Scams & Cons

Why am I being forced to reset my password? It’s a question I asked just this week when I tried to log into Canva and was told I needed to reset my password. I hadn’t used my Canva account in months and hadn’t received an email notification about a data breach, so I went in search of answers.

Option 1 – Canva data breach

Surprise! Not really. Canva suffered a data breach on May 24, 2019. According to Canva, someone hacked their user profile database and gained access to information for 139 million users. Canva says the stolen passwords were encrypted, which would make them unusable, but the attacker also viewed files containing partial credit card and payment information. In this case, the simplest, most obvious answer is the right one. Yet another data breach.

Option 2 – companies are being proactive

There have been so many of these massive data breaches over the past few years that some companies are starting to take a proactive approach. According to Brian Krebs at KrebsOnSecurity.com some companies are now testing their users’ passwords against lists of login credentials stolen in data breaches. The process goes something like this:

1. The company checks its list of user account logins against the stolen credentials list.
2. If the company finds a match, they mark the user account for further testing. If there is no match, they skip that login and move on to the next.
3. User accounts that were marked for testing are checked by comparing the stolen password against the account password the company has on file. If the passwords are a match, the company forces the user to reset his password on his next visit.

Dealing with broken password syndrome

If you’re one of those people who uses the same password multiple times, you could find yourself forced to reset your password even though your account might not have been hacked. Annoying as this may seem, it’s actually a good practice and should help curb the desire of users to take a lax approach to security.

Tip 1 – manage your passwords

There are plenty of software solutions for managing passwords. I’ve used 1Password for nearly a decade now and couldn’t function without it. If a website forces you to reset your password for any reason, see that the new password is in your list and the inconvenience will be minimal.

Tip 2 – manually reset your password

When I was resetting my password for Canva, I accidentally missed saving my new password. Problem? Not at all. The next time I need a password for Canva, I’ll just manually reset and store it. Voila. No muss. No fuss. And no broken password syndrome.

A new friend request…what a great feeling, right? Don’t clap your hands in glee and merrily hit the Accept button, though. Otherwise you could set yourself up for trouble. In the age of social media, Facebook friend requests—and the scams they spawn—are an integral part of our online lives. From recognizing the fraud to knowing how to deal with it, here are 3 tips to avoid fake Facebook friend requests.

The fake Facebook account

Setting up a fake account on Facebook is a quick and simple process. It takes no special skills, just a willingness to put in a little time. Here’s how it’s done.

• Create a new email address using a service such as Yahoo Mail or Gmail. This email address is how Facebook authenticates a new user.
• Find a profile on Facebook to copy and grab as much information as possible. The idea is to make the new account look real, which means there should be some photos, personal information, etc.
• Begin sending friend requests.

Tip 1: Recognizing fake Facebook friend requests

With fake accounts being so easy to set up, the trick to recognizing one is the ‘authentic factor’ of the account. To appear authentic, there needs to be personal information, photos, etc. When a friend request comes in, visiting the profile is the only way to check them out.

Here are a few things to look for:

• How long have they been on Facebook? Find out easily by checking the Timeline for how many posts this person has added to their Timeline and when they added those posts.
• Have they posted photos? How many? When?
• Do they already have other friends? A new account will have only a few friends.

Tip 2: Why is this person asking to be your friend?

It could be because you’re incredibly popular—that’s heartwarming. Or maybe someone just wants to scam you. That sucks.
You can find much of the reason behind a new friend request in the requestor’s profile. The two red flags to watch out for are: is this someone looking for romance, or is this is an existing friend with a new, duplicate profile? If either of these flags are waving, be especially cautious.

Tip 3: The immediate reply

You checked out the new friend request. You thought it looked legit. And you accepted. The next thing that happens is a message to the effect of ‘Hi, how are you doing?’ It’s easy for these people to engage in a conversation. They’ve done it a hundred times before and know every trick—ask leading questions, slowly make things more personal, get the subject comfortable before getting to the real reason for the contact—money.

I make it a point to check out every friend request I receive. Most of the time, the requests fail on the first step. Sometimes, they make it to the second. And I even had one recently get to the message stage.

At that point, I immediately unfriended the person and reported them to Facebook. At least that way I knew I hadn’t assisted them in finding more victims.

Did you see last month’s scam tip? It was Why does Amazon condone scam emails?

Why does Amazon condone phishing emails? You could substitute any big business name such as Apple, Starbucks, or Walmart, and ask the same question. Over the years, I’ve written about all of these companies and many more. From big banks to the Social Security Administration itself, they’ve all been the lure used by scammers. They, just like those who were taken in by the scams, were the victims. So, the question I often hear is why don’t they do something about it?

Third-party emails are like a Halloween party

I know, the comparison seems crazy at first, but a third-party email is nothing more than one person posing as another. Some people go all out when they dress up for Halloween. Others, those who don’t have the expertise or commitment, aren’t nearly as convincing. We see right through their disguise and come away from the experience unconvinced.

A third-party email works exactly the same way. The sender poses as someone else. He doesn’t contact Amazon to ask for permission. He just does it. After the fact, Amazon may learn that someone has been sending emails using their logo and name, but by then the smart scammer has already moved on.

Amazon provides resources to fight phishing email

To use another analogy, phishing emails are a disease that can only be treated after it occurs. The same disease exists for authors whose books have been pirated (it’s happened to me, many times), victims of in-person scams, or any other crime.

The only thing Amazon can do is provide a mechanism to report the problem. They don’t want scammers impersonating them, but there is no way for Amazon to prevent abuse of their name or logo. If you’ve received an email and would like to report it, use this link to visit Amazon’s page for reporting phishing emails.

Ed McMahon might have passed on, but Publishers Clearing House (PCH) is still hitting the streets and giving away money. That’s right, a new version of the Publishers Clearing House sweepstakes is alive and well…and it’s not a scam. Unless, of course, it is.

The catch

I still recall seeing Ed McMahon on TV going to a house with a camera crew and ‘surprising’ the resident with a check for a million dollars. These days, the contest has moved from a lump-sum payout to an annuity of $5,000 a week for life. Actually, with the current contest it’s $7,000 a week for life, but who’s going to quibble over a couple of grand a week? Right?

Here’s the catch. Scammers are using a Publishers Clearing House or PCH scam via both phone and email. Victims have reported being told they’ve won prizes like the current $5,000 a week payout, a check for $2.5 million cash, and/or a car. The perpetrator may ask for payment via Western Union or a Walmart money order to cover the ‘taxes’ on the prize. In other cases, they merely ask for bank account information or a social security number to enable them to send the prizes.

The tip

The PCH scam appears to be most effective with senior citizens and is likely receiving a big boost because the real PCH will televise their next big payout on April 26th on NBC. In any case, don’t be fooled. Publishers Clearing House never calls to tell you you’ve won. They send notifications via registered mail, and they don’t ask for money to cover ‘taxes.’

Social Security scams—the new wave

The Inspector General has warned consumers to beware of robocalls from the main Social Security number. This warning comes in response to an increase in Social Security scams. Thanks to technological advances, scammers are now able to trick CallerID into displaying almost any number they choose. Is it any wonder the bad guys have chosen the number for an organization millions of older Americans rely on to do their worst? Welcome to the new Social Security scam.

CallerID Spoofing

For many years, telephone scams became less common because they weren’t cost-effective for scammers. But thanks to advances in technology, scammers use CallerID spoofing and a robodialer to make calls for very little money.

You may be familiar with those fake ‘local numbers’. In our case, our cell phones use a 208 prefix. We receive calls from other 208 numbers regularly, but have learned the calls are really a robocall and a phishing attempt.

Just like those calls that appear to be coming from a local number, scammers have zeroed in on the Social Security Administration. This is a real problem for consumers. The SSA has always been a trusted organization. Now, the scammers are leveraging that reputation to trick consumers.

Request for personal information

According to the Social Security Administration announcement, “People who have accepted the calls said the caller identifies as an SSA employee. In some cases, the caller states that SSA does not have all of the person’s personal information, such as their Social Security number (SSN), on file. Other callers claim SSA needs additional information so the agency can increase the person’s benefit payment, or that SSA will terminate the person’s benefits if they do not confirm their information. This appears to be a widespread issue, as reports have come from citizens across the country.”

How to avoid Social Security scams

Tip #1: Never answer a call from a number you don’t recognize. Personally, unless I have a pressing reason, I never answer the phone unless the number is already in my address book.

Tip #2: You should still be cautious about answering even if the caller is in your address book. Why? Your phone will display the contact information for any number in the address book, even if the CallerID is being faked.

Tip #3: Never give out personal information on the phone unless you know exactly who you’re dealing with. That means getting numbers for companies from their websites, not from materials they send you.

The only way to avoid these scams is to be vigilant. Why not leave a comment to let me know if you found this tip helpful? I’d love to hear from you.