This week’s first scam comes courtesy of the U.S. Postal Service. From an article online, “USPS® and the Postal Inspection Service are aware of the circulation of a fake email/email scam claiming to be from USPS officials including the Postmaster General.
Got an Amex or a Chase credit card? Then you were the target of a new phishing campaign this week. According to Information Security Buzz, “A new phishing campaign involves scammers sending fake Chase and Amex fraud protection emails asking users if the listed card transactions are valid. Victims who click the no button in the message to dispute the transactions will be redirected to a fake yet legitimate-looking Chase or American Express login site where they will go through a fake verification process that invites them to enter their username, password, birth date, social security number, as well as their bank and credit card information.” (more…)
Our first scam of the week “Says it will pay for data breaches.” Really? You don’t say?
“A new phishing scam that masquerades as a U.S. government consumer agency is supposedly paying data breach victims for the loss of their personally identifiable information. Instead, once consumers enter their name, birthdate, credit card number and Social Security number, you can probably guess what happens next.” Yes, we can.
You know it’s a bad week when the scam of the week involves professional sports teams’ social media accounts getting hacked. From SC Magazine, “According to multiple news sources, the hackers compromised the NFL’s league Twitter and Facebook account, as well as social media accounts belonging to the Buffalo Bills, Arizona Cardinals, Chicago Bears, Cleveland Browns, Dallas Cowboys, Denver Broncos, Green Bay Packers, Houston Texans, Indianapolis Colts, Kansas City Chiefs, Los Angeles Chargers, Minnesota Vikings, New York Giants, Philadelphia Eagles, San Francisco 49ers and Tampa Bay Buccaneers.” A lot of teams lost this week…and they didn’t even play.
FedEx is back in the news for…phishing scams. According to the Tullahoma News, “Law enforcement is warning about a new FedEx phishing scam. The company’s customers from across the country, including locals, have received a text message showing a tracking code and asking to click and set delivery preference. The link is fraudulent.”
Think you’re getting paid back for that data breach? Think again because it’s a scam. According to Kim Komando, “Scammers appear to have set up a website claiming to be run by the ‘US Trading Commission’ that promises financial compensation for the leakage of personal data.” There’s only one problem with this. There’s no such thing as the US Trading Commission. “Instead, this highly detailed fraudulent website preys upon hapless data breach victims.”
(San Diego, CA – January 16, 2020)
DuoCircle is pleased to announce that it recently received its AICPA Service Organization Control 2 (SOC 2) Type 1 Report. This report provides detailed information regarding DuoCircle’s policies and controls relevant to security, availability, and confidentiality of data. DuoCircle meets the SOC 2 standards for Security and Availability Trust Services Principles with zero exceptions listed.
If it’s in the news, it will probably be used in a scam shortly thereafter, and such was the case this week. According to an article on Bleeping Computer, “An attacker is attempting to take advantage of the recent warnings about possible Iranian cyberattacks by using it as a theme for a phishing attack that tries to collect Microsoft login credentials.”
There were pre-holiday phishing attacks and holiday phishing attacks. So, it should come as no surprise that there are post-holiday phishing attacks. According to KLFY.com, phishing emails are targeting shoppers with post-holiday offers.
“Here’s how the scam works: You receive an unsolicited email or text message that appears to be from a major retailer claiming you have a new reward. Experts have seen scammers use the names of Amazon, Kohls, and Costco… but any company can be spoofed. You open the message, and it looks real. It includes a company logo, colors, and a link to claim the reward points or gift from your recent holiday shopping.” You’ve been warned.
(San Diego, CA – January 8, 2020)
DuoCircle is a cloud-based email security solutions company and DuoCircle is offering a Free MX Backup Services account to help ease some of the business impact that the fires have had on Australia.
Hackers are at it again using PayPal to dupe unsuspecting users into stealing their data. According to The Payers, “researchers have spotted an ongoing phishing campaign targeting PayPal customers, where hackers are trying to gain access to customers’ credentials to the payment service.”
The article went on to say, “Targeted customers receive emails camouflaged as ‘unusual activity’ alerts warning them of suspicious logins from unknown devices, with the hidden purpose of stealing all their credentials and financial info. To make sure that the potential victims are willing to click on the link embedded within the phishing message, the attackers say that their accounts are limited until they are secured by confirming their identity.”
Like to play video games? Then you’re a target for a phishing scam. This week’s scam of the week, courtesy of Meta Compliance, is targeted at PlayStation users.
According to the article, “PlayStation users are being warned that scammers are disguising themselves as The Elder Scrolls Online developers in a bid to trick players into disclosing their login credentials. The crooks are targeting PlayStation users via private messages that state their account will be banned if login credentials are not provided within 15 minutes.”
Did you think AOL was dead? Well it isn’t. And it’s being used to scam people with phishing emails. According to Scamicide, there is “a phishing email presently circulating that attempts to lure you into clicking on a link in order to continue using your AOL account. If you click on the link two things can occur and both are bad. Either you will end up providing personal information to an identity thief or you will. merely by clicking on the link, download dangerous malware such as ransomware on to your phone, computer or other device.” Not good.
If there’s one thing you should be able to trust, it’s an email from someone with a “.gov” domain. As in, they work for the government. Surely, only those in the government can register a .gov top level domain. Right? Wrong!
From an article on KnowBe4, “a researcher said he got a .gov domain simply by filling out and emailing an online form, grabbing some letterhead off the homepage of a small U.S. town that only has a ‘.us’ domain name, and impersonating the town’s mayor in the application.” Huh?
Netflix returns this week in our Scam of the Week section. No real surprises here. According to IT Security Guru, “You may get an email that has the official Netflix logo on it which would say that your payment for the month was not able to go through because of some problem with your bank. The email would then go on to say that if you don’t log in and check your payment details you could potentially end up losing access to your account. Needless to say, when you click the link and log in you will end up giving your account details away to someone that would use them for malicious purposes.”
Didn’t even know Facebook had a lottery. Apparently it doesn’t, but that doesn’t stop fraudsters from using it to scam people.
According to ID Theft Center, “The Facebook Lottery Scam is certainly nothing new, but what makes this version different is the accompanying image of a certificate of authenticity made out to the recipient. In this version, which typically comes through private messages on Facebook due to lack of email security service, someone contacts you to let you know that you’ve won, and then informs you that you must show up in person to collect your winnings.
Are you an accountant looking for an opportunity to work from home? Be careful, you may be a victim of a phishing scam. That according to the South Carolina Association of CPAs. From the association’s website, “A job hiring scam that advertises a fraudulent work from home accountant opportunity tricks jobseekers into laundering money, warns John LaCour, the founder of Charleston-based cybersecurity firm PhishLabs.”
This week’s scams exploit people’s greed, desire to go on vacation and desire to be entertained. This first one is greed. If you have an account with Yahoo, and most people do, then you probably received an email from them this week regarding their Security Breach Proposal Settlement. Or did you?
If there’s money to be had, you know the bad guys will jump on it. According to the security training firm KnowBe4, “The bad guys are going to use the ‘urgency’ trick. The settlement is a set amount, meaning there’s only so much cash to go around. If too many people sign up for the cash option, they will have to split the pool. If someone had to spend time or money dealing with identity theft or other problems they believe stemmed from the Yahoo hacks, they can file a claim for up to $25,000 in out-of-pocket losses. All in all, enough bait to trick people.”
We start this week with a repeat offender. From the Daily Mail, news comes that “Scammers have targeted Netflix customers in Australia with an email scam aimed at getting their bank account details. The emails included a link for people to reactive their subscription, which takes them to a Netflix branded phishing page. Once the user logs into their account, they are taken to what appears to be a Netflix account page, with a notification at the top stating their account has been suspended and payment information needs to be updated.”
Use your campus library much? You may be the target of the latest phishing scam. According to SC Magazine, ” The Mabna Institute, an Iranian firm whose members were indicted last year for cyberattacks against U.S. universities and other organizations, appears to have launched a new global phishing operation targeting the education sector last July and August.”