Subscribe
Printer Friendly
Share this PageDecember, 2008
Mark Cuban & Tommy Hilfiger are the latest victims of identity theft.
The UPI is reporting that a 23 year-old New York man - Gregory Mortel - was able to have credit cards issued to him using the names of famous people, including Dallas Mavericks owner Mark Cuban, clothing mogul Tommy Hilfiger, and George Hornig, the chief operating officer of investment bank Credit Suisse First Boston.
I'm wondering why a thief like Mortel chose to steal the identity of rich & famous people. Certainly their wealth would enable a sizable credit line via American Express, but wouldn't he worry that the faces of Cuban and Hilfiger would be instantly recognizable when he tried to use the credit card?
Evidently not...
Mr. Mortel was brazen enough to boast that he would never be punished. Here's what he had to say:
The source said investigators had Hornig call Mortel's cell phone and the suspect said during the call, which was recorded by police, that "nobody will ever be able to trace him to any wrongdoing."
Ooops!
Why Wasn't He Caught Earlier?
We obviously have a problem with our credit system when virtually anyone is able to gather and use someone's financial information to open new credit accounts and use them openly - especially when the victims involved are famous and have very recognizable faces.
Did anyone ask him about his name? Tommy Hilfiger is not a common name. Surely someone at the Equinox gym - where he was picked up by the police while getting a spa treatment (paid for via an American Express issued to Tommy Hilfiger) - should have asked him about having a name identical to a very public figure. Did they even look at the name?
UPDATED: Kate Weinberg, the manager of the Equinox gym, has set the record straight regarding the credit card used by Mr. Mortel. Evidently it was issued by Amex to Gregory Mortel but used the same number as Tommy Hilfiger's card. We apologize to the staff of the Equinox gym for our error in assuming they had not checked the signature on the card. See all of Ms. Weinberg's text in the comments below.
It reminds me of a hilarious experiment by John Hargrave on Zug.com where he signed his credit card receipts in all kinds of ridiculous ways, just to see if anyone would notice.
Here's a sillier example - signing as Shamu on a visit to New England Aquarium:
Hargrave describes his experience like this:
Now, someone should have caught this. First of all, everyone knows that Shamu works at Sea World. Second, how could Shamu accurately render a scale drawing of himself? That kind of penmanship would be unlikely from a creature using only its vestigial fins.
No one noticed. No one cared. No one said a thing.
That's why scammers like Gregory Mortel have no fear when it comes to ruining people's lives. It's up to us to protect ourselves. No one else is going to do it.
WEBex INCORPORATION LOTTERY(AUSTRALIA).
678 NIN NAMARAL STRAATWEG 5009GL.MELBOURNE AUSTRALIA.
WINNER NO: 5
ELECTRONIC MAIL AWARD WINNING NOTIFICATION AWARD PRESENTATION CENTER
DATE:5/12/2008.
Ref:4758961725
Batch No:70564943902/188
Winning no:FGNGB2701/LPRC
CONGRATULATIONS
Hello Lucky Winner,
We are delighted to inform you of your prize release on the 5th of DECEMBER, 2008 from the WEBex INCORPORATION LOTTERY program.
Which is fully based on an electronic selection of winners using their e-mail addresses, your name was attached to ticket number 47061725 serial number 07056490902 batch number 7741137002.
This batch draws the lucky numbers as follows 5-13-33-37-42 bonus number 17, which consequently won the lottery in the second category. You here by have been approved a lump sum of $500,000.00(US DOLLARS) in cash credit fileref ILP/HW 47509/02 from the total cash prize of $2,000,000.00(US DOLLARS) shared among lucky winners in this category.
All participant were selected through a computer balloting system drawn from Nine hundred thousand E-mail addresses from Canada,Australia,United state,Asia,Europe,Middle East, Africa and Oceaniaas part of our international promotions program which is conducted annually.This Lottery was promoted and sponsored by conglomerate of some multinational companies as part of their social responsibility to the citizens in the communities where they have operational base.We hope with part of your prize, you will participate in our end of year high stakes for $1.3Billion(US DOLLARS) international draw.
HOW TO CLAIM YOUR PRIZE: Simply contact our fiducial agent,
Name:Dr Lati Umar
Email:dr.latiumar@webportal.com.my
Please quote your reference,batch and winning number which can be found on the top left corner of
this notification as well as your full name,address and telephone number as to help us locate your fileeasily.
For security reasons, we advice all winners to keep this information confidential from the public until your claim is processed and your prize released to you.This is part of our security protocol to avoid double claiming and unwarranted taking advantage of this program by non-participants or unofficial personnel.
Note: All winnings MUST be claimed on or before the One month. Other wise all funds will be returned as unclaimed and eventually donated to charity .
Congratulations, once more from the entire Management and Staff of Webex LOTTERY Co-operation to all our lucky winners this year.
Thank you for being a part of this promotional lottery program.
Yours Faithfully,
co-ordinator.
On December 17th, Microsoft released an emergency security patch for all versions of Internet Explorer. The patch is considered a critical fix for a current security flaw that has believed to have infected over 2 million computers.
The following version of Internet Explorer are affected:
- Internet Explorer 5.01
- Internet Explorer 6
- Internet Explorer 7
How Serious is the Flaw?
The flaw can be used to let attackers steal personal data such as passwords if a user visits a compromised Web site, of which at least 10,000 are thought to already exist. Thus far, the vulnerability has been used primarily for grabbing gaming passwords for black market sales. The hole could, however, potentially also be used to steal more sensitive information such as banking passwords and other private information. Definitely not a hole you want left unpatched for an extended period of time especially if you have been doing a lot of holiday shopping over the Internet.
Steps To Secure Internet Explorer
First, download the appropriate Microsoft security patch at the Microsoft Update site as well as at the Microsoft Download Center. It is always the best policy to obtain any hardware or software patches directly from the hardware or software vendor’s website instead of some unknown third party website. An unknown third party website purporting a hot patch fix is more likely than not also including unwanted extra baggage in their download in the form of malware resulting in ironically making your system even less secure than before.
After successfully applying the IE security patch, update the virus definitions on your antivirus software on your system. The virus definition date should be December 17th or later. Then run a full virus scan on your system to make sure nothing sneaked in during the period before you applied the security patch. If your virus scan comes back clean, then you can go on the Internet with confidence to finish any last minute holiday shopping.
More technical details are available on the Microsoft Technet website.
Myspacers have been dealing with identity theft scams for years, but now there's mounting evidence that hackers are targeting Myspace's more mature brother, Facebook. According to a Reuters wire story, a virus known as "Koobface" has been making the rounds using the Facebook messaging system.
How Does it Work?
Users are typically told that they "look awesome in this new movie" that the sender has uploaded, and are redirected to a site that in turn asks them to install a bogus Adobe Flash player update. If the user decides to take the bait, the Koobface virus is instantly installed on their computer, at which time it goes about its business gathering credit card numbers and other sensitive information.
How Do I Get Rid of It?
According to Guy Bunker of Symantec, Koobface is fairly easy to get rid of. Users can either install some anti-virus software (which will automatically find and destroy it,) or locate two files in their Windows directory. The files are named "tmark2.dat" and "mstre6.exe", and should be deleted immediately if found.
Find more details on detection, files affected, removal, etc. on the McAfee web site.
Even if Koobface itself isn't all that scary, the Reuters piece cites a security researcher with McAfee as saying that such viruses are on the rise on social networking sites. Presumably surfers are more trusting with these sites because they typically use them to connect with friends, and aren't expecting to be targeted the way they would in a random email from an unknown spammer.
In 2005 and 2006, Myspace suffered from a rash of security problems, the most widespread being a JavaScript virus named "Samy." Samy was relatively harmless since it targeted internet profiles rather than PCs. Nevertheless, more than 1 million users ended up displaying the message "Samy is my hero" on their Myspace profiles in 2005.
How Do I Protect Myself in the Future?
Social networking sites like Facebook turn us into fools when it comes to installing software.
- Want to throw a virtual snowball at someone? Install this application.
- Want to find out what kind of sandwich you are? Install this application.
- Want to know how you're going to die? Install this application.
That's why these sites are the newest playground for virus creators - people are connected, they click on stuff, they install stuff, rinse and repeat.
One good rule of thumb is to avoid redirect links in Facebook or Myspace messages unless you can absolutely verify that the URL is legit. Never download a file from a page you've been redirected to. Report the incident to the support staff at social networking site, and await further instruction.
You may know who your friends are in real life, but it's important to remember that an internet persona can always be hijacked---even if you do look really awesome in that movie.
Screenshots
Here's how the Koobface virus, and other related viruses appear within Facebook:
What Appears in Facebook
Notification in Your Email
Website Download
Updated to add:
Variants of this virus appear to be pointing to data collection or revenue generating web sites. Here are a few titles I've had reported recently:
"hey is this u on thebestphotosonline.com"
and...
"whats the deal with u bein on imdownwitu.com"
Selling puppies via Craigslist - or any classified ad - can be hazardous to your bank account.
Janet from New York sent us this story about a response to an ad she placed in an online classifieds web site. Here's how it went down:
You have received a reply to your pet ad.
Hello,
I am Dan and am writing you because am much interested in your puppy for sale on the classified ads. Kindly email me the details with the actual price and the health condition of the pup. Hope the pup is still in a good state. Looking forwarding to hearing from you soon. Have a nice day.
Mr Dan
Not a bad start. His english isn't great, but that's okay. Here's Janet's reply:
Hi Dan,
I have two puppies left. The boy and the black and white girl. They are very healthy and quite active. They are $475 each. They will have their first 5way shot and have been dewormed. You can visit them if you like. They are available to leave the nest anywhere from the 19th to the 22nd. On the 22nd they will be 8weeks old.
Let me know. Don't worry about their health. I am taking good care of them. They will also come with papers.
Thanks,
Janet
A reasonable response and the price seems right (okay, I don't know anything about puppies, but I'm guessing these are pretty nice for $475 each). Here's where things turn south...
Hello
Thanks for your email. I'm okay with price of the female puppy for $475. I will be making the payment via Certified Check drawn from a United State of America bank. I will making a dual payment which will cover the payment of the puppy and little part of the shipping of the puppy to its final destination.
Furthermore, as soon as you receive payment, you need cash to deduct the money for the puppy and wire the rest to the shipper who will be available for pickup at your end. In addition, you need to deduct $90
for more proper vaccination, Purina puppy chow and vet check before the pickup. Get back to me with the below information in order to get the payment mailed:Name to be on the check:
Address to be mailed to ( No P.O Box Please)
Phone Number(s) I can possible reach on ( Morning/Day/Evening)I just had to let you know how lucky the pup is going to be because the pup is coming to a good home with a spacious fence yard and tender care of family of two kids and Pet Lover.. I will be happy to send you pictures of the puppy development. The shipper will be taking good of him by giving a good hospitality and making a sound delivery to me.
Moreso, I will be glad if you can scan a copy of the AKC registration document and other paperworks for me, i.e if available. Get back to me as soon as the possible so I can effect the payment.Thanks and I look forward to reading from you.
Regards,
~Pups are my World~
Janet could sense that something was very wrong here. What were the warning signs?
- Payment via check. - in an online transaction, a check should be considered worthless. Scammers are experts in creating forged checks. Your bank will initially accept the check, but will later discover that it's a forgery and will remove the funds from your account.
- Extra payment - this is a huge warning sign. Any time a buyer wants to send you more money than you're asking for, alarm bells should go off. They're hoping you will deposit the "extra money" in your bank account and then wire your money to an accomplice. Not only will you not get paid for your merchandise, you'll actually end up paying them money. Getting scammed twice instead of once is not fun.
- Payment via wire - thieves love being paid via wire because it's almost impossible to track and recover the money. Never pay by wire.
- The use of emotion - the scammers play on the sellers feelings by talking about how they'll care for the puppy, take pictures of the puppy, put the puppy in a nice, big, safe, fenced yard, etc. Emotion is a powerful tool in distracting you as they steal your money.
This story had a happy ending. Janet sensed that something was wrong and didn't send the scammers anything. We're sharing the story here with the hope of educating other people placed in the same situation.
NOTE:This is our first in an on-going series of stories direct from visitors of Fight Identity Theft. If you'd like to submit your story, go to our contact page and select "I'd like to share my story."
Whether you're a business traveler touching base with the home office or a vacationer catching up on some last-minute Christmas shopping during holiday travel, airport wireless networks are a welcome distraction during a layover.
But beware...
According to a recent article in Forbes, anyone who logs on using an airport wireless connection is instantly exposed to data and identity theft.
How Bad Are They?
Forbes interviewed a so-called "white-hat hacker," working for AirTight Networks (which makes wireless security software and hardware,) and found that during AirTight's survey of 20 American airports, agents had identified serious security flaws in nearly every network. Some airports even allowed critical baggage handling and ticketing data to pass through their network unencrypted---a potential security risk in more than just the digital sense.
The purpose of the tests was to alert airports to the problem in the hopes that they would choose to hire AirTight as their security provider, but in the short term, let it stand as a warning to travelers: You are nowhere near as safe logging in at an airport hub as you are even at home. Even shopping malls and many universities provide more network protection to their users, and since there are currently no laws on the books that require airports to try any harder, don't expect any of this to change overnight.
Here's a quote from Forbes on how bad things are:They found rampant phony Wi-Fi hot spots created by phishers and, at several large airports, plenty of open or insecure networks run by critical operations such as baggage handling and ticketing. Almost all public networks allowed data such as user names and passwords to pass through the air unencrypted. Only 3% of people used something more secure.
How Do I Stay Safe?
Most security experts would recommend these four steps to relative safety on public wireless networks like those found in airports:
- Be sure that you're connected to a legit network. Phishers sometimes set up bogus hotspots in airports, waiting for unsuspecting travelers to log on.
- Use a firewall.
- Don't type in any credit card information or critical passwords while connected to these networks.
- Disconnect from the network when you're not using it.
These steps won't guarantee you 100 percent safety, but it's a good start if you decide that uploading those Christmas photos to Flickr can't wait until tomorrow.
This video from Forbes provides more details on what you should watch out for:
According to investigative reporters for WirtschaftsWoche, 21 million Germans have had their personal information stolen along with their bank account and bank code numbers. The thieves are offering to sell the data for 12 million euros (about 15.3 million dollars). It is believed the scammers gathered the data by using employees at financial institution call centers.
Could this happen in the U.S.?
It certainly could. Privacy laws throughout Europe are generally tighter than U.S. laws and Germany is among the tightest. Low employee morale, caused by a deteriorating job market and chaos within the financial sector makes crimes like this more likely. I'm sure it's tempting for employees to grab whatever data they can as they're shown the door or maybe they're just looking to add to a mediocre salary. Whatever the reason, it may be time to buckle up and prepare for a bumpy ride.
What could criminals do with this data? Make bank withdrawals.
Criminals can use the bank account info to make withdrawals - either big or small. A .57 cent bank withdrawal from 21 million accounts still ads up to... ummm... let me get my calculator out... $11.97 million dollars. And that's this month, and next month, and the next month, etc. until they're caught or they decide to make a big withdrawal and run.
Here's their strategy, detailed in an IT World article:
Although banking passwords were apparently not included on the CD, criminals would be able to use this data to withdraw funds from a victim's account, said Thierry Zoller, an independent security consultant based in Luxembourg.
Scammers could use this type of information to initiate a large number of debits from German banks, making each withdrawal small in hopes that it would not be noticed by the victim, he said.
This is why carefully checking your bank records is important. If you see a unexplained entry - even if it's small - you should track it down until you understand where it came from. Otherwise you might unexpectedly see a much bigger withdrawal from the same source somewhere down the line.
More about this story at the WirtschaftsWoche in English and German.
You can also find coverage at The Register, and IT World.
We've been hard at work for the past six months on a new and improved site. Let us know what you think.
We've incorporated more video onto the site as well as an easier to understand layout and design.
Do you like it? Let us know.
We're still completing a content review and clean-up throughout the site and you might see a few issues here and there until that's completed.
Hope you like it...
Special Offers
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion.
Subscribe to Breaking News
Subscribe to Fight Identity Theft and receive top stories and breaking news via email.
Recent Blog Entries
Blog Archives
- November, 2009 (1)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (36)
- Government (20)
- Identity Theft (36)
- Junk Mail (5)
- Phishing (10)
- Privacy (18)
- Scam (29)
- Technology (47)
- Telemarketing (2)
- Viruses (10)
- Visitor Stories (1)
- Worms (10)
