You DO NOT Owe for an Overdue Invoice

Billing Scams are a Common Form of Spear Phishing

Do NOT Click Through or Open the Attached File

It's time to take a look at a few of the e-mail scams that have been filling inboxes recently. Some of these were sent to me personally; others were forwarded to me by some of my customers, who wanted to know if they were legitimate or not.  These e-mails are cut and pasted from the originals. In any case an e-mail contains an inline URL, I have changed that URL so it will NOT "work" if you click on it by mistake.  I have NOT stripped out links completely, so that readers may use the "hover trick" to see that the links, in fact, do NOT lead to where you'd expect. (Remember, you can hover your mouse over ANY link, and a program will show its true destination in either the status bar or in a pop-up tooltip.)

You DO NOT Owe for an Outstanding Invoice from a Company Whose Name You Do Not Recognize

This spear-fishing e-mail claims you owe money, and tells you to click a link to settle your bill.  Clicking on the link will take you to a site where they will trick you into disclosing personal info, and most likely will plant malware on your system while doing so.

They DO NOT Have Your Password

That Password They Have is Most Likely an Old One;
They STILL Are NOT Watching You Through Your Webcam

Not too long ago, we discussed the latest e-mail scam, in which they claim to be recording you through your webcam.  Well, the scammers have upped their threats, and you may be the recipient of multiple e-mails threatening to release illicit videos if you do not pay a ransom.  And these latest e-mails have a twist: they include your password! But not to worry; they are NOT legit.

When you see the password they include, you will most likely panic, as you will recognize the password as one you have used.  But most likely, it is not a current password. In my case, the e-mail included one of the earliest passwords I used on the Internet, and one I haven't used much in over a decade.

Data Breaches: What Do They Mean For You?

How to Safeguard our Information
in a World of Security Breaches

What Can We Do when Our Data Gets Out?

Yesterday, all of the tech publications were warning of another major data breach.  Another popular Facebook App exposed users' personal data, and this time, over 120 million users were possibly affected.    Who was careless with our data this time? Nametests.com, a site Techlaurels warned users about over a year ago.

In a nutshell, Nametests had this hole where if you knew the right JavaScript commands, you could potentially access any users' personal information.  A website could exploit this, or any individual who knew how to grab and use a "token."  The "good guy" who discovered this used the flaw to set up a data mining program and subsequently reported the bug to Facebook. The security hole was supposedly closed.

And of course Nametests wanted that hole closed as soon as it was discovered. Who is going to buy a candy bar if there is a bowl sitting next to the register that says "Yours for the taking."  Or to borrow from an old cliche, if you're in the business of selling cows, you don't want to be giving the milk away for free.

No Microsoft Refunds, No Camera Hacks: New Scams

The Latest Attempts to Scam You
By Email and by Phone

Microsoft Has NOT Been Ordered to Issue Refunds, No One Has Hacked Your Webcam, and No One is Coming to Arrest You

It has been a while since we've looked at e-mail you should just ignore and voice mail phishing attempts.  A couple of new attempts to separate you from your money have cropped up lately, all involving scare tactics designed to make you act without thinking.  First comes a junk call scam, telling you you're owed a rebate, next comes an e-mail that reports someone is spying on you, and last comes an arrest threat based on a non-existent debt.  Keep reading to find out the details of each, so you'll recognize them and not panic should they come your way.

Telephone Phishing: Voicemail Messages You Should NOT Return

Phishing Phone Calls:
No, There is No Warrant for your Arrest,
and the Police are NOT on Their Way

DO NOT Return a Scammer's Call

Today's world is full of people who are fraudulently trying to separate you from your hard earned money.  Phishing has become a real problem on the Internet, something we've talked a lot about on this blog in the past.  Spoofed e-mails. bad links, text message spam, and malicious Facebook Posts are common ways in which the fraudsters attack.  

But what about offline? Are you safe from phishing attacks if you do not use the Internet at all? Unfortunately, the answer to that question is no.  As people get wiser about online attack strategies, the Bad Guys have begun to attack you offline.  And one of the most prevalent methods of offline phishing uses your telephone.

Today, we're going to look at Phone Phishing.  We are also going to look at two phishing attempts, both employing voicemail.  In both cases, these are examples of voicemails you should NOT return.

Delivery Notification Scams

Holiday Shopping Season Brings Out
the Delivery Notification Scammers

Do NOT Get Phished by a Bogus Delivery Notice

Black Friday and Cyber Monday set online ordering records this year.  US shoppers spent over $1.59 billion on Cyber Monday alone. Millions of online orders were placed during the past week. And of course, that means millions of packages will be delivered by UPS, USPS, and FedEx. That also means these companies will be sending out millions of delivery notification e-mails.  But does that mean all of these delivery notices are legit? Of course not. 

The scammers do not discriminate. They pretend to be from UPS, The Us Postal Service (USPS), FedEx, and even DHL.  They may claim to need more information from you in order to deliver a package, or they may claim to hold tracking information.  They may claim there is postage due, and you need to click on a link to arrange payment. They may use official looking graphics, or they may be sent in plain text.  And they may or may not be caught by a junk mail filter.

These scams are so ubiquitous that FedEx, USPS, UPS, and even DHL warn against them on their own websites.   UPS offers an 83 page PDF with examples of fraudulent e-mails.  Today, we're going to look at some of these bogus e-mails, so we can learn what to look out for and avoid getting scammed.

Black Friday: Don't Get Scammed

The Biggest Shopping Weekend Brings Out the Scammers

Shop Safely and Avoid the Cyber Shopping Scams

Black Friday, Cyber Monday, and basically the whole Thanksgiving Weekend are some of the biggest shopping days on the planet.  Almost every cyberstore has some kind of special, and our Inboxes and Social Media Feeds are full of discounted offers.  And although there are many legitimate sales, there are just as many scammers looking to rip you off on this big shopping weekend.  Don't be a fool, and look out for the Black Friday Shopping Scams.  Here are a few of the more popular ways to separate honest folks from their hard earned money.

Bogus Order Confirmations

Bogus order confirmations are a form of spear phishing. Scammers send hundreds of fake order confirmations, hoping you will click through to cancel an order.  Basically, the scammer steals official looking logos and graphics from a major retailer, then uses them in an order confirmation purporting to be from that retailer.  These phishing attacks multiply on Black Friday, as many folks are placing online orders during that time.  The e-mail may spoof Best Buy, Amazon, Ebay, Target, WalMart, Costco, etc.  If you click through the fake e-mail, you will be taken to a cloned log-in site.  The scammers are hoping to steal your shopping log-ins, so they can go on a shopping spree with your money, and even lock you out of your own account.

A New Way to Phish: Survey Spam

Beware of Phishing Attacks via Surveys

Scammers Can Use Surveys to Steal Your Personal Information;
That Survey Invitation May be a Phishing Attack in Disguise

The Scammers just keep getting more creative, finding new, seemingly legitimate ways to steal and misuse your personal information.  Survey spam is one of the latest methods Spear Phishers are using to trap their victims.

Spear Phishing refers to a targeted e-mail attack.  Spear phishers send you personalized spam e-mail that usually appears to be from a trusted contact.  That e-mail is intended to trick you into taking an action that will open you to harm. A Spear Phishing attack may try to plant malware, steal your information, and/or trick you into revealing log-ins and passwords.  A Spear Phisher's intentions are never good.

As cyberspace wisens up, the Phishers find new ways to steal your information. One of these ways is through survey spam.

Folks love to participate in surveys.  Often, surveys contain a sweepstakes component to help entice users to take it. "Five survey  participants will be randomly chosen to receive a $50 Amazon Gift Certificate" is a common come-on.  Many companies use legitimate surveys for market research and quality assurances.

Avoid Phishing: Learn to Spot Sham Domains

Phishing Attacks Depend on Sham URLs;
Understanding the Parts of a URL Can Help You Avoid Phishing Attacks

To reiterate, phishing is an attempt to gain someone's personal data by pretending to be someone reputable. Phishing attacks are often carried out via e-mail or social media postings.  These attacks depend on registering domain names CLOSE to those of the real company or person, or by "spoofing" a familiar contact.  Learning to spot sham domain names and e-mail address is key, so you can avoid falling victim to phishing.

Today's article is going to review the parts of a domain name, as well as it's construction.  Then, we have a quiz on domain names: Is the URL Legitimate? If you can learn to spot a sham URL, you will be able to avoid most e-mail phishing attacks. And if you haven't read them yet, our previous articles on phishing can be found at http://techlaurels.blogspot.com/search/label/phishing.

Mail that Should NOT Be Opened

Not All E-Mail Should Be Opened

Avoid Malware by Avoiding Malicious E-Mail

The longer you have had an e-mail address, the more probability you'll receive spam. If you read any of our series on The Privacy Implications of Internet Quizzes, you know that there are many unscrupulous folks out there, eager to harvest your information. Facebook like scams, phony giveaways, and the like are all set up with the express purpose of harvesting your e-mail address. Once harvested, those addresses are often sold. That results in spam.

By definition, Spam means unsolicited commercial e-mail. It is usually sent to a large number of recipients.  It has come to connote scams and shams. It is actually illegal. The US passed the CAN-SPAM Act in 2003, regulating commercial e-mail. But the Bad Guys are not known for following the laws.  Legitimate companies always include opt-out information in order to comply with the law. Spammers use it to their advantage, often including links that look like legitimate opt-out links, but that only lead to malicious content. Additionally, unsubscribing from a SPAM e-mail only confirms to the bad guy that you read your e-mails, making your address even more valuable.


Now much spam is actually harmless. By harmless, I mean it's just attempting to sell you something. That something is probably counterfeit, if it even exists to begin with. More spam actually tries to cause harm to you or your equipment. That spam is not as harmless. It may plant malware on your computer. It may try to steal your credentials, so the crooks can steal your money and/or pose as you and ruin your reputation.

Today's post is going to focus on e-mail you should not open. ALL of this mail landed in my inbox within the last week. Some of these were correctly filtered by my spam filter; others landed in my inbox, and I had to manually mark them as junk. All e-mails have been converted to screenshots, due to their malicious content. (Remember, you can click on the images to open them larger, in an "overlay.")

The Dangers of Internet Quizzes

Are Facebook Quizzes Really Harmless?

People LOVE taking Social Media Quizzes.  Sites like Buzzfeed have entire sections devoted to quizzes.  Facebook timelines are filled with results shared from various quiz-hosting sites.  Quizzes and tests can be great traffic drivers, and from a marketing standpoint, they can be very beneficial to your site.  But what about from a user standpoint?  Are there any dangers of taking these internet tests and sharing the results?  The answer, unfortunately, is neither yes nor no.  There can be great dangers in taking these internet quizzes, or they may be completely harmless.  If you scrutinize before you click, you can easily learn the difference.

What Are Some of the Dangers of Taking a Quiz?

The dangers fall into several categories.  Again, a quiz site may be harmless, and none of these dangers may apply.  Or it may be a complete and total scam site, out to cause you harm.  Most quiz sites fall somewhere between these two extremes. The trick, as with any internet activity, is to be savvy.  You need to arm yourself with the knowledge to evaluate the risks of each individual quiz. This list is by no means inclusive.  It only describes SOME of the dangers you may encounter.

IRS Scams: Don't Get Phished!

Tax Day Brings Out the Scammers Every Year!

Be Vigilant! Do Not Fall for an IRS Hoax

Happy Tax Day!  Tax Time always seems to bring out the Scammers.  They inundate unsuspecting victims with e-mails, claiming to be from the IRS, in an attempt to steal your money, your identity, or both.  Most entice you to open an attachment or click on a link.  Doing either will only fill your system with malware.

Chrome Font Virus

Chrome users: BEWARE!

 

There is a new malware attack that targets Chrome users.  Firefox, Edge, and Explorer users, no need to worry about this one, and you can click away from here.  But if you are a Chrome user, be sure to read this post through to the end.

This is a JavaScript attack that garbles the page as it loads.  Then, a box will pop up a that says “The ‘HoeflerText’ font wasn’t found.”  It will ask you to update.