Technology isn't stopping Spam

Anyone noticed that spam is filling up your inbox? No, it's not your imagination, experts are saying the volume has increased up to 300 percent -- depending who you talk to.

As usual - in the technology versus technology battle - the bad guys seem to have defeated a lot of the countermeasures (spam-filters) that have been developed in recent years.

If you would like to see all the technical explanations, Network World did an excellent article with links to previous articles, here.

According to the Network World article, a certain Amichai Inbar a.k.a. John Che Blau and Jonathan Blau is behind a lot of it (operating out of Tel-Aviv).

I'm sure there are those developing additional countermeasures - which will be made available at a price - but I have a better idea. Use existing laws to take away Mr. Inbar's "ill-gotten proceeds" and put him and all his friends where they belong (prison).

Once they start taking away all the "ill-gotten proceeds," there would probably be plenty of it to fund additional legal actions!

So far as countermeasures being developed to meet this latest threat, history dictates that in a matter of time, they will be obsolete, also.

It probably wouldn't be hard to find the "spam kings," they don't seem to be hiding in caves on the Pakistani/Afghani frontier.

In fact, according to Spamhaus - the largest point of origin by far is the United States.

Perhaps, Microsoft is setting the example (after themselves being attacked for years) and taking legal action.

In my opinion, Microsoft is leading the way towards an effective resolution of this problem.

Here is an interesting site from "Ban Spam," with International contacts on where to report spam (broken down by all the different scam variations and countries).

The more spam that is reported provides valuable intelligence to those, who are taking legal action to stop it.

0 comments

Tickets to the Oprah Show Smell a little Phishy

First gypsies impersonate Dr. Phil and now someone is selling tickets to the Oprah show that smell a little "phishy."

Illinois Attorney General, Lisa Madigan warned the public in a official statement:

In this case, e-mail recipients are asked to submit personal information and told they will receive tickets to The Oprah Winfrey Show after verification of certain financial information and/or the wiring of money to an unknown third party. However, according to Harpo Productions, Inc., The Oprah Winfrey Show does not sell tickets or ticket travel packages to fans. Consumers should disregard any e-mail that purportedly comes from The Oprah Winfrey Show offering show taping tickets for a fee.

No one is reporting any cases of identity theft yet, however one this is certain; wire money to anyone for Oprah tickets and you are going to lose out!

Tickets to watch a taping of the Oprah show are free!

Fraudsters and Phishermen love to have money wired to them - because once it's picked up - it belongs to them and there is nothing the sender can do about it.

Western Union has a warning about wire transfer scams, here.

Of course, the personal information harvested from this phishing attempt might be for sale in underground forums (chat-rooms). More on this, here.

Please note that "unsolicited" requests for personal and financial information via the Internet are scams, no matter how official they might seem. Fake "official looking" websites - including banking sites - are all "too" common in the "sometimes" murky waters of the Internet.

For more on this, you can read the release from Attorney General Madigan's office, here.

The press release mentions information on where to report this scam at the bottom of the release (link above).

0 comments

India Deals with the Problem of Credit/Debit Card Cloning

We read a lot of stories about credit/debit card skimming in the West, but see very few stories about it in other parts of the world.

India, which has become a giant in IT circles is now being victimized by the problem.

In May, I did a post about cloned credit/debit cards showing up in India. Since then I've had the pleasure of corresponding with a "security person," who is sharing information with me regarding the scope of the problem.

In November, in another case, there were more arrests in three Indian cities - 6 skimmers, laptops, a desktop and cards were seized.

The activity was facilitated with the collusion of waiters and shop-keepers.

According to my "source," more card-skimming has been uncovered and the Indian authorities are hot on it's trail. We can probably expect to see a few more criminals arrested in the not so distant future.

Until recently, cloned cards were normally sent in the mail from other destination points in Asia.

Recently, the news media was awash with stories of information being compromised at call centers in India. The industry and the government in India have quickly moved to enact legislation to counter this threat.

The stories got a lot of attention (probably because it happened in India), but in reality, information and data breaches are happening (with too much frequency), worldwide.

India seems to be proactive (refreshing) in taking legal measures, which are far more effective that technological countermeasures, to protect it's citizens and the industry, itself.

Of note, the recent skimming/cloning activity seems to have been introduced by British based gangs and the UK is suffering a "large" issue with this type of activity.

Video (interesting) on skimming in India from IBN, here.

Interesting and "informative" discussion about cyber-law in India by Praveen Dalal, here.

0 comments

How to Protect Yourself from the Cyber Criminals on Cyber Monday

Black Friday has come and gone and now we have Cyber Monday to look forward to. Cyber Monday was coined by the National Retail Federation because it represents one the largest e-commerce shopping days of the year.

While shoppers search the Internet for all the "deals" that will be offered, another element - the cyber criminals - will be offering "goods and services" at too good to be true prices.

If we are to believe recent statistics, the cyber-criminals will be out there in force.

According to the National Consumers League and National Cyber Security Alliance, ten percent of us could become a victim of Internet crime.

Gartner Inc. recently reported that the number of phishing attempts has nearly doubled in the past two years and the Anti-Phishing Working Group has reported similar statistics.

Phishing is a leading cause of identity theft and financial crimes, where someone receives an e-mail appearing to from be a legitimate company (normally financial institution). In the e-mail, instructions are contained to click on a link leading to a fake website, where the goals is to con someone into giving up information (personal and financial).

Auction fraud has also grown to the point that it now is the number-one complaint filed with the Internet Crime Complaint Center or IC3. Internet auctions have become a popular place to buy Christmas gifts.

And a massive bot-net of "zombie" computers designed to attack in-boxes across the world has been seen forming on the horizon to facilitate the "holiday attack." Anyone noticed how many spam e-mails are getting past your spam filters lately? The speculation is that these will be to perform phishing expeditions, and or spread other scams.

The National Consumers League and the National Cyber Alliance offer the following tips, here.

Government sources are also great places for information on how to protect yourself from cyber-criminals.

The Federal Trade Commission has a lot of great information on how to protect yourself and report suspected criminal activity, here. And not to be outdone, the FBI covers a lot of these crimes and has a place where they can be reported, here.

If you are a more "visual" type, the Federal Deposit Insurance Corporation (FDIC) has an excellent video - geared towards the average user - on how to avoid cyber-criminals, here.

While the cyber-criminals will be out there in force this holiday season - being aware helps guarantee that you will be one of the ninety percent that will "just say no" to their various schemes.

Always remember, if it's too good to be true, it probably isn't!

0 comments

Are Counterfeit Documents being Mass-Produced in Nigeria?

In the past several years, we've seen all sorts of counterfeit financial instruments (money orders, cashiers checks and now American Express gift cheques) being passed in Internet scams.

A recent TimesOnline story stated:

Nigerians are forging passports and cheques on an industrial scale and that huge numbers of false documents are passing through provincial British airports.

The face value of the fraudulent financial instruments discovered in "routine checks" amounted to millions of dollars, and the documents (non-financial) are probably used in "illegal immigration.

Story, here.

The TimesOnline article also mentions that the UK is a staging ground for a lot of the stolen merchandise, which are proceeds of auction fraud.

According to the article, the activity also enables the criminals to return (easily) should they get caught:

Suspected Nigerian fraudsters, who have been deported in exchange for charges against them being dropped, are re-entering Britain using forged travel documents and resuming their activities, according to the study.

Other suspects are absconding and disappearing because, unless they are accused of crimes involving more than £50,000, they are being released on bail.

I wonder how many of them get bailed out on a stolen identity, assume another one, and go right back into business?

We seem to see story after story about what a huge problem counterfeiting has become. One of the main reasons is that technology makes it easy to do, and if anyone is caught, the consequences are minimal.

It's true that the article is about activity in the United Kingdom, but the problem isn't contained to the British Isles.

And Nigeria isn't the only place counterfeit documents are being made.

Asia has also been a reported "source" for a lot of counterfeiting. For instance, it's widely believed that North Korea has been flooding the world with "supernotes" (counterfeit $100 bills) that are almost impossible to tell from the real thing. Wikipedia article, here.

If you read through the article, it tells of ties to terrorist organizations and organized crime syndicates.

Nigeria might be a source of counterfeit documents, but they aren't the only one. The United States also is known to have a lot of counterfeit documents being produced, also.

If they didn't, it would be hard for the 14 to 20 million illegal immigrants to find jobs.

Swapmeetdave.com has an interesting page has an interesting page (with pictures) of a lot of the counterfeit items (from Nigeria), here.

0 comments

Consumers Union Calls for Credit Card Reforms on the Eve of Black Friday

Recently, I blogged about "Credit Card Gotchas" after being inspired by a e-mail I received from the Consumers Union.

I got another one that makes a lot of sense, which is to think carefully before spending money you don't have this weekend. Since tomorrow is "Black Friday," the biggest shopping day of the year, the timing is appropriate.

In their own words (or maybe I should say the words of the consumer):

Just as the holiday season gets ready to kick into high gear, Consumers Union is warning shoppers about the increasing number of credit card traps that can trip up consumers and lead to spiraling debt. To help get out the message and mobilize support for reform, the group is releasing "It's Always Christmas Time (For Visa)," an animated satire that takes aim at abusive credit card fees and practices.

"You can find yourself buried in debt if you aren't careful to avoid the credit card gotchas," said Michelle Jun, Staff Attorney for Consumers Union. "Too many credit cards are designed to get you in debt and keep you there."

“It’s Always Christmas Time (For VISA)” is a lighthearted take on the unexpected fees, interest rate hikes, and misleading contracts that are contributing to high credit card debt in the U.S.

After viewing the animation, viewers can send an email to Congress asking lawmakers to support credit card reforms. To view the animation, click on www.CreditCardReform.org.

Consumers enjoy few protections when it comes to credit cards and there are an increasing number of ways they can be penalized with fees or get stuck with higher interest rates:

Universal default: Your interest rate can skyrocket if your credit score declines because of your behavior with other creditors even if you always pay your credit card on time and never miss a payment. Some card issuers will raise your rate if you inquire about a car loan or open a new credit card.

Change of terms: Credit card terms keep changing. Read the fine print and chances are you’ll find this disclosure: “We reserve the right to change the terms (including the APRs) at any time for any reason.” A fixed rate is fixed until the bank gives you at least 15 days notice that it isn’t. If you want to keep your account open, you’ll pay the higher new rate on your existing balance.

Teaser rates: That low rate you signed up for expires suddenly and you end up paying more. A temptingly low introductory rate can climb to 30 percent or more. - more -Minimim payment: If you pay the minimum payment every month, you’ll end up paying a lot more than what you charged and you could be on the hook for a very long time.

On time payment: Card issuers are systematically mailing statements closer to the due date, giving customers less turnaround time. You can be hit with a late fee even if the payment is mailed on time. The average fee for a late payment has more than doubled in the past decade.

Double cycle billing: Finance charges are usually calculated using the average daily balance. If you alternate between paying off and carrying a balance, you’ll end up paying more interest.

Cash advance/convenience checks: The interest rates on these are higher than your credit card.

Penalty interest and fees: Late payments can raise your interest from 7% to 27%! Rather than rejecting charges that exceed your credit card limit, issuers today often let them go through but then charge a hefty fee -- as high as $39.

Fees, fees, and more fees: As if the penalties weren’t enough, you pay more fees for paying by phone or charging abroad. You may have to pay a fee to receive what used to be free year-end summary statements.

Balance transfer switcheroo: Transferring a balance from an account with a high APR to another one with a lower interest rate could come at a high cost. Any payments you make are typically applied first to the lowest rate balance. So while the credit card company uses your payment to quickly pay off that 0 percent transfer balance, you are piling up interest on purchases, at say, 18 percent. Multiple balance transfers will hurt your credit score.

Full article from Consumers Union, here.

I write about fraud from a victim's perspective, and I've often lamented on why it seems insane to keep writing-off not only monetary losses (passed on to everyone), but "seemingly," the millions of victims created by the not very secure handling of people's personal information.

People need to learn to be responsible when using credit - but that's hard to do - when credit card companies issue (too) large lines of credit to new customers and even send pre-approved offers to family pets (this actually happened at my house). My daughter had been using the dog's name when registering on certain websites.

It's not hard to see why so many are up to their necks in debt before they realize what happened, or why there is so much credit-card fraud. It all boils down to too much bad debt that eventually has to be compensated for.

I recently blogged about how sending mass-mailings of pre-approved credit card offers is dangerous to the recipient's financial health. There seems to be a trend of making it too easy to get credit and not paying enough attention to the consequences of doing so.

Perhaps, what is needed is a new era of responsibility? Bad debt is an expense on any financial statement and the quest to keep expanding customer bases has led to an environment of "robbing Peter to pay Paul." Since the issuers would go out of business if they weren't profitable, revenue streams are added to cover it, and "more."

And guess who ends up paying for it?

In my opinion - should we fail to address the problem soon - the bottom is likely to "fall out" sometime in the future and that isn't going to be a "good thing" for the credit-card- issuers, or their customers.

0 comments

buySAFE Survey Reveals Customer's Fears about e-Commerce

Rob Caskey - who is buySAFE's marketing guru - sent me this interesting survey they conducted. What's interesting about the survey is that takes the fear of Internet fraud beyond bogus financial instruments and identity theft to a more basic level.

The survey reveals that the average person fears they won't get the product received, or get something other than what was represented. And if you consider all the variations of auction fraud on the Internet, this is what normally happens to the average customer when they are defrauded.

And - after all - when we go shopping the goal is to have a pleasant experience and get something we want. We don't want to have to constantly worry about getting ripped-off.

Here is what the press release from Market Wire had to say:

On the brink of Black Friday – the biggest shopping day of the year - identity theft and credit card fraud are not the only issues causing consumers to abandon their online shopping carts this holiday season. A recent survey by online trust and safety company buySAFE, Inc. (www.buysafe.com) and online market research service Insight Express revealed that respondents are almost equally concerned with the possibility of non-delivery or receiving something different than promised. These concerns – along with concerns about the trustworthiness of the retailer, quality of merchandise, and shipping costs -- are amplified when shoppers are considering buying from smaller, independent online retailers.

Detailed survey results, here.

There is no doubt that there are a lot of hard-working and "honest" sellers on the Internet, who have been hurt by all fraud that takes place on auction sites. In fact, according to the experts, auction-fraud seems to be the number-one complaint these days.

From legitimate accounts being taken over by phishing (eBay and PayPal are the two most targeted brands) to a wide-array of counterfeit and stolen goods being sold, consumers face the real fear of getting ripped-off when buying an item.

I had a conversation with another person who writes about fraud on the Internet recently, and we both agreed that the average Internet customer almost needs to become a "fraud expert" to ensure they aren't going to be "taken advantage of."

buySAFE has created it's own "niche" in the market by ensuring a seller is legitimate and giving their customers the "peace of mind" that they are dealing with a legitimate and "trusted" retailer.

Although the service isn't free to sellers (customers don't pay anything), it protects the average person from all the fraud we hear read about in the e-commerce world. So far as the honest sellers - who have been damaged by Internet fraud (consumer confidence) - it lets everyone know they are a "trusted source."

For the smaller seller and the person out there in search of a "good deal," the service allows them to focus on their primary goals (selling and shopping) and it leaves the "worrying" to someone else, (buySAFE).

buySAFE has a couple of bloggers on their team (who I've had the opportunity to correspond with) and I've found more than one interesting insight about e-commerce when reading them.

Jeff Grass, buySAFE CEO's blog, here.

Steve Woda, buySAFE founder and Chairman's blog, here.

Here is more about buySAFE, courtesy of the Market Wire release:

buySAFE, Inc. is the leading trust and safety company for e-commerce transactions. buySAFE qualifies merchants, identifies reputable online businesses with the buySAFE Seal, and uses surety bonds to provide broad protection for individual buyers from online transaction risks. The buySAFE bond is backed by Liberty Mutual, Travelers, and ACE USA for up to $25,000, and boosts consumer confidence for lesser-known online retailers, allowing them to compete with the big, established brands. buySAFE has issued more than 9.5 million surety bonds on individual online purchases. There are currently more than two million items bonded with buySAFE that can be found at www.buysafeshopping.com. buySAFE is headquartered in Arlington, Virginia. More information can be found at http://www.buysafe.com/.

0 comments

Is it a Lack of Security at Retailers Causing the Debit/Credit Card Breaches?

Whether by hacking databases, or placing skimming devices on point-of-sale systems, debit/credit card fraud is raising it's ugly head, worldwide.

After finishing my most recent post about skimming devices placed on BP point-of-sale systems in the UK, I read an article in Computer World about what might be the latest large data breach.

Jaikumar Vijayan writes:

Several financial institutions last week canceled thousands of credit and debit cards in Michigan because of fraud concerns related to an apparent data compromise at a convenience store chain, highlighting the wide effect that retail security breaches can have.

Jaikumar's story, here.

Jaikumar's story states that Wesco, a retailer, is suspected as being the point-of-compromise. Of course, Wesco isn't admitting this and merely states that the matter is under investigation.

Office Max was the suspected point-of-compromise in another case last fall and to the best of my knowledge - they never admitted to being involved. Dollar Tree and Sam's Club have also recently been suspected as being points-of-compromise in breaches, where large amounts of credit/debit card information were compromised.

Why are hackers targeting retailers? The answer might be that large amounts of account information - including PINs (personal-identification-numbers) - are being maintained in databases, which are poorly protected and therefore easily compromised (hacked).

In his story, Jaikumar interviewed an expert from Gartner (Avivah Litan):

It also wasn’t clear how the data might have been breached. But four out of five data compromises involve security breaches at point-of-sale systems, said Avivah Litan, an analyst at Gartner Inc. The POS systems at convenience and grocery stores, as well as gas stations, can be especially vulnerable because of a lack of IT security awareness and resources, Litan said.

Much of the exposure results from merchants connecting their POS terminals to IP-based networks, Litan said. Often, such systems store magnetic stripe data from cards and have default passwords that can be easily hacked, she added.

The Payment Card Industry security standard explicitly prohibits the storing of magnetic stripe data on POS systems. But retailers continue to do so, and many POS applications store the data by default, Litan said.

The problem is that the retailers never admit to being breached, the banks give out limited information when asked about it, and it appears that there are too many companies not following the Payment Card Industry Data Security Standard.

Perhaps the problem is that Payment Card Industry Data Security Standard isn't being enforced and the consequences are lacking for those in violation of it. At a minumum, shouldn't these companies be prevented from doing electronic payments by the industry?

Even if a lot of the losses are being written-off, they are normally passed on to everyone in the form of increased fees, interest rates, or in the case of retailers - higher prices. Despite this, there are also people that are denied compensation, especially if they fail to be timely in filing a claim; or a PIN was used and they can't tie it into a known breach.

With the amount of data-breaches, it's often difficult to figure out where any particular person's information was stolen from.

If the Payment Card Industry can't clean up their own backyard, perhaps it's time for some government inquiries into why so much information is being compromised?

Even without government intervention, there is the matter of consumer confidence to be considered. Consumer confidence is what makes businesses thrive, and a lack of it can be a disaster for all of those involved.

I'm sure there are retailers protecting their information properly, and the ones who aren't give everyone a bad name.

0 comments

ATM Skimming Case Travels to 19 Countries on 5 Continents

Skimming device (courtesy of the "ATM Pool" at Flickr)

Police in the United Kingdom are calling an ATM skimming case, one of the biggest of it's kind. ATM skimming is where a debit-card's magnetic stripe is counterfeited (cloned) and the PIN (personal identification number) is compromised - normally with a hidden camera.

Official's estimate the fraud has already netted about $4.5 million and the counterfeit cards have been used in 19 countries and five continents.

According to the story published in the SundayMirror.co.uk:

The scam was uncovered after police launched an investigation - codenamed Operation Turner - after receiving 560 complaints. Detective Sergeant Dick Bollard, who is leading the probe, said: "This is one of the biggest scams of its kind. It's a very large and complex investigation which is expected to take a considerable amount of time.

"The investigation is ongoing and we are looking into a number of leads in the UK and abroad." A spokesman for trade organisation APACS, which helps banks fight fraud, said: "These scams have involved copying a card's magnetic strip and in cases filming a driver keying in a PIN number by using some sort of hidden camera.

SundayMirror.co.uk story, here.

Two suspected dishonest employees at BP gas stations (where the devices were planted) have been arrested. One of them might be an illegal immigrant, also.

If the cards have been used in 19 countries so far, it's safe to assume that the people behind this are pretty organized. Although no one ever knows for sure, there might be Internet chatrooms (forums) - where Internet fraudsters gather to barter and sell stolen information spreading the activity.

The UK has had a lot of this skimming lately and I did a recent post about it where Romanian Illegal Immigrants were to blame.

And the UK isn't the only place that is having problems with debit-card skimming at gas stations. A similar case happened at Arco stations in California and there have been many other instances, worldwide.

BP owns Arco in the United States.

Although a lot of skimming is attributed to devices being placed on (self service) point-of-sale terminals and ATM machines, there has been recent evidence cards are also being cloned after databases have been hacked at retailers.

Some who investigate this believe that the people behind this intentionally hold on to the stolen information before using it to frustrate investigative efforts that would discover their techniques, or operations. In some recent cases, the authorities could only speculate, which of the known breaches, an individual person's information was stolen in.

Skimming can also be accomplished by retail, or restaurant employees using portable "encoding devices." Unfortunately, most of the technology used is legal and can even be bought on eBay.

It pays to keep an eye on your card to make sure it isn't being swiped more than once.

There's probably not much an individual person can do when entire databases are compromised, but an individual can shield their PIN when using their debit card (strongly recommended).

At least if they don't have your PIN, they can't get cash; however they might still be able to use the card number for signature based, or e-commerce transactions. Note that credit-cards are cloned for the same purpose.

Last, but not least - debit cards don't offer the same protection as credit cards do. If you expect to recover your money, the allowed time frame to file a claim is a lot less than with a credit card.
It's a good idea to watch your statement carefully.

If you would like a more visual demonstration of how skimming occurs, Visa has a pretty telling page (portable devices), here.

Flickr has a link to a public group pictures of ATM machines, including skimming devices, here.

There are a lot of eyes out there (customers and employees) that might spot a suspicious device - if you do - never touch it and make sure you report it to law enforcement (immediately). Since the activity normally occurs in public (retail) spaces, an educated individual could very well make the difference in cracking one of these cases. Remember that anyone near the device - no matter how official they look - might be involved, themselves.

0 comments

Why Do We Keep Blaming Identity Theft Victims?

I just got done reading an article by Mark Seagraves (WTOP Radio) about 478 laptops that have been stolen from the IRS. Mark was able to obtain this information via the "Freedom of Information Act."

At first, I thought "here we go again," but in reality -- there are probably thousands of laptops that have disappeared in the private sector that were never made a public record via the "Freedom of Information Act."

In fact - in a lot of the data breaches observed - the breached seem to disclose as little as possible. I wonder if we know about every data-breach that might have occurred?

Articles about missing laptops compromising "millions" make good stories, but in reality, laptops are a desirable item and get stolen all the time. It's entirely possible they are bought and sold on the black market and even used by criminals, who are clueless of their "information value."

I predict sometime in the near future, we'll see a story on information was compromised by the theft of a smart phone. They're pretty easy to steal and (desirable), also.

On the other hand - with chat forums selling personal information for a few dollars a pop - the amount of compromised information out there is potentially huge.

Recently, we saw stories where personal information was being harvested off hard-drives that were thrown-away, or given to charity. How many hard-drives have been discarded without removing the information on them?

Again - with the amount of personal information being stolen and used in financial crimes - who knows? Some "expert" will argue that none of it has been used and the criminals using it are unlikely to comment.

No matter where it comes from, the astronomical increase in identity theft, clearly indicates that a lot of information is being compromised - whether stolen from a laptop, garbage can, or via malicious software, sometimes referred to as crimeware.

I had to chuckle recently when some "security experts" observed that in most identity theft cases, the information compromised came out of trash cans. Whether they are right, or wrong - the information sent in mass mailings starts in a database - sold for a profit and printed on a computer.

The only difference is the method of mail being used. Trust me, the Postal Inspection Service investigates a tremendous amount of fraud that is sent via snail mail and mail fraud is nothing new.

Yes - according to the experts - we are to blame and need to take action to ensure criminals don't compromise the sensitive information being sent to us in mass mailings. Is anyone paying us for our time to rectify a problem, we didn't create? Has anyone ever considered that maybe we shouldn't be mailing this type of information and then making it too easy to obtain one financial instrument, or another?

We see technology fixes, which are highly publicized, but seem to have short lifetimes after "saavy" criminals defeat them. An example of this is the "chip and pin" technology - which seemed to be compromised in no time at all on older ATM machines.

There are still a lot of older ATM machines to be used.

I've also seen "experts" blame people for not keeping their virus protection up-to-date, or falling for social engineering schemes. Are they to blame for e-commerce sites that are easily faked and complete "do it yourself" scamming kits routinely available on the Internet?

An entire security industry has grown up around this problem and if you want protection - which doesn't always work - you need to line someone's pockets. In fact - in many instances - you not only have to line their pockets once, but you also have to pay for all the countermeasures that are developed when their measures are defeated.

Businesses love income streams.

Then there are the faux providers of protection, which can lead to more information being sifted from your computer if you happen to download their "fixes." It's very difficult for most consumers to determine - who is reputable and who is not - when their ads are right next to each other on the Internet.

Sadly enough - one of the solutions has been to offer "identity theft insurance," which means that people are being asked to finance their own protection. A lot of this is being sold by the same people, who are buying and selling all the information that caused the problem in the first place.

We need to address to the real issue, which is there is too much information out there that is "poorly protected" and easily accessed for "dubious purposes."

Please note that I'm not advocating that people don't need identity theft protection, or to protect their systems. Virus protection, firewalls and identity theft protection are probably good things to have in the current enviroment we are dealing with.

And I'm not saying all the "experts" are wrong. Trust me, a lot of them are hard working, thoughtful and dedicated people trying to make a difference. The problem is that money can buy a lot of experts and those using and abusing people's personal information have plenty to spend.

We need to stop believing that technology can cure the problem and realize we are dealing with a social issue. The bottom line is that a lot of sensitive personal information is being poorly protected and too many people are being victimized by the use of it.

Since so much money is being made by making "sensitive information" too easy to access, the people making a lot of money are resistant to change. Until we make it less profitable for them to continue "enabling" the problem, the problem isn't going to disappear and is likely to grow.

If the people enabling the problem are "resistant to change," perhaps the answer is to create laws to protect the innocent and make it a little harder for the guilty to do business as usual!

Blaming victims for something they didn't cause is getting a little old!

0 comments

Flash Mob to Attack Fake Bank Sites this Weekend!

It seems the "artists" (Artists Against 419) are planning an offensive against Internet scammers this weekend.

They are inviting people to see what this is all about and participate if they wish.

In their own words:

Welcome to the Fifteenth Flash Mob!

Three years doesn't seem like a long time in the grand scheme of things. But in that time, aa419 has grown into a major anti-fraud force on the internet. A quick look at our database will tell you why -- we have identified more than 10,000 fake web sites in that time, and shut almost all of them down.

We're proud of finding and blacklisting all these scammers, but we're even more proud of working with hosters to get their sites offline. And to accomplish this, we rely on a fantastic group of volunteers, some of whom have killed hundreds of scam sites all on their own!

Listen to our Radio 419 broadcast during the flash mob, and join us in chat. We will be holding live tutorials throughout the Flash Mob, and this is an excellent chance for you to learn the nuts 'n' bolts of fake bank killing!

For more details, link here.

In case you didn't already know - 419 is the Nigerian Penal Code for advance fee fraud - which victimizes millions of unsuspecting people. The artists have very detailed descriptions of all the variations on their site.

The people behind this consider themselves "artists" because they trash fraudulent bank sites - also have a wonderful sense of humor - which is evident on the site, itself. All humor aside, the site is also an excellent place to learn how Internet scams work, and more importantly how to safely navigate "dangerous waters," while surfing.

Of note, they recently affiliated themselves with the Anti Phishing Working Group (APWG), which I reference (frequently) as a great resource to learn about phishing.

I did a recent post on how the Phishermen are Reeling in Record Catches.

Hopefully, the artists will hit them hard this weekend!

0 comments

Why Buying Gift Cards on Auction Sites isn't a Good Idea

I recently did a post wondering if sites reselling gift cards would create an additional avenue for dishonest people to commit fraud. After all - gift card fraud - isn't new and eBay limits the sales of them on their sites because of the criminal activity associated with them.

The main reason eBay limited the sales on their site was pressure from the retail industry, or so I've read.

Fraud committed against retailers costs billions, and it's added into the "cost of goods sold," which means we are all paying higher prices because of it. There is a limit to being able to add the price of fraud into the cost of an item (competition) and when this happens, businesses fail.

A lot of people have lost their jobs when retail fraud couldn't be controlled.

In response to my original post, Joe LaRocca, Vice President of Loss Prevention for the National Retail Federation was kind enough to send me some links illustrating how big a problem this has become.

In November, the NRF released information that estimates retailers will lose $3.5 billion during the holiday (Christmas) season - link here.

Many retailers issue gift cards versus cash for refunds (especially when no receipt is present) and fraudsters sell them for cash. Joe provided me with an interesting link on this (story and video clip) from NBC4.com, here.

Refund fraud normally is a result of shoplifting, but when dealing with gift card fraud, we also need to include credit/debit card and check fraud. Retail fraudsters buy gift cards with their "bogus financial instruments" and then sell the cards for cash. Of course - they could be refunding merchandise bought with their bogus instruments - but it's easier (less work) for them to simply buy the "gift cards" and resell (fence) them.

Credit/debit card and check fraud are two activities that directly tie into "identity theft," which victimizes 9 million people a year in the United States, alone.

Besides the "indirect costs" we all pay - a lot of ordinary people become fraud victims after an encounter with a fraudster on an auction site. The Internet Crime Complaint Center cites auction fraud as their number one complaint and it keeps growing every year.

Besides placing yourself at risk - buying gift cards over the Internet - might be supporting the victimization of ordinary people and businesses alike!

0 comments