Visa's big break to TJX on security standards during their data breach!

The TJX data breach -- which in case you haven't heard just doubled it's estimate of records compromised from 45 to 90 million -- has caused a lot of finger pointing between the financial and retail sectors.

Of course, this was revealed in court filings (like the revelation below) and I'll be surprised if anyone is willing to answer any questions about it.

The latest is that Visa knew that TJX had "extensive security problems," but chose to let them off the hook to become PCI compliant until 2009.

Evan Schuman of EWeek reports:

Credit card company Visa knew in late 2005 of the extensive security problems at TJX, but decided to give the retailer permission to remain non-compliant through Dec. 31, 2008, according to documents filed in federal court on Nov. 8.

The Dec. 29, 2005, letter from Joseph Majka, a fraud control vice president for Visa, was written months after cyber-thieves had already secretly infiltrated TJX's systems, starting the work that would ultimately become the worst data breach in credit card history.

Ironically -- while hackers were happily stealing a lot of PEOPLE's personal and financial information -- Visa wrote TJX telling them they would be holding off from fining them as long as they were diligent in fixing the problem.

In 2007, Visa fined one of TJX's banks before the deadline had expired.

PCI compliance standards are enforced by the payment card industry themselves. All that seems to be coming out of the largest data breach in history is a lot of finger pointing and litigation, which like fines, are driven by a financial incentive.

I hate to say it, but neither side of the fence wants to stop using plastic. They both are making billions of dollars in the process.

Perhaps -- if an entity with no financial stake in all this dictated the standards --the people having their information stolen by criminals would be a LOT better off.

The question is when are people (customers) going to come first?

eWeek story, here.

0 comments

Symantec reports on spam trends for 2007

Photo courtesy of slumberparty_uk at Flickr

According to Symantec's November report about 70.5 percent of the e-mail sent to your inbox is spam. This is pretty frustrating for a lot of us, who have to rely on spam filters that don't seem to work very well.

If you are like me, I get spam in my inbox and have legitimate e-mail mistaken as spam and sent to my bulk folder.

I've also heard of a lot of spam being able to bypass corporate spam filters recently. This can be particularly dangerous if an employee clicks on something that is malicious in nature.

Some experts have tested employees with phishy (spam) e-mails to see if they would fall for the bait. A large percentage of them did.

I mentioned corporations in the paragraph above, but this can happen at any organization.

In keeping with tradition, the spam kings stay on top of current events and ensure their social engineering lures are what would be considered newsworthy and even trendy.

From the Symantec November Report:

Ron Paul, MP3s, and global warming…what do they all have in common? No, it’s not some new presidential campaign. They were all topics leveraged in new spam tactics in October.

Even as the game becomes more sophisticated, most spam isn't effective unless it can lure a human being into whatever scheme it is attempting to pull.

Spam is already being seen that impersonates (spoofs) presidential candidates and claims to support environmental causes.

In the case of spam that impersonates environmental causes, a lot of them might include a survey asking for a lot of personal and financial information.

So far as the election campaign spam going around, we will probably see attempts to misdirect campaign contributions, commit identity theft and possibly even be used as a tool to spread misinformation (smear tactics).

One thing to remember is that giving out information to someone you really don't know tends to put you at an extreme risk of becoming an identity theft victim.

So far as financial scams go, the spammers also appear to be very interested in the real estate market:

Last month, Symantec reported how spammers had taken an interest in the housing market slowdown by offering different home refinancing deals. In an ongoing attempt to leverage capital by any means possible, the latest variations suggest releasing equity from your parents’ home.

Anyone, who falls for a not very legitimate scheme involving real estate is probably going to be taken to the cleaners. Sadly, fraudsters often target desperate people looking for a (too good to be true) way out of the mess they are already in.

The current real estate crisis is giving them an easy vehicle to do this!

With a reported 1,000,000 foreclosures pending in the United States and a possible loss of $200 billion to the lenders, this trend particularly bothers me.

The report also mentions Russian Bride scams, pump and dump stock scams using MP3, and spam e-mails using links containing Google searches.

The links containing Google searches misdirect the user to pretty questionable e-commerce sites, which could be (probably are) nothing more than a ploy to steal someone's money.

The information on the links using Google searches is explained in full on the Symantec blog, here.

This latest report indicates that spam is a problem that isn't going away in the near future. Spam is a known vehicle for everything from deceptive advertising to outright scams on the Internet.

Besides protecting your system, which Symantec is in the business of doing, being aware of the social engineering lures is the key to not becoming a Internet fraud statistic. It's refreshing to see Symantech address this with these reports, also.

For the full report, which has more spam variations than I've mentioned in this post, click here.

Symantec also does a blog on current online fraud schemes that are circulating, which can be seen, here.

0 comments

A few hard questions for Governor Spitzer to answer

I've written a few posts about Suad Leija, the young woman who has provided a lot of the evidence leading to the recent arrests of the main players (jefes) involved in the largest counterfeit documents cartel operating in the United States and Mexico.

These documents are sold to whoever has the money to buy them. Besides illegal immigrants, it’s safe to assume a portion of them have been sold to criminals and possibly even terrorists.

The cartel I'm referring to is known as the Castorena Leija-Sanchez organization.

According to ICE (Immigration and Customs Enforcement), this organization was making about $300 million a year selling counterfeit documents. If one were to consider that each one of these documents has a street price of about $100, this would mean they are responsible for about 60 million counterfeit documents being put in circulation.

If each person bought two of these counterfeit documents that would equate to about 30 million people, who have used these documents.

On the site PaperWeapons.net -- Suad’s husband, who uses the pseudonym of Lazarus -- has put up a video with a few questions directed at Governor Eliot Spitzer (NY) regarding his intent to issue driver's licenses to illegal immigrants.

You might want to know what the Castorena Leija-Sanchez and Eliot Spitzer have in common? The answer is that counterfeit documents issued by the Castro Leija-Sanchez organization will probably be used to establish the identifying information for the driver's licenses in New York State.

When this happens, we will have a lot of legitimately issued driver's licenses with not very legitimate information on them!

Here are the questions, which have been made into a video and released on YouTube:

1. Is Governor Spitzer replacing the members of the Castorena Leija-Sanchez organization by providing identification documents to people, who have broken the law?

2. Is a public official, who is sworn to uphold the laws of the United States and the State of New York aiding in the commission of criminal activity by providing documents that support illegal immigration?

3. If it is Governor Spitzer’s sworn duty to uphold the law should the people he serves insist his driver's license is taken away and he be impeached?

4. Is it fair for Governor Spitzer to break the law to get votes?

5. Since this card identifies the holder as someone, who has broken the law is it a get out of jail free card?

When law enforcement personnel discover that a illegal immigrant has broken the law, they are supposed to report them to the federal authorities. This is so they can be deported. Unless I'm missing something in all the hype that has resulted from this issue, this license will clearly identity the holder as a illegal alien.

If I were an illegal immigrant, I might be worried that if the political climate shifted, the licenses might be used to track down and deport people. Most of them are probably going to continue to use counterfeit documents that will not identify them as people, who are breaking the law.

Some of these concepts might be confusing to the average person, who has had the pleasure of living in a sanctuary city.

In a sanctuary city, the politicians tell the police not to ask any questions about a suspect’s immigration status. In other words, they are directed to bury their heads in the sand on this law. Sadly enough, this is also the case when illegal immigrants are arrested for serious crimes.

Here is a story from CBS5.com about an attorney (David Klehm), who is suing the San Francisco PD for not reporting illegal aliens. The same attorney has filed similar law suits in Los Angeles and San Jose.

The problem with issuing any identification document for a person -- who has entered the country illegally -- is how we know the document they are using to get a legitimate ID is in fact legitimate, itself.

This explains how most of the 9/11 terrorists managed to operate pretty freely before committing their heinous crime.

Most of the 9/11 hijackers used counterfeit documents, sometimes known as feeder documents to get legitimate driver’s licenses. Feeder documents are documents that are used to obtain legitimate documents. The goal of most people using counterfeit documents is to eventually get legitimate documents.

I doubt seriously that issuing driver's licenses to illegal immigrants is going to stop their primary goal, which is to establish themselves as legitimate citizens.

In 2004, Congressman Ed Royce made the following statement about provisions being stripped from the 9/11 bill regarding border security:

The 19 9/11 hijackers had 63 validly issued U.S. driver's licenses between them. What were they using that many for? They were moving around the country undetected and plotting and planning. In fact, as many as eight of them were even registered to vote. They then used those bogus licenses to board U.S. planes.

Congressman Royce further put things into perspective by saying:

Driver's licenses were the 9/11 terrorists' license to kill and to kill massively. We know that.

"They had 63 of these driver's licenses between them, for the 19 of them. And these identification documents gave these hijackers unfettered access to nearly everything they needed to plan and carry out their attacks on Washington, D.C. and on New York City. And the identification cards also allowed them to remain in the country with the appearance of legitimacy long after their visas had expired and their presence in the United States became illegal.

These provisions, designed to protect our borders were taken out of the bill despite the fact that 87 percent of the public supported having them included.

On a personal level, I’m more worried about National Security than anything else, but there are a lot of people saying these driver’s licenses enable voter fraud, also.

The Wall Street Journal published an editorial by John Fund on November 2nd, which explains this better than I can.

The editorial states one reason some politicians might be in favor of handing out these driver's licenses:

The background here is the National Voter Registration Act, commonly known as "Motor Voter," that President Bill Clinton signed into law in 1993. It required all states to offer voter registration to anyone getting a driver's license. One simply fills out a form and checks a box stating he is a citizen; he is then registered and in most states does not have to show any ID to vote.

Come to think of it, there has been a lot of controversy this week about how Bill’s better half answered some questions regarding this issue.

Perhaps, she can help Eliot answer the questions posed to him? After all, they both represent the great State of New York. Her answers have seemed to get a lot of attention already.

The problem of illegal immigration isn't going to be easily fixed. Granting driver's licenses to illegal immigrants adds fuel to an already out of control fire we are facing in this country. This is especially true when we lack the means to verify exactly, who they are in the first place.

The bottom line is that it enables more serious crimes than illegal immigration and our politicians have a sworn duty to protect us from being harmed by it!

There is an e-book written about Operation Paper Tiger, which documents the story of how the Castorena Leija-Sanchez family was investigated by the authorities. The book contains transcripts (taken from wire taps) of the organization in operation.

If you were on the fence as to whether or not our borders are secure, or just want to know how insecure they really are, the book is a must read.

Currently, the book is only available on the Paper Weapons site, here.

0 comments

San Francisco Supervisor charged with bribery, extortion, mail and voter fraud!

There are some of us wondering how many more politicians will be caught with their hands in the cookie jar. In the past few years, quite a few of them seem making a mockery of the oath they took when they went into public service.

One of the San Francisco's own is being prosecuted for a host of fraud charges, including the fact that he himself committed voter fraud.

Karen Gullo at Bloomberg.com is reporting:

Ed Jew, a member of San Francisco's board of supervisors, was charged today with fraud, bribery and extortion for allegedly soliciting $80,000 from business owners in exchange for using his influence with the city's planning commission.

An indictment handed down today by a federal grand jury in San Francisco accuses Jew, 47, of soliciting bribes from Quickly tapioca drink shops in San Francisco, according to a statement by the U.S. Attorney's Office for the Northern District of California. In May, Jew accepted $40,000 in cash from Quickly representatives, prosecutors said.

SF Supervisor Ed Jew is also under investigation for committing voter fraud. SF Gate (Cecilia M. Vega, Jaxon Van Derbeken) reported in June:

Embattled San Francisco Supervisor Ed Jew surrendered to Burlingame authorities Tuesday night after San Francisco's chief prosecutor filed criminal charges against him and issued a warrant for his arrest, saying the lawmaker lied about where he lives in order to run for office.

Jew, who turned himself in with his bail bondsman at his side, posted $135,000 bail and was released.

The arrest and felony charges bring to a head a City Hall scandal that has dogged the rookie supervisor ever since FBI agents last month raided his city office, his residences and his Chinatown flower shop.

Interestingly enough, Wikipedia has a very detailed write-up on the ongoing Ed Jew saga, here.

Bloomberg.com story, here.

SFGate.com story, here.

0 comments

Will the current mortgage crisis result in more mortgage fraud?

Will irresponsible lending practices and in some instances, fraud end up being the cause for an overall problem in the credit industry?

In case you haven't noticed, there seems to be a lot of homes up for sale. I'm even starting to see signs stating that the house in question is being sold by the bank.

We are even seeing signs that the problem might be worse than expected within the credit industry.

Reuters (courstesy of CNBC) is reporting:

Total losses stemming from writing down the value of mortgage-linked securities could be as high as $200 billion, with financial institutions sitting on at least $60 billion in losses that have not yet been disclosed, JPMorgan said Monday.

Banks and insurers, including Merrill Lynch, Ambac Financial Group and MBIA have reported third-quarter losses as they write down the value of securities, including collateralized debt obligations, or CDOs, backed by residential mortgages.

There is much more to come, JPMorgan analyst Chistopher Flanagan said on a conference call with clients.

In a different story, it was also announced that the CEO of Citibank is stepping down because of losses incurred by sub prime mortgages.

Forbes reported:

In a statement Sunday night, Prince said “it is my judgment that given the size of the recent losses in our mortgage-backed securities business, the only honorable course for me to take as chief executive officer is to step down. This is what I advised the board.”

Of course, Mr. Prince doesn't have anything to worry about personally. There are now reports surfacing that he could walk away from Citibank with $31 million in his pocket.

I could go on and on about the irresponsible lending practices that lured people into buying homes they could ill afford. Hidden in all the irresponsible lending practices is a fair amount of fraud.

Instances of mortgage fraud seemed to rise during the boom in the real estate market. The best resource (I know of) that addresses mortgage fraud is the Mortgage Fraud Blog authored by Rachel Dollar, who is an attorney specializing in the field.

If you are interested in the amount of fraud seen in the mortgage industry, the Mortgage Fraud Blog is an excellent resource.

Fraud associated with mortgages is unlikely to go down anytime soon. We will probably see a lot of fraudulent schemes pop up luring people with the promise of getting out of their personal mortgage crisis.

If anyone is interested, the Mortgage Bankers Association has a pretty decent consumer protection site (stopmortgagefraud.com) to educate the public on this type of fraud, here.

Reuters story (courtesy of CNBC), here.

Forbes story, here.

0 comments

eBay shoppers crack QVC fraud case

eBay and auction sites are found to have HOT merchandise being sold on them too frequently (my opinion). I ran across a story in the Register, written by Dan Goodin, where two eBay customers cracked a $412,000 fraud case being committed against QVC.

As reported by Dan Goodin:

A woman has pleaded guilty to fleecing the QVC home-shopping networking of more than $412,000 by exploiting a gaping hole in its website that allowed her to receive merchandise without paying for them.

Quantina Moore-Perry ordered handbags, jewelry and electronics and then immediately canceled the transactions. The flaw allowed the North Carolina woman to take delivery of more than 1,800 items without being billed. Moore-Perry would then sell the booty on eBay, according to the Associated Press, which cited authorities.

I wonder if QVC offered a reward to the two eBay shoppers, who discovered this flaw in their system?

This would also make me wonder if this woman was the only one who has defrauded QVC in this manner?

There is a lot of controversy surrounding the sale of stolen merchandise on eBay and other auction sites. I've heard that some companies now have a dedicated person in their security departments to watch these sites for stolen merchandise.

Register story, here.

For other posts, I've written concerning stolen merchandise on auction sites, click here.

0 comments

IRS Phishing Scam lures victims with a donation plea for the Southern California Fires

In an apparent scam that packs a double whammy, the IRS is being impersonated in a spoofed e-mail requesting donations for the recent Southern California fires.

From the IRS press release:

The Internal Revenue Service today warned taxpayers to be on the lookout for a new e-mail scam that appears to be a solicitation from the IRS and the U.S. government for charitable contributions to victims of the recent Southern California wildfires.

In an effort to appear legitimate, the bogus e-mails include text from an actual speech about the wildfires by a member of the California Assembly.

The scam e-mail urges recipients to click on a link, which then opens what appears to be the IRS Web site but which is, in fact, a fake. An item on the phony Web site urges donations and includes a link that opens a donation form which requests the recipient’s personal and financial information.

It appears that in this scam, people are being solicited for both money and their personal information.

The IRS is warning that this is likely to make them a victim of identity theft, and that providing any personal and financial information is likely to result in a person having a lot more money taken from them than they intended to give:

The bogus e-mails appear to be a “phishing” scheme, in which recipients are tricked into providing personal and financial information that can be used to gain access to and steal the e-mail recipient’s assets.

The IRS also believes that clicking on the link downloads malware, or malicious software, onto the recipient’s computer. The malware will steal passwords and other account information it finds on the victim's computer system and send them to the scamster.

Generally, scamsters use the data they fraudulently obtain to empty the recipient’s bank accounts, run up charges on the victim’s existing credit cards, apply for new loans, credit cards, services or benefits in the victim’s name or even file fraudulent tax returns to obtain refunds rightfully belonging to the victim.

If you happen to run into one of these spoofed e-mails, here is something you can do to help the IRS and people, who might fall for this:

Recipients of the scam e-mail can help the IRS shut down this scheme by forwarding the e-mail to an electronic mail box, phishing@irs.gov, using instructions found in “How to Protect Yourself from Suspicious E-Mails or Phishing Schemes” on this site. This mail box was established to receive copies of possibly fraudulent e-mails involving misuse of the IRS name, logo or Web site for investigation.

IRS press release on the latest spoof using their name, here.

Fraudsters have been using the IRS name to scam people on an ongoing basis. Frequently, the name of other government agencies are used as a badge of authority by scammers, also.

Other posts regarding this phenomenon can be seen, here.

Governor Schwarzenegger in California stated that there will be zero tolerance for fraud in wake of the fires. His press release, along with numbers to report suspected fraud can be seen, here.

Sadly, whenever disaster strikes, scammers of all sorts pop out of the woodwork to steal money from people.

In case you don't have time to link to the press release, the number is 800-952-5210.

0 comments

Does anyone really know how much information was lost by TJX?

About a week ago, I saw that the amount of compromised records in the TJX data breach had doubled.

Interestingly enough, the allegation that the amount of compromised records had risen from 45 to 90 million wasn't brought forward by the folks at TJX. This new revelation was reported by the banking industry. They also reported at least $151 million in fraud losses have been associated with the breach.

This isn't the first time in recent history that the estimate of losses has risen dramatically. The Certegy breach jumped from 2.3 to 8.5 million records compromised. The media caught on to this increase as the result of a SEC filing.

Since this was part of ongoing civil case against TJX, the people revealing it have a powerful motivation to prove their point. TJX is still claiming that most of the information stolen was masked (hidden by asterisks), or had expired.

The $151 million in fraud losses startled me slightly since I had only seen one story about the information actually being used reported in the press. I'm referring to 6 people arrested in Florida, who went on a million dollar shopping spree and were later caught.

After doing a Google News Search, I was able to find one more story about a Ukrainian indivdual, who was caught in Turkey trying to sell some of the data.

In the Boston Globe story I read about this, both the card issuers and TJX dodged Ross Kerber's attempts to quantify some of the more recent estimates of loss being made.

I wonder if in data breaches, anyone really knows, or all the parties involved put out whatever version of the facts that suits their own interest in the matter?

The fact that some of the people investigating the TJX debacle have now doubled their estimate of the amount of records compromised lends credence to this theory. Of course, that depends on which version of the story you want to take as gospel.

It's unlikely the hackers (who might know the most accurate figure) will ever admit to it, either. Doing so, would incriminate themselves, and besides that, it probably isn't good for the business they are in. When a data breach is discovered, the fact that they have stolen the information is made public and it is (from their standpoint) compromised.

In fact, from the criminal's perspective (my speculation), the most profitable information they have is data no one knows they've stolen yet. I'd be curious to discover exactly when all this fraud occurred. Did it occur after the breach was made public, or before it?

Perhaps that is why very little of the information from data breaches seems to be used? Quite simply, it probably has little value to the criminal element, once everyone knows it's been compromised.

If you were a identity thief would you want to buy any of the information from the TJX data breach? The bottom line is that it would probably be dangerous to use, and it likely wouldn't even pass muster in most of the payment card authorization systems.

After all -- knowingly using it, would probably make them a statistic -- or one of the less than one-percent of identity thieves that get caught.

There is no doubt that there is a lot of personal and financial information being made available to criminals. Routinely, we see stories where the information is sold (e-commerce style) over the Internet.

The amount of known sources, where data has been stolen has gotten out of hand, also. The Privacy Rights Clearinghouse, Attrition.org and PogoWasRight all are making a valiant attempt to keep records of the known data breaches -- but with the lack of transparency in most of these data breaches -- it's unlikely they are going to be able to document the full scope of the problem,

There are probably many more data breaches out there that go unreported, or the entities who were breached have no idea that they occurred.

Until we start going after the source of the problem (the criminals), the problem of data breaches and identity theft will continue to grow. As we continue to bury our heads in the sand and minimize the problem, the criminals doing this will likely be laughing all the way to the bank!

Boston Globe article about the new statistics in the TJX breach (well-written), here.

0 comments

One of the oldest social engineering techniques (sex) still seems to work!

Some would argue that sex is one of the oldest social engineering ploys to deceive someone into doing something they normally wouldn't do. As far as I know, it's been being used since biblical times.

Roderick Ordoñez at the Trend Labs Malware Blog (Trend Micro) is reporting that malware is being downloaded on systems using a mysterious woman named Melissa, who strips off her clothing (in increments) when a user puts in the right CAPTCHA code.

CAPTCHA codes are those annoying letters and numbers, we have to enter in a box to prove we are human.

From the Trend Labs Malware post:

A nifty little program that Trend Micro detects as TROJ_CAPTCHAR.A disguises itself as a strip-tease game, wherein a scantily clad “Melissa” agrees to take off a little bit of her clothing. However, for her to strut her stuff, users must identify the letters hidden within a CAPTCHA. Input the letters correctly, press “go,” and “Melissa” reveals more of herself.

It appears that no one is completely sure what the malicious intent is with Melissa, but Roderick speculates that:

The CAPTCHAs in the example above were taken from the Yahoo! Web site, possible proof that someone may be building a huge base of Yahoo! accounts. For spam-related reasons perhaps? Although various methods of OCR (Optical Character Recognition) are already used to circumvent the CAPTCHA, this social engineering technique is new in that it uses people to unsuspectingly aid a malicious user.

The dangers of downloading all kinds of what I refer to as cybernasties are well documented on porn sites. A lot of these sites are owned by organized criminals, and unsuspecting users have had their identities stolen by going on them.

Here is a post, I did where British citizens were charged with a crime after having their identities stolen in this manner:

British citizens accused of child porn found to be fraud victims

The investigation that started this originated in the United States.

Recently, I did a post on hackers almost shutting down the State of California's systems, by misdirecting them to porn sites. In the post, I wrote:

As I've written before -- exercise extreme caution when clicking on porn sites, they often make your computer come down with a virus (or worse)-- especially if "safe surfing practices" aren't being used.

Interesting post from the Trend Labs Malware Blog with some rather revealing graphics, here.

0 comments

The FTC Fraud Department didn't really send you that phishmail

Phishing attempts spoofing (impersonating) government agencies aren't anything new. Here again, the FTC (Federal Trade Commission) is being used as a badge of authority to trick people into downloading something that is likely to steal their personal and financial details.

From the FTC press release about this most recent occurrence:

A bogus email is circulating that says it is from the Federal Trade Commission, referencing a “complaint” filed with the FTC against the email’s recipient. The email includes links and an attachment that download a virus. As with any suspicious email, the FTC warns recipients not to click on links within the email and not to open any attachments.

The spoof email includes a phony sender’s address, making it appear the email is from “frauddep@ftc.gov” and also spoofs the return-path and reply-to fields to hide the email’s true origin. While the email includes the FTC seal, it has grammatical errors, misspellings, and incorrect syntax. Recipients should forward the email to spam@uce.gov and then delete it. Emails sent to that address are kept in the FTC’s spam database to assist with investigations.

The virus contains a keylogger, which logs information keyed into a computer and sends it back (electronically) to the phishermen (bad guys). This is a common method of stealing people's financial and personal information, which then is used to steal money.

The technical terminology used in the press release refers to a virus. Two other terms used to describe how a keylogger is planted on a system are malware and crimeware.

Keylogging software seems to be legally purchased, often touted as a way to spy on your family, or employees. Law enforcement and people committing more sophisticated forms of espionage have been known to use them, also.

If you are interested in seeing how many people are marketing keyloggers, click here.

Phishing might sound technical, but it almost always uses a psychological technique known as social engineering (trickery) to accomplish it's purpose. In this case, the trick (lure) to click on the attachment is fear, but in a lot of cases, it's something that's too good to be true.

The FTC refers people, who want to learn more about phishing to http://www.onguardonline.gov/.

Another place that has a lot of information about phishing is the Anti-Phishing Working Group.

Traditionally, the Phishermen relied on tricking people to give up the information they were seeking. More and more, keyloggers are being used that steal the information automatically.

Other posts, where I've written about keyloggers can be seen, here.

I've been getting a lot of queries on this site about another government agency (the IRS), who has also been spoofed frequently by the Phishermen. The last update on this was on September 19th, but my guess is that these are still circulating out there, also.

Full FTC press release on this matter, here.

Here is an interesting CNet blog post about FTC Chairman, Deborah Platt Majoras, stating publically that phishing is driving her insane. This was taken from a comment she made about a month ago to the first National Cybersecurity Awareness Summit.

(Deborah Platt Majoras courtesy of the FTC site)

0 comments

13 percent of the U.S. population were fraud victims, according to the FTC

More than one out of ten people fell victim to a fraud scheme last year, according to the Federal Trade Commission. Of even greater interest was the fact that weight-loss scams came out number one, over lottery and buyers-club scams.

From the FTC press release on this:

The Federal Trade Commission today released a statistical survey of fraud in the United States that shows that 30.2 million adults – 13.5 percent of the adult population – were victims of fraud during the year studied. More people – an estimated 4.8 million U.S. consumers – were victims of fraudulent weight-loss products than any of the other frauds covered by the survey.

Fraudulent foreign lottery offers and buyers club memberships tied for second place in the survey. Lottery scams occur when consumers are told they have won a foreign lottery that they had not entered. Victims supplied either personal information such as their bank account numbers or paid money to receive their “winnings.” In the case of buyers clubs, victims are billed for a “membership” they had not agreed to buy. An estimated 3.2 million people were victims of these frauds during the period studied.

Here is another set of statistics worth evaluating:

Print advertising – direct mail, including catalogs, newspaper and magazine advertising, and posters and flyers – was used to pitch fraudulent offers in 27 percent of reported incidents. The Internet, including Web sites, auction sites, and e-mail, was used to make 22 percent of the fraudulent pitches. Television or radio accounted for 21 percent of the pitches, and telemarketing accounted for nine percent.

Interestingly enough, at least according to this survey, the Internet is only one venue used to pitch fraudulent schemes. Almost half (48 percent) were pitched by more traditional marketing venues, such as direct mail, newspaper and magazine advertising, television advertising and telemarketing.

Schemes pitched via the Internet only accounted for 21 percent of the reported incidents.

The full release by the FTC, along with consumer tips can be read, here.

The FTC has another page worth reading (I like the fact that it points out certain behaviors that most fraudsters exhibit), here.

Both of these links contain information on where to report fraud, which is highly recommended. The sad truth is that a lot of fraud victims never report being taken advantage of. Admitting that you were taken in by one of these schemes is embarrassing to a lot of people.

Trust me, there are a lot of people out there that fall for something that's too good to be true. Not reporting a scam probably means another person is probably going to end up being victimized by it.

With all the publications, television and radio shows, and direct mail come-ons out there, the FTC needs help identifying all the fraud that is out there.

I wonder what would happen if laws were passed that required advertising (marketing) mediums to exercise a little due diligence (act with a certain standard of care) before accepting money to plaster some of these fraudulent schemes all over the place?

One thing is for certain, most fraudsters aren't going to be able to get their customers to promote their goods, or services without paying them to do so!

0 comments

Counterfeit Document Gang Jefe(s) "Chiefs" charged with murder, racketeering and conspiracy

Recent picture of Suad Leija taken at an undisclosed location. Although not mentioned in many of the articles about this arrest, Suad is responsible for providing a lot of the information used in this latest indictment. Her story has been covered in the mainstream media by Lou Dobbs, Paula Zahn, Fox, CNN, La Opinion and Univision.

Operation Paper Tiger, the federal investigation into the organized trade in counterfeit documents has resulted in the arrest of three of the Jefes (Chiefs) of the largest organized gang (the Castorena Leija-Sanchez organization) involved in the trade.

Also arrested was one of the hit-men associated with the gang. The latest charges include murder, racketeering and conspiracy. These charges have been added to previous charges (already) filed regarding the organized counterfeiting of identification documents by the organization.

All 23 defendants arrested thus far are from the Castorena Leija-Sanchez counterfeit document organization. Three of the people arrested include Manuel Leija-Sanchez, Pedro Leija-Sanchez and Julio Leija Sanchez -- three brothers who allegedly are in control of the organization throughout the United States and Mexico.

There is a lot of evidence that this organized gang, which the government describes as International in nature, is responsible for providing counterfeit documents to ANYONE with the money to buy them. This would include not only millions of illegal immigrants, but a LOT of criminals and potentially, even terrorists.

On Wednesday, the Department of Justice announced the indictment of the three leaders of this cartel in a press release:

Federal racketeering conspiracy and murder-related charges were added against three brothers – now all in custody and charged together for the first time – and their alleged “hitman” in Mexico to a pending indictment resulting from the dismantling in April of an international counterfeit identification document business that allegedly generated profits between $2.5 million and $3 million a year in Chicago’s Little Village Community. Manuel Leija-Sanchez, 40, who was arrested in Mexico last Friday, and his brother, Pedro Leija-Sanchez, 35, who was arrested in Mexico in August, are facing extradition to the United States. Together with a third brother, Julio Leija-Sanchez, 31, who was arrested in Chicago in April, the three are among a total of 23 defendants facing charges in Chicago as part of Operation Paper Tiger, an investigation led by U.S. Immigration and Customs Enforcement (ICE). Also facing extradition from Mexico is the alleged hit-man, Gerardo Salazar-Rodriguez, 34, who was charged previously and was arrested in Augustin Mexico, federal law enforcement officials announced today.

Not mentioned in the press release, or most of the news articles, I saw appear on this story is the fact that most of this was made possible by a young woman by the name of Suad Leija.

Suad Leija is the step-daughter of Manuel Leija-Sanchez -- who has been providing information to the authorities about the gang's inner-operations and identifying members -- previously unknown to law enforcement.

The Chicago Tribune (Antonio Olivo) was the one mainstream source, I'm aware of, who refers to Suad's involvement in the case. I've also been told by Suad's husband that she has completed two recent interviews with Univision and was featured on the Minutemen Project the other day.

Suad started providing information on the organization after discovering her husband was trying to gather intelligence on potential terrorists, who the organization had provided with counterfeit documents. This led to her having to make a hard choice, which was whether to side with her family, or her husband. Suad chose her husband after being educated on the dangers this trade poses to the United States.

I would have to speculate that a lot of evidence used to arrest Manuel, Pedro and Julio was obtained as a result of information Suad has provided to the authorities.

If one refers to the Paper Weapons site, it also shows that the earnings of this cartel are a lot higher than $2.5 - 3.0 million allegedly earned by the Chicago cell of the organization. The figure quoted on the site is actually closer to $300 million. This figure includes the earnings of the numerous cells of the organization, which are located in cities throughout the country and operated as franchises.

Suad's story has been well-documented by mainstream media types, such as Lou Dobbs, Paula Zahn, Fox, CNN, Univision and La Raza. She has also produced a series of YouTube videos, which reveal why she decided to educate the public on how counterfeit documents are actually "paper weapons."

Interestingly enough, her story has been covered extensively in the Spanish media. One reason for this might be that pending legislation will force employers to respond to no-match social security numbers. Because of this, legal Hispanic identities will likely be targeted for identity theft purposes. In the past, making up a name was sufficient to pass muster for employment purposes.

Suad and her husband have written a novel describing the full detail of their involvement in Operation Paper Tiger, which is currently only available from the Paper Weapons site. This book reveals what might be at stake if we continue to allow criminals to control our borders.

Included in the book are transcripts from actual wire-taps, many of which, tie into this most recent indictment.

They are currently writing another novel, which will detail Suad's personal story.

Here is my original post, I did on Operation Paper Tiger, which introduces the book:

Operation Paper Tiger - the true story, which reveals why our borders aren't very secure!

I highly recommend it to anyone, who is concerned about our Nation's security.

DOJ press release on the arrest of the Leija-Sanchez brothers, here.

Indictment from Eastern Court of Illinois, here.

ICE (Immigration and Customs Enforcement) has a slightly different version of this latest development in the story, here.



(Passport photo -- which are frequently used to make counterfeit documents -- of Pedro Castorena-Ibarra)


(Pedro Leija-Sanchez doing time for another crime under an assumed name)


(Julio Leija-Sanchez)

0 comments

Is Myexcusedabsence.com a counterfeiting mill for dishonest employees?

Just about when you think you've seen everything on the Internet, someone comes up with something so outlandish that a reasonable person has to question it's legality.

Jessica K. Brown (AP) is reporting on a website that allows anyone to counterfeit (my term) excuses to provide to an employer.

From the AP article (courtesy of the Washington Post):

For about $25, students and employees can buy excuse notes that appear to come from doctors or hospitals. Other options include a fake jury summons or an authentic-looking funeral service program complete with comforting poems and a list of pallbearers.

Apparently, they are getting away with it because they have a disclaimer on the site stating that the templates are for "entertainment purposes only."

Oddly enough, the AP article directly quotes one of the owners as saying:

"Millions of Americans work dead-end jobs, and sometimes they just need a day off," said John Liddell, co-founder of the Internet-based company Vision Matters, which sells the notes as part of its Excused Absence Network. "People are going to lie anyway. How many people go visit their doctors every day when they're not sick because they just need a note?"

To me, this is a direct admission that they know fully well that their templates are being used to defraud employers.

And please remember that it wouldn't be too far fetched to guess that some of these excuses could be used by people committing workmen's comp fraud.

Will the owners of this enterprise be held liable when someone loses their job after providing one of these counterfeit excuses to their employer?

According to the article at least one person has been already been arrested after using one of these counterfeit excuses. A New Jersey woman was arrested after using one of these notes to try to get out of appearing in court. I guess this means people can and will use these counterfeit documents for other purposes besides getting a day off.

Since, a lot of these people are collecting pay using these documents, there is a financial loss being incurred by employers from this activity, also.

There are a lot of reasons for employee absenteeism and many consider it a factor in how productive (profitable) any organization is.

In 2003, a study was published by Braun Consulting News that attempts to quantify the reasons it occurs and what can be done about it. Interestingly enough, the study showed that employee absenteeism was decreasing. The study recommends proactive ways of increasing employee morale, which was found to be big factor in what causes employees to call in sick.

The study is worth a read and it certainly points how organizations need to take a proactive approach in an ever-changing world to address employee absenteeism.

Saying this, most employers are going to take a dim view of forged documents and any employee, who uses them and gets caught, is going to be extremely lucky if they are not terminated for their actions. Most employee handbooks I've ever seen have a clause in them warning against falsifying documents, and most of them call for immediate termination for doing so.

This is a pretty hefty price to pay to get a day off!

Most reasonable bosses are more than happy to take care of a hard working and productive employee if they have a need. My guess is that these documents will be used by employees -- who aren't very hard working, and have already abused the system so much -- they need a written excuse.

The amount of payroll a company spends it directly attributable to how much money they are making. The more of it that gets stolen, the less a company will have to spend on wages and benefits. Given this, the people at myexcusedabsence.com are costing the honest worker wages and benefits should their materials be used for anything other than entertainment purposes.

The Internet offers a lot of questionable services, and too many of them operate under the "entertainment purposes" guise.

Maybe if enough people complained to the Federal Trade Commission (FTC) about them and they were investigated throughly a few of them might be held accountable.

After all, in this instance, one of the site owners seems to have openly admitted to the associated press that he is fully aware of what people are using them for!

AP article (courtesy of the Washington Post), here.

0 comments

As Southern California burns, watch out for charity scams!

A sad commentary on how some people react to a disaster are the amount of scams that surface as a result of them.

The Postal Inspectors are warning us that we are likely to see a lot of these scams appear as a result of the Southern California fires.

If you are one of the good people out there, who intends to lend some financial support, it is a wise thing to make sure your hard-earned money is going where it is supposed to.

From the USPIS release:

Our charitable nature leaves us vulnerable to charity fraud schemes. Most charities are legitimate organizations that support good causes. Some, however, are run by swindlers. With more than 700,000 federally recognized charities soliciting for charitable contributions, the U.S. Postal Inspection Service reminds everyone it pays to be cautious when making a donation.

Disasters bring out the best in people who truly desire to help those impacted by these situations. Unfortunately, disasters also bring out the worst; scammers take advantage of the circumstances by stealing the charitable donations intended to help victims of the disaster. Postal Inspectors saw numerous charity scams emerge in the days following the devastation of Hurricane Katrina, the 2004 Southeast Asia earthquake and tsunami, and the September 11th terrorist attacks.

The recent California firestorm offers a new opportunity for fraudsters to perpetrate charity scams. If you're considering a contribution to help with relief efforts, it's important to know where your donation dollars will go. California Charities can be researched on the Attorney Generalwebsite, http://ag.ca.gov/charities or at the Better Business Bureau's Wise Giving Alliance, http://www.give.org/.

The Postal Inspectors are also offering some general tips on how to avoid these scams:

-- Give donations to known charities, or research new or unfamiliar charities first.

-- Refuse high-pressure appeals. Legitimate fundraisers won't push you to give on the spot. -- Be suspicious of solicitors who say they can only accept a cash donation.

-- Always make checks out to the name of the charity, never to an individual.

-- Be wary of "sound-alike" charities, many scammers use names that sound similar to names of legitimate charities.

-- Be skeptical if someone thanks you for a pledge you don't remember making. This is a tactic scammers use to lull victims into sending "additional" funds.

-- Ask for ID. For-profit fundraisers must disclose the name of the charity requesting the donation --- it's the law. Many states require paid fundraisers to identify themselves as such and to name the charity for which they're soliciting. If the solicitor refuses to tell you, hang up and report it to law enforcement officials. Also ask how much of your donation goes to those in need and how much goes to the fund raiser.

Last, but not least -- if you spot one of these scammers, you can help terminate their activities by reporting them to the Postal Inspectors.

You can find your local Postal Inspector by calling 877-876-2455. If you are of a more technical nature and prefer to report illegal activity online, you may do so, by clicking here.

USPIS release, here.

Although, Arnold isn't taking calls from bloggers this morning, I'm sure he supports terminating this type of activity, also.

The people in Southern California will need a lot of money to help them recover. Wasting monetary resources on scams will not help the situation.

PS: I'm dedicating this post to Paul Young, a noted Southern California blogger and friend, who writes Prying1.

I've enjoyed reading his investigative insights on issues, which are obtained, by digging a little deeper than the mainstream media.

0 comments

Payment card fraud victims being denied compensation

Apparently, fraudsters are now able to clone some payment cards, assign a new PIN -- and it appears that the customer's old PIN was used when the bank reviews the transactions.

Card Guide (UK) is reporting:

The Chip and Pin technology that has been in use in the UK over recent years is supposed to be practically fraud proof, but this is not the case, as thieves can clone cards and put a new PIN number onto the card – this is known as a YES card.

However, it appears to the bank that the original card and PIN have been used, and therefore banks claim that either the customer carried out the transaction themselves or they gave their PIN number to someone or were careless with the security of their PIN.

Card Guide story, here.

There have been many instances, where payment card thieves were able to get card details, along with the PIN numbers. It can happen to just about anyone, even when they are being careful.

If you have had a fraud claim denied because the bank claims you were careless, you might want to read about instances (substantiated), where PIN details were stolen using pretty sophisticated methods, here.

Of course, there are and always have been people, who try to claim fraud for their own financial advantage. Because of this, it seems some innocent people are getting their claims denied (my opinion).

Figuring out, who is guilty of this is getting harder all the time.

My guess is that with all the fraud involving payment cards, it's no longer an expense the banks can continue to write-off as a cost of doing business.

Banks denying claims because they say a customer compromised their own information is nothing new.

One example of how this happens can be seen on BankofAmericaSucks.com, here.

I guess all the zero liability ads we see all the time aren't exactly one-hundred accurate?

If you have wrongfully had a claim denied, I've seen individuals made whole by escalating the matter with the financial institution. In some instances, using a consumer advocate was necessary.

On a final note, in most businesses, the cost of fraud is passed off to everyone, when we pay more for goods and services. The truth is we are all held liable for the cost of fraud!

0 comments

Scammers trick grocery chain into sending them $10 million

(Photo courtesy of rcbatey at Flickr)

Normally, when e-mail scams are brought up, we think of unfortunate individuals falling for something that's too good to be true. A surprising discovery, found in federal court filings, proves that this isn't always the case.

Yesterday, Rebecca Boone of the Associated Press (courtesy of the StarTribune.com) reported:

Supervalu Inc., the Eden Prairie-based grocer, fell prey to an e-mail scam this year, sending more than $10 million to two fraudulent bank accounts, according to federal court filings.

Apparently, Internet e-mail scam artists accomplished this by sending spoofed e-mails impersonating Frito-Lay and American Greetings:

The company said it received two e-mails -- one from someone purporting to be an employee of American Greetings Corp. and another from someone claiming to be with Frito-Lay, according to the documents. Both e-mails claimed that the companies wanted payments sent to new bank account numbers.

At first, it appears that no one at SuperValu questioned the account changes and approximately $10 million was wired into them.

According to the article, the scam was discovered quickly and the FBI intervened. SuperValu will not comment on how much money they actually lost.

Either this is a fluke, or it shows a growing trend, where businesses are being specifically targeted in e-mail scams.

This isn't the only type of e-mail scam that has been targeting businesses and organizations.

Stories about what is known as spear phishing have been circulating recently. Spear phishing differs from regular phishing because indivduals are targeted by name, and as reported in some of these stories, sometimes by both name and title.

Previous posts, I've written about spear phishing can be seen, here.

Please note that stealing money isn't the only goal in spear phishing. Sometimes the goal is to steal information (which is worth money), also.

Phishing has become more sophisticated in recent history. Besides using social-engineering (trickery) to obtain information -- malware (sometimes known as crimeware) is downloaded into a system by opening a e-mail attachment -- which steals the information automatically and on an ongoing basis.

Another growing trend is the sale of DIY (do-it-yourself) phishing kits in underground (normally Internet) forums. These kits are enabling less technically inclined criminals to get into the game.

This goes to show that educating employees (especially those with access to financial assets, or valuable information) how to avoid being scammed might be something worth taking a look at.

On a final note, we need to remember that the same type of scam could be accomplished via snail mail with convincing letterhead, or even via a fax. The best way to avoid scams is to be able to recognize the behavior behind them.

AP Story, here.

0 comments

USPIS Presents: Work@Home Scams: They Just Don't Pay!

The United States Postal Inspectors have produced a pretty telling video showing how Internet criminals lure people into taking jobs that will cause them financial and legal trouble.

The film entitled, Work@Home Scams: They Just Don't Pay shows what happens to people, who accept work-at-home jobs that aren't what they appear to be.

It also speaks to how this problem has grown from ads in the classified section of newspapers and magazines to being plastered all over the Internet.

A lot of us probably see spam e-mails offering these too good to be true jobs that don't make sense on a daily basis. You might also run into one of these scams on a job-site, such as Monster.com.

Another fact is that applying for one of these jobs can lead to giving up your personal information, which will later be used to steal your identity.

Please remember these scams still show up in the classified ads of newspapers and magazines, also.

Here is (what I consider) an interesting story about someone falling for one of these scams that should have known better (my opinion):

BBB Worker Takes Job Processing Fraudulent eBay Transactions

0 comments

How much money is lost by businesses due to coupon fraud?

Here is an interesting blurb about an Arby's employee, who stole $14,524 by using coupons to conceal the fact he was dipping into the till.

NBC10.com (Philadelphia) is reporting:

A fast-food restaurant employee was charged with theft after police said he was skimming the cash register by using coupons.

Curtis Smith, 32, of Coatesville, was an employee at the Arby's store located on Concord Pike for several years, police said.

Police said Smith used $1 off coupons at the register and would then take that money from the register. He obtained between $50 and $150 at a time, police said.

The investigation started because of declining revenues at the restaurant.

Coupon fraud can be a huge problem for companies, who use them as marketing tools. A few years ago, Subway discontinued a promotion because too many coupons were being reproduced and sold on auction sites.

CouponInfo.com has some pretty good descriptions of the types of coupon fraud going on out there. According to the site, there is even an underground market in counterfeit coupons.

They state that coupon fraud costs companies millions of dollars a year.

After reading this, I decided to go on eBay and see if I could find coupons for sale. After going to the site, I was able to find quite a selection. If you want to take a look, click here.

Because everyone always picks on eBay, I decided to see what Google had to say. After doing this, I was amazed at the market out there in selling coupons.

No wonder CouponInfo.com couldn't put an exact figure to the losses caused by coupon fraud. It would be pretty hard to figure out!

Going back to the story about the Arby employee, the article doesn't state where he got the $14,523 in coupons. Of course, it's hard to say, but it wouldn't be hard to find them by doing a little surfing on the Internet.

Maybe this is something that businesses, who issue and redeem coupons should watch a little more carefully?

NBC.com story, here.

0 comments

P2P under Congressional scrutiny - FTC to investigate

Although there are legitimate uses for P2P (peer to peer) software, there is no doubt that there are a lot of dangers to using it, also.

Officially, the concerns are how this exposes people to identity theft -- but this costs the entertainment industry (who probably have a few lobbyists dedicated to this matter) a lot of money when they don't get their royalties (money) on music and videos -- which people download for free using P2P.

Now Congress is asking the Federal Trade Commission to take a deeper look into the matter.

Still worried that peer-to-peer filesharing networks like Lime Wire are causing users to "inadvertently" expose sensitive documents, posing potential security risks, members of Congress are now asking for a formal investigation into the phenomenon.

The latest concern from the House of Representatives Committee on Oversight and Government Reform, judging by a 7-page letter (click for PDF) dated Wednesday to Federal Trade Commission chairwoman Deborah Majoras, appears to be this: Peer-to-peer networks may make unsuspecting consumers vulnerable to identity theft.

The same group of politicians, led by Reps. Henry Waxman (D-Calif.) and Tom Davis (R-Va.), suggested earlier this summer that peer-to-peer networks can pose a "national security" threat by allowing users to expose sensitive information unwittingly. (Some politicians, particularly those with entertainment industries in their districts, also took the opportunity once again to condemn unlawful transfer of copyrighted content via the networks.)

I've written a little about why it isn't a good idea to use some of the P2P networks out there:

Japanese cop exposes confidential information on 6,000 people using P2P (file-sharing) software

How P2P Software like Limewire Compromises Personal and Financial Information

Besides being a potential national security threat and an identity theft venue, most of this software is liable to do a lot of damage to your system. And unless you are pretty technically inclined, you will probably have to spend a little of your hard-earned money to fix the damage it will cause!

CNet news blog story, here.

0 comments

Krackin software will crack your computer's security!

(Screen shot courtesy of Websense)

Krackin is one place you don't want to try to download music, or videos. The result will be your computer becoming what is known as a zombie, which will be used to spew out spam e-mails, which facilitate Internet fraud.

If you have clicked on this, I highly recommend reading the link in Websense's alert, which I have provided below.

Websense is reporting:

Websense® Security Labs™ has received several reports of a new Web site that is being distributed in spam sent out by those running the Storm attacks. For more details on the Storm attack, see (http://www.websense.com/securitylabs/blog/blog.php?BlogID=141).

This site poses as a new piece of software called "Krackin v1.2" and advertises:

* Easy to install
* Auto-Virus scanning* Mobile Source Downloading
* IP Blocking to Prevent Tracking
* Unwanted User Blocking

Users with unpatched computers are automatically exploited. Users with patched computers are prompted to download and run a file called "kracking.exe" This file contains the Storm payload code.

Websense alert, here.

On a final note, if you are a parent, this would be a good topic to cover with younger family members. From the appearance of the screenshot above, it would likely attract younger users.

0 comments