be the next victim! Just hang up.
The purpose of the call is to steal from you — your money, your identity, your trust. How to protect your identity.
When someone approaches you, remember they always want something. — Frank Catalano
Caller ID Can be Faked
The telephone Caller ID display can be faked. The number showing is no guarantee that the caller is who they say they are.
Unless you initiate the call (and have obtained the number from a legitimate source), you have no certainty who you're dealing with.
Never give any personal information, such as a Social Security number, to a caller unless you're positive he or she is a legitimate representative of a company with which you regularly do business. If there's any question, ask for the caller's full name, title and department and tell him or her you'll call back. Use the business's phone number as posted on its website or on any mailed statement or correspondence you've received from the company. — ZoneAlarm Security Blog
Beware of "Computer Support" Calls
If you receive a phone call from a “technical support” person saying that you have a problem with your computer, just hang up. All such calls are SCAMS.
While this example deals specifically with computers, similar motives and techniques are used in other scams.
The person calling you is undoubtedly more technically adept than most users. They will attempt to convince you that your computer needs fixing, then obtain your credit card to bill you for an unnecessary support call.
All computers run slower over time. The caller will most likely make the problem worse (they are attempting to steal your identity and/or the use of your computer to attack other computers) as well as sell you bogus anti-virus software.
The caller will attempt to “prove” they are legitimate by getting you to visit their website. Don't! They aren't located in your country regardless of what the site they send you to indicates. Most are located in India or similar countries where consumer protection and fraud law are not easily prosecuted.
One trick is to have the victim click on the Windows Key + R keyboard combination to bring up the Run command, then have them type in “msconfig” (they'll spell it out) to open System Configuration and click on the services tab:
They scammer will then point out the stopped Microsoft services, calling them “errors” and telling them that their computer is about to crash.
These errors are NORMAL, but the caller wants you to panic and follow their advice. Most users are confused by the use of the keyboard commands and immediately feel out of their depth. This is intentional.
Now they'll get you to enter the same Windows Key + R keyboard combination, then www.google.com (which opens Google) and have you search for an older (insecure) version of TeamViewer.
When installed, this program will provide the caller with remote access to your computer without any of the newest security measures.
Remember, the caller has no advance information about your computer. All they have is their bag of tricks to try to scam you.
- Never provide remote access to your computer via TeamViewer or any other product.
- Never follow instructions to navigate to folders or type any instructions via your keyboard.
- Never provide or confirm any personal or computer information (including passwords, software versions or serial numbers, credit card numbers, etc.).
- Never visit websites or install software suggested by the caller.
Remote access or unknown software can allow the remote user to do ANYTHING on your computer, including install nefarious software or steal personal information.
If you follow their advice, you've waste your money on software that won't help protect your computer. Worse, it will likely make your computer more vulnerable, become a victim of identity theft and credit card abuse.
Don't be a victim! Just hang up.
Cleanup is Costly
Microsoft estimated the cost of cleaning up after a successful scam at $875.00 (and that was in 2011). More on these sites:
- Cold call tech support scams increasingly common.
- How to protect yourself from scammers (CRTC).
- ‘We're with Windows.’ The anatomy of a cold-calling scam.
- Avoid tech support phone scams — from Microsoft security.
- Listen to a scam computer virus call.
- 15% received a call (22% of them fell for the con).
- Microsoft takes on scummy tech-support companies has more hints about avoiding getting caught in this massively-profitable racket.
Don't be the next victim! Just hang up.
If You've Become a Victim
If you've fallen for one of these scams, don't be embarrassed. If you were the only victim, the crooks would be out of business. However, you do need to take some immediate measures to limit the damage, starting with reporting the crime.
If your computer was accessed, take your computer to a trusted computer professional to assess the damage. In some cases the computer many need to have a clean install (data backed up, operating system and software reinstalled, data restored) to ensure the computer is not infected. Service personnel can look for the signs of problems but no one can guarantee the computer is clean under these circumstances.
Your passwords may be compromised. Notify the companies involved and immediately change ALL your passwords.
If you used a credit card or provided banking details, you'll need to immediately notify your banking institutions.
Notify the police to report the potential identity theft and contact the Canadian Identity Theft Support Centre at 1-866-802-3609 for free, expert advice for Canadians who have become victims of identity theft.
If you become a victim, it will probably take you hundreds of hours and an average of $1,000 to recover from ID theft. Even worse, some innocent victims have ended up in prison because identity thieves have committed crimes in their names. — Scambusters.org
Check That Number!
There are resources that let you check out a phone number. These services depend upon reports from people like you that may have fallen victim to the scam or are simply concerned that it may be a scam.
- 800notes is a free reverse phone number lookup database built by its users.
- CallerSmart is a free service (or app) that allows you to find out who called or texted you.
Remember that unless you've called back using a number provided by the scammer, you don't know if the number showing on your call display is accurate. Would you allow your real number to display if you were about to con someone?
Unfamiliar messages. Passwords that no longer work. These are just two of the many clues that cybercriminals have gotten a hold of your password and broken into your [email] account. — ZoneAlarm Security Blog
Obtaining Information by Deceit
Phishing is a form of spam intended to obtain financial and personal information by deceit.
It takes advantage of vulnerabilities in some browsers and email programs but depends even more upon people's ignorance.
The intent is to steal your on-line identity — a crime commonly referred to as identity theft see the sidebar
The information gained will be used to by gaining access to your accounts or to establish new ones. Crimes may be committed in your name and your reputation may be destroyed.
There are huge personal and financial costs if you allow yourself to become a victim — $37 billion in 2010, (down from $56 billion the year before).
One thing that allows phishing and other identity theft practices to succeed is that most of the victims are using technology they don't understand.
- They use passwords that are easily guessed and often repeated everywhere.
- They use obsolete and vulnerable software rather than learning to use newer software with built-in safeguards.
- They are unwilling to learn about the risks or change their habits to reduce those risks.
Your ignorance is your downfall.
“Spear” phishing is harder to detect. It uses information about you obtained online but which makes the user appear to be someone you can trust. It may appear to come from a friend, but it is a scammer looking to steal from you.
The spear phisher thrives on familiarity. He knows your name, your email address, and at least a little about you. The salutation on the email message is likely to be personalized: "Hi Bob" instead of "Dear Sir." The email may make reference to a "mutual friend." Or to a recent online purchase you've made. Because the email seems to come from someone you know, you may be less vigilant and give them the information they ask for. And when it's a company you know asking for urgent action, you may be tempted to act before thinking.
- Don't take the Bait! is a excellent video about phishing from the Bank of Montreal.
- Spear phishing: scam, not sport.
Looks Can Be Deceiving
Phishing involves convincing you that you're seeing information from a legitimate source when you're not.
Phishing emails are designed to look like legitimate messages from actual banks, businesses, and other organizations. In reality, though, criminals created the message, usually in an effort to steal your money, identity, or both. They want you to click links that will take you to a website that looks authentic but is really just there to capture your credit card or other personal information or perhaps to distribute malware. — ZoneAlarm Security Blog
See ZoneAlarm's blog to learn more:
- 7 Ways to Spot a Phishing Scam.
- Ad Targeting: Trusting merchants, social media, and mobile providers with personal information.
- Email Hacked? Here is what to do.
- Several excellent older posts have been removed, but check the current listings.
Identity Theft is a Long-Term Problem
If you are the victim of identity theft, you can expect to fight to regain your credit rating for years — over and over again.
Victims report that it takes months or years to regain their credit rating, only to find that a new report forces them to start all over again.
While electronic data can quickly get you into trouble, financial institutions want physical (on paper) evidence that you're not responsible.
How Phishing Works
Going on a Phishing Expedition
Becoming a victim is easier than you might think. Let's have a look at the process from the perpetrator's point of view.
Remember, YOU are the intended victim of this trap.
Step One: Create a Fake Website
The first step is to set up a look-alike site that closely resembles a site that your victims are already using or could be using. The company's logo and other trademarked images are used to convey authenticity. (See the section on abusing transfer of trust.)
Proprietary Images Can be Hijacked
The “Google Docs” image (shown beside this text) was captured from a fake website.
I've seen a similar layout embedded into an email (one of the reasons you DON'T want to allow your email program to automatically load images).
If a site (or email) invites you to use your email address and password to log into Yahoo!, Gmail, Windows Live, AOL or other email account, DON'T! Always use an address sourced from a legitimate location.
However, for the purposes of this demonstration, let's assume that the victim (you) click on these links. You've now provided the scammer with the information they need to take over your email (or bank) account.
It Could Exploit Anybody
The message could exploit a bank (most have been targeted), Google Docs, e-Bay, PayPal or any site where you conduct business using a credit card or enter with a user name and password.
Step Two: Send Out an Email
Next, send an email message to thousands of potential victims (like you) indicating that there is a problem with their account, or that their account will be closed unless they go to the website and re-enter personal information, including their user name and password (or bank PIN).
Most such messages indicate that you have less than 24 hours or your account will be closed. (They don't want you taking time to think about it or contact the actual company where the account is located, do they?)
The following message is NOT from who you think:
Legitimate businesses will never ask for account or personal information; definitely not via email.
Not From Who You Think
*These links open in a new tab or window in your browser so you can compare them with the text above.
- How to view message headers on various email providers from Google help.
The message obviously didn't come from islandnet.com. Note the following problems:
- The “sender's” address (firstname.lastname@example.org) isn't from islandnet.com.
- Companies seldom use a free email service like Yahoo!. They use emails based upon a domain they own (e.g. islandnet.com).
- The headers show routing inconsistent with a message from Islandnet.
Scammers Getting Smarter
But you can't count on knowing based upon the email sender's address. Scammers often know how to forge headers to make it appear to come from a legitimate company.
Recently spam with the same message (probably from the same scammer) seems to come from a different email address every time (probably using addresses stolen because of lax password security).
Deceit Getting Cheaper
According to Symantec's 2015 Website Security Threat Report Part I, it costs as little as $0.50 to $10 per 1,000 stolen email addresses on the black market.
The Anatomy of an Email Scam
Don't get hooked.
HTML Email Hides Details
One of the dangers of "enhanced" or HTML email is that stuff can be hidden. How to look for it.
Firefox security features help you avoid problems with invalid or insecure sites.
Step Three: Collect the Information
The victim (you) clicks on the link and finds themselves on what they believe to be the correct site (remember, the perpetrator has created the site to look like the original), so they enter their user name or email address and password.
Of course, this information is not going where you think it is — you're sending it directly to thieves.
Step Four: Assume Your Identity
Taking your electronic identity (which you've just provided to them on the phishing site), the thieves go to the real site (such as your bank) and log into your account.
The information obtained in this manner is then used to either obtain funds from your account or to set up credit in your name.
Another Sort of Phishing Email
The example above is designed to lure you into providing account information and/or to visit a bogus website where you'll enter that information.
Scam with a Different Purpose
A message can also be designed to get you to send money via Western Union or some other method.
The following is the text of a message I received from a friend (with some identity information removed — indicated by the square brackets):
URGENT HELP NEEDED.......[my friend's first and last name]
I'm so sorry to bother you,but i really need your help at the moment, I came down here to Manila Philippines for a short vacation,unfortunately i got mugged at the park of the hotel i'm staying ,everything i had on me was stolen including,cash,credit cards and cell phone....I need help to settle the bills and flying back home, I'll surely pay back as soon as I get back home.The amount needed now is just $2,500 .. I'll surely pay back as soon as i get back home. I'm so confused right now and also want to let you know I was beaten up while trying to protect myself and had some scratches on me but his doing well now,You can have the money wire to my name and the address below via western union;
Receiver's Name: [my friend's first and last name]
Location: Manila, Philippines
Get back to me with the details, would definitely refund it back to you once i arrive Hopefully.
Am freaked out at the moment..... I need your Help
The sender hoped I'd reply with financial details so they could collect the funds themselves.
How I Knew It Was a Scam
The message appeared to come from this person's current email address, but there are several clues that this wasn't legitimate:
- The use of ALL CAPS in the subject line usually indicates a scam.
- The inconsistent or incorrect use of capitalization and punctuation indicates that English is not the sender's native language or they have poor grammar skills (the person they were impersonating is a professional writer and editor).
- The message was sent from the IP address 126.96.36.199 (found in the headers) which is in Ebene, Africa. (Remember, this person is supposed to be broke and in the Philippines.)
- The person was supposedly “beaten up” (yet only has “some scratches”).
- The person had no cash, credit cards or cell phone but was able to send an email to me.
- The message was sent to an email address that the sender would be unlikely to use when corresponding to me in such a circumstance.
The victim could have resolved her issues with a call to the credit card company. Not only would the hotel would have obtained a copy of a guest's credit card when the reservation was made (and verified it when the person checked in) but credit card companies provide the necessary help in such circumstances.
Address Owner Reports Bogus Message & Tightens Password
The real owner of the address did the smart thing and sent out a message to her contacts indicating that the original message was bogus and changed their account's password to something more secure.
Fake Emails Getting Better
Scammers are improving their techniques and their language skills. Grammar is improving and spear phishing techniques are resulting in more realistic looking email scams.
However, they'll still try to get you to respond quickly and without thinking too hard. Beware of these signals:
- The sender indicates they are out of contact but in dire need (like the example above).
- Any attempt to get your user name and password, especially when the form is either attached or embedded in the email message.
- Attachments are generally unnecessary in most messages. They are useful when sending documents, photos, etc. but an unexpected attached form or .zip file should probably not be opened.
- Altered or unusual links in the body of the message or its attachments.
- The presence of official looking logos attached to the message (most companies now use images hosted on a server).
How to Tell Fake Links
One of the methods commonly used to scam people are fake links in email messages.
Fake links drive unsuspecting traffic to sites that either
- pretend to be a legitimate site like a bank (in order to steal account information); or
- infect their computers with a virus (turning their computer into part of a botnet that attacks legitimate sites or attempts to infect other computers).
Where Does That Link Go?
You'd never click on a link that said, “scamming site” or “get your computer infected here.” That's why fake links exist.
Links Have Two Components
Hyperlinks on a website (and in an email) have at least two components:
- the hidden encoded address (the hyperlink where you are being sent); and
- the linked text (what you see highlighted in the link).
Only the hyperlink itself (the hidden part) determines where the link sends you.
Just as placing a Mercedes license holder onto a Ford doesn't turn it into a Mercedes, a misleading description doesn't change the link's destination.
Using the Status Bar
Remember I told you that the status bar was a valuable tool? If you hover over the link in a website or email message and look at the status bar at the bottom of the message, you'll see where the hyperlink is actually sending you.
Not All Links are What they Appear to Be
Take a look at the following link and then see where it leads you (a new window opens):
If you hover over the link and look in the status bar (some browsers show the hyperlink address in a small box above or below the link itself) you can tell without visiting the link's destination (strongly recommended when dealing with unknown sites and emails).
Just because the linked text says it is pointing towards www.mybank.com doesn't mean that is the real destination.
Learning More of the Mechanics
If you are interested in the mechanics of this process, have a look at Cut 'N Paste HTML Editing. It explains simple HTML and demonstrates how a simple HTML link works.
It is common for phishing emails to use shortened URLs (web addresses) created by services like TinyURL and bitly hide the destination address, but you can check these links before visiting the site. Paste the address into your browser's address bar with the changes noted below, then hit enter:
- TinyURL: add preview before the address (http://preview.tinyurl.com/c7b7ybm).
- bitly: add a + after the address (http://bit.ly/16M0Io3+).
You're taken to TinyURL or bitly with information showing about the true (full) destination for the shortened link. In these examples, all shortened links point back to this page.
Shortened links are common in Tweets (Twitter messages) because only 140 characters doesn't allow for long complex Web addresses. However, they are seldom needed in an email except where the length of a complex address wraps, potentially causing the link to break.
- Destination unknown: shortened URLs and your security.
- Short URLs considered harmful for cloud services (or PDF version).
How Can a Fake Site Exist?
First of all, people that set these fake sites up and send out the phishing emails wish to remain anonymous. They are breaking the law and don't want you (or the police) to be able to find them after they steal your identity.
The provided links are only up for a short time before they are removed by the financial institutions affected or by the legal authorities.
Forged links often point to a site in an educational institution where passwords and access are easy to come by. By their very nature, universities house a lot of smart and curious people. Smart as they are, too many don't view the issue of security as their problem. Because of a few people's lax attitudes, many will suffer significant financial setbacks.
Delete Attached Forms
More recent phishing attempts have provided an attachment to their messages which, when opened, replace the fake site with a form which accomplishes the same nefarious purpose — to get your information using deception. Don't be fooled. An unexpected attached form is likely an attempt at identity theft.
Configuring Your Software to Protect You
Whatever choices you make with your software, you'll want to take advantage of some advanced (and often hidden) features:
- Ensure that you can see the hints when your mouse hovers over a link or other hot spots on your browser.
- Use stronger passwords. There are complex online password generators as well as software to help remember more complex passwords.
- Learn how to view the headers in an email message, and the signs of a risky message.
- Ensure your antivirus, firewall and other security software (usually combined into one product) is current and updated daily.
- Windows users should ensure that all critical Windows Updates are installed, including the latest service pack.
- Ensure your browser and email software are current and updated. Stop using a product that is no longer maintained.
Advanced features are often hidden to provide for a cleaner, simpler look. Remember, software vendors don't have to pay to clean up problems that could have been prevented were these features enabled in a standard (default) installation.
If you need help determining how to configure your software and security protection, contact someone knowledgeable. Be careful when selecting your “expert” helper (especially if they call you). Remember, you're putting your trust in this person. I provide these services in Greater Victoria.
Get Help From Your ISP
Use whatever tools your ISP makes available to identify potential spam, phishing and other problematic email messages. Check your ISP's help or support website or call their help line.
I strongly recommend hosting with Islandhosting.com. They specialize in website hosting and can provide personal support when you need it. Their friendly, knowledgeable staff can deal with most email programs and services. Unlike some major ISPs, you're dealing with a real person that is knowledgable, not someone overseas with a script in front of them.
Transfer of Trust
A successful phishing scheme, like any con, depends upon gaining your trust.
They'll use your trust of your financial institution, major vendor (e.g. Microsoft) or other authority (CRA, CRTC, phone company, etc.). They know that if you believe they are who they say they are, then you'll be more likely to follow their instructions.
You trust the caller, web page or Internet link because it appears to be someone you trust.
The Internet Can Be Exploited
The original Internet was used only by scientists exchanging data. There was no need for high security.
But this has changed. The Web is used for e-commerce, personal transactions and more.
Browsers and enhanced (HTML) email messages can be exploited, particularly if you don't understand the language (HTML markup) or how to protect yourself.
Preventing Successful Phishing
There are a number of things that you can use to avoid being the victim of this type of attack:
- Be wary of any threats to close your account or emailed requests to re-submit billing and other personal information. Such requests for account information or passwords are NEVER legitimate.
- Be wary when using public computers. Your passwords, accounts and personal information can be retained by the browser's cache for later retrieval by anyone with access to that computer.
- Keyloggers can capture private information on any computer.
- Do not use open or untrusted secured wireless networks such as those at coffee shops and other public networks. Someone can be "listening in" on the transaction and obtain your user ID and password.
- Do not trust information emailed to you including any links to sites.
- Do not trust information on an unknown website.
Always use trusted sources to obtain the telephone number or website address to contact your financial institution or any site requiring personal information or a password. Google is not necessarily that trusted source, especially if you click on the sponsored links.
Report Identity Theft
If you have been a victim of identity theft (or suspect you have), contact the police to report identity theft.
Use a Safer Browser
Your Choice Matters
Your choice of web browser can make a difference in your ability to protect yourself online. Whichever browser you choose, the most recent will usually have improved security features and/or have known security issues patched.
Internet Explorer is not recommended for routine surfing and browsing sites on the Web. While IE may be convenient, it is so tightly integrated into Windows that any security issue in any Microsoft product puts your computer at risk.
Google Chrome has huge privacy risks, especially if you sign into your Google account while surfing (even if it is only for checking your Gmail). Google makes their money by exploiting information you provide. Google NEVER forgets.
Firefox is a much safer browser to use.
As an independent stand-alone product it is less vulnerable to cross-program security issues. Because it isn't tied to an operating system or to a search company, it can focus on its users rather than those controlling the purse strings. It can perform all the features needed in a browsers without the downside.
Have a look at some of the built-in security features of Firefox:
- Firefox designed to protect your privacy.
- Firefox's Private Browsing allows you to surf without saving information about the sites and pages you've visited or are cookies or passwords saved.
- Firefox gets a fresh update of forgery sites a whopping 48 times a day!
Firefox is also updated frequently, so security fixes and new benefits are available sooner.
Anti-Phishing Tools & Information
These tools and information sites will help you to learn more about phishing and provide you with tools to verify suspect websites and files.
I urge caution when using these tools. Be sure you understand the terminology and understand the risks.
Checking Out Suspicious Websites
Check to see if a site has been flagged for phishing:
- PhishTank is a collaborative clearing house for data and information about phishing on the Internet.
- urlQuery.net is a service for detecting and analyzing web-based malware.
- CSI: ACE Insight allows you to check for malicious sites.
Check the site's information and/or disclaimer pages so you understand the capabilities and shortcomings of the service. The following is from urlQuery's About page but can be applied to most such services:
Currently no service or security solution provides 100% detection of malicious content. The data provided is to help give a second opinion and should not be taken as fact. As with other sandbox technologies it can be detected which can skew or make the results inaccurate. Other issues might include browser incompatibilities or settings/configurations within the browser.
Checking Out Suspicious Files
Be cautious when checking out suspicious files. In most cases you're safer simply deleting the email along with the unopened suspect file unless you were expecting it from a trusted source.
If your antivirus program detects a problem with an attachment, you'd best delete it rather than having the antivirus program treat it even if it is an essential file sent from a trusted computer.
You're best to discard it rather than risk infecting your own computer by opening the attachment. Instead, print out a copy of the file on the original computer while disconnected from the Internet. The original computer needs to have a full security scan with a current and updated software.
- Tools for foiling malicious links and files lists a number of sites where you can upload suspect files you received as attachments.
- CSI: ACE Insight allows you to upload suspect files you received as attachments.
More About Phishing
The following sites deal with phishing.
- Anti-Phishing Working Group on preventing phishing fraud.
- Securities-Fraud.org on preventing phishing fraud.
- Citibank Phishing Email is an example of how phishing works.
- Secunia has vulnerability management tools for consumers and corporations.
419, fiction by Will Ferguson, looks at the issue of phishing from both the victim's and perpetrators views. Strongly recommended.
419 takes readers behind the scene of the world's most insidious internet scam. When Laura's father gets caught up in one such swindle and pays with his life, she is forced to leave the comfort of North America to make a journey deep into the dangerous back streets and alleyways of the Lagos underworld to confront her father's killer. What she finds there will change her life forever… — GoodReads
Updated: June 1, 2016