DoIT Security has received a new variation of a classic get-rich-quick scam, this time claiming to be from a Powerball winner who wishes to distribute millions of dollars, supposedly to lessen the impact of COVID-19. Over 5000 UMBC addresses received emails from this sender, most likely containing the same message.
From: "Bill and Helene" <kkt-co@beige.plala.or.jp>
Subject: We Have Private For Donation
Date: Tue, 11 Aug 2020 14:26:21 +0900
--
The Corona Virus (COVID-19) Outbreak isn't just a major health
crisis -- It's also a large economic disruption leading to people
Losing their Jobs and making it harder to take care of their
Families.
We know that a little financial support can go a Long Way.
I'm Bill Lawrence from Sacramento California the Winner of 150 million
United State Dollars Jackpot from the Power ball lottery held on
December 16, 2019. My Jackpot was a gift from God to me.
Hence my entire Family has agreed to do this.
We are donating $75 million to Help individuals and Small Scale
Businesses around the world.
I write to inform you that Google in alliance with Microsoft and Yahoo has submitted your
"Email" to my request to receive a donation amount of $5,000,000
Please accept this Token as a Gift From me and My Family.
We await your urgent response Via email heleneandbill97@gmail.com
Bill and Helene Lawrence
https://www.powerball.com/winner-story/150-million-powerball-ticket-claimed
Messages like these, which promise large amounts of money, are most likely advance-fee scams. Also known as Nigerian Prince scams, or 419 scams, advance-fee scams promise a large amount of money that can be claimed after paying a comparatively small fee. After a victim pays the fee, the scammer may claim to need another fee, or may vanish. Either way, victims will never receive any money in return.
In addition to the irregular grammar and capitalization, note the From address with a .jp domain, and the time zone, UTC+0900. Both of these indicate that the message originated in Japan, not California. Although the URL provided appears to be legitimate, it does not indicate that the message is really from the Powerball winner. It is always best not to click links in suspicious emails, as they may contain malware, steal personal information, or, as in this case, simply provide misleading information when used in the context of a scam email.
If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.
How do I forward full email headers?
https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970
To read more articles published by DoIT visit:
https://itsecurity.umbc.edu/critical/?tag=notice.
In the article linked below, the Better Business Bureau is warning of government imposter scams. In these scams, a malicious actor will call or even message the victim claiming to be from a government agency. Their goals are usually to steal the victim’s personal and financial information, to steal the victim’s money or or to persuade the victim to install malware.
According to the article, most Americans have encountered this scam before. Research done by the Better Business Bureau found that the Social Security Administration, Service Canada, the Internal Revenue Service (IRS) and the Canada Revenue Agency are among the most impersonated.
Some examples of Social Security-related impersonation scams:
Increase a benefit: In this scam the malicious actor will claim that the victim is eligible for increased benefits, typically due to a cost of living increase. The malicious actor will request bank account details so that the money can be deposited into the victim’s account. Once the malicious actor has the banking information they are able to steal money from the account.
Restoring Social Security Number: Some malicious actors will claim the victim's Social Security Number has been suspended. The malicious actor will ask the victim to pay for it to be restored. They may also ask for the victim's Social Security account information, which allows them to apply for benefits under the victims name.
Social Security Number used in a crime, in this scam the malicious actor will threaten arrest if the victim does not respond immediately.
When the IRS is used as a cover instead of the Social Security Agency the scams vary, though they have many similarities to the Social Security scams. For instance, the malicious actor may claim to be an IRS agent and threaten the victim with arrest for unpaid taxes or even fraud.
The only way to avoid being arrested, the victim is told, is by paying a fine (or the unpaid taxes) immediately. Victims are told to buy gift cards and to provide the caller with the number on the back of each card. But of course these threats are fake, and these are just scammers trying to use fear to get the victims money or information.
Just as with phishing scams, the malicious actors follow the headlines and change their scams with thet latest news. During the Covid-19 pandemic and after the passage of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, scammers started to claim to be from the CDC or the United States Treasury Department in order to manipulate and steal personal and financial information from victims.
Some examples of Covid-19 related impersonation scams are:
Relief benefits: Malicious actors claiming to be from the IRS and offering to expedite benefits under the CARES Act.
Fake donations: Malicious actors claiming to be from the CDC requesting donations. Email and text messages making these claims may arrive with malware or URLs that could cause harm to the victim's device.
Contact tracing scams: Email, texts, or messages on social media claiming to be from contact tracers informing the victim that they have come in contact with someone who has tested positive for Covid-19. These scammers seek personal information and/or send messages that may contain malware. For official information on contact tracing efforts in Maryland please visit https://coronavirus.maryland.gov/pages/contact-tracing.
Scammers have also threatened arrest for missing jury duty, impersonated immigration officials threatening to deport the victim, and offered free money in the form of government grants.
Some red flags to watch for to see if the person claiming to be from a government agency is actually a malicious actor:
The IRS generally first contacts people by the postal mail. Never provide your bank account or other personal information to anyone who calls you.
Don’t pay by gift cards. The IRS and other government agencies will not idemand or even accept payment using iTunes cards, gift cards, prepaid debit cards, money order, bitcoin or cash.
The IRS will never request personal or financial information by email, text, or any social media platform. Do not click on any links in unsolicited emails or text messages.
Social Security numbers are never “suspended”.
Caller ID cannot be trusted to confirm that the source is from a government agency. Look up the phone number for the agency and call to see if they are really trying to contact you.
The Social Security Administration will never threaten to arrest you because of an identity theft problem.
If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.
How do I forward full email headers?
https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970
For more information, please check out:
https://www.bbb.org/article/news-releases/22775-government-impostors-study
To read more articles published by DOIT visit:
https://itsecurity.umbc.edu/critical/?tag=notice.
https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19
]]>The article warns that users are being contacted through emails and/or phone calls claiming that they have opened an Amazon Prime account. The malicious actor then will inform the users that the account was opened fraudulently through a security flaw on their computer.
The malicious actor then asks the user for remote access to their computer to fix the breach. Allowing this will let the malicious actor steal personal and financial information, including passwords and even banking information.
Another version of this scam is very similar but claims there is an Amazon-Music subscription instead of an Amazon Prime subscription.
Amazon has stated that that they will never cold-call a customer, and will never ask for remote access to a computer or payment over the phone. Never give any details to an unknown caller, and if you’re not sure if the call is legitimate or not, log into your official Amazon account and contact customer support through there.
If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.
How do I forward full email headers?
https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970
For more information, please check out:
To read more articles published by DOIT visit:
https://itsecurity.umbc.edu/critical/?tag=notice.
Don't have a recovery email on your UMBC account?
Follow these steps to set up your recovery email. Please use an email address that is not your UMBC email.
Login to your myUMBC account: http://my.umbc.edu/account
Click Account security setup
At the top of the page, enter your alternate email address
Scroll down to the bottom of the page and click Update my security settings
Don’t have a secondary email address?
Create one with Google or Yahoo. Instructions can be found here:
https://wiki.umbc.edu/pages/viewpage.action?pageId=1867956
If you have any questions or concerns email us: security@umbc.edu_________________________________________________________________________
Receive any suspicious emails?
Forward it to security@umbc.edu along with the email headers. Instructions for displaying the headers (you normally don't see them) so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.
Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity
]]>234 UMBC accounts suffered from this breach; DOIT is currently notifying these individuals via their UMBC emails and/or alternate emails. However, if you have a Wattpad account don't wait; contact the site to see if your information has been exposed.
If you don’t have a alternate email address listed on your UMBC account, follow these instructions below:
Login to your myUMBC account: http://my.umbc.edu/account
Click Account security setup
At the top of the page, enter your alternate email address
Scroll down to the bottom of the page and click Update my security settings
DOIT has been notified of this breach via Have I Been Pwned(HIBP).
More about Wattpad data breach visit:
If you have any questions or concerns email us: security@umbc.edu_________________________________________________________________________
Receive any suspicious emails?
Forward it to security@umbc.edu along with the email headers. Instructions for doing so can be found at the UMBC support wiki: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.
Follow us on myUMBC:https://my3.my.umbc.edu/groups/itsecurity
]]>OLC Ideate Labs for Online STEM: Innovating STEM Education 2020
With COVID pandemic, virtual labs are now a requirement rather than a "nice to have". There are many technologies and strategies that can complement and substitute for face-to-face STEM labs that are no longer viable due to the COVID-19 pandemic.
To help higher education institutions and faculty successfully respond to this new requirement. MERLOT and OLC will be offering for FREE, a 3-day OLC Ideate Labs for Online STEM: Innovating STEM Education 2020 conference on August 19-21, 2020 on strategies for teaching STEM labs online with various technologies. This free virtual expo will showcase a wide range of virtual and distance labs designed to support online STEM education, offered by both commercial and open educational resource (OER) providers.
In the article linked below, BBC News warns of different Covid-19 themed frauds and scams. Many malicious actors follow the headlines just like the rest of us, and when they see a crisis like Covid-19, they take the opportunity to jump on the fear and try to scam as many people as they can.
The article warns of these scams to be wary of:
Covid-19 Financial Support Scams
Fake government emails, which look to be from a government department and offer financial grants. The emails contain a link which can steal both personal and financial information.
Scam emails offering access to a “Covid-19 relief fund”, and encouraging users to fill in a form and hand over personal information.
Official-looking emails offering “tax reductions.” The email is reported to contain a link that takes users to a fake government website which can harvest users personal and financial information.
E-mails offering to help Benefit recipients in applying for universal credit, but which fraudsters will grab some of the payment as an advance for their "services".
Email about claiming fake school meal funds and fake government grants.
Health Related Scams
Phishing emails claiming that the user has been in contact with someone who has been diagnosed with Covid-19. The links lead to fake websites that are used to steal personal and financial information or even infect the device with malware.
For official information on contact tracing efforts in Maryland please visit https://coronavirus.maryland.gov/pages/contact-tracing.
Fake ads for non-existent Covid-19 related products, such as hand sanitizer and face masks. They simply will take the users’ money and send them nothing.
Offers of fake Covid-19 test kits and hand sanitizer, or even products claiming to treat or prevent Covid-19.
Social Distancing Related Scams
Fake emails and texts claiming to be from “TV Licensing”, telling people they are eligible for six months of free TV because of Covid-19. Users are then told there has been a problem with their card and are asked to click on a link that takes them to a fake website designed to steal users persona and financial information.
Emails asking people to update their TV subscription services payment details by clicking on a link which is designed to steal credit card information.
Fake profiles on social media sites designed to try and manipulate users into giving them their money.
Fake investment advertisements on social media sites encouraging users to “take advantage of the financial downturn.” Bitcoin platforms are using emails and adverts on social media platforms to encourage users to put money into fake companies using fake websites.
Malicious actors cold-calling home residents offering to do shopping errands.
Messages telling the user that they have been fined for leaving their home more than once a day. Links in these messages are designed to steal a victim’s personal and financial information or to install malicious software onto the user’s device.
What We See at UMBC
At UMBC, DoIT is getting reports of work-from-home phishing emails. These phishing emails follow a similar pattern of offering a work-from-home opportunity and ask for personal information like personal email and home address. They will then send a fraudulent check to the user which should not be cashed.
Recently DoIT has also seen phishing emails attempting to impersonate UMBC staff and asking for gift cards or phone numbers.
For more information on these and other phishing attempts at UMBC please visit the DoIT Security page which can be found here https://itsecurity.umbc.edu/.
If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.
How do I forward full email headers?
https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970
For more information, please visit:
https://www.bbc.com/news/business-53573408
To read more articles published by DoIT Security please visit:
https://itsecurity.umbc.edu/critical/?tag=notice.
https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19
]]>Recently DoIT has been notified of a phishing email scam where the malicious actor is impersonating a UMBC staff member. The name has been removed from the From for privacy reasons, but an example of the email can be seen below:
From: Forged Name <hjacj00909@gmail.com> Date: Mon, Aug 3, 2020 at 1:20 PM Subject: Urgent To: <@umbc.edu> I have a task I need you to get done for me Asap, I want to send out a couple gifts cards to some selected staffs, even though we all put in all our best to move this organization forward, some individuals really stand out and I want to surprise them with a little gifts.this is really urgent and important, Please let me know if you can head out to purchase the gift cards so I can advise certain product and denominations. Thanks |
The phishing email above not only is impersonating a UMBC staff member, but the email has many grammatical mistakes, and there is a feeling of urgency with the subject line “Urgent” and words like “ASAP” being used. These are just some of the examples of the red flags for identifying this and other phishing email scams.
The main goal of this phishing email scam is to get the users to purchase the gift cards and give the gift codes to the malicious actors. Other scams similar to this one might ask for products like iTunes cards, gift cards, prepaid debit cards, or even bitcoin.
If you do receive this or a similar email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu.
How do I forward full email headers?
https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970
To read more articles published by DOIT visit:
https://itsecurity.umbc.edu/critical/?tag=notice.
https://itsecurity.umbc.edu/home/covid-19-news/?tag=covid19
For more information on a similar scam to the one above:
https://itsecurity.umbc.edu/critical/?id=94550