Scam Alerts & Information

Social engineering is the ultimate con – the bag of tricks employed by fraudsters who lie, cheat and steal their way past your organization’s security controls. Their goals: theft, fraud or espionage. Social engineering bypasses all technologies, including firewalls. It appeals to hackers because there is a general lack of awareness of the problem and it’s nearly 100% effective.

What is an organization’s best line of defense?
Their people. Properly trained staff, not technology, is the best protection against social engineering attacks. Learn how to protect yourself and your organization against social engineering attacks by understanding social engineering tactics and knowing how to recognize scams. People are the weakest link and as a result, organizations must build a human firewall by training their people.

What is social engineering?
Social engineering is the human side of breaking into a corporate network. Social engineering involves gaining sensitive information or unauthorized access privileges by building inappropriate trust relationships with insiders.

Social engineers manipulate people into speaking/acting contrary to their normal manner. The goal of a social engineer is to fool someone into providing valuable information or access to that information. In most cases the attacker never comes face-to-face with the victim, but they get the information or the access they need to commit fraud nearly 100% of the time.

Why are social engineers so successful?
Experienced social engineers relate well with others. They are consistently quick to establish a personal connection with the target and use that connection as the basis of building rapport. The simplest way to get information is to ask for it directly, and this forms the basis for the various techniques used by hackers.

Common social engineering techniques include:

How do you protect yourself and your company?
Social engineering attacks may be inevitable in the world today for the simple reason that humans are easy targets; nevertheless, that does not mean that attacks are unpreventable.

The single most important key to avoiding social engineering attacks is to not give sensitive information to anyone unless you can verify that they are who they claim to be and that they have a legitimate need for access to the information. Organizations and individuals can protect themselves through training and awareness as well as security-related policies and procedures.

By staying alert to potential security threats and keeping in mind the suggestions listed above, you will be much more prepared to enjoy the conveniences of online services with peace of mind!

No matter how secure a system is, there's always a way to break in. Hackers and malicious social engineers are turning to the weakest part of the infrastructure – the people – who are often the easiest to manipulate and deceive.

Impersonation is one of several social engineering tools used to gain access to a system or network in order to commit fraud, industrial espionage or identity theft. Impersonation differs from other forms of social engineering because it occurs in person, rather than over the phone or through email.

The social engineer "impersonates" or plays the role of someone you are likely to trust or obey convincingly enough to fool you into allowing access to your office, to information, or to your information systems. This type of social engineering plays on our natural tendencies to believe that people are who they say they are, and to follow instructions when asked by an authority figure. It involves the conscious manipulation of a victim to obtain information without the individual realizing that a security breach is occurring.

Impersonation requires a lot of preparation, so it occurs less often than other forms of social engineering. Social engineers prefer the more anonymous phone or email approach over appearing in person. Done well, however, nobody ever knows that the impersonator was ever there. To the people they spoke to, they were just another individual in a non-stop stream, although perhaps just a bit nicer than the run-of-the-mill grump.

Roles of the impersonator
Some common roles that may be played in impersonation attacks include: a repairman, a meter reader, IT support, a manager, a trusted third party (an auditor, for example), or a fellow employee. Most of these roles fall under the category of someone with authority, which leads us to ingratiation. Most people want to help, so they will bend over backwards to provide the required information (or access) to anyone with authority.

These tricks work because we all regularly interact with people we don't know. It's human nature to trust credentials – a badge or a uniform – but they can be forged. We trust uniforms, even though we know that anyone can wear one. And when we visit a website, for example, we use the professional appearance of the page to judge whether or not it's really legitimate -- never mind that anyone can cut and paste graphics. In the same way, we have a tendency to automatically trust someone in authority.

Common social engineering roles:

Impersonators do their homework
Impersonation works best when the social engineer gives a convincing performance, complete with the proper technical jargon or other insider information. Impersonators do their homework. They come armed with:

Once inside the building, impersonators will look for opportunities to:

There are some warning signs of an attack. Pay special attention to:

Before releasing any information to anyone, it's essential to at least establish:

Countermeasures for impersonation attempts
Verification is the key. A social engineer's goal is to fit in with the crowd - to look like someone who should be there. They may be disguised as any number of people who frequent your organization and, because they look like they belong, your best defense is being alert and asking someone in authority if they should be there. Always verify the identity of anyone who shouldn't be allowed inside your organization.

In a recent twist, scam artists are using the phone to try to break into your computer. They call, claiming to be computer techs associated with well-known companies like Microsoft. They say that they’ve detected viruses or other malware on your computer to trick you into giving them remote access or paying for software you don’t

need.

These scammers take advantage of your reasonable concerns about viruses and other threats. They know that computer users have heard time and again that it’s important to install security software. But the purpose behind their elaborate scheme isn’t to protect your computer; it’s to make money.

How Tech Support Scams Work
Scammers have been peddling bogus security software for years. They set up fake websites, offer free "security" scans, and send alarming messages to try to convince you that your computer is infected. Then, they try to sell you software to fix the problem. At best, the software is worthless or available elsewhere for free. At worst, it could be malware — software designed to give criminals access to your computer and your personal information.

The latest version of the scam begins with a phone call. Scammers can get your name and other basic information from public directories. They might even guess what computer software you're using.

Once they have you on the phone, they often try to gain your trust by pretending to be associated with well-known companies or confusing you with a barrage of technical terms. They may ask you to go to your computer and perform a series of complex tasks. Sometimes, they target legitimate computer files and claim that they are viruses. Their tactics are designed to scare you into believing they can help fix your "problem."

Regardless of the tactics they use, they have one purpose: to make money.

If You Get a Call
If you get a call from someone who claims to be a tech support person, hang up and call the company yourself on a phone number you know to be genuine. A caller who creates a sense of urgency or uses high-pressure tactics is probably a scam artist.

If You've Responded to a Scam
If you think you might have downloaded malware from a scam site or allowed a cyber criminal to access your computer, don't panic. Instead:

Cell phone users are increasingly turning to Bluetooth technology to talk - hands free - on their phones. But as this high tech tool gains popularity in the US and Canada, scammers are finding ways to exploit it.

How the Scam Works:
Scammers use specialized software to intercept your Bluetooth signal and hack into your device. It's called "blue-bugging." Doing this gives them access to all your texts, contacts, photos, call history... everything on your phone.

Scammers sometimes use hacked phones to make long distance calls. Other times, they access your private text messages or photos. But unless you are a celebrity, government official or high-powered corporate executive, you are unlikely to be a target.

Recently, the newest scheme is for scammers to set up a pay-per-minute phone number. Then, they hang out in a busy area and hack into phones. Scammers use the phones to dial the number and rack up charges by the minute.

For More Information
Check out Bluetooth.com for tips on using products with Bluetooth technology. Also, see your cellphone manufacturer's website for more advice.

To find out more about scams, check out BBB Scam Stopper.

A Facebook scam highlighted the threats posed to the millions of users of the popular social network. Security experts say users of social networks and Facebook, in particular, have high confidence in the links and information shared there. Attackers are constantly trying to take advantage of the high levels of behavioral trust, according to security firm BitDefender. While Facebook has security teams and automated systems to detect suspicious activity and contain threats quickly, third-party app baits, spam, Likejacking and other activities persist, said Catalin Cosoi, head of the online threats lab at BitDefender. Here are six signs you may have fallen prey to a Facebook scam.