Scams, Spams, and Nasty Schemes

It’s a jungle out there…and in here, too. I’m talking about the Internet, and right now, email specifically.  You just can’t be too careful when dealing with email.

Because I’m both an author and a web designer, my main email address is pretty well-known across the Internet. Certainly the spammers and scammers know about it.  I currently get 20-30 spam emails a day. Most of them are annoying, but pretty innocuous, trying to sell me goods or services I don’t need. The weight loss tips, get rich quick schemes, special tools, prescription drug, and great rates on shipping from China offers are aggravating mostly by their sheer bulk.

But some of them are less innocuous. By now the Nigerian prince or defecting diplomat scheme is so well-known as to be the butt of numerous jokes. But people fell for it. Plenty of them. And, having seen the amount of money to be made, the schemers and scammers have moved on to more sophisticated tricks.

For a while I got five or six notices a day from various banks that I had an urgent message and needed to log into my account. Generally poor grammar and wording were a dead giveaway that those messages didn’t really come from their supposed senders, along with the fact that I didn’t actually have an account at any of those banks.

The first time I got an email purporting to be from one of my web clients saying she’d been mugged in some foreign country and needed help, I was both concerned and suspicious. I hadn’t heard of this scheme, so I actually responded with a request for more information. The reply I got was so unlike my client, I knew it was a scam and ignored all further emails related to it. I later got four more versions of that scam relating to other friends or clients.

The scammers are getting better at it, though. The emails telling me I’ve won a $50 gift certificate from Amazon look very legit. The messages saying there is a problem with my Paypal account carry the Paypal logo and are nicely worded. It’s only when you put your cursor over the link to see where it’s really going that you can tell they’re trying to get you to enter your Amazon or Paypal login credentials on a page that most definitely isn’t attached to either site.

Any attempt to get someone to click on a bad email link or open a malware-laced document is generally called a Phishing attack. But it gets worse. What are sometimes called “spear-Phishing attacks,” where the link or attached document is tailored to a specific environment, can cause an unfortunate click to produce widespread devastation.

I’ve gotten emails purporting to be business documents from a co-worker. I don’t work in a corporate environment, but if I did, an email from purchasing@suchandsuch.com claiming to have a spending report attached might trick me into opening it or clicking on a link.

Those are perilous emails because a click on a bad link or document can give hackers access to an entire corporate network. Thousands of businesses have been hit with ransomware attacks. The city of Atlanta’s computer network was shut down for weeks when held for ransom. My local church’s computer system was also disabled for several days due to ransomware. Those attacks can almost always be traced back to someone clicking on a bad link or opening a document containing malware. The infamous hacking of the Democratic party started with a Phishing attack.

A few days ago, though, I got an email that topped all the others for me personally in terms of the general nastiness of the scam. It was basically a blackmail attempt. It said that I’d visited a porn site and while I was there, the sender had installed malware on my computer, turned on my web cam, caught me in a compromising action on the camera, stolen all my contacts information and would send the video to all of them if I didn’t pay their demand of sending 3,000 Bitcoin to the sender.

I’m an author. I do research all over the web, including some of its shadier corners. I’ve probably even been to a porn site a time or two, though I tend not to linger in such places. Otherwise I knew that the rest was pretty much impossible (in my case), so I didn’t take the threat very seriously. I suppose there are people for whom some of this might be a real possibility and such a note would worry them.

What did actually give me pause was that the subject line contained my name and an old password I once used in a couple of places.  I imagine the sender got that from somewhere on the dark web, where all sorts of hacked data, including some from famously huge data breaches like the Yahoo and Equifax debacles, is available for sale. And don’t kid yourself. Your information is up there somewhere, too.

I no longer use that password, and haven’t for some time, but this was a good reminder of why you should never use the same password in different places and why it’s a good idea to change those passwords occasionally.

Apparently I wasn’t alone in receiving this email, according to this article I found, which echoes the conclusions about it I came to about it:
https://www.businessinsider.com/new-email-scam-uses-old-password-fake-porn-threats-webcam-video-bitcoin-2018-7

Stay safe, my friends!

Some email safety tips:
• Don’t open emails from unknown sources. 
• Never, ever open an attachment unless you’re very sure of what it is and who sent it to you.
• Keep automatic open of attachments turned off in your email program.
• Don’t click on links in emails unless you’re very sure of what it is.  Remember that your friends’ email accounts can be hijacked, and spammers can spoof the names and email addresses of people you know into the “From” field.
• Any time you get an email from a bank or financial institution saying you have a message, don’t click the link. Go to the institution’s site and log in. If the message is legit it will be posted to your account.
• Keep your computer’s virus protection up to date.
• Don’t log into your email account on open, public wi-fi.
• Change all of your passwords periodically and never use the same one at two different places.

First, an apology. I missed my scheduled blog date last month. No excuses other than I can be a ditz at times and I just forgot the date.

Now onto this month’s rant.

About a month or so ago my husband’s cousin answered the phone only to have a man tell her that her elderly mother had missed jury duty and had to pay a fine immediately or she’d be arrested and go to jail. She was alarmed, naturally. But fortunately for her, the scammer made a revealing mistake. He mispronounced the name of the county where she lives. The local television network did a story on it you can watch here:

http://wlos.com/news/local/asheville-woman-became-skeptical-when-suspected-scammer-mispronounced-buncombe-county

Anyone in the Asheville, NC, Sheriff’s Office would presumably know that Buncombe County is pronounced BUN-cum (just like the bunkum he was spinning) and not Bun-COM-bee. Until he made that mistake he had her nearly convinced and very worried.

The scammers are everywhere these days. I don’t even answer my phone anymore if I don’t recognize the number. Anyone who really wants to talk to me will leave a message. I’ve probably gotten a dozen or so messages from purported IRS agents telling me that I owe back taxes and risk going to jail if I don’t respond immediately. Good thing I’ve read about that scam in several places and knew it was fake.

And the phishing emails… Every day I get one or two purporting problems with my bank account or other utility account. It’s easy to ignore when they’re from banks where I don’t have an account, but occasionally I do get them from places I do business with and those sometimes require careful perusal.  In general, though, I don’t click on any links in those kinds of emails. If I suspect it might be genuine, I open a browser and go to the website of the bank, credit card company or whoever from my bookmarks. If there really is a problem, they’ll send me a message there.

One of the more memorable scams I had the fun of experiencing happened two or three years ago. I got a call on my cell phone from a woman who identified herself as a representative from AT&T, saying that my bill was overdue and my service was about to be cut off unless I gave them my credit card info right then.

The fun was that I recognized it as a scam very quickly since I pay my bills online and I’m totally compulsive about making sure everything is paid on time. I knew that my AT&T bill had been paid the week before, well in advance of the due date.

In my defense, I was kind of bored right then. So I argued with the woman for a bit, telling her I didn’t see how my account could be past due. She was good, sounded very professional as she said something to the effect of, “Perhaps a payment was delayed. But I’m showing that your service is scheduled to be cut off shortly. You’ll need to make a payment right away to prevent that from happening.” I managed to string her along for about ten minutes with various excuses and objections.

She finally realized I was onto her, and then the fun really began. The professional tone got suddenly very nasty. She cursed me out. No kidding. Called me a f****g b***h and other ugly names before she hung up. Obviously I’d annoyed and frustrated her. Good. Maybe I even kept her from trying to scam one other person in the time I wasted with her.  I had a good laugh about it.

But truthfully, it’s no laughing matter.  Too many people fall for those scams and are cheated out of large sums of money, sometimes even their life’s savings. I wish I knew how to stop them.