Scams & Cons

I had just started to write this month’s scam tip when I received an undeliverable message alert in my email. The message had the subject line, “I hacked your device info@terryambrose.com and you have a problem now…” Not being one to overlook divine intervention (or pure dumb luck), I decided I’d found my November scam tip.

How the “I hacked your device” scam works

So, what’s the deal with the “I hacked your device” email scam? Is it a scammer, or was my device really compromised? While it’s impossible to tell as I write this tip, there is a very high probability this is a scam. In all likelihood, nobody has compromised my device. I’ve lost no data. It’s just a guy who sent me an email in hopes I would pony up money because of his threats.

The bottom line is this is an extortion racket. In the old days, it was two burly guys who showed up in person and demanded money for someone named Vinny. These days, it’s all done online—and is mostly anonymous.

What you can do about this scam

My solution for this email was to look at the source information. According to that, the email came from an IP address that belongs to a company called INAP. On their About page, I discovered that INAP’s mission is to provide “Empowering purposeful, performance-driven IT transformation at global scale.” Their mission sounds pretty ambitious to me, so I sent a message to their “abuse” email and reported the scam.

I received a response about 48 hours later telling me the sender’s information had been spoofed, the originating address was not on the INAP servers, and advising me I should change my login credentials for my email account. Sigh…so much for justice. On the flip side, that email address isn’t even real, so there’s nothing for me to change.

3 tips to deal with the I hacked your device scam

Tip 1: Don’t pay money to someone who claims they have compromised your device. I don’t know the odds on this, but it’s a long shot that the person contacting you is telling the truth. Most likely, they’re looking for an easy buck.

Tip 2: Keep your device software current. By downloading the most up-to-date versions of the apps you use, you’ll minimize your risk. This advice applies to all of your software, not just that designed to handle viruses and malware.

Tip 3: Never connect to an unknown network. In these days of mobile devices and our never-ending thirst for internet bandwidth, it’s tempting to make use of any available internet connection. But, before you sign onto a network, be sure you know who’s running it. Is it a business you frequent? If so, happy surfing. If not, think about finding a different way to satisfy that thirst.

Dear Citizen — unless you’ve been living off the grid, you’ve heard this phrase. The people behind it want you to believe they can cut off your social security benefits…or send you to jail…or some equally preposterous claim. The problem is, this scam is a big deal in 2019 and people are falling for it.

Tip 1: Save your sanity—press End Call, not 1

The sad truth is robocall scams work. The bad guys can spoof phone numbers almost at will. What this means is the number displayed by Caller ID is worth zip. The good news is this scam uses a recording to move you to the next step, i.e., talking to a real person.

The scam begins with the opening line of this post—Dear Citizen. After that, there will be a warning, and after that, the opportunity to make your local scammer happy by pressing 1. Don’t do it. Pressing 1 will do exactly the opposite and put you into scam-victim hell.

Tip 2: Watch for the tentacles

Many people wonder why they can’t just block the number and be done with this scam forever. Here’s the reality check—these calls are big business. Think of this scam as something like an octopus. but with a lot more tentacles. Each tentacle is trying to reach you and pull you in. Cutting off one doesn’t stop the others.

Stopping scams like this will require better technology from the phone companies, but until they provide those solutions, hanging up is your best bet. Blocking the number that was used will prevent more calls from that particular number, but won’t stop calls from other numbers.

Tip 3: Watch your step—outsmarting scammers is a slippery slope

I’ve seen plenty of comments all over the Internet by people who said they strung the scammer along, threatened to report him to the police, said they were with law enforcement, etc. Sure, that works most of the time, but is the thrill of beating these guys at their own game worth the risk?

Do you have a solution that’s worked well with robocall scams? Leave a comment, I’d love to hear it.

Why am I being forced to reset my password? It’s a question I asked just this week when I tried to log into Canva and was told I needed to reset my password. I hadn’t used my Canva account in months and hadn’t received an email notification about a data breach, so I went in search of answers.

Option 1 – Canva data breach

Surprise! Not really. Canva suffered a data breach on May 24, 2019. According to Canva, someone hacked their user profile database and gained access to information for 139 million users. Canva says the stolen passwords were encrypted, which would make them unusable, but the attacker also viewed files containing partial credit card and payment information. In this case, the simplest, most obvious answer is the right one. Yet another data breach.

Option 2 – companies are being proactive

There have been so many of these massive data breaches over the past few years that some companies are starting to take a proactive approach. According to Brian Krebs at KrebsOnSecurity.com some companies are now testing their users’ passwords against lists of login credentials stolen in data breaches. The process goes something like this:

1. The company checks its list of user account logins against the stolen credentials list.
2. If the company finds a match, they mark the user account for further testing. If there is no match, they skip that login and move on to the next.
3. User accounts that were marked for testing are checked by comparing the stolen password against the account password the company has on file. If the passwords are a match, the company forces the user to reset his password on his next visit.

Dealing with broken password syndrome

If you’re one of those people who uses the same password multiple times, you could find yourself forced to reset your password even though your account might not have been hacked. Annoying as this may seem, it’s actually a good practice and should help curb the desire of users to take a lax approach to security.

Tip 1 – manage your passwords

There are plenty of software solutions for managing passwords. I’ve used 1Password for nearly a decade now and couldn’t function without it. If a website forces you to reset your password for any reason, see that the new password is in your list and the inconvenience will be minimal.

Tip 2 – manually reset your password

When I was resetting my password for Canva, I accidentally missed saving my new password. Problem? Not at all. The next time I need a password for Canva, I’ll just manually reset and store it. Voila. No muss. No fuss. And no broken password syndrome.

A new friend request…what a great feeling, right? Don’t clap your hands in glee and merrily hit the Accept button, though. Otherwise you could set yourself up for trouble. In the age of social media, Facebook friend requests—and the scams they spawn—are an integral part of our online lives. From recognizing the fraud to knowing how to deal with it, here are 3 tips to avoid fake Facebook friend requests.

The fake Facebook account

Setting up a fake account on Facebook is a quick and simple process. It takes no special skills, just a willingness to put in a little time. Here’s how it’s done.

• Create a new email address using a service such as Yahoo Mail or Gmail. This email address is how Facebook authenticates a new user.
• Find a profile on Facebook to copy and grab as much information as possible. The idea is to make the new account look real, which means there should be some photos, personal information, etc.
• Begin sending friend requests.

Tip 1: Recognizing fake Facebook friend requests

With fake accounts being so easy to set up, the trick to recognizing one is the ‘authentic factor’ of the account. To appear authentic, there needs to be personal information, photos, etc. When a friend request comes in, visiting the profile is the only way to check them out.

Here are a few things to look for:

• How long have they been on Facebook? Find out easily by checking the Timeline for how many posts this person has added to their Timeline and when they added those posts.
• Have they posted photos? How many? When?
• Do they already have other friends? A new account will have only a few friends.

Tip 2: Why is this person asking to be your friend?

It could be because you’re incredibly popular—that’s heartwarming. Or maybe someone just wants to scam you. That sucks.
You can find much of the reason behind a new friend request in the requestor’s profile. The two red flags to watch out for are: is this someone looking for romance, or is this is an existing friend with a new, duplicate profile? If either of these flags are waving, be especially cautious.

Tip 3: The immediate reply

You checked out the new friend request. You thought it looked legit. And you accepted. The next thing that happens is a message to the effect of ‘Hi, how are you doing?’ It’s easy for these people to engage in a conversation. They’ve done it a hundred times before and know every trick—ask leading questions, slowly make things more personal, get the subject comfortable before getting to the real reason for the contact—money.

I make it a point to check out every friend request I receive. Most of the time, the requests fail on the first step. Sometimes, they make it to the second. And I even had one recently get to the message stage.

At that point, I immediately unfriended the person and reported them to Facebook. At least that way I knew I hadn’t assisted them in finding more victims.

Did you see last month’s scam tip? It was Why does Amazon condone scam emails?

Why does Amazon condone phishing emails? You could substitute any big business name such as Apple, Starbucks, or Walmart, and ask the same question. Over the years, I’ve written about all of these companies and many more. From big banks to the Social Security Administration itself, they’ve all been the lure used by scammers. They, just like those who were taken in by the scams, were the victims. So, the question I often hear is why don’t they do something about it?

Third-party emails are like a Halloween party

I know, the comparison seems crazy at first, but a third-party email is nothing more than one person posing as another. Some people go all out when they dress up for Halloween. Others, those who don’t have the expertise or commitment, aren’t nearly as convincing. We see right through their disguise and come away from the experience unconvinced.

A third-party email works exactly the same way. The sender poses as someone else. He doesn’t contact Amazon to ask for permission. He just does it. After the fact, Amazon may learn that someone has been sending emails using their logo and name, but by then the smart scammer has already moved on.

Amazon provides resources to fight phishing email

To use another analogy, phishing emails are a disease that can only be treated after it occurs. The same disease exists for authors whose books have been pirated (it’s happened to me, many times), victims of in-person scams, or any other crime.

The only thing Amazon can do is provide a mechanism to report the problem. They don’t want scammers impersonating them, but there is no way for Amazon to prevent abuse of their name or logo. If you’ve received an email and would like to report it, use this link to visit Amazon’s page for reporting phishing emails.