These are the latest scams and online threats you should understand and avoid to protect your sensitive personal and financial information.
WannaCrypt, WannaCry, WCry Ransomware
As many of you know, a worldwide ransomware attack, borrowed from leaked NSA exploits was unleashed Friday, May 12 2017. It exploited a known vulnerability in Windows operating systems that Microsoft released a patch for on March 14, 2017. The malware is no longer in the wild however, it's likely that will change and the next one will be more sophisticated.
Once the malware finds a computer missing the patch, it does two things:
- Encrypts all the files on the computer; and
- Looks for other computers on the network to infect.
Like other ransomware variants, files remain encrypted until a ransom in the form of Bitcoin is paid.
What is looks like
Below is an example of what the ransomware screen looks like.
What should you do?
- Keep your computers, tablets and smart phones up-to-date with patches.
- Run anti-virus software on all computers, tablets and smart phones and keep it up to date.
- Avoid clicking on email links especially from unknown sources. Launch a browser and go directly to the web site instead. At the very least, hover over links before clicking to see if they look legitimate.
- Legitimate organizations will not ask for sensitive information through unsecured communications such as email. Nor will they make threatening phone calls.
- Do not open attachments from unknown sources.
- Avoid calling phone numbers in suspicious emails.
IRS, States and Tax Industry Warn of Last-Minute Email Scams
IR-2017-64, March 17, 2017
WASHINGTON — The Internal Revenue Service, state tax agencies and the tax industry today warned both tax professionals and taxpayers of last-minute phishing email scams, especially those requesting last-minute deposit changes for refunds or account updates.
As the 2017 tax filing season winds down to the April 18 deadline, tax-related scams of various sorts are at their peak. The IRS urged both tax professionals and taxpayers to be on guard against suspicious activity.
The IRS, state tax agencies and the tax industry, acting as the Security Summit, enacted many safeguards against identity theft for 2017, but cybercriminals are ever evolving and make use of sophisticated scams to trick people into divulging sensitive data.
For example, one new scam poses as taxpayers asking their tax preparer to make a last-minute change to their refund destination, often to a prepaid debit card. The IRS urges tax preparers to verbally reconfirm information with the client should they receive last-minute email request to change an address or direct deposit account for refunds.
The IRS also suggests that tax professionals change and strengthen their own email passwords to better protect their email accounts used to exchange sensitive data with clients.
This is also the time of year when taxpayers may see scam emails from their tax software provider or others asking them to update online accounts. Taxpayers should learn to recognize phishing emails, calls or texts that pose as familiar organizations such as banks, credit card companies, tax software providers or even the IRS. These ruses generally urge taxpayers to give up sensitive data such as passwords, Social Security numbers and bank account or credit card numbers.
Taxpayers who receive suspicious emails purporting to be from a tax software provider or from the IRS should forward them to firstname.lastname@example.org. Remember: never open an attachment or link from an unknown or suspicious source. It may infect your computer with malware or steal information. Also, the IRS does not send unsolicited emails or request sensitive data via email.
The Security Summit maintains a public awareness campaign for taxpayers – Taxes. Security. Together. – and an awareness campaign for tax professionals – Protect Your Clients; Protect Yourself – as part of its effort to combat identity theft.
Follow the IRS on Social Media
Subscribe to IRS Newswire
Protect Your Security Online
Make your password difficult to guess: it should be at least 8 characters long. Longer is better. Use a complex combination of numbers, letters and punctuation marks when possible. Use a passphrase (two or more words), an acronym or a combination.
Don't share your login information with anyone for any reason. Scammers can create fake websites that look like the website you're trying to visit. They will ask you to log in their fake website in order to get your information. As a rule (there are exceptions), don’t click on links or open attachments, especially office suite documents that can contain malicious macros. Rather, launch your browser and browse to the site using Favorites or Bookmarks. If you choose to click a link, hover over it first to see if it looks legitimate. Always check the website's URL before you enter your login information. When in doubt, type the web address into your browser to get to the correct page.
If you aren't sure of where a link will take you, don't click on it - even if it comes from a friend, family member, or a company you are familiar with. Be extremely skeptical of any link in a social network, even if it looks like it was sent by someone you know. Stick to reliable sources that you recognize and trust for your news gathering--especially when a story or event is sensational.
If you receive an email claiming to be from a friend, family member, or company you are familiar with, but something seems off - call your friend, family member to report it. When in doubt, don't click on links and don't respond to the email.
Report any suspicious activity. If you receive a strange email, see strange posts, or get a strange phone call from a company you a familiar with, such as Empower, contact that company and let them know.
Get more information about Avoiding Online Thieves
and protecting yourself on social media
YAHOO! Data Breach
Yahoo recently announced that 500 million of their accounts were hacked and are being sold by internet criminals. This is believed to be the largest ever publicly disclosed data breach by a company. Bad guys are going to use this information in a variety of ways. For instance, they will send phishing emails claiming you need to change your Yahoo account, looking just like the real ones. Here is you should do right away:
- Open your browser and go to Yahoo. Do not use a link in any email. Reset your password and make it a strong, complex password or rather a pass-phrase.
- If you were using that same password on multiple websites, you need to stop that right now. Doing so is an invitation to get hacked. If you did use your Yahoo passwords on other sites, go to those sites and change the password there too.
- Change the security questions and make the answers something that is not obvious. Security questions and answers were stolen too in this breach.
- Use a free password manager that can generate hard-to-hack passwords, keep and remember them for you.
- Watch out for any phishing emails that relate to Yahoo in any way and ask for information. Do not click on links or open attachments in the messages. The real Yahoo email does not ask you to click on links or contain attachments.
Now would also be a good time to use Yahoo Account Key, a simple authentication tool that eliminates the need to use a password altogether.
Scam of the Week - Fake Security Emails
There is a new scam you need to watch out for. In the last few years, online service providers like Google, Yahoo and Facebook have started to send emails to their users when there was a possible security risk, like a log-on to your account from an unknown computer.
Bad guys have copied these emails in the past, and tried to trick you into logging into a fake website they set up and steal your username and password. Now, however, they send these fake security emails with a 1-800 number that they claim you need to call immediately.
If you do, two things may happen:
1) You get to talk right away with a real internet criminal, usually with a foreign accent, that tries to scam you. They claim there is a problem with your computer, "fix" it, and ask for your credit card.
2) You get sent to voice mail and kept there until you hang up, but your phone number was put in a queue and the bad guys will call you and try the