With so many online services associating phone numbers with a person’s identity, it is more important than ever to ensure that malicious actors cannot take control of your number. However, a growing scam called SIM swapping seeks to do just that. Using personal information found or bought online, scammers can call a cell phone service provider while posing as a customer and ask to have the victim’s number transferred to the scammer’s phone. Without the proper precautions, this can all be done without any contact with the real customer.

SIM swap scams can cause more harm than just a fraudulent phone bill. Combined with other personal information, access to a victim’s phone number can allow scammers to access a variety of online accounts, all while posing as the legitimate owner of those accounts. This could even allow access to the victim’s email and online banking accounts. It also allows scammers to bypass any SMS or phone call-based two-factor authentication.

Phone service providers have added a few security measures to help stop SIM swap scams, but they rely on you to keep them secure. First, you can set up a PIN that must be provided before a SIM swap can be completed. Your PIN should be kept private, and should not be based on other personal information, like your birthday. Additionally, you should never send a security code from your provider to the sender of an unexpected text or phone call. Scammers may pose as your service provider before or while attempting a SIM swap scam in an effort to trick you into giving up verification codes sent by your provider. If you receive a code, it is best to contact your provider directly using their official contact information, not a number sent in a text.

For more information, please see:

https://scambusters.org/simswap.html

https://www.wired.com/story/sim-swap-attack-defend-phone/

Mobile devices are now an integral part of our daily lives. They make communication and access to information incredibly convenient from virtually anywhere. This convenience can make it easy to forget that mobile devices are vulnerable to many of the same threats as computers. Here are some common risks to watch out for when using your device.

Unsecured internet connections – Free public Wi-Fi is often unencrypted, meaning other people on the network may be able to access any data you send or receive. Depending on your settings, your device may connect to these networks automatically in order to decrease mobile data use. Consider turning off this feature for more control over your data. However, wired connections in public places may not be secure either, and can be tampered with and monitored or used to send malware to your device. In either case, it is important to know where your connection is coming from and limit transmission of private and sensitive data accordingly.

Malicious apps – Downloaded apps often request a number of permissions that they claim are necessary in order for the app to function. If granted, a malicious app can easily take control of your device. To avoid this risk, only download verified apps from reputable sources, like Apple’s App Store or Google Play. For an example of a malicious app and the damage it can do, check out this article about how one app spreads ransomware:https://itsecurity.umbc.edu/critical/?id=93247.

Loss or theft – Mobile devices contain a plethora of personal data, all of which can be valuable to unscrupulous individuals. Therefore, it is just as important to use a strong password for your phone as it is for your computer. A short PIN may not be enough to stop determined thieves from stealing your data. Consider adding 2-factor authentication by enabling both the password and fingerprint recognition settings, if possible. Finally, remember that remote wiping is an option for cases where your device is permanently lost. This will allow you to delete all data remotely, preventing it from being stolen. For more information on remote wipe, seehttps://insights.samsung.com/2020/05/28/3-things-you-should-know-about-remote-wipe-2/.

For additional information, check out: 

https://cybersecurity.osu.edu/cybersecurity-you/protect-personal-devices/mobile-devices

https://www.pandasecurity.com/mediacenter/panda-security/mobile-security-tips/

Forbes posted an article of a phishing attack discovered by Abuse.ch. This attack is using a Black Lives Matter-themed email phishing campaign with the goal of having readers unknowingly install malware. The attack is said to be sending out emails with the subject “Vote anonymous about ‘Black Lives Matter’ ”. 

The email is said to contain the statement: “Leave a review confidentially about Black Lives Matter… Claim in the attached file”. If the reader clicks on the attached file it will install known at "Trickbot" onto the reader's device. 

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. As well please do not click on or download any attachments from suspicious emails, this action could put your device at risk. Please forward the message (with the email headers) to security@umbc.edu. 

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970

For more information, please check out: 

https://www.forbes.com/sites/thomasbrewster/2020/06/11/watch-out-theres-a-big-black-lives-matter-scam-about/#7449987a62d8

The image as well as original tweet from abuse.ch can be found at: 

https://twitter.com/abuse_ch/status/1270739166716989443?s=20

According to the article linked below, a recent work-from-home scam has been targeting college students. These malicious actors are targeting students via emails that appear to be sent from a college or company advertising fake work-from-home job opportunities.

The malicious actor will use these emails to obtain the students personal information. Once the malicious actor has the students information, they will send a counterfeit check instructing the students to deposit the check into their personal checking account. The malicious actor will then ask the student to withdraw the money and make a payment necessary for the job.

The article states that students who do fall victim to this scam can experience bank accounts being closed due to fraudulent activity and a report filed by the bank with a credit bureau or even law enforcement. The student would also be responsible for reimbursing the bank.

Tips to help spot and avoid these type of scams:

• Research the company first, look for a legitimate website and contact information. Try to find what others are saying about the company as well.

• If they are contacting you and claiming to be from the University, locate the sender’s information through the school website and confirm whether the offer is real or not.

• Look for bad grammar and spelling.

• Offers of employment or pay without an interview are red flags. Legitimate jobs usually want to see who they are hiring.

• Never send funds in the form of cash, check, gift cards or wire transfer to secure a job.

• If you do receive a check from a scam similar to the one above, please do not cash the check.

• If you have provided any banking or financial information to the suspected scammers, please notify your bank or financial institution immediately.

If you do receive any email that you suspect is a scam, please do not click on any URL or reply. Either of those actions confirms to the sender that your email address is valid. Please forward the message (with the email headers) to security@umbc.edu. 

How do I forward full email headers?

https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970  

For more information, please check out:

https://www.winknews.com/2020/06/17/work-from-home-scam-targets-florida-college-students/

With COVID-19 causing many to shop online instead of in person, many scamming websites have appeared selling fake products. The Better Business Bureau created a list of tips for shopping online safely.

• Make sure you know who you are dealing with. Check the spelling and the domain names, then google the website to see if the site has had any complaints against it.

• Scam websites usually have poor grammar and spelling, very little information, and capital letters in the middle of sentences.

• Make sure the website is using https:// at the beginning. A trusted website will have a secure domain so that your information is safe. Make sure to check the address bar for a “not secure” message as that is another red flag.

• If at all possible try to find the age of the website to see if it was recently established. Many malicious actors establish new websites in response to current events.

• Check the website's ‘about me’ and ‘contact us’ links, as many malicious actors will not take the time to fabricate a history for the brand such as you would see on a legitimate website.

• Check for the website's privacy policy to understand what personal information is being requested. If there isn’t a privacy policy that is a big red flag.

• If you receive a phishing email from a malicious actor, the Better Business Bureau says that they are usually without personalization. They say legitimate companies will usually refer to the customer by name, while malicious actors might not.

• Research the business first to make sure it is legitimate before giving them any of your personal and/or financial information.

• If the deal feels too good to be true then it probably is too good to be true.

• The Better Business Bureau recommends using a credit card when purchasing any product or service through a website. If your transaction is protected by the Fair Credit Billing Act, and you receive a defective product or it doesn’t arrive at all, you can dispute the charge and temporarily hold the payment while the credit company investigates them.

For more information, please check out: 

https://www.bbb.org/article/news-releases/22474-bbb-warning-be-careful-purchasing-from-unknown-websites-during-covid-19

https://www.bbb.org/article/tips/14040-bbb-tip-smart-shopping-online

Contact tracing is an integral part of the fight against COVID-19.  It speeds response, identifies potential hot spots, and focuses testing efforts.  Unfortunately, it also creates an opportunity for scammers to deploy two of their most powerful tools, impersonating authority and a sense of urgency.

A North Carolina news station conducted an information test by calling a producer's friends and using a script based on CDC recommendations.  

After the initial greeting and confirmation of the subject's name and birth date, the script abandoned the CDC guidelines and started asking for the subject's Social Security number, home address and other personal information.  These questions are presented as necessary to 'confirm' the subject's identity.  In fact, they are the basic elements of identity theft.  Several of the attempts were successful in getting a complete picture of the subject's personal information.

In another part of the same segment, the station interviewed an IT Security professional who demonstrated how a simple, professionally-worded message (from a fictitious contact tracing company) could get recipients to click on a link that could install malware on their computer.  The malware could be leveraged to give  an attacker complete access to all information on the system.

Contact tracing gives scammers a chance to represent themselves as providing a legitimate and authoritative service in combating a pandemic, and to take advantage of the stress their victim may feel on being informed that they have been identified as at-risk for infection.

If you get a text message or email telling you that you will be called by a contact tracer, then just wait for the call.  If you get a message telling you to click a link, DO NOT CLICK THE LINK!

If you live in Maryland, please visit https://coronavirus.maryland.gov/pages/contact-tracing .  If you are called by a legitimate contact tracer, your caller ID will tag the call as MD COVID.  If you do not have caller ID, the calling number should be (240) 466-4488.  You can also call back on (240) 466-4488 if you receive voice mail.  A legitimate contact tracer will not ask you for your Social Security number, bank account number or credit card information, nor will they ask for money.

References:

Rossen Reports: Feds warn of new contact tracing scam

https://www.wxii12.com/article/rossen-reports-scammers-posing-as-contract-tracers/33251285

Notification of Exposure: A Contact Tracer's Guide for COVID-19

https://www.cdc.gov/coronavirus/2019-ncov/php/notification-of-exposure.html

Welcome to covidLINK - Maryland,giv

https://coronavirus.maryland.gov/pages/contact-tracing

Maryland COVID Contact Tracing

https://www.norc.org/Research/Projects/Pages/maryland-covid-contact-tracing-.aspx