Online Crime Bytes

Beware of Scam Callers Claiming ZERO TAX program

With tax season underway, malicious scammers are amping up their campaigns against us. If you are getting any type of unsolicited calls or texts, please delete them and deal with the tax service you normally use instead. Also don't answer calls from numbers you don't recognize, just let them go to voice mail. And even then, don't respond to unsolicited requests to call them back.

Today, I got a scam voicemail from a female voice with all the "ums" and "ahs" you would expect from a human, no strange accent, so pretty realistic. The call came from Lompoc, California with an 805 area code, or at least that's what caller ID identified. Here is the message:

"Hey, there, um, I guess I missed you. It's Cindy over at US Tax Experts. So I tried you last week as well and this is a followup notification regarding the new Zero Tax program that's now open for you. It looks like you have some past money that's due, which we can squash with this new deal. So basically it becomes noncollectable but you must elect to enroll this month, um, so give me a shout back at this number 858 ### #### again my number is 858 ### ####. Thank you, and I'll talk to you later today..."

The number she gave was different than the origination number, and I am now permanently deleting it. But thought I'd share so in case others who received similar calls are searching for answers about legitimacy, they can easily find this blog and delete the messages. 

Warning: Blockchain Phishing Scam

This phish almost got me. I had just opened new iPhone account and for a second, thought, hmmm, was there a blockchain in my new phone I needed to activate? I searched the email's return link and it looked legit. Then I hovered my mouse over the activation link and it is totally shady, resolving to a blockchain like name with dashes and numbers in it (a fake address):

 

"nft-blockchain-2365 ..." which is a web app that already has my name set in its URL.

 

Needless, I am warning everyone. If it looks legit, hover your cursor over sender's email address, and the links that they want you to click for a second and it will show you where it really resolves to. (Do not click the links, though.) Although in this case, the email return address does appear go to

"[email protected]," and that has me puzzled on how they could spoof that. (I'd check the DNS registrar if I had time but I don't.)

 

If an email still looks real and you think you need to respond, just go to the site the way you normally would by typing it into your browser window manually.

 

Here is the phish email that I received:

 

Your Blockchain wallet will be suspended!

Dear Blockchain customer,

 

Our system has shown that your Blockchain Wallet has not yet been KYC verified. This verification can be done easily online with the below displayed connection

Due to the recently update of NFT's, all unverified accounts will be suspended on: Friday, April 16, 2022. We're sorry for any inconvenience we might cause with this.

 

Visit our website to start the security procedure: (I removed lin but it said it went to block chain wallet identification it was really the bad link)

 

 

Please keep in mind that our intention is to keep our customers safe, secured and happy.

 

Thank you for your understanding.

The Blockchain Team

 

 

Hacking Google Voice

Recently, the Federal Bureau of Investigation released a report on how criminals are using a Google form of this type of telephone verification system to take over a victim’s gmail account and set up fraudulent Google Voice accounts in their victim’s names and phone numbers.

According to the FBI press release, the scammers target people who post things in online marketplaces, such as a couch for sale or reward for a lost dog (Fluffy).

“The scammer contacts you via text or email. He is really interested in buying that couch or thinks he found Fluffy. He says he just needs to make sure you are legitimate so he doesn’t get scammed. He says he will send you an authentication code from Google to confirm that you are a real person and not a bot. You will receive that authentication code in the form of a voice call or a text message. He asks you to repeat that number to him.

What he is really doing is setting up a Google Voice account in your name using your real phone number as verification. Once set up, he can use that Google Voice account to conduct any number of scams against other victims that won’t come back directly to him. He can also use that code to gain access to, and take over, your Gmail account.”

Google Voice allows users to set up a virtual phone number to use for calls and texts. But in this hack, the victim doesn’t need to have a Google Voice account to fall victim. The FBI offers this advice:

1. Watch out for warning signs. Most scammers use a sense of urgency to pressure you into making a snap decision. Pause ask yourself why you’re feeling this way and who’s behind it.
2. Don’t share your Google Verification code with others.
3. Don’t give your email address to anyone reaching you on the phone.

And perhaps the best advice I can offer is don’t use the same password for all your different online accounts.

Sharing Photos of Kids

It has always bugged me that people post so many pictures of their kids on Facebook without their kids’ consent. I raised that issue years ago with several parents who regularly posted pictures of their kids on Facebook. 

“Did the kid give permission for that picture to be posted?” I asked them individually over Messenger. “If not, at what age does he or she get rights of consent?”

None of them really answered, I got one vague response about why I was asking, and another response kindly suggesting I get over it: This is the way of things now.

I’ve even gone so far as to suggest removal of some of these photos, for example one of a naked newborn because the creeps out there might get ahold of that image and use it in all the wrong ways. Not to mention the “Oh my God” factor of that person finding out all her nakedness was shown online to a large group of parental friends when just a wee babe.

McAfee nailed this in a recent press release about a survey they conducted on just this topic. In it, the majority of parents didn’t even consider consent, and fathers, mostly, don’t care if the kids get embarrassed by what they post.

On the other hand, the majority did worry about things like kidnapping, pedophilia, and other bad things happening as a result of those pictures being posted online. Yet these same parents also went ahead and posted pictures of their kids in school uniforms or showing other identifying and location related data.

According to the McAfee report, photos are often automatically tagged with location information when uploaded to social media accounts, making it easier to find them. The report also suggests tightening privacy settings if you are inclined to share photos (which is a good rule to follow in general for all postings) and iterating ground rules with family and friends likely to post images of your children.

For more information, see the McAfee release here: https://www.mcafee.com/enterprise/en-us/about/newsroom/press-releases/press-release.html?news_id=20180821005713

Car Warranty Scam

The "courtesy" call came at 11:52 this morning from (818) 870-8192. It lit up as 'NSI GRP' on the LED. It is assumable GRP means Group.

"Recently we sent you a postcard in the mail saying your service maintenance warranty was about to expire for your 98 Volvo," the male-voice recording said. I recalled the postcard: small, white with a blue border around the frame. Not from my dealer so I threw it out.

The recorded message then goes on to say that if you don't respond by pressing 1 on the touchtone, your car will never be eligible for warranty again.

Stupid about things like keeping warranties in places where they can be found, and just as ignorant of details like warranty expiration dates, this one actually got me to push a button.

When I pushed 1, it took me to a second recorded message, this one female and saying while they respect your privacy, please push 1 again. (My interpretation: you're basically saying, 'OK I know I'm giving away my privacy now.') I hung up then, figuring the next tier is where you give the criminals your information to see about the warranty or some such.

To settle my question around warranty expiration, I called a reputable source - my Volvo dealer. The head of sales, John White, laughed as he told me my car had been out of warranty since 2003.

"I'd never offer you a warranty on that car. A '98? All those miles," he added bemusedly. My warranty ignorance aside, the implication is that no reputable firm would offer any decent kind of warranty on a relic as mine (when did 9 years become ancient for a car?).

Still, how did the caller know the make, model and year of my automobile? At first I thought of the dealership and financer of my loan. But it quickly became apparent there are many places this information could be available to scammers. Easy enough to get car make and year records from the DMV. From there the scammers could extrapolate, knowing (unlike me) that a car that age would be out of warranty.

It feels almost useless to wonder how they got such targeted information about my vehicle. But just know that the criminals are getting better at targeting their attacks like this. Read my previous blog entry, Getting Personal for another form of targeted attack against online crime fighters.