phishing

5 Tax Scams You Should Know About for 2018

Kat Tretina — Tue, 30 Jan 2018 09:00:05 +0000

Tax season is underway. While no one really enjoys doing their taxes, everyone looks forward to getting a tax refund. It's no wonder why. According to the IRS, over 80 percent of tax returns resulted in a refund for tax year 2015. And the average refund was a whopping $3,120.

However, all that money makes tax season one of the busiest times of the year for scam artists. Each year, criminals target taxpayers to steal their personal information or their tax refunds.

Most scammers prey on vulnerable populations, such as the elderly or first-time tax filers, but anyone can be at risk. These are the top tax scams you should be aware of in 2018. (See also: Beware These 6 Phony IRS Calls and Emails)

1. Threatening phone calls

A common tax scam involves aggressive phone calls. You'll receive a call — sometimes from a number that shows up on caller ID as from a Washington D.C. area code— and the person on the line will claim to be a representative of the IRS.

They can be very convincing. They may know your full name, your mother's maiden name, and even the last few digits of your Social Security Number.

That person will say you're behind on your taxes or filed a fraudulent return. They may threaten you with immediate arrest, going so far as to say police are on their way to your home. They'll say the only way to avoid jail is by making an immediate payment with a credit card over the phone.

Know that the IRS does not communicate over the phone and does not threaten taxpayers with jail time. If there is a problem with your return, or if you do owe money, you will receive a notification in the mail. If you receive these calls, hang up right away.

2. Information phishing

Similarly, you may receive calls or emails from so-called IRS representatives or tax preparation software companies. They may claim that there's a problem with your return or refund and that they need to verify your information to fix the issue. They'll ask for personal information like your Social Security number, birth date, and place of employment. Then, they use that information to file a fraudulent return in your name to claim your refund.

Remember, the IRS will only send you information through the mail. If you're unsure if an email is real, open up a new browser window and log into your account that way, or look up your tax preparer's phone number and call that person directly.

3. Requests for gift card payments

Another scam involves a call from an IRS impostor who claims that your return notification letter was returned as undeliverable. That person will tell you your bill is overdue and that you must make a payment immediately.

Instead of asking for your credit card or personal information, they'll ask you to send them a prepaid gift card or debit card. Know that the IRS does not accept payments in this format.

4. Identity theft

Identity theft is a serious issue. You may think that canceling and replacing your credit cards is all you need to do, but the problem can be much more involved than you think. Thieves can use your personal information to submit a fraudulent tax return and collect your refund.

If you went through any form of identity theft, or if your personal information was stolen, it's a good idea to place a fraud alert on your credit reports and notify the IRS. If you suspect tax-related identity theft — for example, when you try to file your return you get a notice that your return has already been filed — you'll need to fill out IRS Form 14039, Identity Theft Affidavit, and follow the mailing instructions on the form.

Moreover, it's a good idea to complete and submit your tax return as soon as possible to ensure thieves cannot submit a return in your name. (See also: 8 Reasons You Should File Your Taxes as Soon as Possible)

5. Tax preparer fraud

Fraudulent tax prep "professionals" often advertise their ability to get you the largest refund possible. They do this by falsifying information on your return, such as adding nonexistent dependents, claiming credits or deductions you don't qualify for, and reporting incorrect income. They'll also typically base their rates off a percentage of your refund.

The IRS encourages you to ask your tax preparer questions about anything suspicious or confusing, and to look into their credentials and certifications before agreeing to hand over your return. All legitimate tax preparers should have a PTIN (preparer tax identification number).

It's important to carefully vet your tax professional and to closely look over any forms before signing. Regardless of whether you've been scammed or not, you will still be on the hook for any fraudulent information reported on your return.

Verifying any IRS activity

Some scam artists can be very convincing. If you're not sure whether it's a con or not, hang up or close your email. Call the IRS directly at 1-800-829-1040. You'll be connected with a real representative who can review your account and let you know if there's anything they need from you. They can also help you report any fraudulent activity or scams.

Like this article? Pin it!

This article is from Kat Tretina of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

How to Protect Your Retirement Account From a Hack

Dr Penny Pincher — Wed, 08 Nov 2017 09:00:09 +0000

Unlike your bank accounts that are protected by the Federal Deposit Insurance Corporation for losses up to $250,000, there is no such universal protection for your retirement funds. If you get hacked, thieves can gain access to your retirement account and transfer funds into their own pockets.

What would happen if your investment account was hacked and funds were stolen? Many brokerages have customer protection guarantees in case of unauthorized account activity, but customers are responsible for taking certain action before and after the hack to qualify for reimbursement of stolen funds.

Investment brokerage policies vary on the subject of restoring losses from unauthorized activities. In general, customers are responsible for promptly detecting and notifying the brokerage of unauthorized activity, and for showing that the security lapse was not their fault.

Here are steps you can take to protect your retirement account.

Monitor investment accounts

Unlike a checking account or credit card account that is typically monitored fairly closely, a transfer from an investment account can easily go unnoticed for months until a quarterly statement. The first step in getting funds restored to your retirement account after a hack is to notify the brokerage that unauthorized activity has occurred.

Instead of waiting for a quarterly account statement in the mail, you can access your account electronically to check for unexpected activity. Some brokers allow you to set up alerts and receive notifications by email if a transaction has processed.

Protect account access credentials

There are several important security measures you can take to prevent a thief from accessing your retirement account.

1. Set up two-step verification

An easy way to boost the security of your access credentials is to sign up for two-step verification with your brokerage. This means that in addition to your password, you’ll need a one-time numeric code that is sent to you via text message or email when you try to log in. This adds a layer of security; simply having your login and password is not enough for a thief to gain access to your account.

2. Beware of phishing scams

Criminals often send out emails that appear to be legitimate asking for login information. They may also try to trick you into clicking on a link that leads to a fake website designed to capture your username and password when you try to log in. Some internet security products verify that websites are authentic and post a warning when you try to access unconfirmed sites, in order to provide protection from phishing. (See also: How to Avoid Phishing Scams)

3. Don't sign in on a public Wi-Fi connection

Avoid using public computers to access your retirement account, and avoid logging in over an unsecured Wi-Fi connection. You should also avoid reusing the same password for multiple accounts.

4. Don't share your login with anyone

Think twice before sharing your access credentials with others, even companies such as Mint or Personal Capital that use your login to help monitor your account. If a company that has your login information gets hacked, and your access credentials are stolen and used to drain your account, this loss may not be covered by the recovery policy of your broker. (See also: Stop Making These 8 Risky Password Mistakes)

Secure your computer

Hackers can steal retirement account access credentials directly from your computer. Install anti-virus and anti-malware software, including a firewall, to prevent thieves from breaking in. Use a login for your computer to keep others from accessing your files. After a hack, investigators from the brokerage may want to examine your computer to see that you were using reasonable security features when determining whether you were at fault for the hack.

Policies of major brokers for hacked accounts

Account restoration policies in response to unauthorized activity vary by broker. Following are links to policies at major firms so you can check to see what is required to get retirement funds restored after a hack.

In general, you are responsible for monitoring and protecting your own retirement account by keeping your password secure and taking reasonable security precautions on your computer or other devices. If the hack and resulting loss occurs due to breach of the brokerage's computer system, you'll likely get your funds restored based on the policies of most brokerages.

Like this article? Pin it!

This article is from Dr Penny Pincher of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

18 Surprising Ways Your Identity Can Be Stolen

Carrie Kirby — Wed, 08 Mar 2017 11:00:10 +0000

Most people have already been victims of the most basic forms of identity theft — having fraudulent charges on your credit card. Those even less lucky have been victimized in more aggressive ways, with criminals obtaining medical care, working, and flying in our names.

Unwinding that mess can take years and thousands of dollars. The effect is exacerbated by the fact that the crime doesn't generally stop with the one person who stole your information. Credit card numbers, Social Security numbers, and other data gets packaged and sold on the underground Internet so that different people all over the world could be impersonating you at the same time.

"It's a pain. It does cause a lot of stress," said Lindsay Bartsh, of San Rafael, California, who said that straightening out a web of fraudulent medical bills, flights, job applications, and credit applications took every minute of her free time for a year.

How does it happen? Here's a look at both the most common ways thieves steal our data, as well as some of the newest ploys to watch out for.

1. Mail Theft

Bartsh believes this time-honored tactic is how her personal information got out into the criminal underworld. An expected W-2 tax form never arrived. Assuming it was stolen, it would have given thieves a wealth of information, such as Social Security number and workplace.

2. Database Hacks

When a large corporation gets hacked, the effect can be widespread. When the U.S. government's Office of Personnel Management was breached, some 22 million people had their personal information exposed. (I was one of the many who received a warning about this, because I had a writing contract with a government agency.)

3. Malicious Software

If you have a virus on your computer, you may suffer more than a slowdown or a system crash. Some malicious programs that spread as viruses record every keystroke you type, allowing thieves to find out your online banking username and password. These programs can infect your mobile phone as well as your computer.

4. Search Engine Poisoning

This is a sneaky way of tricking people into giving up their own personal data, or getting malicious software onto a person's computer. The criminals create a fake website similar to a real one, or that could plausibly be a real one.

One tactic is for you to click through to the fake site and try to buy a product, entering your credit card or debit card number. Another way they try to get you is for you to unknowingly download information-stealing software onto your computer.

Where does the search engine part come in? These criminals manipulate Google and other search engines' algorithms to get their phony sites ranked high in search listings, leading users to believe they must be legit. Fortunately, Google has made progress in preventing this in recent years, but it still happens.

5. Phishing

Phishing is a term that broadly means "fishing" for personal information through a variety of common social interactions — so-called "social engineering." The most common phishing attack happens when you get an email that looks like it came from your bank or another legitimate company. It may come with an alarming subject line, such as "overdraft warning" or "your order has shipped." When you click a link in the email, you may see a login screen identical to your normal login, which will trick you into entering your username and password. You could also be asked for more identifying details, such as Social Security number and account number.

Fortunately, banks have put some countermeasures into place to fight phishing. You can also protect yourself by not responding directly to incoming messages. If you get an email that looks like it's from your bank, type your bank address into your browser instead of clicking the link, sign in, and check your account's message center. Or just call your bank's customer service number.

6. Phone Attacks

The Internal Revenue Service has been warning for several years that scammers are calling people claiming to be the IRS, either claiming that they have a refund due or owe money. Fishing for information via the phone is also known as "vishing," as in, "voice phishing."

If they're taking the refund tactic, they'll probably ask for your bank account number or other personal info, supposedly in order to send you your refund. If they say you owe, they may ask for a credit or debit card number, or worse, try to get a payment in a way that's not traceable or refundable, like through a prepaid debit card.

This kind of scam is also known as "pretexting," and the really good scammers make it seem realistic by having some basic info about you on hand before they call, like your address and date of birth, which are pretty easy to find online.

7. Text Attacks

In another twist on phishing, "smishing," or SMS phishing, sends you a text message encouraging you to click a link that will either trigger the download of malicious software or direct you to input personal information.

8. Fake Wi-Fi Hotspot

Also known as an "evil twin" hotspot, this is a Wi-Fi connection setup in a public place, like a cafe, with a name that leads you to believe it was provided by someone trustworthy, like the cafe owner. The evil twin Wi-Fi hotspot really connects you to the Internet, just like a legit connection. The difference is, the evil twin is provided by a hacker, who uses specialized software to eavesdrop on information you're sending out — like your bank password or Social Security number — or to direct you to a malicious website like those described above.

When a hacker interrupts your attempt to access a legitimate website and steals the data you're trying to send, it's called a "man in the middle attack."

9. Dumpster Diving

Another low-tech but very effective method is simply pawing through recycling bins, looking for discarded credit card offers, bills, medical records, and other paperwork that could have personal information on it. Not only can identity thieves hit you at home, they could also search dumpsters outside of medical offices, schools, and banks.

10. Workplace Theft

A U.S. Department of Justice survey of convicted identity thieves found that a third of them accessed victims' information through their jobs. The criminals worked for mortgage companies or at government agencies such as the Department of Motor Vehicles, where they had access to treasure troves of client information. Others lifted information from job applications.

Back in 2000, just one guy was responsible for stealing 33,000 people's credit reports at his credit industry help desk job. He sold the reports to thieves who, according to news reports, used the information to steal up to $100 million.

11. Burglary

When someone breaks into your home or car, it may not be the loss of your jewelry, cash, or laptop that hurts the most. If they find your credit cards, Social security card, or tax returns — or get such information off a stolen computer — you could be in for severe identity theft.

12. Pickpocketing

Another old-fashioned crime that has thrived in the era of high-tech data theft, pickpocketing nowadays commonly leads directly to identity theft. In fact, a major ID theft ring busted 10 years ago targeted crowded events to steal wallets and convert the information inside to valuable dossiers of information, which they would later resell.

13. Mobile Phone Theft

If you have authorized your phone to make payments on your behalf, saved passwords for banking and retail sites, or saved other personal data on it, having the device stolen could cost you a lot more than the replacement cost. Phones that aren't password- or fingerprint-protected are most vulnerable.

14. Mobile Phone Account Hijacking

Another form of ID theft targeting phones happens when someone gets ahold of your account information and uses it to order a new phone or line, with the bill going to you.

15. Shoulder Surfing

This technique involves watching over someone's shoulder as they enter a password at the ATM, or using a camera to steal the information from farther away. This could also be a tactic for getting someone's phone password before physically stealing the phone.

16. Skimming

This nefarious technique involves stealing credit or debit card information with a card reader that may look just like a legitimate card reader. Skimming devices have been found at gas station pumps, on ATMs, and at retail store registers. Or, waiters in restaurants can put your card through a skimmer when they take it to the back to finalize your bill.

17. Friend and Family Theft

Also known as "familiar fraud," this crime happens when the ID thief is your child, your parent, even your spouse. Sadly, it's not uncommon for parents to abuse the identities of their own minor children in order to get credit. In a disturbing story broadcast on This American Life, Rachel Rosenthal couldn't figure out how her identity thief kept catching up with her, no matter how many accounts she closed — until she realized that the thief lived in her own home and had access to all her mail and documents. It was her boyfriend, who had been "helping" her financially, with money he withdrew from her bank account.

Often, these crimes take place in the context of real relationships, where one party happened to turn on the other party. But there are also crooks out there who look for partners specifically to steal their identities, especially on dating sites and social media.

18. Social Engineering Targeting Companies

You don't have to work for a credit agency or mortgage bank to get customer information if you are skilled enough to trick employees into giving it to you. Thieves may call an airline, posing as a secretary who needs her boss's trip information, or call a company pretending to represent a client or supplier. A friendly fast talker may be able to get employees to skip security protocols and give out information they shouldn't. Every call the thief makes is a little easier, armed with the information from the last call

Like this article? Pin it!

This article is from Carrie Kirby of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

10 Ways to Keep Your Private Info Private

Carrie Kirby — Thu, 02 Mar 2017 11:00:09 +0000

In a world where so many of us share everything from the birth of a child to our weight loss goals on social media, privacy might seem like a moot point. But the reality is, growing identity theft threats make safeguarding personal details more important than ever.

The good news is, there are simple things you can do to keep yourself safe. It is just about paying attention to where your personal information could leak out, and plugging the holes. (See also: Your Credit Card May Be Sharing Your Private Info)

1. Destroy Unneeded Paper Documents

Any junk mail that contains a credit offer. Old documents with your signature, Social Security number, date of birth, or other identifying details. Old tax returns. Convenience checks from credit cards. These are some of the most sensitive items that you should never dispose of without shredding. Buy a crosscut shredder or take your documents to a business shredder to destroy, or burn the paper in your fireplace.

2. Safeguard Your Mail

The U.S. Post Office recommends that you pick up your mail promptly after delivery and always put the mail on hold if you go out of town. Some folks take it a step further by investing in a locking mailbox or renting a post office box away from their residence. Remember to protect outgoing mail as well, by dropping it into a secure mailbox or handing it to the carrier, instead of leaving it out for the carrier to pick up.

3. Be Wary of Online Forms

You may be asked for your name, email address, home address, phone number, date of birth, and other personal information many times a day on the Internet. And often, it's legitimate to share that information — for instance, when signing up for a food delivery service. But when asked for personal details, ask yourself who's behind the request — a reputable brand, or a company you've never heard of? Is the sign-up really necessary?

4. Don't Overshare on Social Media

First of all, know who you're sharing with when you post something on social media. On Facebook, you can choose to share a post with the public, with all your friends, or only a subgroup of friends. Personally, I don't know all the people I've accepted friend requests from very well. So most of the things I post — especially potentially compromising information such as an upcoming surgery or vacation — are only shared with a select group of close friends and relatives.

Second, there are some things you don't want to share with anyone — not even relatives. Hundreds of thousands of people each year have their IDs stolen by someone they know. Never post a photo of personal documents, like a new passport or even a kid's report card. Beware of documents that may be visible in the background of snapshots, like that tax form stuck to your fridge with a magnet.

5. Conduct Periodic Audits of Your Online Info

This sounds complicated, but it's actually easy. First, Google your full name. Look yourself up on "people search" websites, especially FamilyTreeNow, which allows people to search for personal data without paying or signing up for an account. A lot of the info you will find on these sites are public records, but that doesn't mean you want to make it easy for potential data thieves to aggregate all public info about you for free. Opt out of all such sites, which may take some time clicking around, but is worth it.

6. Be Suspicious of Everyone Who Handles Your Information

Your children's school and your doctor's office probably aren't out to rob you, so you might feel comfortable sharing any information they ask for. Here's the thing, though: Do you know if they're storing those documents securely or disposing of them properly when no longer needed? (See also: 7 Simple Ways to Protect Yourself From Medical Records Theft)

One way to limit your exposure to this risk is to give as little information as possible. Yes, every school form might ask for your child's medical insurance ID, but is it really necessary? At the doctor's office, decline to write your Social Security number on paperwork. They don't need it on every piece of paper in your file.

Another way to limit your exposure is to ask staff how papers are handled and secured, and to push for better safety in the likely event that there's room for improvement.

7. Keep Your Computer Clean

Logging onto bank, mortgage, and credit accounts to pay bills, check balances, and transfer money is incredibly convenient. It can also be incredibly dangerous if you do it on a compromised computer. Be wary of what you click, whether it's an app you download or a link or attachment in email, because if your computer gets a virus, it could do more than slow it down. Hackers can use such Trojan horses to slip a keystroke logging program onto your computer, recording everything you type, including usernames and passwords. Never log onto banking and other sensitive sites using public Wi-Fi connections.

Besides avoiding clicking dodgy links and regularly scanning your computer for malware, you can safeguard your online banking data by regularly changing your passwords, and by making your passwords really hard to guess.

8. Limit What You Carry Around With You

Stealing your purse or wallet is another way thieves can get ahold of your private information. Don't carry anything more than you need — one or two credit cards and your driver's license should do. Leave your Social Security card at home. (See also: 5 Things to Never Keep in Your Wallet)

9. Opt Out of Junk Mail

You can sign up to stop credit and insurance companies from sending you preapproved offers, which could be used to take out accounts in your name. (See also: How to Remove Yourself From Mailing Lists and Eliminate Junk Mail)

10. Don't Get Caught by a Phisher

Beware of impostors asking for your bank password or other information. You may already know that if you get an alarming email purportedly from your bank, you can go straight to your bank website and log on, or call them, instead of clicking the link.

But increasingly, phishers are reaching victims by phone as well. So many people have been tricked into installing malicious software or giving up credit card numbers by fake "Microsoft tech support" calls that Microsoft set up a page warning the public about them. The Internal Revenue Service has set up a similar warning about criminals who call posing as IRS agents and ask for money or personal data. (See also: Beware These 6 Phony IRS Calls and Emails)

This article is from Carrie Kirby of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

Don't Panic: Do This If Your Identity Gets Stolen

Paul Michael — Tue, 25 Oct 2016 10:30:09 +0000

The Bureau of Justice Statistics (BJS) reported that in 2014, 17.6 million Americans aged 16 or older were victims of identity theft. That, alone, is a scary fact. And to be honest, when anyone says the phrase "identity theft," most of us picture lives being upended, years of court cases, and bank accounts being wiped out.

But let's look a little deeper into this issue, because while it is definitely something to keep on your radar, identity theft is a broad term. Plus, these days, with so many people being affected, there are more resources available than ever before to help you out. So before you go into full-blown panic mode…read on.

It's Highly Unlikely Someone Will Actually "Steal" Your Identity

Of the 17.6 million Americans that were victims of identity theft in 2014, only 4% of them actually had their personal information used to open a new account. Think about that for a second, and you should already be feeling much more calm. The chances of someone actually pretending to be you, opening up account everywhere in your name, and sinking you into a world of pain, are very slim indeed. Sadly, media outlets and the news don't like to cover that, because it's not sexy, and it doesn't get ratings. That's why the identity theft stories you hear about are horrific. But in reality, it is highly unlikely that you will have your literal identity stolen.

Identity Theft Is a Very Broad Term

The phrase itself puts most people in a cold sweat, but it covers a lot of different aspects of the crime. The vast majority of identity theft crimes, around 86%, are tied to the misuse of a credit card or bank account. That's it. Someone grabs your digits, takes out some cash, and calls it a day before the card gets canceled. Or, they withdraw a bunch of money and move on to someone else's account. Either way, it's quick and dirty, but rarely goes beyond that level of theft. And as the next point proves, it's not worth worrying about…

Credit Card and Bank Account Misuse Is Covered

If someone manages to get hold of your credit card, either by stealing or cloning it, they will undoubtedly go on a shopping spree. But you don't have to worry. While the initial shock of seeing thousands in charges you didn't accrue is horrifying, you are not on the hook for it. Card issuers and bank accounts cover you for most (and generally all) of the theft. You will get all of those funds put back onto your account, usually very quickly, and the card issuer or bank will take the hit and investigate the crime. Sadly, very little of this money is recovered from the thieves who did the spending. Unless there is CCTV footage of them committing the crime, and significant evidence to track them down, they'll get away with it. But rest assured, you won't have to foot the bill.

Over 52% of Identity Theft Victims Resolve the Problem in a Day or Less

Not years. Not months. Not weeks. Just one day. That should come as great comfort if you're worried about the time and expense it could take to sort out the mess some nasty crook has created for you. And here's further cause to relax…only 9% of victims spent more than a month trying to get their lives back on track, and even then, it was not a month taken off work, fighting eight hours a day, seven days a week. It is simply a process that can take time to get right.

This Is a Common Problem, So You'll Get Help

When identity theft first popped up, it was hard to get card issuers and banks to listen to the facts. But these days, that has all changed. There were more victims of identity theft in 2014 than there were property crimes, so it's definitely on law enforcement's radar. Most credit card companies monitor accounts very closely, and track your spending habits. They will often shut down a card immediately if they believe there is suspicious activity going on — for instance, an unusually large purchase, many purchases in one day, or purchases made out of state.

If your card is stolen, report it the moment you notice it is gone, or has been cloned. If you see a new account has been opened in your name, report that immediately. These companies want your business, and they are setup to handle this kind of crime.

It's Easy to Stop Identity Theft in Its Tracks

These days you have resources and tools to monitor your accounts and your credit reports. The Federal Trade Commission (FTC) puts this kind of protection into two basic categories.

Credit Monitoring

This tracks activity on your credit reports, and notifies you if a company checks your credit history, a new account is opened in your name, a debt collector reports a late payment, your credit limits change, or your personal information changes. It's worth noting that this isn't actually protection, but a warning. However, once you're alerted, you can act on that information.

Identity Monitoring

This alerts you when personal information, including your driver's license, passport, Social Security number, medical ID number, or bank account information, is used in ways that don't show up on your credit report.

You will already know of major identity theft protection sites and services out there, including LifeLock, CompleteID, IdentityGuard, and IDShield. Your bank account and credit card issuers may also have their own version of identity theft protection for you to take advantage of. All of these services require a nominal monthly fee, but for the peace of mind offered, it's worth it.

Criminals Need More Than Just Your Personal Information

If you see a news story talking about a data breach, take the time to find out what has actually been stolen. As Time reported in 2015, criminals can do very little with your name, birth date, and email address. Even with your address and phone number on top of that, they aren't going to be able to do much without a SSN and/or account numbers and passwords. The most they can do is some kind of "phishing" scam, where they will use your personal information to try and get money out of you in some way, via phone or email. But use your common sense, and never respond to a cold call or email. Always contact a business yourself to verify this.

This article is from Paul Michael of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

6 Cheap Ways to Ensure Your Cyber Security

Aaron Crowe — Fri, 12 Jun 2015 09:00:15 +0000

Anyone with a computer has probably been a victim of a phishing attempt, where hackers pose as a trustworthy entity and try to get your username, password, credit card details, and other sensitive information that your mom told you never to give to anyone.

But mom's advice isn't enough. The U.S government may be able to afford $14 billion for cyber security to protect its networks from hackers, but the rest of us can't. Here are some free and inexpensive ways to keep safe online.

1. Passwords That Go Beyond Your Dog's Name

Strong, unique passwords are a must-have for each site you visit, but especially for those storing sensitive personal information.

Using your dog's name and the year you graduated from high school as a password isn't terribly secure. The website 1Password creates and stores strong passwords for you, so that you don't have to remember for each website you visit. You just need to remember the main password to enter 1Password; just don't make it a simple one your dog could remember.

2. Different Email Addresses

Use a different email address for site registration and recovery than you use for everyday email. If your regular email address is compromised, an attacker can't also reset all of your sensitive passwords.

Whatever email system you do use, pick one with a robust spam filter to avoid phishing attacks. I'm a fan of Gmail.

3. Two-Step Verification

Set up two-step verification for Gmail and Apple to protect your accounts with your password and your phone. The Google verification requires entering a password as you normally would when signing in. Then, a code is sent to your phone via text, voice call, or through Google's mobile app. Or, a security key can be inserted into your computer's USB port.

Once signed in, you can choose not to use two-step verification again on that computer — only your password. If someone tries to sign into your account from another computer, two-step verification will be required.

4. Buy an Online Security Program

An all-in-one online security program such as Norton Security with backup provides virus detection, password storage, file backup, parental controls, and firewall protection. Buying programs for those features individually is expensive, and free options may not provide the same level of threat protection.

The parental controls are especially strong. According to a study by AV-Comparatives, the premium edition of Norton scored ahead of all other antivirus programs for overall parental controls and blocked 99% of all pornography.

5. Monitor Your Credit for Free

You can pay a credit monitoring service to alert you to any significant changes or suspicious activity on your credit report and credit cards, but you can do the same thing yourself for free.

Your bank or credit card provider may already offer fraud alerts and other protections for free. For example, you can choose to be notified via email or text message if your credit card is used to withdraw cash or a transaction happens outside the U.S.

Logging into your account every day and checking your account activity is another free way to monitor your credit, though that can be a lot of work.

One of the best ways to protect your credit is to get a free credit report each year at AnnualCreditReport.com. Consumers are entitled to a free report yearly from each of the three main credit reporting agencies. Request one report every four months to cover an entire year. If you find any errors, report them to the credit bureau you got the report from immediately.

6. Talk to Your Kids

Lastly, talk to your children about the importance of staying safe online. I check out websites my daughter wants to visit before allowing her online, but it's easy to run into dangerous sites without knowing you're doing it.

Safekids.com offers advice on online safety, including how to avoid cyberbullying, parental guides for Facebook and Instagram, and recognizing when a sexual predator is manipulating children.

What steps have you taken to increase your cyber security?

This article is from Aaron Crowe of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

6 Signs That a Winning Notification Email Is a Fake

Linsey Knerl — Wed, 14 Sep 2011 09:48:22 +0000

I’ve written about my hobby of entering sweepstakes before, and like any worthwhile endeavor, there is always a downside. One of these, unfortunately, is the massive amounts of new email you will receive as you sign up for newsletters and give out your contact info for prize notification. While fake prize emails can be sent to anyone, those who enter giveaways seem to be even more prone to receiving them. And while most of my newly sweeping friends have a bit of a learning curve in identifying the fakes from the real thing, they eventually master these six red flags that something isn’t right. (See also: Sweeping 101)

1. You Don’t Remember Entering

Even with the thousands upon thousands of sweepstakes I’ve entered over the past 14 years, I have a mild recollection of most of them. If I were to receive an email saying that I won dinners for a year from a local eatery, it would ring a bell, and I’d likely get excited. If some random company tells me that I won a questionable amount of cash in a promotion I don’t remember, however, I would take a minute to examine it more carefully.

Not sure if you entered or not? Google the promotion name, company, and prize to see what you find. Most likely, if it is a legit sweep, it was listed on several sites that prize winners frequent.

2. The Company Is Huge

While Pepsi, Yahoo, and Google do hold many giveaways, they rarely handle their own correspondence. If you get an email from Yahoo itself claiming to have picked your name to get a free iPad, for example, see 1) if you remember entering and 2) if the email is signed by a fulfillment company. If the email is signed by a PR company, it’s more likely real than if it’s signed by Pepsi’s CEO.

Again, you can Google to get the info for the company that is handling prize fulfillment for the sweepstakes you are wondering about. Major sweepstakes are most often done by major companies that only do sweepstakes drawing, notification, and awarding.

3. The Word “Lotto” Is Ever Used

Seriously, do you even play the lottery? If you get an email from a foreign country with the happy announcement that you have “lotto” prizes, it’s not legit. Lottery takes money to play, and as far as I know, they never notify people via an ambiguous email.

Other sneaky terms to beware of include “grant award” and any mention of an international fund.

4. The Email Went Out to Everyone

Check the “to” field in your email. Do you find your email alongside a dozen or more other email addresses within the same alphabetical range as yours? Bad news — you’re on a spam email list. Someone is desperately sending this same email out to thousands of unsuspecting email account holders hoping someone will bite. Delete this one without question.

Whatever you do, do NOT reply or attempt to unsubscribe to any email that has dozens of addresses. This will only confirm to the spammer that the email is valid, encouraging them to send even more junk your way.

5. Hyperlinks Are Fishy

Most fake emails trying to access your info (also known as phishing emails) will try to get you to either click on a link within the body of the email, or reply to a particular email. The destination, at first glance, may seem legit (“Please check out xyzcompany to get your prize!"). By placing your mouse over the hyperlink and NOT clicking on it, however, you can see where the link is directed to go to. If this is anything but the address in the email, RUN! These are clever rouses designed to get you to sites you would never visit. Don’t do them the honor.

Do a quick link check of all URLs in the body and at the bottom of the email. PayPal scams, for example, often look a lot like an official PayPal email, but the hyperlinks within the text all direct to scam sites designed to get your sensitive information.

6. You Were Asked to Send Money

This one is quick and easy to master. Don’t pay shipping fees, processing fees, or award fees for your prize. A prize is a prize, after all, not something you ordered.

Beware of anyone claiming that you have to pay taxes upfront for any prize. The IRS handles income tax, your local treasurer handles motor vehicle and boat taxes. Let them do their jobs, and leave the scammers wishing you weren’t so smart.

This article is from Linsey Knerl of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

Phishing Scams Continue to Plague Social Media Sites

Adam Baker — Tue, 13 Oct 2009 14:00:03 +0000

Social Media is going through an unprecedented explosion in popularity right now. Don't believe me? See for yourself. There are no signs this trend is going to slow anytime soon.

But this huge surge in popularity also makes the various social media networks a prime target for scams. While these social networks do a great job of proactively fighting the onslaught of spammers and scammers, occasionally a well-timed attack can slip through the cracks.

Just in the last couple of weeks, both Twitter and Facebook have both had several accounts compromised by viral phishing scams. In general terms, a phishing scam is any attempt to capture or steal personal information from an unknowing victim. In the social media world, this often is the process of trying to capture the username and password of a given social network account.

Most of us are familiar with getting spam messages or half-hearted scamming attempts in our e-mail or on our social media accounts. However, what makes these scams particularly effective is that they often times will be sent by someone that you already know. Once they obtain the login information of just a few initial accounts, scammers will then send out more messages to everyone connected to the compromised accounts. This means even just a couple accounts can quickly snowball into thousands.

Of course, the messages are specifically designed to pull at your curiosity. Here are the sample messages from the most recent attacks:

Twitter:

rofl this you on here? http://videos.twitter.secure-logins01.com

Facebook:

lmao! i cant stop laughing at you in this pic, when did you do this? http://tllg.net/xyzxyz

As you can see, there are a lot of similarities between these two different scams. First, they both reference the fact that some funny has happened in either a picture or a video. This is a very strong and effective pull for the far majority of people to want to know more. Also, both of the messages contain all lower-case lettering, which is common in unformal chatter between online friends.

And the scam has other things working in it's favor. In the example of Twitter given above, the link took you onto an extremely well replicated version of the log-in page. Because Twitter has an open API (meaning it easily allows third parties to develop applications), there are many legitimate and trusted sites which do have you log-in when using them. So many Twitter users don't second guess having to enter their log-in credentials.

So what can YOU do to help avoid all this madness?

Do not use the same password for your e-mail and your social media accounts. Take the time to create a separate, strong password for each of your online accounts. It's well worth it.
Be extremely weary of direct messages asking you to view pictures and/or video. As we pointed out above, this is a common theme used by scams.
Even if it appears to be a legit request, be sure to establish contact with the "friend" who sent it. Ensure that their account hasn't been compromised.
When it doubt, don't risk it. If you notice some of the formatting similarities we outline above or the message seems uncharacteristic in any way, there's probably a reason.

**If you think one of your social media profiles has already been compromised, take the following steps immediately:**

Change your account password, including any other online accounts that share the same password.
If you can't access your account, attempt to reset your password to the account.
If able, delete any spam messages that were sent out by the scammers.
Try to let your friends know that your account was compromised to prevent anyone from following the links further.
Report the incident to the social network itself, so they can track and eliminate the spread of the scam.

Further resources on similar topics...

Lastly, if you aren't a scammer or spammer yourself, consider following @WiseBread and @ManVsDebt on Twitter! You can find even more to follow on WiseBread's list of Top Personal Finance Blogs.

This article is from Adam Baker of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread:

Finding the Right Job: There’s Plenty of Phish in the Sea

Linsey Knerl — Fri, 19 Oct 2007 15:59:39 +0000

My husband and I are no strangers to the job hunt scene. Before he was even out of college, we were scouring the newspapers, searching the online databases, and handing out resumes to colleagues in hopes of helping him land that killer job. And while it was very frustrating that the rate of return on most job inquiries was very low, it wasn’t nearly as annoying as the slew of phony job emails that began infiltrating my husband’s email inbox.

Scammy job emails have taken several forms in my experience:

Phishing – This is usually disguised as an inquiry from a reputable company looking to get more information before scheduling an interview. They may ask for your social security number, bank account information, credit card numbers, or the name of your first junior high crush (this last one is doubtful, but equally damning.) While you may not get excited from seeing a message from Coca-Cola (since you obviously didn’t apply there), you may initially get overjoyed from seeing a supposed email from a place you did apply to. Upon finding out it is a scam, it can tick you off. Just be sure to ignore these emails. No potential employer wants to know you bank account info; trust me.

Nigerian Scam or Spoofing – Yeah, we know that not all of these actually come from Nigeria. In fact, a large portion of these emails are now originating in other parts of Africa and Eastern Europe. The premise is still the same, however. The phony company has determined that you are a perfect fit for their job as a payment processor. All you have to do is cash their phony check and wire back a percentage of the money. In addition to this tired scheme, similar emails may ask that job-seekers participate in certain forms of money-laundering or the shipment of stolen goods outside of the country. (What is especially frustrating about these emails is that they are more appropriate for some job-hunters than others. My husband, for example, was seeking to use his International Business degree in a new career. Upon first glance, some of these scams would appear to be a potential job opportunity. I would expect that someone looking for a career in Cosmetology wouldn’t even take the time to read through most of these emails, however.)

Franchise Opportunities – If you know someone that really makes thousands a week with little to no start up or effort, give me their number. Otherwise, I’ll just assume that it can’t usually be done. The Federal Trade Commission has taken measures to ensure that such arrogant claims be accompanied with certain disclosure statements if the purchase price of such a “start-up opportunity” is more than $500. This FTC Franchise Rule requires that all “opportunities” include a franchise disclosure document that includes basic information about the promoter's company, including any lawsuits from purchasers or lawsuits alleging fraud. In addition, the promoter must give potential purchasers the names, addresses and phone numbers of at least 10 previous purchasers closest to the potential buyer. If this info isn’t included, or the company refuses to provide it -- RUN!

Home Business Opportunities – Why would any company pay you $1 per stuffed envelope when they could hire out a mailing company to do it for pennies? They wouldn’t. And you can just forget about that medical billing and transcription opportunity you just found out about. With the new HIPAA laws and the sanctity of medical privacy, a real doctor isn’t about to just send anyone a load of confidential medical info without any background or training. Get more info before paying anything. Most real employers pay their employees; not the other way around.

Take heart in knowing that you eventually will find employment. It may take awhile (just remember how long we waited ). If you keep your head and take time in responding to job-related emails, however, you can save yourself from horrors far worse than unemployment.

This article is from Linsey Knerl of Wise Bread, an award-winning personal finance and credit card comparison website. Read more great articles from Wise Bread: