Subscribe
Printer Friendly
Share this PageFight Identity Theft Blog
It's our favorite time of year here in the U.S. - TAX TIME!
Along with tax season comes the predictable onslaught of IRS scam emails. No, these don't come from the IRS. They are from the same old bad guys trying to separate you from your money.
Here's an email that just arrived today:
They're only offering a refund of $63.80??? Those crooks!
I would have thought a higher amount, like $630.80 would better peak our interest in recovering the money. Oh well, I'm sure they do extensive testing to determine the cash amount that draws the most clicks...
Once you click the link you'll see a beautiful reproduction of the IRS site along with a form asking for your:
- SSN
- Credit card number
- Credit card expiration date
- Credit card CVV security code from the back of the card
- Credit card ATM PIN
This looks like a clear credit card fraud attempt. With this information they can purchase items over the internet or withdraw cash from your account.
What should you do if you receive an email like this?
The IRS, unfortunately, doesn't currently have an easy way to report these emails. The best you can do right now is call 800-366-4484 to report it, but the number was busy each time I tried to call. Not good.
The IRS has placed this kind of phishing scam in their "Dirty Dozen" tax scams for 2006. Here's what they had to say:
Phishing. Phishing is a technique used by identity thieves to acquire personal financial data in order to gain access to the financial accounts of unsuspecting consumers, run up charges on their credit cards or apply for new loans in their names. These Internet-based criminals pose as representatives of a financial institution and send out fictitious e-mail correspondence in an attempt to trick consumers into disclosing private information.
Sometimes scammers pose as the IRS itself. In recent months, some taxpayers have received e-mails that appear to come from the IRS. A typical e-mail notifies a taxpayer of an outstanding refund and urges the taxpayer to click on a hyperlink and visit an official-looking Web site. The Web site then solicits a social security and credit card number.
In a variation of this scheme, criminals have used e-mail to announce to unsuspecting taxpayers they are “under audit” and could make things right by divulging selected private financial information. Taxpayers should take note:
The IRS does not use e-mail to initiate contact with taxpayers about issues related to their accounts. If a taxpayer has any doubt whether a contact from the IRS is authentic, the taxpayer should call 1-800-829-1040 to confirm it."
Since the IRS is so lame in trying to shut down sites, I thought I'd do something.
It appears the servers are based in Korea and I've emailed the ISPs that manage the IP involved, but I'm not holding my breath.
The last word... enjoy tax season, just don't try to claim an early refund from scammers.
Here's a scam story with a happy ending... kind of.
Harrison Odiawa (aka Abu Belgore), pictured below, was convicted in a Lagos, Nigeria court to 376 years for advance fee fraud, obtaining by false pretence, conspiracy and forgery.
So why isn't this a happy story?
It turns out the victim, a U.S. citizen named Robert Blick, has been serving a 30 month jail sentence himself for defrauding his own business partners in order to give over $2,000,000 to the scammers.
The story begins on March 21, 2003, when Blick received an e-mail from a person in Nigeria by the name of Taye Owo, looking for a foreign contractor to transfer $20.5 million out of Nigeria.
Sound familiar?
Unfortunately, Blick hadn't heard of the scam and became excited about getting 20 million dollars for nothing. Don't we all?
After many emails, phone calls, and faxes back and forth, the scammers provided a certificate of incorporation for Blick's American company in Nigeria as well as a job completion certificate. With those, Blick believed he was ready to pick up the 20 million and decided London was the place to make it happen. Once in London, however, the deal played out just like it always does...
The scammers "... told him that he would need £10,000 for his agent to open a bank account, and another $18,750.00 as a trust processing fee when the money transaction took place.
Blick, who came to London with only £10,000, had to stop around London with his credit cards to raise another £20,000 to meet these demands. From this moment on, Blick was in the net of the fraudsters and they milked and milked him until he started selling his personal property and dipping his hand into the account of the company he co-owned with his partners in America.
First, they showed him an aluminium strong box, which he thought contained the money. They also opened it and showed him two bundles, which he confirmed were genuine. They could not, however, pay him because one document - International Clearance and Policy Certificate (ICP) number was not available. It had to come from Nigeria, so the payment was cancelled. Next, he was informed on April 7, 2003 that a sum of $ 410, 000 was required before the ICP could be issued. He paid $195,000 as his own share. Belgore was to pay the rest."
Like all "Advanced Fee" schemes, the big payoff gets closer and closer, but never quite materializes.
The milking continued until Blick's American corporate partners became suspicious and called the FBI. Luckily the FBI was able to knock some sense into Blick, but not until he had given $2,092,894 million of his and his company's money to the scammers.
In January, 2004 Blick was charged with wire fraud along with conspiracy to draud the Nigerian government. After all, the scam Blick went along with supposedly involved stealing the 20 million dollars from the Nigerian government. Blick was convicted in September, 2004 and sentenced to 30 months in jail.
Enough talk about the "victim." Now back to our scammers...
Once Blick was convicted, the FBI alerted the Nigerian Economic and Financial Crimes Commission (EFCC) regarding Odiawa, alias Abu Belgore, the man behind the fraud. With evidence provided by Blick and others, Odiawa was convicted and sentenced to the 376 years.
Does this story have a happy ending? Sort of...
- A scammer has been brought to justice.
- A victim has been taught a painful and valuable lesson about greed.
- The public gets another case study on how to avoid scams and scammers.
The victim and the scammer both received their comeuppance. Hopefully the family of the victim and his business partners get back their $2,000,000.
For all the gory details of the case, see the EFCC web site.
Remember that scene in National Treasure where Nicolas Cage pulls a thumb print off Diane Kruger's champagne glass and uses it to get into the super-secret room housing the Declaration of Independence? If not, rent it tonight and take a look.
So, is that really possible or is it just one of those movie-inspired myths? Unfortunately for security vendors, it's pretty close to the truth.
A study at Clarkson University revealed that fingerprint scanners were fooled 90% of the time by fake fingerprints created from gelatin, dental plaster, or even Play-Doh! Another option is for a thief to just cut one of your fingers off and use it on the scanner.
So should you care about this high-tech biometrics stuff? What does this have to do with your life? Well, the Albertsons grocery store chain has recently implemented a biometric finger scan for payment and identification in some stores and both Wal-Mart and Costco are supposedly discussing doing the same thing.
Before there's wide-spread adoption, hopefully these security questions will be resolved. One company trying to do that is Luminetx. They recently patented their vein scanner (designed initially for medical purposes) for use in biometric scans. Evidently your vein layout is extremely unique and can't be faked or bypassed (so far).
Whether it's your finger, eyeball, or arm, get ready for high-tech features at your local grocery or big box store. They're coming.
I've seen a number of stories, most recently in yesterday's Times Online, that describe surprise and fear over what Google knows about its users.
This is silly, in my opinion.
Sergey Brin and Larry Page - Founders of Google
The Times Online headline is "Big Google is Watching You" and the article states:
"Google has an extraordinary amount of information about its users. It logs all the searches made on it and stores this information indefinitely. Because every computer has a unique IP (internet protocol) address, every visit to every website can be traced back to the computer making it — a fact which is well known in geek circles but remarkably under-publicised outside them."
and
"Users of Google’s Gmail service, who are already having their e-mails scanned to place targeted ads, have given the company their identity, a full record of all their searches and copies of all their e-mails, stored indefinitely. Users of Google’s Toolbar are inadvertently giving the company a list of not just all their searches but also of every single website they visit. And, as the lawsuit makes clear, all this information is potentially vulnerable to subpoena."
Maybe I'm one of those geeks that realizes that this happens on virtually EVERY web site you visit.
What's a Log File and What Does it Look Like?
When you visit a web site, most will keep a log of what information is requested along with the IP address of who requested it. What does the log file look like? Here's a real sample from the Fight Identity Theft site:
192.168.1.100 - - [29/Sep/2005:09:56:28 -0400] "GET /how-to-report-scams.html HTTP/1.1" 200 22806 " http://search.yahoo.com/search?p=how+to+report+a+scam" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
So here's what this glob of code shows...
- First is the person's IP address (I changed it to protect the visitor's privacy)
- The date and time of the request
- What was requested (in this case, our "How to Report Scams" page)
- The referring web site (in this case, the person did a Yahoo search for "how to report a scam")
- The type of browser being used (Microsoft Internet Explorer 6)
- And the operating system (Windows NT 5.0 = Windows 2000)
This is how web sites work. They collect data and log the data for later analysis (e.g. "How many people visit my homepage?" "What did a person search for to find my web site?", etc.)
What Information Are You Sharing and Can You Hide It?
So what information are you sharing as you browse the web? ShowIpAddress.com is one of many sites that will show you what a log file can capture about you. The only personally identifiable piece of information is your IP address. That number is assigned to you by your Internet Service Provider (ISP). One way or another that number can be traced back to you as an individual, even if you are surfing during work at a Fortune 500 company or other large organization.
Does that make you scared, angry, or just plain nervous? Maybe it should, maybe it shouldn't. In either case, you can browse anonymously if you choose.
There are many products and services that allow you to web surf anonymously. Most will route your requests through their servers, thus hiding your IP address. Anonymizer.com has been around for a long time and they provide a service where you can use their site to browse anonymously for free.
But, back to Google...
Are they evil because they log this information? Powerful, yes, because so many people use their services, but I wouldn't say evil.
When I choose to sign up for a service like Gmail, I know that they will be reading my email content so they can serve up related ads. That's how they make money. That's how I can have a 2.5 gigs of free storage for my messages. Yahoo has a similar policy. Same with MSN Hotmail.
When I choose to use Google search I have to know that they log what I'm searching for and analyze it to spot user patterns. The same thing happens at Yahoo and MSN.
I have to realize that sites, like Google, store this information and will use it to improve their product and to make money. I also have to realize that it could be handed over to the government.
This is all part of the trade-off we make every day between security/privacy and convenience. If you are extremely concerned with privacy you probably shouldn't be using the internet and you certainly shouldn't sign up for a service that clearly states it will read and store your email messages. If you're concerned that your search history or email messages could be revealed at a later date you should consider using a product that protects your anonymity, like Anonymizer.
Here's the bottom line...
When information is aggregated, abuses, information leaks, subpoenas, and profiteering can occur. When it does occur it should be exposed and fought. I just don't see where Google has done anything evil or different than any other web site on the internet.
Feel differently? Then please append a comment to this story.
Derrell and Terrell Brittenum of Memphis, TN have been charged with forgery, theft by deception and financial identity fraud for purchasing a 2005 Dodge Magnum last June 2005 in Atlanta using someone else's identity.
The twins recently appeared on the most-watched show in America - American Idol. Evidently they were excellent performers and had moved on to the next round in Hollywood, CA. Unfortunately for them they've now been dropped from the show based on their actions.
Here's a before photo:
And an after photo:
E!Online reports that:
"Both brothers were released from jail on bond Sunday morning and were preparing to travel to Los Angeles for the next round of eliminations when they received word that their presence was no longer welcome.
Though the twins may have blown their shot at Idol worship, they reportedly have other opportunities to consider. Bennett claims to have been contacted by "several" record labels interested in signing the brothers."
Great! Evidently some record labels are still interested in these gentlemen. Maybe their arrests will give them additional "street cred."
Whatever sells records, I guess...
The U.S. Federal Trade Commission reported earlier today that they received more than 255,000 complaints regarding identity theft in 2005. That's up from 247,000 reported in 2004. Total fraud reports topped 686,000.
So what trends show up in the report? Well, here are a few:
- Identity theft again was the top vote-getter with 37% of all fraud complaints. No surprise there.
- More fraud involving wire transfers. The percentage of Internet-related fraud complaints with “wire transfer” as the reported payment method more than tripled between calendar years 2003 and 2005, increasing by 12 percentage points. Be careful before wiring money to anyone! Most lottery scams and Nigerian email scams usually involve wiring money to people. Don't do it!
- Geographic areas with the highest per-capita problems with identity theft? Phoenix-Mesa-Scottsdale, AZ; Las Vegas-Paradise, NV; and Riverside-San Bernardino-Ontario, CA.
- Number of complaints where no money was lost went up from 24% in 2003 to 32% in 2005. Some of you are getting smarter!
- Email is increasing as a means to scam you. It is the #1 method to reach victims and has increased from 26% to 35% in the past 2 years.
The complete report can be downloaded in Adobe Acrobat format from the FTC web site.
Can five million Britians be duped? Yes, according to a study done by the British consumer protection organization Which?. Which? contacted more than 1000 Brits to see how widespread the scam problem is in the U.K. The results?
- More than 28 million of 60 million citizens had been exposed to one or more scams.
- Five million of those 28 fell victim to a scam.
- The most popular scam related to "an automated phone call that invites people to claim a prize. A third of adults have received such a call and two million have responded, usually by calling a premium-rate number, which can cost up to GBP 1.50 ($2.70 U.S.) a minute."
The funny thing is that I've even seen people outside the U.K. fall victim to these international lottery scams. Here's a typical email that arrived in our honeypot inbox this week:
As I was saying, I've received email from U.S. residents wondering if they'd really won after receiving an email like this. They never questioned how they'd won even though they weren't residents of the country where the lottery was held and had never even entered the lottery.
Greed makes us stupid, doesn't it? That's what the scammers count on.
UPDATE!
Many of you have also received snail mail versions of this scam. In this scam you receive a letter saying you've won as well as a check for $3,000 - $4,000 dollars to cover the taxes and processing fees - supposedly.
Anyway, listen up people.
This is a scam. The check is fake.
It may initially be accepted at your bank but will eventually be worth absolutely nothing. So when you deposit it and then send them a check from your account, you will lose money.
Ask yourself... Why would they send you a check and then have you send them a check right back for the same amount? Does that make sense? It does if you're trying to scam someone.
No, this won't be a post about some political scandal in Iraq.
Instead, I wanted to post an scam email — one where a supposed American soldier wants to share some of Saddam Hussein's booty (booty here meaning "Plunder taken from an enemy in time of war.")
Here's the email:
I haven't seen an email like this since "Bradon Curtis" a "special forces commando" working in Afghanistan wanted to send us some Taliban money a few years ago.
As always, these emails should produce more laughs than greed as they land in your in-box. The scam is one of the oldest in the book and will involve you giving up more and more money as you try to get your grubby, greedy mitts on 7.2 million of Saddam's money.
If you're a victim of identity theft, you will likely need to contact banks, credit card companies, and department stores. Most companies have what's called an Interactive Voice Response (IVR) in place to "help" you.
These systems can be very frustrating, especially when you're stressed out and just need to talk to a fellow human being to work out your problems. That's where the IVR Cheat Sheet comes in handy.
Paul English, Boston resident and CTO of travel search engine company Kayak.com, decided to take matters into his own hands and create a cheat sheet for major institutions in the U.S. and the U.K.
Here are some examples of what you'll find:
- Trans Union - 800-916-8800. No cheat is necessary. Just press 2 and you're connected directly to a real person.
- Bank of America - 800-900-9000 and press 0.
- MasterCard - 800-MC-ASSIST and then press 000 on each menu.
- PayPal - 402-935-7733 and then say "agent."
- eBay - 800-322-9266 and then press 0,0.
Isn't this fun! The list contains over 259 companies as well as a how-to guide for companies that aren't listed.
Here's the link: The IVR Cheat Sheet
Peer-to-Peer (P2P) file sharing networks exist so people can download free mp3 files, DVDs, movies, etc. They work by having each member of the network share some personal files while downloading files from other people's computers. Share and share alike, right?
This has understandably driven the RIAA (Recording Industry Association of America) as well as the people in Hollywood crazy. So crazy that they are suing people they catch sharing copyrighted materials. We're not going to go into the ethics either way on this argument. Maybe some other time...
The problem is that people are not only sharing their ripped CDs and DVDs, they're also sharing (accidently, I'm guessing) sensitive files on their hard drive like tax returns, bank statements and cancelled checks.
A blogger recently decided to do a few searches on Gnutella, a major P2P network, for sensitive documents. It took him only 10 minutes to find a handful.
Take a look at what he dug up... (maybe it's your tax return)
What is the lesson you should learn?
- Avoid P2P networks PERIOD! The software that enables the network is often full of spyware and the files you download can be infected with viruses and other malware. Not good.
- Keep control of other users on your computer, especially if they are teenagers. If they install file-sharing software on your computer it may be your tax return (along with your SSN, DOB, address, etc.) showing up all over the internet.
- If you do decide to use file sharing software, make sure you've clearly designated a single folder to share and make sure you don't accidently drop your scanned bank statements in the folder.
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion. You can find us on Facebook or Twitter.
Fight Identity Theft Newsletter
Enter your email address and keep up to date. More info | Unsubscribe
Recent Blog Entries
- May, 2010 (1)
- March, 2010 (1)
- February, 2010 (1)
- January, 2010 (3)
- December, 2009 (1)
- November, 2009 (5)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (38)
- Government (21)
- Identity Theft (39)
- Junk Mail (5)
- Phishing (13)
- Privacy (19)
- Scam (32)
- Technology (52)
- Telemarketing (2)
- Viruses (11)
- Visitor Stories (1)
- Worms (11)
