Identity Theft and Fraud
Protecting Your Identity

Cybercrime

What is Cybercrime?
Like traditional crime, cybercrime covers a broad scope of criminal activity and can occur anytime and anyplace. What makes it different is that the crime is committed using a computer and the Internet. You may recognize some of its most common forms such as identity theft, computer viruses and phishing, and at a corporate level, computer hacking of customer databases.

Most people are aware of these and protect themselves and their PCs with anti-spyware and anti-virus software such as Norton or McAfee programs. You should be alert to the fact that cybercrime is becoming more and more sophisticated and not only targets consumers and large corporations, but small to medium sized businesses as well. Single programs against these intrusions are not enough.

An alarming cybercrime now affecting small to medium sized businesses is “corporate account take over.” This involves cyber criminals penetrating the computer network of a business and spreading malicious software, such as a “keylogger” which records the words typed, Web browsing history, passwords and other private information. This in turn allows them access to programs using your log-in credentials.

If they steal your password and breach your online banking system, the cybercriminal can begin an online session to initiate funds transfers, by ACH or wire transfer, to their accomplices. The accomplices withdraw the money almost immediately.

Online Security Practices
While no tools or automated software is 100% effective, the best solutions to protect your agency are to be well informed and use common sense. Using a multiple vendor, multi-layer approach to system design can significantly reduce your chances of being a victim of cybercrime. To assess the risks associated with a cyber-intrusion of your agency’s online systems and critical client data, ask yourself the following questions:

1. Does your agency have a hardware based firewall at the network level?

2. Does the network firewall include anti-virus, anti-spyware and anti-spam services along with content filtering and intrusion prevention, detection and real-time reporting?

3. At the individual PC level, does each computer have centrally updated and monitored anti-virus, anti-spyware and anti-spam software loaded?

4. Are your computers set up to automatically update your operating system and applications for the latest available security and critical updates?

5. Do you consider your browser security setting to determine how much or how little information the browser can accept from, or transmit to, a website?

6. Does your agency have a security policy in place that includes such policies as disaster recovery, use/storage of passwords, use of social media on work computers, etc.?

7. Does your agency back-up critical files in case of an issue that disables your systems?

8. Has your agency identified an individual to review security policies and practices on an ongoing basis?

9. Are you aware of the laws governing the protection of personal information in your state?

10. Do you have cybercrime insurance to protect your data and liability exposure in the event of an intrusion?

11. Does your agency have a training program to educate employees on best practices to avoid becoming a victim?

12. Does your online banking system provide multiple layers of security tools to prevent intrusions into the system such as token-based authentication? Agency principals should consider the types of transactions they conduct within online banking and check with their banking institution for available security enhancements.

These are just some of the basic steps an agency can implement to assess and protect itself from cybercrime. Your agency should have a network security assessment and review conducted by a certified information technology firm that specializes in network security. This evaluation will help you to identify the “next steps” in securing your network and data from unauthorized access and distribution.

Click here to read the entire article authored by Danielle Johnson – VP, Director of Information Technology at InsurBanc.

If you have any further questions regarding Cybercrime, please give us a call at 1-866-467-2262.

Back to Top

Identity Theft

Identity theft is one of the fastest growing white-collar crimes in the nation. It is becoming more sophisticated and the number of new victims is growing. A consumer’s identity can be stolen by simply stealing information from your mail or garbage or through sophisticated phone and online schemes. Identity thieves need only to obtain your name, address, an account number and/or your social security number to take over your identity.

As a consumer, you can avoid identity theft by being aware of the various schemes and consciously taking basic precautions.

Back to Top

Common Ways Your Identity Can Be Stolen

• On the Internet – through “phishing” or “spam” emails and leaving personal information on unsecured websites.
• “Dumpster Diving” – people that go through your garbage cans or a communal dumpster to obtain copies of your checks, credit card or bank statements.
• Through your mail – be conscience of bank and credit statements and preapproved credit card applications.

  Back to Top
  

Phishing

"Phishing" is a scam that involves identity thieves “fishing” for your personal and financial information. This is how it works:

• A consumer receives an e-mail which appears to originate from a financial institution, government agency, or other well-known/reputable entity.
• The message describes an urgent reason you must "verify" or "re-submit" personal or confidential information by clicking on a link embedded in the message.
• The provided link appears to be the Web site of the financial institution, government agency or other well-known/reputable entity, but in "phishing" scams, the Web site belongs to the fraudster/scammer.
• Once inside the fraudulent Web site, the consumer may be asked to provide Social Security numbers, account numbers, passwords or other information used to identify the consumer, such as the maiden name of the consumer's mother or the consumer's place of birth.

Other phishing scams include text messages - called "smishing", phone calls or recorded messages requesting verification of your credit card or bank account information and emails that are job offers, surveys, prizes & awards, gift certificates, sponsors or charities or money laundering schemes.

Back to Top

Whaling

While normal “phishing” efforts depend on reaching the greatest number of people with one email, “whaling” targets top level executives at organizations with a personalized email.

• Emails appear to be sent from a legitimate business authority (Better Business Bureau or the U.S. Tax Court).
• These emails are in regards to a complaint with the Better Business Bureau, a recruitment company, information about an invoice or a tax matter.
• Links embedded in these emails will ultimately install malware on your computer.
• Bottom line – never open an email or forward it to a staff member unless you are sure of the identity of the sender.

Back to Top

How to protect yourself

• Protect your Social Security Number, credit card and debit card numbers, PINs (personal identification numbers), passwords and other personal information.
• Review bank statements and credit card bills carefully.
• Shred old statements, financial documents, bills, pre-approval credit card offers or other documents with sensitive personal information.
• Financial institutions and government agencies will never ask for personal or account information over the phone or online. Never provide the information unless you have initiated the contact. If you think the contact may be legitimate, contact the institution yourself.
• Disregard "too good to be true" offers.
• Review your credit report annually. AnnualCreditReport.com provides consumers with the secure means to request and obtain a free credit report once every 12 months from each of the three nationwide consumer credit reporting companies in accordance with the Fair and Accurate Credit Transactions Act (FACT Act). You can also contact each credit bureau separately.

  Credit Bureaus

  
  Equifax
  PO Box 740241
  Atlanta, GA 30374
  To report Fraud: (800) 525-6285
  To order a credit report (800) 685-1111
  www.equifax.com
  
  Experian
  PO Box 2002
  Allen, TX 75013
  To report Fraud: (888) 397-3742
  To order a Credit Report: (888) 397-3742
  www.experian.com
  TransUnion
  PO Box 2000
  Chester, PA 19022
  To report fraud: (800) 680-7289
  To order a credit report: (800) 888-4213
  www.transunion.com

  Back to Top
  

If You Become a Victim

If you are a victim of identity theft you should contact the proper authorities immediately.

• Contact creditors or financial institutions for any account that have been tampered with or opened fraudulently.
• Contact the fraud departments of each of the three major credit bureaus.
• File a report with your local police.
• File a complaint with the Federal Trade Commission at www.ftc.com or 1-877-IDTHEFT.

Back to Top

Fraud

In addition to identity theft, consumers should also be aware of other scams that attempt to trick individuals into giving them money. Many of these include counterfeit cashier’s checks.

• Notification you have won a lottery and once you pay a "processing" fee or transfer charge, you will receive the money. The fraudster takes your money and you never get your "winnings".
• Emails from overseas seeking your help to cash a check - You are instructed to cash the check, keep a portion for yourself and send a check to them for the difference.
• An offer to purchase an item you are selling online and sending a check for more than the purchase price. Then you are asked to cash the check and send them the difference.
• After you’ve sent the money, you learn that the check you cashed is counterfeit and the bank has offset the amount of the check against other funds in your account.
  

How can you avoid these types of fraud?

• If it sounds too good to be true, it’s not true!!
• Be wary of any offer that requires you to wire money or withdraw cash from your account.
• Contact the issuing bank to attempt to verify the validity of the cashier’s check before depositing the item. Do not use a phone number that is listed on the check in question.

Back to Top

Social Network Fraud

Social networking sites are becoming more popular attack avenues for cybercriminals because people trust those they believe to be “friends”. These cybercriminals use that trust to upload malicious software onto your computer and to try and gather personal information. Caution should be used when on these sites.

Using social engineering techniques, these scammers manipulate people into entering fraudulent sites or clicking on links to spread viruses or reveal confidential information.

Here are a few examples:

• Koobface (an anagram of Facebook!)Worm
  The scams involving the koobface worm are pretty straight forward. In the attack, a user will receive a message from what appears to be one of their friends. The message will say something like “Paris Hilton Tosses Dwarf On The Street”, “You must see it!!! LOL. My friend caught you on hidden cam” and many others.
  Included in the message will be a link to a page which appears to be a YouTube video. A request to “upgrade your Flash player now” will appear and if downloaded and installed will infect your PC and send similar messages to your friend.
• I’ve Been Robbed! Western Union Me Money!
  This scam involves suddenly receiving a message from one of your friends telling you that they’re stuck in another country, they’ve been robbed, don’t have a wallet, and need money to get out of the country. It sounds like a horrible situation but don’t get fooled and wire money before you can verify with your friend.
• IQ Test
  Facebook users appear to get in invitation from a “friend” asking them to check out an IQ test. You take the test and at the end are asked to enter your cell phone number so your results can be text to you. When you do you get signed up for a premium texting services with high monthly fees.
The best way to prevent these scams is to avoid all links or invitations that appear to be out of the ordinary, even if from a friend.

Back to Top

Online Fraud

• Malware
  Malware, short for "malicious software," includes viruses and spyware to steal personal information, send spam, and commit fraud. Criminals create appealing websites, desirable downloads, and compelling stories to lure you to links that will download malware. Malware most times remains unnoticed, either by actively hiding or by simply not making its presence on a system known to the user.
• Spyware
  “Spyware” is a type of malicious software installed on your computer without your knowledge. It collects small pieces of personal information including Internet surfing habits and sites visited. It also can redirect web browser activity and change computer settings. Spyware is typically hidden from the user, and can be difficult to detect once installed. Spyware can be installed on computers visa fraudulent emails, legitimate software download or pop-up windows. These messages masquerade and try to be as legitimate looking as possible.
• Keystroke Logging
  As with spyware, keyloggers are installed on your computer without your knowledge. It is the action of tracking (or logging) the keys struck on a keyboard, typically in a hidden manner so that the person using the keyboard is unaware that their actions are being monitored. Keystroke logging can record the words typed, Web browsing history, passwords and other private information. This is extremely dangerous in all aspects of computer usage, especially with financial information.
  Please consider the following to keep your computer safe;
  
  1. Protect your computers with a strong anti-virus/anti-spyware/anti-spam software program and make sure they are updated on a daily basis at a minimum and note the expiration date. Anti-virus software alone is not sufficient to protect your systems from today’s complicated techniques. Most identity theft problems originate with spyware.
  2. For Windows users, please be sure the Windows Firewall Service is turned on and your computer is up to date with critical patches. Configure Windows Update to check for these critical updates automatically.
  3. Strongly consider the use of a hardware based firewall product. These products are designed to protect all your computers from attackers before it reaches your PC. Typically they also provide anti-spyware and anti-virus capability as well. Stopping the intrusion before a threat arrives at your PC is one of the best measures you can take to avoid infecting your computer.
  4. Strongly consider the use of Content Filtering to prevent users from visiting websites that are inappropriate. These sites are more likely to contain spyware payloads that will attempt to install on your system. Some hardware based firewalls mentioned above also provide content filtering.
  5. Don’t trust any email from any source that is asking for or attempting to verify personal information, account numbers, etc.
  6. If your agency utilizes an online banking system, you should consider using an additional layer of security called token-based authentication. The security token, provided by your financial institution, is a small hand held device that generates a unique, random password that is required for certain transactions. These transactions are blocked without the physical possession of the token.

• Scareware
  “Scareware” is a term to describe an attempt to scare a person, via pop-ups, into believing their computer was scanned and has a virus. These pop-ups contain frivolous and alarming warnings or threats and are especially designed to look like they come from the user's operating system.
  The fake scan concludes that the user's computer has a malware infection and says to fix it the user must download antivirus software and the cost is as much as $50. What the user usually gets is a form of malware that actually does infect the computer. Not to mention being out the fee!
  To avoid these types of scams, log directly onto your anti-virus software program and check for alerts. Also, in some scenarios it is possible to become infected with scareware even if the user attempts to cancel the notification or click on the “X” in the corner to close the screen. The safest way to close the pop-up is to open the Task Manager (click control+alt+delete) to delete the message.

Back to Top

Helpful Links

FTC – Take Charge: Fighting Back Against Identity Theft

FTC - Identity Theft Victim’s Statement of Rights

FDIC Video: Don't Be an On-line Victim: How to Guard Against Internet Thieves and Electronic Scams

FDIC Phishing Brochure