ACH & Wire Fraud Prevention

Both ACH (automated clearing house) transactions and wire transfers are forms of electronic fund transfers (EFTs). Wire transfers typically involve larger sums of money and are transferred between banks. ACH transfers are scheduled transactions, like online bill payments, that typically involve smaller amounts of money.

ACH (automated clearing house)

ACH fraud is the theft of funds through the Automated Clearing House financial transaction network. The ACH network acts as the central clearing facility for all Electronic Fund Transfer (EFT) transactions in the United States, representing a crucial link in the national banking system. Payments linger in the ACH network awaiting clearance for their final banking destination.

Here are a few examples of ACH fraud:

1. The criminal accesses a commercial customer's credentials, generates an ACH file in the originator's name, and quickly withdraws funds before the victim discovers the fraud.

2. The criminal accesses a retail customer's credentials and sets himself up as an automatic bill pay recipient.

3. In an insider threat scenario, an employee of the target company or a bank modifies ACH files to steal money.

4. In a variation on check kiting -- a scam in which funds are juggled back and forth between bank accounts at separate banks -- a criminal takes advantage of the time lag in transactions.

5. In a spear phishing scam, an employee with authorization for ACH transactions receives an email that leads him to an infected site, which installs a keylogger to access authentication information. The thief can then impersonate the company's authorized representative and withdraw funds.

ACH fraud prevention tips:

1. Reconciliation of all banking transactions on a daily basis.

2. Initiate ACH and wire transfer payments under dual control, with a transaction originator and a separate transaction authorizer.

3. If possible, and in particular for customers that do high value or large numbers of online transactions, carry out all online banking activities from a stand-alone, hardened and completely locked down computer system from which e-mail and Web browsing are not possible.

4. Be suspicious of e-mails purporting to be from a financial institution, government department or other agency requesting account information, account verification or banking access credentials such as usernames, passwords, PIN codes and similar information. Opening file attachments or clicking on web links in suspicious emails could expose the system to malicious code that could hijack their computer.

5. Install a dedicated, actively managed firewall, especially if they have a broadband or dedicated connection to the Internet, such as DSL or cable. A firewall limits the potential for unauthorized access to a network and computers.

6. Create a strong password with at least 10 characters that includes a combination of mixed case letters, numbers and special characters.

7. Prohibit the use of "shared" usernames and passwords for online banking systems.

8. Use a different password for each website that is accessed.

9. Change the password a few times each year.

10. Never share username and password information for Online Services with third-party providers.

11. Limit administrative rights on users' workstations to help prevent the inadvertent downloading of malware or other viruses.

12. Install commercial anti-virus and desktop firewall software on all computer systems. Free software may not provide protection against the latest threats compared with an industry standard product.

13. Ensure virus protection and security software are updated regularly.

14. Ensure computers are patched regularly particularly operating system and key application with security patches. It may be possible to sign up for automatic updates for the operating system and many applications.

15. Clear the browser cache before starting an Online Banking session in order to eliminate copies of web pages that have been stored on the hard drive. How the cache is cleared will depend on the browser and version. This function is generally found in the browser's preferences menu.

16. Verify use of a secure session (https not http) in the browser for all online banking.

17. Avoid using an automatic login features that save usernames and passwords for online banking.

18. Never leave a computer unattended while using any online banking or investing service.

19. Never access bank, brokerage or other financial services information at Internet cafes, public libraries, etc. Unauthorized software may have been installed to trap account number and sign on information leaving the customer vulnerable to possible fraud.

20. Stay in touch with other businesses to share information regarding suspected fraud activity.

21. Immediately escalate any suspicious transactions to the financial institution particularly, ACH or wire transfers. There is a limited recovery window for these transactions and immediate escalation may prevent further loss by the customer.

Here is an example of wire fraud:

1. The organization’s legitimate email domain is @company.com.

2. The attacker registers domain names deceptively similar to the organization’s (for instance, @conpany.com, @cornpany.com, @cmpany.com).

3. The attacker learns the names of the Designated Executive and Designated Employee through social engineering or online research.

4. The attacker sends an email purporting to be from the Designated Executive, using a deceptively similar email domain.

5. The Designated Employee receives this email and sees that it is from “Designated Executive” <Designated.Executive@conpany.com> directing the Designated Employee to have $1 million wired to account number 123456789.

6. The Designated Employee, following procedure, checks to see that the email came from “Designated Executive.”

7. But the Designated Employee fails to notice the misspelling in the email domain @conpany.com, mistaking it for a legitimate company email address.

8. The Designated Employee logs into the online banking portal account and requests an outbound wire transfer for $1 million to account number 123456789.

9. The bank, following procedure, checks to confirm that the request for the wire transfer did come from the Designated Employee’s account on the online banking portal.

10. The bank wires $1 million to account number 123456789.

11. Meanwhile, the actual Designated Executive has no knowledge of this wire transfer.

Wire fraud prevention tips:

1. Never wire money to people you don't know, regardless of how convincing or enticing their story may be. Scammers often win their victims' confidence with some "bait," such as a work-at-home offer, a great deal on a product for sale, or news that you have won some kind of lottery. Be especially careful with transactions over the Internet, where the other person's true identity can remain anonymous. A stranger asking you to wire money is a huge red flag that it is a scam. Don't fall for it.

But even if you get a request to send a wire transfer and it's supposedly from someone you do know, confirm that's the case some other way, such as through a separate phone call.

2.       If you're being pressed to make a decision or send money fast, it's probably a sign of a scam.

3.       Walk away from any offer from a stranger who asks you to deposit a check into your bank account and instructs you to wire any of that money to someone else, perhaps in another country. Let's say you receive a check, cashier's check or money order for an item you are selling or to cover so-called processing fees, shipping costs or other expenses. But then you notice that the check is for more money - perhaps far more - than what you were expecting. The other party instructs you to deposit the check and wire a portion back to an associate in another country. Later you find out that the check was fake and you are out all of the money you wired. In this type of scam, victims may end up owing thousands of dollars to the financial institution that wired the money.

Likewise, if you are selling something online, be wary of a request by a "buyer" to wire you the money because that may be a ruse to get your bank account information. Or, this person may plan to send you the money illegally using someone else's bank account number, and ultimately you'd be without your merchandise as well any payment. Always remember that wiring money is like sending cash, and because you voluntarily sent the money, you have fewer protections in terms of getting it back.

4.       Never give out your bank account or credit card numbers in response to an advertisement or an unsolicited call, text message or e-mail. That information could enable someone to steal money out of your account by a wire transfer, before you have time to realize that the interaction was fabricated by a swindler.

ATM Machine Safety

1. As always be mindful of your surroundings. Don't select an ATM at the corner of a building - corners create a blind spot. Do your automated banking in a public, well-lighted, high traffic location that is free of shrubbery and decorative partitions or dividers.

2. Maintain an awareness of your surroundings throughout the entire transaction. Be wary of people trying to help you with ATM transactions. Be aware of anyone sitting in a parked car nearby. When leaving an ATM make sure you are not being followed. If you are followed or think you are, drive immediately to a police or fire station, or to a crowded, well-lighted location or business. If lights around the ATM are not working, don't use that machine.

3. Do not use an ATM that appears unusual looking or offers options with which you are not familiar or comfortable. There are machines that thieves stick on top of ATM machines called skimmers that steal your banking information.

4. When using a walk-up ATM, park as close as you can to the machine. Before leaving the safety of your car, check for suspicious persons or circumstances. Have your ATM card ready before you approach the machine.

ATM Skimming

ATMs and gas stations — especially in tourist areas — may have skimming devices. Scammers use cameras, keypad overlays, and skimming devices — like a realistic-looking card reader placed over the factory-installed card reader on an ATM or gas pump — to capture the information from your card’s magnetic strip without your knowledge and get your PIN.

What to look out for:

- Inspect the ATM, gas pump, or credit card reader before using it…be suspicious if you see anything loose, crooked, or damaged, or if you notice scratches or adhesive/tape residue.

- When entering your PIN, block the keypad with your other hand to prevent possible hidden cameras from recording your number.

- If possible, use an ATM at an inside location (less access for criminals to install skimmers).

- Be careful of ATMs in tourist areas…they are a popular target of skimmers.

- If your card isn’t returned after the transaction or after hitting “cancel,” immediately contact the financial institution that issued the card.

Turn Cards Off:

You may be able to turn your cards "on" and "off" from your phone. If you suspect your card has been skimmed, you can use the app on your phone to turn the card "off," a setting that denies any requests to use your card. Once the suspicion has passed, if no fraud occurred, you can use the app to turn the card back "on."

This type of switching feature often includes some flexibility. You might turn off the card for online purchases but keep it open for stores. You might also turn the card 'on" for all transactions except ATMs.

Discover offers a "freeze" button you can use on your account to prevent new purchases, cash advances or balance transfers. And a variety of financial institutions have made the switching feature available. Check your bank or credit union's website or ask if this type of feature is available for the plastic you currently carry.

Geolocation:

Ask your financial institution about pairing geolocation software with your card. This type of feature tracks the location of both your card and phone. When someone attempts a transaction, the card company compares the location of the phone with where the card is being used. If it matches it will let the transaction go through. If the card and phone locations don't match, the card company denies the transaction. This way, if someone steals your card or card information, it would be difficult to make a purchase.

You also may be able to set GPS limits on the card, making it possible to use the card within a certain geographical area, but not outside of it.

Watch Your Statements:

Keep a close eye on your credit card statement for purchases you didn't make.

Consider monitoring your checking account transactions daily on your financial institution's website.

Consider using a notification service. If you put a threshold on your credit or debit card when using such a service, you will get an alert if someone charges something over that amount. For instance, if you set a limit of $1,000, you'll be notified if someone attempts to spend $1,500 with the card. Typically, under the account services tab, you'll be able to change the notifications. Most financial institutions and credit card issuers offer this feature, but if you don't see it, contact the financial institution and ask if notifications can be set up.

Ask for a "card not present transaction" notification. If someone tries to use your credit or debit card number online, you'll be notified immediately.

Chip Enabled:

EMV, which stands for Europay, MasterCard and Visa, refers to a standard for cards equipped with computer chips. Rather than swiping the card, as you would for a card with a magnetic stripe, you insert the card into a terminal slot during a transaction and then remove it once the transaction is complete.

One of the biggest perks of EMV cards involves a higher level of security. Unlike the magnetic stripe on a card, which contains data that remains the same, EMV cards change with each transaction.

EMV cards are a great solution to the problem with skimming because they produce unique, 1-time tokens that a hacker can't reproduce. They're basically impossible to predict, and they don't work for more than 1 transaction. So, if a hacker is able to get your card number and clone the card, he or she can't use it at a retailer that accepts EMV.  Also, EMV cards don't significantly improve security for online purchases, nor does the technology work when the ATM or point-of-sale terminal hasn't been upgraded, like at many gas stations, for example.

Bitcoin

1. If your wallet’s stolen, act fast - If your Bitcoin wallet has been stolen, the thief will need to move the Bitcoin currency out of it. You need to act fast in order to save your Bitcoin. When the Bitcoin wallet is stolen from the victim, the thief will have to “spend” the Bitcoins in it - by either adding them to his own wallet, purchasing something, etc. The only way to get away without losing your money is if you “spend” the Bitcoins (purchase something or import them to a new wallet) before the thief does.

2. Keep your PC clean if you’re dabbling in Bitcoin - Cybercriminals love Bitcoin. There are numerous malware families today that either perform Bitcoin mining or directly steal the contents of victims’ Bitcoin wallets, or both. Keep your computer clean and uncompromised by “thinking before you click” and keeping your system, applications and anti-virus up-to-date.

3. Encrypt your wallet - Despite Bitcoins own beautiful illustrations of glittery coins, what you’re dealing with are numbers - long encryption keys. To stay safe, you just have to ensure no one else ever has access to these. There are several important rules to keep Bitcoins safe. The key words here are: back up and encrypt. Bitcoin provides a way to encrypt wallets, and this would make it much more difficult for the attacker to get his hands on the Bitcoins.

4. Don’t keep all your eggs in one basket - or you’re Bitcoin in one wallet - Bitcoin is a special case - if you’re worried a site breach or Trojan attack may have put your Bitcoin within reach, don’t just change passwords, even if your wallet is encrypted. Make a new one, and move your coins to it (with a new, strong password). If a wallet or an encrypted wallet’s password has been compromised, it is wise to create a new wallet and transfer the full balance of bitcoins to addresses contained only in the newly created wallet.

5. Most finance experts advise - don’t put your life savings in Bitcoin - The soaring price of Bitcoin isn’t a signal to invest: If you’ve made a profit on Bitcoins you already own, well done. There’s simply no way to know whether their prices will keep rising, stabilize or collapse. And there are a lot of risks - everything from them being hacked, your e-wallet being hacked, someone successfully forging them or Bitcoins being made illegal.

6. If you must store Bitcoins online, don’t store large amounts - Online Bitcoin wallets are not designed to work like bank accounts - they’re convenient, as you can access them from anywhere - but they’re a prime target for cybercriminals. Web Wallets are like a regular wallet that you carry cash in and not meant to keep large amounts in.

7. Mobiles and Bitcoins don’t mix - Various Android apps offer ways to carry Bitcoins with you - but again, these come with their own risks. Earlier this year, a flaw in Android rendered ALL Bitcoin wallets unsafe - although it was rapidly patched - and apps which allow transfer via NFC add additional risks, particularly if a device is lost. Mobile wallet applications are available for Android devices that allow you to send bitcoins by QR code or NFC, but this opens up the possibility of loss if mobile device is compromised. It is not advisable to store a large amount of bitcoins there.

8. Keep your fortune in “cold storage” - If you’re serious about Bitcoin, the security procedures are long and complex - even Bitcoin admits that setting up an offline wallet, stored on CDs and USB sticks is “tedious” and “not user friendly”. Bitcoin says, “Because bitcoins are stored directly on your computer and because they are real money, the motivation for sophisticated and targeted attacks against your system is higher than in the pre-bitcoin era.” Bitcoins own procedure for creating an “offline” wallet, which never contacts the internet in plaintext form, is here. This procedure is also known as creating an “air gap” or “cold storage”. Followed correctly, it provides protection from malware and cyber attacks - although not, of course, from traditional crimes such as extortion.

9. Still worried? Store them on paper - One safe - if extreme - way of ensuring Bitcoins don’t fall into the hands of hackers is to store them on paper. Bitcoin says, “When generated securely and stored on paper, or other offline storage media, a paper wallet decreases the chances of your bitcoins being stolen by hackers, or computer viruses. With each entry on a paper wallet, you are securing a sequence of secret numbers that is used to prove your right to spend the bitcoins. This secret number, called a private key, most commonly written as a sequence of fifty-one alphanumeric characters, beginning with a ’5′.” Be sure, though, your PC is clean before you print - the free software used to generate codes has been targeted by cybercriminals. Run a complete scan of your machine first, then keep AV software running as you print out.

Business basics

Data Security

1. Safeguard Data Privacy: Employees must understand that your privacy policy is a pledge to your customers that you will protect their information. Data should only be used in ways that will keep customer identity and the confidentiality of information secure. Of course, your employees and organizations must conform to all applicable laws and regulations.

2. Establish Password Management: A password policy should be established for all employees or temporary workers who will access corporate resources. In general, password complexity should be established according to the job functions and data security requirements. Passwords should never be shared.

3. Govern Internet Usage: Most people use the internet without a thought to the harm that can ensue. Employee misuse of the internet can place your company in an awkward, or even illegal, position. Establishing limits on employee internet usage in the workplace may help avoid these situations. Every organization should decide how employees can and should access the web. You want employees to be productive, and this may be the main concern for limiting internet usage, but security concerns should also dictate how internet guidelines are formulated.

4. Manage Email Usage: Many data breaches are a result of employee misuse of email that can result in the loss or theft of data and the accidental downloading of viruses or other malware. Clear standards should be established regarding use of emails, message content, encryption and file retention.

5. Govern and Manage Company-Owned Mobile Devices: When organizations provide mobile devices for their employees to use, a formal process should be implemented to help ensure that mobile devices are secure and used appropriately. Requiring employees to be responsible for protecting their devices from theft and requiring password protection in accordance with your password policy should be minimum requirements.

6. Establish an Approval Process for Employee-Owned Mobile Devices: With the increased capabilities of consumer devices, such as smart phones and tablets, it has become easy to interconnect these devices to company applications and infrastructure. Use of these devices to interconnect to company email, calendaring and other services can blur the lines between company controls and consumer controls. Employees who request and are approved to have access to company information via their personal devices should understand and accept the limitations and controls imposed by the company.

7. Govern Social Media: All users of social media need to be aware of the risks associated with social media networking. A strong social media policy is crucial for any business that seeks to use social networking to promote its activities and communicate with its customers. Active governance can help ensure employees speak within the parameters set by their company and follow data privacy best practices.

8. Oversee Software Copyright and Licensing: There are many good reasons for employees to comply with software copyright and licensing agreements. Organizations are obliged to adhere to the terms of software usage agreements and employees should be made aware of any usage restrictions. Also, employees should not download and use software that has not been reviewed and approved by the company.

9. Report Security Incidents: A procedure should be in place for employees or contractors to report malicious malware in the event it is inadvertently imported. All employees should know how to report incidents of malware and what steps to take to help mitigate damage.

Network Security

1. Set Clear Administrator Privileges. An important first step in providing security for your network is to establish and enforce administrator privileges, managing who has authorization to install software and change system configuration settings.

2. Secure Your Private Network. Many intranet or private networks consist of multiple local area networks (LANs) designed to connect your computers to resources, such as printers, servers and other applications. Trace department business functions from users computers back to the physical servers that house their data. Your network design should allow users to have access to the information they need to do their job, without allowing them to access other non-job-related information.

3. Secure Endpoints by Configuring Demilitarized Zone (DMZ). In network security, endpoint security refers to protection of the private network where it intersects with public network. The common devices used at these endpoints to connect to the public network include mail servers to send and receive emails, web servers to host websites, and proxy servers to handle requests from clients seeking resources.

A common security configuration to protect these endpoints is a Demilitarized Zone (DMZ). A DMZ is a computer network with firewalls and other prevention systems inserted as a "neutral zone" between a company's private network and the outside public network. All incoming and outgoing communications pass through the firewall and intrusion detection and prevention systems prior to entering the private network.

4.        Monitor the Network. You and your cyber security providers should implement network logging and monitoring strategies. These allow companies to monitor unauthorized data transfers and unauthorized attempts to access your private network. Detection systems should provide responsible parties with appropriate alerts and scheduled reports.

5.        Maintain Firewalls. Firewalls are a fundamental network security solution. They are used to permit only appropriate traffic to enter and leave the private computer network. In addition to using firewalls to protect your private network from the Internet, firewalls installed within your private network can be used to segment the network into unique security domains supporting enhanced layers of defense.

6.        Establish Intrusion Detection and Prevention Systems. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) can work together with firewalls to analyze traffic to determine if it is legitimate. An IDS product will provide alerts on invalid traffic, while an IPS will block the traffic.

7.        Protect Remote Access. If your employees are allowed access to your private network from remote networks, this access should only be through a firewall that protects your private network. Another option is to utilize a Virtual Private Network (VPN) that uses encryption and multi-factor authentication to provide greater security.

8.        Isolate Guest Wireless Local Area Network (WLAN). If your company operates a wireless local area network (WLAN) for the use of customers, guests and visitors, it is important that it is kept separate from the main company network.

9.        Use Encryption Programs. When used properly, encryption technologies can virtually prevent files, directories, or disks from falling into unauthorized hands.

10.    Define and Practice Continuity Plans/Disaster Recovery. Once you have completed mapping and securing your network, assess any critical equipment or systems and evaluate the potential business impact if they should fail or are breached.

Security & Privacy Best Practices

Cyber security is a growing concern for organizations, regardless of size. While you can never fully take away the risk of an attack or breach, with some planning, due diligence, and regular review, you can take helpful steps to protect your entity in this important area.

Operations & Human Resources:

1. Educate Your Employees Data breaches are often caused by employees - navigating to sites infected with malware, downloading infected attachments, and/or accessing Wi-Fi from an unsecure location. Educate your employees on your policies and why they are in place. Encourage them to frequently change passwords, and offer guidelines on creating secure passwords. As mobile devices become more and more prevalent, it is essential to also consider smart phones and tablets in your business cyber security plan. You will need to develop policies and controls around protecting data on employee devices (such as mandating a security lock) and also talk to employees about protecting any company data they may have on their phones or tablets.

2. Checking Account and Financial Statements. Review your checking account and financial statements for suspicious amounts or vendors. By keeping a regular pulse on the financial state of your business, you will be more likely to recognize fraudulent activity. These documents should be reviewed on a monthly basis.

3. Segregation of Duties. Regularly review your company’s segregation of duties for any gaps, especially if there has been staff turnover in the accounting department. This issue is best dealt with as soon as an employee leaves, but you may find it helpful to set a regular review schedule to ensure that proper separation is maintained.

4. Technology Controls. When reviewing gaps from employee turnover, don’t forget technology controls. Companies often forget to change access codes and passwords when an employee leaves, leaving their technology at risk. A regular review of policies and access levels will help to prevent security breaches.

5. Access Security - Disabling network access, disabling e-mail access, and deleting contact information from all company directories.

6. Data Security - Recovering all data from the desktop hard drive and notifying vendors so that this individual cannot place orders or incur obligations on behalf of the company.

Policies and Educational Processes.

Each year, companies should review their anti-fraud and whistleblower policies to ensure they are still effective for the company’s current size and that they are serving their intended purpose. While these are general risk areas that affect every company, it is essential to understand your business’ specific risks, which will depend on your size, structure and industry. Involve your Board of Directors, Audit Committee, or Certified Public Accountant as appropriate. Larger organizations may want to engage a Certified Fraud Examiner to help it review and develop the appropriate controls. A small time investment upfront may just pay off by preventing costly occupational fraud.

1. Internal Controls and Policies. Just like you have internal controls for your financial processes, you need controls and policies around your IT assets, as well. Ensure that passwords are changed and access is removed for terminated employees as soon as possible, and limit employee access to sensitive data.

2. Develop and communicate clear policies for employees regarding what devices they can use, what types of programs/applications they can download, and how to securely access Wi-Fi when needed. Without clear, communicated policies around your company’s IT, even the strongest controls will not do much to significantly decrease your organization’s vulnerability.

Mobile Devices:

1. Implement a mobile device management program, requiring authentication to unlock a device, locking out a device after five failed attempts, using encrypted data communications/storage, and enabling the remote wiping of devices if a mobile device is lost or stolen.

2. Permit only authorized wireless devices to connect to your network, including point of sale terminals and credit card devices, and encrypt communications with wireless devices such as routers and printers. Keep all "guest" network access on separate servers and access devices with strong encryption such as WPA2 with AES encryption or use of an IPSec VPN.

Computers & Servers

1. Continuously monitor in real-time the security of your organization’s infrastructure including collecting and analyzing all network traffic in real time, and analyzing centralized logs (including firewall, IDS/IPS, VPN and AV) using log management tools, as well as reviewing network statistics. Identify anomalous activity, investigate, and revise your view of anomalous activity accordingly.

2. Deploy web application firewalls to detect/prevent common web attacks, such as cross-site scripting, SQL injection and directory traversal attacks. Review and mitigate the top 10 list of web application security risks identified by the Open Web Application Security Project (OWASP). If relying on third-party hosting services, require deployment of firewalls.

3. Harden client devices by deploying multilayered firewall protections (both client and WAN-based hardware firewalls), using up-to-date anti-virus software, disabling by default locally shared folders and removing default accounts. Enable automatic patch management for operating systems, applications (including mobile and web apps) and add-ons. All ports should be blocked to incoming traffic by default. Disable auto-running of removable media (e.g. USB drives, external drives, etc.). Whole disk encryption should be deployed on all laptops, mobile devices and systems hosting sensitive data.

4. Conduct regular penetration tests and vulnerability scans of your infrastructure in order to identify and mitigate vulnerabilities and thwart potential attack vectors. Regularly scan your cloud providers and look for potential vulnerability points and risks of data loss or theft. Deploy solutions to detect anomalous flows of data which will to help detect attackers staging data for exfiltration.

5. Implement Always On Secure Socket Layer (AOSSL) for all servers requiring log in authentication and data collection. AOSSL helps prevent sniffing data from being transmitted between client devices, wireless access points and intermediaries.

6. Regularly Update Security Programs. Out-of-date antivirus software is almost as ineffective as not having one at all. Don’t ignore those little pop-ups and reminders to download the latest update, and make sure your employees don’t, either.

7. Review server certificates for vulnerabilities and risks of your domains being hijacked. Attackers often use “Domain Validated” (DV) SSL certificates to impersonate e-commerce websites and defraud consumers. Sites are recommended to upgrade from DV certificates to “Organizationally Validated” (OV) or “Extended Validation” (EVSSL) SSL certificates. OV and EV SSL certificates are validated by the Certificate Authority to ensure the identity of the applicant. EV SSL certificates offer the highest level of authentication and verification of a website. EVSSL provides users a higher level of assurance that the site owner is who they purport to be, presenting the user a green trust indicator in a browser’s address bar.

8. Develop, test and continually refine a data breach response plan. Regularly review and improve the plan based upon changes in your organization’s information technology, data collection and security posture. Take the time after an incident to conduct a post-mortem and make improvements to your plan. Conduct regular tabletop exercises testing your plan and personnel.

9. Backup your Data. Even with the right controls in place, your digital assets may still be compromised. It’s important to backup your financial, legal, and client information on a regular basis. Set backup processes to run automatically so that they are not subject to human error (i.e. - forgetfulness).

10. Be knowledgeable about the Cloud. Cloud-based storage offers a variety of benefits, especially for smaller entities that do not have internal IT staff. However, you are still responsible for your data when it is stored in the cloud, so make sure you fully understand where cloud-based data is stored (in the US or offshore) and your provider’s liability to protect the data.

11. Enforce effective password management policies. Attacks against user credentials, including brute force, sniffing, host-based access and theft of password databases, remain very strong attack vectors warranting the use of effective password management controls. Best practices for password management include:

12. Use multi-factor authentication (e.g. one-time PINs) for access to administratively privileged accounts. Administrative privileges should be unique accounts and monitored for anomalous activity and should be used only for administrative activities;

13. Require users to have a unique password for external vendor systems and refrain from reusing the same password for internal system and personal website logins;

14. Require strong passwords comprised of an 8-character minimum including a combination of alphanumeric characters, and force password changes every 90 days with limited reuse permitted;

15. Deploy a log-in abuse detection system monitoring connections, login counts, cookies, machine IDs, and other related data;

16. Avoid storing passwords unless absolutely necessary and only store passwords (and files) that are hashed with salt or are otherwise encrypted;

17. Remove or disable all default accounts from all devices and conduct regular audits to ensure that inactive accounts can no longer access your infrastructure;

18. Remove access immediately for any terminated employees or any third parties or vendors that no longer require access to your infrastructure.

19. Least privilege user access (LUA) is a core security strategy component, and all accounts should run with as few privileges and access levels as possible. LUA is widely recognized as an important design consideration in enhancing data security. It also provides protections against malicious behavior and system faults. For example, a user might have privileges to edit a specific document or email campaign, but lack permissions to download payroll data or access customer lists. Also, LUA controls help to minimize damages from exposed passwords or rogue employees.

Email

Require email authentication on all inbound and outbound mail streams to help detect malicious and deceptive emails including spear phishing and spoofed email. All organizations should:

1. Authenticate outbound mail with SPF and DKIM, including parked and delegated sub-domains;

2. Adopt a DMARC reject or quarantine policy once you have validated that you are authenticating all outbound mail streams;

3. Implement inbound email authentication check for SPF, DKIM, and DMARC;

4. Encourage business partners to authenticate all email sent to your organization to help minimize the risk of receiving spear-phishing and spoofed emails,

5. Require end-to-end email authentication using SPF and DKIM with a DMARC reject or quarantine policy for all mail streams managed or hosted by third parties.

Spear phishing risks

One of the most sophisticated types of phishing attacks is called spear phishing. This is when a hacker will target a specific group or organization and will tailor their attacks to make them look relevant to the recipient. Hackers will carry out these types of attacks in order to gain access to sensitive corporate data, and because the emails they send will look genuine they can often be very successful.

1. However, despite these worrying statistics there are a number of steps which can help to identify potential phishing emails. When receiving emails, users should look at the following:

2. Do you know the sender, and is the email address one you would expect them to use? An email purporting to be from your CEO, but sent from a Gmail account, should always ring alarm bells.

3. Are you expecting a message from the person? Does the email look suspicious? Does the link look genuine?

4. The content of the email can be a giveaway. One of the most basic reasons that phishing attacks work is that they prey on a user’s emotional response - fear, curiosity or reward, and emails that evoke strong emotions such as these should be considered triggers.

5. Is the email specific? Does it make sense? Although criminals have a lot of information about individuals they will still keep messages generic to pique your interest, and make you take action.

6. And of course, while grammar has improved in recent years, mistakes are often an indicator that all is not as it seems.

Phishing is one of the most common attack methods for cyber-criminals, however an effective training program and user awareness will minimize the risk of employees falling victim. Once employees know what to look for they will be able to quickly identify any potential phishing emails and report them before any damage is done.

Car security

Car security measures are very important because cars get very often stolen and broken into and more often than not, the wallets, passports or IDs get stolen from the car. Thieves are most likely after cash or valuable objects like jewelry, watch, laptop computers and sunglasses when they break into the cars.

If thieves accidentally come across your checkbook, wallet, phone, passport, or any other valuable item in your car during their adventures, they may think of committing a different kind of crime, identity theft. Although, their initial motive might have been breaking into your car to steal cash and other valuables, or, stealing your car for its parts, the thieves may not forgive you for leaving parts of your identity components in the car. They will write as many checks and take as much cash as they can from your bank account, until you report the loss of your checkbook or lost cards to the bank. They may even go shopping or call their cousins overseas and run you a 4-digit phone bill from your friendly wireless service provider.

1. Don't leave your valuables in the car for a long and extended period of time. If you have to make short trips to make copies, take all the important documents and objects with you, or just leave them for a very short period of time to reduce your risks. Never leave documents, purses or wallets in the car. The trunk isn’t a safe place either—thieves always check here.

2. Park your car in a secure, monitored, and private parking lot, away from visibility. Park your car in a parking garage equipped with security systems and on-site security attendant. Usually, private and smaller parking provide better security for their facilities.

3. Don't park your car in such parking places as long-term airport parking. Such places are hardly ever monitored and thieves know that these long term parking provide the best opportunity since the car owners are not coming back any time soon. Empty your car of all important contents when you park your car in the long-term airport parking.

4. Park your car in a well-lit area. This will make their working conditions a little more difficult and challenging since they have to be very careful not to be seen.

5. Park your car in a busy area. Don't park it in an isolated area where there is no car or foot traffic in order to deter thieves. Again, you will make their life more difficult and working conditions challenging.

6. Install a car security system in your car. Make sure it is the electronic sound alarm, which may discourage the thieves from further searching the car. The manual wheel lock may prevent them from steeling the car but will not discourage them from searching your car and stealing valuables. Use multiple warning devices, such as car alarms, steering wheel locks and gear-shift locks.

7. Help authorities. Consider etching your Vehicle Identification Number (VIN) on windows and engine parts so authorities can ID a car if it’s stolen.

8. Use technology. Install GPS and immobilization devices, this includes smart keys and kill switches.

Children & teens

As the definition of “privacy” changes in the modern age, it’s more important than ever to ensure your child is posting safely and responsibly on social networks.

These days, kids are glued to their social media. Whether using Twitter, Instagram, Snapchat or Facebook on a smart phone from the high school cafeteria, the younger generation is in constant communication with their peers. That’s why addressing the issue of privacy on social media should be a priority of all parents.

This also means kids need to understand how to behave appropriately and know what information is OK to share. With the threats of online predators, hackers, or cyber bullies being very real and very relevant, it’s important to prevent them from accessing your child’s personal information, including phone number, home or email address, or personal photos, for malicious reasons. Review the following issues with your child to ensure they know what is and isn’t OK on their social media profile.

1. Everything you share is permanent. Anything you post online can potentially live on the Internet permanently. Even when you delete a photo or message, it can be screen-captured, copied, forwarded, shared, or stored on other people’s computers. Therefore, you must carefully consider everything you post.

2. Don’t share personal information. This means don’t post your phone number, email address, home address, or “tag” your city of residence on sites that allow you to do so, such as Facebook. Also don’t share information about your school or schedule.

3. Only communicate with people you know. Your social networks should be comprised of people you know personally. If a stranger contacts you trying to get personal information, details about where you go to school, etc., let an adult know.

4. Carefully select the photos you post. It’s best to have a profile photo that isn’t a photo of you (which can attract unwanted attention). Ask a parent to approve all photos you post, and carefully consider what you would want your friends to see. Remember, too, that any photo you post could also be altered to embarrass you or make you look bad.

5. Do not share mean posts or pictures about other people. If you see a mean comment, forward, tweet, or other social media communication, you should never share it with your friends. This is cruel behavior and can be legally unsafe for both you and the person who shared it.

6. Make an appropriate screen name. If your social media site requires you to make a screen name, make one that doesn’t personally identify you—and make it appropriate.

7. Report anything that makes you uncomfortable. If someone is making you uncomfortable or hurting your feelings via social media, report it to your parents.

8. Social networking is not a bad thing. The American Psychological Association, for instance, points out that shy teens and pre-teens can better learn how to socialize behind the safety of computer screens and mobile devices. But if your child accidentally exposes too much of his or her personal information, they could be asking for serious trouble.

Here are some Safety Tips to help you think about online safety for your family.

1. Use the Internet with your kids. While you're spending time with them, you can help them to be safe and responsible online.

2. Learn about the technology together, ask lots of questions, and don't be intimidated if it seems like your kids have a better understanding of the technology than you. Remember, it's your family, and you have the power and responsibility to keep an eye on what your kids are doing.

3. Teach kids never to give their personal information to people they meet online, especially in chat rooms and on bulletin boards. If you have a family web site with your children's pictures up, don't include information like where they go to school, where you live, your phone number, or any other personally identifiable information - that's giving personal information out every bit as much as sending an e-mail or talking to someone in a chat room.

4. Instruct your child never to plan a face-to-face meeting with online acquaintances, and to notify you if they are approached for an offline meeting.

5. Establish clear ground rules for Internet use for your family. Think about signing a Contract with your children that reflects those rules. Learn about the different parental control tools, protective software, and controlled access options that are available, and decide which, if any, are best for your needs.

6. Tell your children not to respond if they receive offensive or dangerous e-mail, chat requests, or other communications, and to leave if they go to a web site that makes them uncomfortable. Also tell them to show you anything they receive that makes them uncomfortable. Assuring them that you won't be angry with them and that they are not to blame can help you to develop a trusting, open relationship.

7. If you become worried that your child or another child is in danger, don't hesitate to contact the authorities

What You Really Need Know

Q. Who is in control of my young child's personal information online?

A. You are in control of your young child's personal information.

Q. How will I know if a Web site is collecting personal information from my child under 13 years old?

A. Web sites wishing to collect personal information about your children will seek you out and let you decide whether or not they may collect, use and/or share that information.

Q. How will they notify me?

A. Web sites will try to email you to seek your permission. If your child tries to provide information about him or herself, the site will ask her for your contact information and use that information to seek your permission.

Q. How do I prove/verify that I am my child's parent?

A. Web sites will ask you to verify that you are the parent in several possible ways. Some will ask that you call a toll-free phone number and speak with a trained operator who will verify that you are the parent. Some sites will ask you to send a note via postal mail or via fax. The Web site may also seek credit card information to prove that you are the parent.

Q. How do I know if a Web site will respect my child's privacy?

A. Proactively surf with your children and familiarize yourself with the Web sites they most like to visit. First, look to see if there is a privacy policy posted on the Web site - it should be easy to find. Next, read the policy and ask yourself if the Web site shares your child's information with others outside of the company.

4 Tips To Prevent Cyber bullying

1. Be a proactive parent

Cyber bullying is — and should be — a major concern for parents. Doing what you can to prevent your child from being a perpetrator or victim is paramount.

2. Define what cyber bullying is

Talk to your child about what cyber bullying behavior is. The Cyber bullying Research Center defines cyber bullying as “willful and repeated harm inflicted through the use of computers, cell phones, and other electronic devices.” However, it is not limited to that. Your child may be participating in cyber bullying unknowingly. Things like forwarding a hurtful message or taking inappropriate photos of someone can also be considered cyber bullying (and, more importantly, make your child legally liable). Ensure your children know what this behavior is and that they do not participate.

3. Keep an eye out for telltale signs

Though you may encourage communication, your child may feel uncomfortable talking about their cyber bullying problems for reasons such as fear, insecurity, or shame. Marie Newman, co-author of the book When Your Child Is Being Bullied: Real Solutions, lists behaviors that may be symptoms of a child who has been a victim of cyber bullying.

- Your child suddenly spends much more — or much less — time social networking, or asks to have a social media account shut down.

- After texting or being online, your child seems withdrawn, upset, or outraged.

- Your child suddenly avoids formerly enjoyable social situations.

- Your child blocks a number or an email address from their account.

- Many new phone numbers, texts, or email addresses show up on your child’s phone, laptop, or tablet.

If you notice any of these behaviors, gently address the subject with your child, offering your love and support.

4.       Encourage your community to take action

Be a role model for your own child, and encourage others to follow suit. The Bully Project encourages individuals to mobilize their communities and take a stand against bullying by uniting students, teachers, parents, and the community at large. You can review a toolkit and resources for anti-bullying advocates, and encourage dialogue within your community.

Preventing your child from becoming a victim or perpetrator of cyber bullying is in your hands. Therefore, you should always encourage an open dialogue about this important issue.

Children's Online Privacy Protection Act

The primary goal of the Children's Online Privacy Protection Act (COPPA) Rule is to give parents control over what information is collected from their children online and how such information may be used.

The Rule applies to:

1. Operators of commercial Web sites and online services directed to children under 13 that collect personal information from them;

2. Operators of general audience sites that knowingly collect personal information from children under 13; and

3. Operators of general audience sites that have a separate children's area and that collect personal information from children under 13.

The Rule requires operators to:

1. Post a privacy policy on the homepage of the Web site and link to the privacy policy on every page where personal information is collected.

2. Provide notice about the site's information collection practices to parents and obtain verifiable parental consent before collecting personal information from children.

3. Give parents a choice as to whether their child's personal information will be disclosed to third parties.

4. Provide parents access to their child's personal information and the opportunity to delete the child's personal information and opt-out of future collection or use of the information.

5. Not condition a child's participation in a game, contest or other activity on the child's disclosing more personal information than is reasonably necessary to participate in that activity.

6. Maintain the confidentiality, security and integrity of personal information collected from children.

7. In order to encourage active industry self-regulation, COPPA also includes a safe harbor provision allowing industry groups and others to request Commission approval of self-regulatory guidelines to govern participating Web sites' compliance with the Rule.

Kaspersky Lab provides a great resource for children and teen safety. Visit their site at https://kids.kaspersky.com

Cloud safety

What is cloud computing?

In simple terms, cloud computing is a method of storing files and data in a centralized network that can be reached from anywhere and by any type of device. This includes mobile phones, tablets, laptops and desktops. The notion of the “cloud” is because this data is placed in a network where say someone in NYC could access as well as someone in California.

Many people use cloud-based computer services and they don’t even know it. Consumers access and share information using remote server networks whenever they log on to social networks, like LinkedIn or Facebook, edit photos on Flickr, blog with WordPress, or create files using Google Docs. These are examples of cloud computing, which, simply defined, is how we store and share data, applications and computing power on the Internet.

Is it safe?

While there are so many advantages from using the cloud to store your data, of course there’s the question of safety and security. Primarily, the method of cloud computing is an extremely safe way to store data. Most companies have a system in place with their own firewalls and anti-virus software to protect their data stored on the premises. The issue comes about when computing is outsourced, and the control over security is no longer in your hands

Here are some tips to protect your data in the cloud:

1. Look for a Secure Web Address: Before shopping online or giving any sort of personal information, look at the URL—if the website is secure connection enabled, it will have an ‘s’ after the ‘http’ portion of the URL. An ‘https’ URL tells you the website has an SSL license, meaning your information is scrambled as it travels across the internet.

2. Don’t Provide Personal Information: Don’t put anything in the cloud you would not want others to see, especially the government or a private litigant. A credible website will never need sensitive personal information, like your social security, PIN, or bank account numbers. If a site you don’t trust asks you for anything personal, don’t trust it! It could be a phishing scam trying to gain access to your personal information. Pay close attention if the cloud provider reserves rights to use, disclose, or make public your information.

3. Create Strong Passwords: Make long passwords with at least eight or more characters. For added security, include punctuation, symbols and a mix of upper and lowercase letters. Don’t ever use the same password for all of your accounts and change them at least once a month.

4. Be Wary of Downloads: Don’t ever download a file from a website you don’t trust. There’re many malicious websites out there which let you download corrupted files with viruses and trojans that can infect your computer and steal your personal information.

5. Check for Site Updates: Credible websites are updated often with security measures. Look around to see when the site was last updated. If it’s been more than a couple of months, you might not trust the site.

6. Look for Contact Information: If you’re thinking about purchasing something from a website, look for the company’s contact information, including a physical address and a telephone number. This information is usually in the website’s footer. Don’t assume that a phone number is real—always call and ask questions to make sure the company is legitimate.

7. Read the Privacy Policy: Read the privacy policy before placing your information in the cloud. If you don’t understand the policy, consider using a different provider. Also make sure that the cloud provider gives advance notice of any change in the terms of service or privacy policy. Read the Terms of Service before placing any information in the cloud. If you don’t understand the Terms of Service, consider using a different cloud provider.

8. Leaving the Cloud: Know exactly what happens when you remove your data from the cloud provider. Does the cloud provider still retain rights to your information? If so, consider whether that makes a difference to you.

9. Delete Cookies Often: Cookies are small files designed to track your web activity. When you enter information into a site, such as a user name and password, the site uses cookies to remember your information so you don’t have to enter it the next time you visit. Hackers can use cookies to gain access to your accounts, so you should delete them often. Deleting cookies differs depending on which browser you use, but it’s usually found in your browser’s privacy settings.

College Students

In order for a thief to steal a college student's identity, they must first obtain the necessary information which allows them to “become” the college student, at least in the eyes of lending institutions and other financial companies. How easy this task is depends on how vigilant a student is about protecting their personal information.

1. Pre-approved credit offers monthly. Those mass-mailed forms, usually partially filled out with the recipient’s information such as name, address, and other personal data is fantastic opportunity to steal a person’s identity. If the recipient is not interested in the offer and simply throws away the form, it is one of the most common documents used by identity thieves. By picking the offer out of the trash can, the thief can then fill in the rest of the blanks and send it in or simply call the toll free phone number provided on the form, allowing them near instant access to one aspect of the victim's identity.

2. Bank Accounts. Another manner in which identity theft occurs is when thieves get their hands on personal banking account information, such as a checking or savings account statement. Anyone who does not balance their account is at risk of incurring fraudulent charges, simply because they do not keep track of what charges are legitimate. Oftentimes, the thief steals by withdrawing money in small increments - not enough to stand out as a glaring error to the casual observer but enough to build up to a large amount over time.

3. Social Security Number. Another danger to college students is their Social Security Number. Many college courses require a student to use their Social Security Number to log in to websites used to post homework assignments and other course communications. The university may also use that number as an identifying number in the administration office.It is very easy to forget to exercise caution when using a Social Security Number, particularly when it is used so often. Lax computer security or evens something as simple as a criminal watching a student enter the number, allows a thief can quickly and easily gain access to the Social Security Number, which is the key to obtaining additional information about an individual.

4. Computers / Laptops / Tablets. Computers and laptops also pose a threat that many students don't think about. Many students use a laptop every day in class to take notes and organize coursework documents. But what if that computer is stolen? What would a thief find inside? Most students in today’s world use their computers to access online banking, pay bills, order merchandise, and communicate in just about every other aspect of their lives, too. If personal and account information is stored on the hard drive, the thief has instant access to very information that makes it possible for them to assume the student's identity.Of course, students also shouldn't overlook one of the most common ways to steal someone’s identity - stealing a wallet, purse, or backpack. This can even occur in the student's dorm room, particularly if parties or unfamiliar guests are common, and they usually are in college dorms. Students should exercise the same security at home as in any unfamiliar environment.

How students can protect against identity theft.

1. Lock your door. This is the single most important way to keep your computers secure.

2. Don't assume your desktop computer is safe. Invest in some inexpensive cables designed to tether the CPU to something immovable in the room.

3. Use password protection. Adjust your computer settings to prompt for a password anytime the computer is used. Change that password from time to time.

4. Don't reveal too much. Social networking sites may ask for your birth date, but birth dates are a boon to identity thieves. Likewise, do not reveal any other personal info on these public sites, or in response to any e-mail requests for your Social Security number, credit card numbers, or other data, even if it's from a familiar-sounding company. Always err on the side of caution. For example, if you receive an e-mail that says it's PayPal and wants to verify your credit card number, call PayPal directly from the number listed on its Web site - NOT from any information in that e-mail. If you simply send your credit card number in response to that e-mail, you could find yourself stuck with a maxed-out credit card and a host of negative credit report problems.

5. Keep thorough records. If your laptop is stolen, can you provide a full description for the police? Write down your computer's make, model, color and most importantly, the unique serial number, which acts as a key identifier, much like the vehicle identification number (VIN) on a car. You might also need this information in case you want to file an insurance claim.

6. Install a tracking device. Use a GPS tracking device that runs invisibly on the computer to relocate the stolen property.

7. Use a multi-layered security approach. Consider software that provides permanent tagging, GPS tracking, covert data recovery, remote data deletion, stolen property tracing, and property registration.

8. Start shredding. Search and preview the personal data (both your data and anyone else's data that might be on your computer), including credit card numbers, Social Security number(s), birth dates, tax returns and financial aid documents, on your computer. You then have the option to digitally shred, encrypt, or redact that information, depending on your needs. Students can also find free digital shredder software online.

9. Contact your college's IT department about network security. Many colleges provide security software or other services free to their students. Before you purchase a specific computer protection system, check with the IT department of the college to ensure that system is compatible with the college's network, or you'll be tossing money out the window.

Crimes that target college students

1. The tuition scam. The fraudster calls or emails a student, claiming to be from the college admissions department. Sometimes the crook spoofs IDs to make it look like he's coming from a legitimate organization. The scammer claims the student's tuition fee is late and claims the student will be immediately dropped from classes if a payment isn't made immediately by credit card. Students need to hang up immediately on such calls and contact the college's admissions department directly.

2. Bad behavior. Students are notorious for their hard-partying, free-spirited lifestyles in college. But behind every smartphone is a camera that can photograph and videotape embarrassing indiscretions -- which can later be used against the student to extort money. There are people who will pretend to like you but are actually setting you up for blackmail. Students should think twice about their actions while at college - especially if they're drinking.

3. Fake credit cards. Some credit card offers are fake, aimed at getting naïve students to hand over personal information - or lure them to sites that have malware or add malicious software to the student's computer. The credit card world is laden with scams, and college students, being new to the credit game, are particularly susceptible. Be wary of signing up for cards from issuers you’re not familiar with–and not only credit cards, but prepaid debit as well. You risk the chance of relaying information to a phony lender and potential identity thief. And even the card is actually available and functioning, you need to be exceedingly cautious about hidden fees and unreasonable rates. Know what to expect from a credit card. If you see an APR of 25% or more, or an annual fee of $30 or more, you should be concerned.

4. Passwords. Everyone knows they should never use simple or easy-to-use passwords on email accounts or other sites and never use the same password on multiple sites. But students need to be particularly savvy about where they store those passwords, as leaving them on smartphones and laptops in college dorms make them vulnerable to theft.

5. Advance Fees. If someone offers to find a student a loan, job, scholarship or other service for a "fee," it's likely a scam. This is particularly true if the scammer says a "scholarship is guaranteed or your money back" or claims "you can't get this information anywhere else" or insists on a credit card to "hold" the scholarship. In general, the higher the fee, the more suspicious the person should be.

6. Online books. Never buy books online without first checking out reviews or talking to friends to validate the site or seller. Books are drastically discounted in this con. Thieves steal your credit card information when you submit your order online, and the books you order are never delivered. Remember to make online purchases only through a reputable, secured website.

7. Non-existent Apartments. Never agree to rent an apartment without seeing it first - both inside and outside - and meeting with the landlord. This scam is simple: Offer a great apartment, collect rent or a deposit over the phone for a place you don't own, and then disappear.

8. Check cashing. In this scam, a "friend" asks the student to cash a check for him - and might even offer to let the student keep some of the cash for the trouble. Once the check is deposited, it bounces, and the student is out both the money and a returned check fee.

9. Wi-Fi. College students, more than anyone, spend mountains of time online via Wi-FI at coffee shops, restaurants and parks. Hackers and thieves prey on them by setting up an alternative Wi-Fi site - often dubbed a "man in the middle" site - that looks similar to the main site but is actually a scammer trying to get students to connect to their site where they steal a person's information.

10. Social security number. Never Give Out A Social Security Number - Students are often too trusting and open, and geared toward answering questions and information. If someone's credit card is stolen, it can be canceled and a new card issued. But if a Social Security number is stolen, the repercussions can last a lifetime. When a scammer gains access to your social security number, they have an option on your life and you have to look over your shoulder for the rest of your life. "

11. Spear phishing. Emails are being sent to university employees that appear to be from their employer. The e-mail contains a link and claims some type of issue has risen requiring them to enter their log-in credentials. Once employees provide their user name and password, the perpetrator accesses the university’s computer system to redirect the employees’ payroll allocation to another bank account. The university employees’ payroll allocations are being deposited into students’ accounts. These students were hired through online advertisements for work-at-home jobs, and provided their bank account information to the perpetrators to receive payment for the work they performed.

12. Check fraud. Scammers are posting online advertisements soliciting college students for administrative positions in which they would receive checks via the mail or e-mail. Students are directed to deposit the checks into their accounts, and then print checks and/or wire money to an individual. Students are never asked to provide their bank account information to the perpetrators.

13. Data Breaches. Some universities have been victims of intrusions, resulting in the perpetrators being able to access university databases containing information on their employees and students.

14. Mystery shopping. Students receive emails or promotions for a website where they can register to become a secret shopper. Once signed up, they’re then told they must pay a fee for more program information to continue the application process. Never pay money upfront for a job. Legitimate job offers will not require payment. If you are interested in this type of work, you can search through legitimate assignments at the Mystery Shopping Providers Association (MSPA) website at www.mysteryshop.org.

15. Address farming. Thieves target large groups of students in this scam. They promise members of Greek organizations, and other types of clubs, discounted interest rates on credit cards or other services—all of which are bogus. In turn, scammers require group members to provide their addresses and personal information, enabling them to steal students' identities.

16. Fake credit card applications. Thieves mix in with representatives of legitimate credit card companies who are on campus handing out credit card applications. The thieves collect applications you’ve filled out, then steal your information so they can rip you off on your new credit card. Typically, they skim off your card slowly each month, relying on the fact that most students usually don’t read their statements. You can avoid this scam by applying for a credit card only through a known entity such as your bank or credit union.

17. Student loan and scholarship scams. Crooks ask students for an advance fee in order to secure their student loans. The requested amount can be 3 to 4 percent of the loan. Or, they make up a fee in order for students to apply for a scholarship. Don’t fall for these scams. Legitimate student loan agencies and scholarship providers never ask for money upfront.

18. Social media scams. One technique involves scammers setting up fake pages for universities and reaching out to the college’s students to acquire e-mail addresses. Phony pages and profiles are created to harvest personal information. In its most innocuous incarnation, this sort of scam means an inbox full of spam. In its most hostile form, social media fraud can result in identity theft. To avoid these scams, add only friends you know, limit the information you post online, and be wary of invitations to “like” pages.

Computers

Internet Safety

1. Never open suspicious files. Assume that any file you receive may be potentially infected, even if you know the sender well. Viruses, spyware and other malicious code typically originate from an infected PC and its address book, thus it will most likely come from family, friends, or business associates. When working with your email, browsing websites, or chatting via an Instant Messenger, do not accept any unsolicited files from anyone since they could contain malicious code.

2. Clicking Unknown Links. Avoid going to any URLs in email messages that may be questionable. Hackers often infect web pages with malicious code, so do not visit any website that you are not familiar with.

3. Anti Virus. Always keep your anti-virus, anti-spyware, and firewall protection up to date. New threats emerge regularly so it is critical that you keep your protective software and firewall technology current. In addition, scan your system monthly with the settings recommended by your Internet security provider.

4. Restrict Administrative Privileges. It is important to make sure that all employees have a level of administrative access equal to their job responsibilities. This includes not allowing employees to install software, music files, games, etc., as well as restricting access to external services such as web mail and remote control services. These types of restrictions will help protect your organization from spyware such as keystroke logging.

5. Your Operating System. Keep your operating system and your application software patches up to date. In order to prevent being infected by malicious code, keep the software patches up to date for your operating system, i.e.: Windows, Linux, Apple, as well as for your applications, i.e.: Internet Explorer, Firefox and Safari.

6. Stay informed and educated. It is important that not only your IT department stays up to date on the latest threats but that your employees and your business customers are also advised of them and that you educate them about the techniques of "safe computing." Internet security providers release formal alerts on the latest threats and vulnerabilities and how to protect against them.

7. Spam. Spammers scan the internet to find computers that aren't protected by security software, and then install bad software - known as "malware" - through those "open doors." That's one reason why up-to-date security software is critical. Malware may be hidden in free software applications. It can be appealing to download free software like games, file-sharing programs, customized toolbars, and the like. But sometimes just visiting a website or downloading files may cause a "drive-by download," which could turn your computer into a "bot."Spammers take over your computer is by sending you an email with attachments, links or images which, if you click on or open them, install hidden software. Be cautious about opening any attachments or downloading files from emails you receive. Don't open an email attachment - even if it looks like it's from a friend or coworker ' unless you are expecting it or know what it contains. If you send an email with an attached file, include a text message explaining what it is.

8. Don't Let Your Computer Become Part of a "BotNet" Some spammers search the internet for unprotected computers they can control and use anonymously to send spam, turning them into a robot network, known as a "botnet." Also known as a "zombie army," a botnet is made up of many thousands of home computers sending emails by the millions. Most spam is sent remotely this way; millions of home computers are part of botnets

Use Security Software That Updates Automatically

The bad guys constantly develop new ways to attack your computer, so your security software must be up-to-date to protect against the latest threats. Most security software can update automatically; set yours to do so. Also, set your operating system and web browser to update automatically.  If you let your operating system, web browser, or security software get out-of-date, criminals could sneak their bad programs - malware - onto your computer and use it to secretly break into other computers, send spam, or spy on your online activities. Don’t buy security software in response to unexpected pop-up messages or emails, especially messages that claim to have scanned your computer and found malware. Scammers send messages like these to try to get you to buy worthless software, or worse, to “break and enter” your computer.

Treat Your Personal Information Like Cash

Don’t hand it out to just anyone. Your Social Security number, credit card numbers, and bank and utility account numbers can be used to steal your money or open new accounts in your name. So every time you are asked for your personal information - whether in a web form, an email, a text, or a phone message - think about whether you can really trust the request. In an effort to steal your information, scammers will do everything they can to appear trustworthy. Learn more about scammers who phish for your personal information.

Check Out Companies to Find out Who You’re Really Dealing With

When you’re online, a little research can save you a lot of money. If you see an ad or an offer that looks good to you, take a moment to check out the company behind it. Type the company or product name into your favorite search engine with terms like “review,” “complaint,” or “scam.” If you find bad reviews, you’ll have to decide if the offer is worth the risk. If you can’t find contact information for the company, take your business elsewhere. Don’t assume that an ad you see on a reputable site is trustworthy. The fact that a site features an ad for another site doesn’t mean that it endorses the advertised site, or is even familiar with it.

Give Personal Information Over Encrypted Websites Only

If you’re shopping or banking online, stick to sites that use encryption to protect your information as it travels from your computer to their server. To determine if a website is encrypted, look for https at the beginning of the web address (the “s” is for secure). Some websites use encryption only on the sign-in page, but if any part of your session isn’t encrypted, the entire account could be vulnerable. Look for https on every page of the site you’re on, not just where you sign in.

Protect Your Passwords

Here are a few principles for creating strong passwords and keeping them safe:

1. The longer the password, the tougher it is to crack. Use at least 10 characters; 12 is ideal for most home users.

2. Mix letters, numbers, and special characters. Try to be unpredictable - don’t use your name, birthdate, or common words.

3. Don’t use the same password for many accounts. If it’s stolen from you - or from one of the companies with which you do business - it can be used to take over all your accounts.

4. Don’t share passwords on the phone, in texts or by email. Legitimate companies will not send you messages asking for your password. If you get such a message, it’s probably a scam.

5. Keep your passwords in a secure place, out of plain sight.

Learn How To Create A Strong Password: fraudsmarts.com/password

Back Up Your Files

No system is completely secure. Copy important files onto a removable disc or an external hard drive, and store it in a safe place. If your computer is compromised, you’ll still have access to your files.

Web Browser Security:

One of the most critical points of entry to your computer or gadgets is your Web browser. Unfortunately, your Web browser can have hundreds of security holes that hackers can, and do, exploit. Maybe your browser isn't updating, or perhaps you have add-ons or plug-ins installed that have their own security holes.

1. KEEP BROWSER UP TO DATE

One of the easiest ways to keep hackers away is to make sure your Web browser up to date. A lot of times, browsers like Microsoft's Edge, Mozilla's Firefox and Google Chrome issue patches and fixes for bugs they know about. Typically, they get most of them before hackers can have a field day exploiting vulnerabilities.

Fortunately, most browsers these days are automatically updated. For instance, if you installed Microsoft's new Windows 10 operating system, its default setting is to automatically update your software and issue patches, including for its Edge browser.

Firefox and Chrome also have default settings for automatic updates. You just need to restart them occasionally for the latest updates to install. If you're not sure if you're set up for automatic updates, here's how to check:

Chrome: Google Chrome updates automatically, and turning that off isn't easy. That's good. But to make absolutely sure you've got the latest version, you can click on the Menu icon (little box with three horizontal lines in the upper right corner of your page). Choose "Help and About," then "About Google Chrome."

If you need to change the update settings, go to Menu>>Settings, and then click the "Show Advanced Settings" link. Click or un-click "Protect You and Your Device From Dangerous Sites" to turn automatic updates on or off.

Edge: If you're using Windows 10, go to Start>>Settings, then click "Update & Security." Windows Update should say your device is up to date. If it's not, choose "Advanced Options," then "Choose How Updates Are Installed" and select "Automatic (recommended)."

Internet Explorer: In Windows 8, using a mouse, right-click in the lower right corner of the screen and choose "Control Panel." If you're using a touch screen, swipe from the right of the screen and tap "Settings," then "Control Panel." In Windows 7 and Vista, go to Start>>Control Panel.

In Control Panel, click "System and Security." Under "Windows Update," choose "Turn Automatic Updating On Or Off." Choose "Install Updates Automatically" from the drop-down menu.

Firefox: Click the Menu icon (far upper right-hand corner; its three horizontal lines) and choose "Options" and then "Advanced" in the left-hand column. Select the "Update" tab on the right, and under "Firefox Updates," make sure "Automatically Install Updates (Recommended: Improved Security)" is selected.

2.       UNINSTALL UNNEEDED PLUG-INS

Even if your browser itself is secure, it might have third-party plug-ins that aren't.

Flash the only plug-ins to keep an eye on, though. You might also have Microsoft Silverlight, Unity or a toolbar that you installed years ago and don't actually need. So, one way to give yourself an extra layer of protection is to delete unneeded plug-ins.

To do that in Windows 10, go to Start and select "All Apps." That's essentially Windows 10's version of the Control Panel. That will list all the programs installed on your device. Right click on the one you don't want; then select Uninstall.

In older versions of Windows, go to Start>>Control Panel, then under "Programs," click "Uninstall a Program." Select the plug-in you want to remove, and click Uninstall.

Secure your web browser

Today, web browsers such as Microsoft Internet Explorer, Mozilla Firefox, and Apple Safari are installed on almost all computers. Because web browsers are used so frequently, it is vital to configure them securely. Often, the web browser that comes with an operating system is not set up in a secure default configuration. Not securing your web browser can lead quickly to a variety of computer problems caused by anything from spyware being installed without your knowledge to intruders taking control of your computer.

There is an increasing threat from software attacks that take advantage of vulnerable web browsers. We have observed new software vulnerabilities being exploited and directed at web browsers through use of compromised or malicious websites. This problem is made worse by a number of factors, including the following:

1. Many users have a tendency to click on links without considering the risks of their actions.

2. Web page addresses can be disguised or take you to an unexpected site.

3. Many web browsers are configured to provide increased functionality at the cost of decreased security.

4. New security vulnerabilities are often discovered after the software is configured and packaged by the manufacturer.

5. Computer systems and software packages may be bundled with additional software, which increases the number of vulnerabilities that may be attacked.

6. Third-party software may not have a mechanism for receiving security updates.

7. Many websites require that users enable certain features or install more software, putting the computer at additional risk.

8. Many users do not know how to configure their web browsers securely.

9. Many users are unwilling to enable or disable functionality as required to secure their web browser. As a result, exploiting vulnerabilities in web browsers has become a popular way for attackers to compromise computer systems.

How to Secure Your Web Browser

- Microsoft Internet Explorer

For up-to-date information on security and privacy settings for Internet Explorer, visit: http://windows.microsoft.com/en-us/internet-explorer/ie-security-privacy-settings

- Mozilla Firefox

To learn how to keep your information safe and secure with Firefox's private browsing, password features and other security settings,

visit: https://support.mozilla.org/en-US/products/firefox/privacy-and-security

- Apple Safari

For information on the Safari’s security settings on Apple devices, visit: https://support.apple.com/en-us/HT201265

For information on Safari installed on computers,

visit: http://help.apple.com/safari/mac/8.0/ and select “Privacy and security” on the menu.

- Google Chrome

For more information on Chrome’s security, safety and reporting features, visit: https://support.google.com/chrome#topic=3421433 and select the options displayed under the topic.

- Opera

Security badges: http://help.opera.com/opera/Windows/1857/en/private.html#badges

Web preferences: http://help.opera.com/opera/Windows/1857/en/controlPages.html#content

- Chromium

Security information: https://www.chromium.org/Home/chromium-security

3.       ENABLE CLICK-TO-PLAY PLUG-INS

Adobe Flash. There have been many holes in Flash and we recommend that you disable or at least limit this Plug-In.

It's called click to play. Instead of a plug-in always running, you have to click on it to activate it. Here's how to do that.

Chrome: Menu (horizontal lines in the upper right corner)>>Settings. Click "Advanced Settings" at the bottom of screen. Under "Privacy," choose "Content Settings." Under "Plug-ins," choose "Let Me Choose When To Run Plug-in Content."

Edge: This browser doesn't really have click-play. You have to disable and re-enable plug-ins manually.

Windows 10: Right-click on the Start menu and choose "Control Panel." Click "Network and Internet" and then under "Internet Options" click "Manage browser add-ons." Click the "Manage add-ons" button and then highlight a specific plug-in in the "Toolbars and Extensions" area. If a plug-in is enabled, click the "Disable" button in the lower-right corner.

If you're just interested in Adobe Flash, in Edge, click the icon with the three dots in the upper-right corner, then select "Settings." Click the "View Advanced Settings" button and you'll see the "Use Adobe Flash Player" option. Turn this off when you don't need to use Flash.

Internet Explorer: In the far top right corner, click on the little gear icon and choose "Manage Add-Ons." Highlight a specific plug-in in the "Toolbars and Extensions" area. If a plug-in is enabled, click the "Disable" button in the lower-right corner.

Firefox: Menu (horizontal lines in the upper right corner)>>Add-Ons. Choose "Plugins" in the left-hand column. Next to each plug-in, you'll see a drop-down menu. Change each one to "Ask To Activate."

4.       GET RID OF UNNEEDED BROWSER EXTENSIONS

Browser plug-ins and browser extensions are easy to confuse. Plug-ins handle video or other content that the browser can't handle on its own. Extensions are bits of code that add new features to the browser.

Extensions have a downside, though. Many of them need your passwords to do their job. That opens up extensions to hackers, who use extensions to install malware.

A couple of tips: Before you install an extension, make sure it's coming from a trustworthy source and has been around for a while. Second, be sure to review your extensions every once in a while, to weed out the ones you don't need any more. If you're not using an extension, or you suspect it's not from a reliable company, delete it. Here's how:

Chrome: Go to Menu>>More Tools>>Extensions, then click "Remove" on each extension you don't need.

Edge: Microsoft's new browser is going to start introducing extensions sometime this year.

Internet Explorer: This browser does not support extensions.

Firefox: Menu>>Add-Ons. Choose "Extensions" in the left-hand column, then select the ones you don't want and click "Remove."

5.       RUN ANTI-EXPLOIT SOFTWARE

While most security software is great at detecting and stopping the millions of viruses out there before they can install, security holes in your browser and other programs give viruses a better chance to slip past unnoticed. Unfortunately, you don't even know there's a security hole in a program until the developer releases an update.

Software companies are starting to release anti-exploit programs. This watch your programs for signs that someone might be trying to use them to sneak on to your system. Then it blocks those attempts.

If you think of your main security program as the castle wall and the army guarding it, an anti-exploit program is the guy watching for traitorous citizens trying to open the backdoor.

6.       TYPOSQUATTING

One mistyped letter could lead to ID theft. Missing just a few letters in a web address can cost you the money in your bank account, or start an all-out identity theft attack, because of a type of fraud called "typosquatting."

The typosquatter's URL will usually be one of four kinds, all similar to the victim site address:

1. A common misspelling, or foreign language spelling, of the intended site: exemple.com

2. A misspelling based on typos: xample.com or examlpe.com (xample.com redirects to a scam site that tries to trick you into downloading malware, it is not suggested you visit it)

3. A differently phrased domain name: examples.com

4. A different top-level domain: example.org

An abuse of the Country Code Top-Level Domain (ccTLD): example.cm by using .cm or .om. A person leaving out the letter o or c in .com in error could arrive at the fake URL's website.

Once in the typosquatter's site, the user may also be tricked into thinking that they are in fact in the real site; through the use of copied or similar logos, website layouts or content. The fraudulent site is trying to get you to login with your user name and password or download malware with a fake “flash updater” pop-up, for example.

Stay Safe:

1. When visiting any web site, double-check the URL before logging in.

2. Be very careful entering things. If you're going to PayPal or you're going to your bank, just be very careful and pay attention to what you type.

3. Make sure you're on the real website by looking at the address bar on your browser.

Common Misconceptions:

Misconception: Windows Updates Make Antivirus Software Unnecessary

Since Windows updates are crucial to your PC’s security, if you’re diligent about installing patches you can forget using an antivirus. This, however, is a deadly mistake.

Truth: Windows Updates Come After The Fact. Windows Updates patch known vulnerabilities, but aren’t meant to protect from everyday threats. While keeping Windows up-to-date is a necessary part of security, it can’t replace an antivirus, which works nonstop to protect you. Also remember that anti-virus software is a management tool to catch already known viruses. AV software does not stop brand new viruses or social engineering scams.

Misconception: Malware Infections Are Obvious

Truth: A Lot of Malware Is Silent. There are dozens of rogue applications that are spying on you without making a sound. Many of these create zombie computers, which are responsible for much of the spam and website attacks that happen constantly. Additionally, if you fall for a phishing scam and a password falls into a thief’s grasp, they could be accessing your accounts - quietly, of course, so that you don’t suspect anything.

Don’t assume that just because everything looks normal that it is. Change your passwords regularly to be sure that someone isn’t getting in behind your back.

Misconception: I Don’t Do Anything Important On My Computer, So I Don’t Need To Be Careful

This is probably the most common reason people give for not keeping their computer safe. Sadly, it’s a poor excuse and those who give it are wrong.

The Truth: At the bare minimum, a virus or other malware infecting your PC — even if your financial info isn’t at risk - is going to take time to deal with. Your time is valuable, and if you’re recruiting a tech-savvy friend to fix your PC after your neglect, their time is affected too. Wiping your computer and starting fresh thanks to malware means more time and effort to get your programs re-installed and running just the way you like. In addition, Malware isn’t looking to steal files on your system. Rather, it’s tracking your every keystroke, stealing passwords, or even hacking into your webcam to spy on you.

Misconception: I don’t run Windows, so I’m immune to Malware

The Truth: All platforms are vulnerable and this includes iPad, iPhone, Android and other mobile devices. While Windows viruses won’t affect Mac computers, Macs can still get infected with viruses. In addition, you can fall for phishing tricks, perhaps via email or social media, no matter what platform you use.  Accidentally handing your password over to a fake site is going to yield the same result no matter if it’s done on Windows, Mac, or Android.

Misconception: My Apple or Andoid tablet is secure

The Truth: There is a plethora of mobile-based malware and viruses out there today. Never let your guard down and carelessly open a web site, email or attachment on a smart phone or tablet. These devices can be infected and can infect a corporate network if connected as a BYOD device.

Misconception: Windows Is Inherently Insecure

The Truth: Ever since Windows 7 hit the scene, the virus problem has been significantly curtailed. The problem is that most Windows users don’t care enough to update their systems with pertinent security patches. Microsoft is good about plugging security holes as they’re found, but if users don’t apply those updates, they leave themselves vulnerable. At that point, Windows itself is no longer at fault.

Moreover, Windows is the world’s most popular operating system. Combine that with the fact that Windows does not require its users to be tech-savvy and you’ve got a recipe for high number of security incidences.

Misconception: You don’t need security software

The Truth: The ones who create malware and viruses are always looking for new ways to facilitate the spread of malicious software, which means that their methods are always evolving.

But more importantly, we are human. Humans make mistakes. We can’t keep our guards up 24/7 and sometimes we’re lazy, forgetful, or reckless. All it takes is one lapse in judgment for your computer to be infected and that’s the real value of antivirus software: it protects you through your mistakes.

If you aren’t using antivirus software, install one now along with a virus scanner. Afterwards, if you find that you have an infection, clean it up as soon as possible.

Misconception: All You Need Is Security Software

The Truth: Malware and virus creators are always engineering new ways to spread their code. Antivirus companies are always one step behind (they have to study a virus to understand it’s signature before they can protect against it) which means that the notion of antivirus is fundamentally reactionary. AV software does not stop brand new viruses or social engineering scams.

Credit cards

To help prevent fraudulent use of your card, here are steps you should take.

1. Sign new cards as soon as you receive them.

2. Keep your card account numbers and personal identification number (PIN#) in a confidential place.

3. Check your cards periodically to make sure none are missing.

4. Destroy and dispose of copies of receipts, airline tickets, and travel itineraries, anything that displays your card numbers.

5. Memorize your PIN.

6. Check out unfamiliar companies by calling your local consumer protection agency.

7. Don't provide information that you're uncomfortable giving.

8. NEVER give anyone the password that you use to log on to your online account or Internet Service Provider.

9. Don't provide financial account information unless you are paying for a purchase using that account.

Card Cracking

In card-cracking scams, young adults (primarily students, newly-enlisted military, or single parents) are recruited to facilitate fraud against the bank. The perpetrators typically target consumers via social media and convince them to share their checking account information in exchange for some type of a kickback - usually in the form of a counterfeit check remotely deposited into their account of which, the consumer is allowed to keep a portion of the funds.

However, the fraudster often removes all of the funds before the bank determines that the check is counterfeit. Fraudsters may also convince the student to provide them with their debit card, along with their PIN. The consumer is instructed to report the card as lost or stolen, thereby receiving protection via Reg E, while the fraudster withdraws the funds.

Using a credit card overseas

1. Check if your card is accepted. Choose a U.S. credit card that’s widely accepted abroad. Generally, this means taking a Visa or MasterCard rather than Amex or Discover. Some U.S. cards are also starting to offer chip-and-PIN technology that can mean wider acceptance across Europe. Call your credit card company to find out how widely it’s accepted overseas and what fees you may be charged for purchases in foreign currencies.

2. Let your credit card company and bank know about your trip. If a credit card company or your bank starts seeing purchases overseas, they may flag your card as fraud and freeze your account. This is great if your card had actually been stolen, but less great when you’re traveling and your means of paying for things gets cut off. Let them know the locations you are traveling to and the dates of this trip so they do not freeze your card. They should note this in your account so there are no issues.

3. Know your credit limit. It’s not uncommon to accidentally to go over your credit limit - especially if you’re travelling for weeks at a time. At home, going over limit may be an inconvenience or incur a small fee, in different countries where credit cards are not as widely used, this may be seen in a harsher light. U.S. State Department websites vaguely suggest that Americans have been arrested for “innocently exceeding their credit limit while traveling abroad.” That’s probably an unusual situation, but one in which you certainly don’t want to find yourself.

4. Write down the international customer service number for your card(s). The usual 800 number for customer service won’t work abroad so find out the international number where you can reach them if your card is stolen, lost, or you encounter any other issues. Store it in your phone, e-mail it to yourself, or write it on a piece of paper you’ll keep with important documents.

5. Transfer extra funds to a savings account. If you’re bringing your debit card, only have the money in your account you will need for the trip and a little extra for emergencies. Transfer any excess to a savings account. This way if your card is stolen, the thieves can’t wipe out your entire account.

6. Make copies of your cards. Make a copy of the fronts and backs of your credit and debit cards. This way if you’re cards are stolen, you can report it to the local police and the U.S. Embassy.

7. Limit your cards. You don’t need to take your entire wallet and all of your credit cards. This will just make the situation worse if your bag gets lost or stolen. Choose the best credit card for your travels, and bring one or two.

8. Be aware of what’s covered by your credit card. You may be pleased to find out your credit card may offer a form of travel insurance for anything you charge on the card. For example, if you charge a rental car with your card, you can be insured for any damages. Call your credit card company to see what’s covered abroad.

9. Protect your cards. Carry your cards in a safe way, like a money belt that wraps around your body or a purse that wraps across your chest. Wallets and purses around a shoulder can be targets, and a backpack can be easily looked through while you’re not paying attention. When you’re putting in your PIN, cover it. Someone can be looking over your shoulder to attempt to steal it.

10. Keep track of your card. Don’t let your card out of your sight. It’s not uncommon for merchants abroad to double swipe or take it in the back to copy information down. And of course, always make sure you get your card back before you leave.

11. Track your purchases. Keep a receipt for your purchases. Check your statements regularly while you’re still traveling. If you have any charges that shouldn’t be there, call your credit card immediately because time is a factor.

12. Ask if there’s a fee to charge. Some places charge a hefty fee for not paying with cash, so double check anywhere you go. Some credit cards charge an additional few percentage points of the transaction as a foreign currency transaction fee.

13. Always carry back-up cash. There’s a good chance you’ll encounter places that only accept cash. Also, credit and debit cards aren’t as reliable as you would hope. An ATM can eat your card, credit card machines can be down, or you can run into other problems using your card.

14. Act fast if your card is stolen. If your card is missing, contact your credit card company, the local police, and the U.S. Embassy. When you’re home, you can contact the IRS Identity Protection Unit to report any stolen credit and debit cards as a first step in mitigating potential harmful effects of identity theft.

15. Beware of pickpockets. While pickpocketing has been on the decline in the U.S for the past fifty years or so, it’s still a major problem in Europe. Pickpockets often work in groups, are often children and are typically well-dressed. Be extra vigilant around tourist attractions, public transportation, restaurants, bars and hotel lobbies.

Data breaches

For Consumers:

1. CONSIDER ANOTHER WAY TO PAY - Try newer ways to pay, such as PayPal or Apple Pay. Any technology that avoids you having your credit card in your hand in a store is safer. Those services store your credit card information and it's not given to the retailer when you make a payment. Stored-value cards or apps, such as the ones used at coffee chains Starbucks and Dunkin Donuts, are also a safer bet, because they don't expose credit card information at the register.

2. SIGN IT, DON'T PIN IT - If you're planning on paying with a debit card, sign for your purchase instead of typing in your personal identification number at the cash register. You can do this by asking the cashier to process the card as a credit card or select credit card on the display. Not entering your PIN into a keypad will help reduce the chances of a hacker stealing that number too. Crooks can do more damage with your PIN, possibly printing a copy of the card and taking money out of an ATM.

3. BEWARE OF EMAIL SCAMMERS - After big data breaches are exposed, and get a lot of media attention, scammers come out of the woodwork looking to steal personal information. Some emails may mention the latest breach or offer free credit monitoring, but you should never click on the links. Many are for fake sites that try to steal personal information or passwords.

4. KEEP UP WITH CREDIT CARD ACTIVITY - Review credit card activity often for any unauthorized charges. And keep an eye out for smaller charges. Thieves will charge smaller amounts to test to see if you notice and then charge a larger amount later. They may also steal a small amount from millions of accounts, scoring a big payday. Also, take advantage of the many alert features that credit cards companies offer today.

5. MONITOR CREDIT REPORTS - Check your credit report for any accounts that crooks may have opened in your name. Credit reports are available for free, from each of the three national credit reporting agencies - Equifax, Experian and TransUnion - every 12 months

For Small Businesses:

1. Keep Only What You Need. Reduce the volume of information you collect and retain to only what is necessary. Minimize the places you store personal data. Know what you keep and where you keep it.

2. Safeguard Data. Lock physical records in a secure location. Restrict access to employees who need to retrieve private data. Conduct employee background checks and never give access to temporary employees or vendors.

3. Destroy Before Disposal. Cross-cut shred paper files before disposing of private information. Also destroy CDs, DVDs and other portable media. Deleting files or reformatting hard drives does not erase data. Instead, use software designed to permanently wipe the drive, or physically destroy it.

4. Update Procedures. Do not use Social Security numbers as employee ID or client account numbers. If you do so, develop another ID system now.

5. Train Employees. Establish a written policy about privacy and data security and communicate it to all employees. Educate them about what information is sensitive and their responsibilities to protect that data.

6. Control Use of Computers. Restrict employee use of computers to business. Don't permit use of file sharing peer-to-peer websites. Block access to inappropriate websites and prohibit use of unapproved software.

7. Secure All Computers. Implement password protection and require re-logon after a period of inactivity. Train employees to never leave laptops or PDAs unattended. Restrict tele-working to company-owned computers and require use of robust passwords that are changed regularly.

8. Keep Security Software Up-To-Date. Keep security patches for your computers up to date. Use firewalls, anti-virus and spyware software; update virus and spyware definitions daily.

9. Encrypt Data Transmission. Mandate encryption of all data transmissions. Avoid using Wi-Fi networks; they may permit interception of data.

10. Manage Use of Portable Media. Portable media, such as DVDs, CDs and USB "flash drives," are more susceptible to loss or theft. Allow only encrypted data to be downloaded to portable storage devices.

Are there more security breaches now than ever before?

This question is hard to answer. More companies are revealing that they have had a data breach, either due to laws or public pressure. Our sense is that two things are happening - the criminal population is stealing more data from companies AND that we are hearing more about the breaches.

Are all breaches alike?

No - security breaches can be broken down into a number of categories. What they have in common is that they usually contained personal identifying information in a format easily read by thieves, in other words, not encrypted.

1. Lost or stolen laptops, computers or other computer storage devices

2. Backup tapes lost in transit because they were not sent either electronically nor with a qualified human escort

3. Hackers breaking into systems

4. Employees stealing information or allowing access to information

5. Information bought by a fake business

6. Poor business practices - for example sending postcards with Social Security numbers on them

7. Internal security failures

8. Viruses, Trojan Horses and computer security loopholes

9. Information tossed into dumpsters - improper disposition of information

Visit http://www.FraudSmarts.com/data for data theft resources.

Debit cards

Debit cards have different protections and uses. Sometimes they're not the best choice.

Here are 10 places and situations where it can pay to leave that debit card in your wallet:

1. Online. Since the debit card links directly to a checking account, don't use a debit card online, you have potential vulnerability there. If you have problems with a purchase or the card number gets hijacked, a debit card is "vulnerable because it happens to be linked to an account. Also includes phone orders in this category.

The Federal Reserve's Regulation E (commonly dubbed Reg E), covers debit card transfers. It sets a consumer's liability for fraudulent purchases at $50, provided they notify the bank within two days of discovering that their card or card number has been stolen.

2. Big-Ticket Items. With a big ticket item, a credit card is safer. A credit card offers dispute rights if something goes wrong with the merchandise or the purchase, she says. With a debit card, you have fewer protections. In addition, some credit cards will also offer extended warranties. And in some situations, such as buying electronics or renting a car, some credit cards also offer additional property insurance to cover the item.

3. Deposit Required. When renting something and it requires a deposit. This is where you want to use a credit card instead of a debit. That way, the store has its security deposit, and you still have access to all of the money in your bank account. With any luck, you'll never actually have to part with a dollar.

4. Restaurants. In restaurants, you have so many people around. The danger: restaurants are one of the few places where you have to let cards leave your sight when you use them. But others think that avoiding such situations is not workable. The "conventional advice of 'don't let the card out of your sight' - is just not practical.

The other problem with using a debit card at restaurants: Some establishments will approve the card for more than your purchase amount because, presumably, you intend to leave a tip. So the amount of money frozen for the transaction could be quite a bit more than the amount of your tab. And it could be a few days before you get the cash back in your account.

5. You're a New Customer. Online or in the real world, if you're a first-time customer in a store, skip the debit card the first couple of times you buy. That way, you get a feel for how the business is run, how you're treated and the quality of the merchandise before you hand over a card that links to your checking account.

6. Buy Now, Take Delivery Later. Buying now but taking delivery days or weeks from now? A credit card offers dispute rights that a debit card typically does not. But be aware that some cards will limit the protection to a specific time period. So settle any problems as soon as possible.

7. Recurring Payments. We've all heard the urban legend about the gym that won't stop billing an ex-member's credit card. Now imagine the charges aren't going onto your card, but instead coming right out of your bank account. Another reason not to use the debit card for recurring charges: your own memory and math skills. Forget to deduct that automatic bill payment from your checkbook one month, and you could either face fees or embarrassment (depending on whether you've opted to allow over-drafting or not). So if you don't keep a cash buffer in your account, to protect yourself from over-limit fees, you may want to think about using a credit card for recurring payments.

8. Future Travel. Book your travel with a check card and they debit it immediately. So if you're buying travel that you won't use for six months or making a reservation for a few weeks from now, you'll be out the money immediately. Another factor is that hotels aren't immune to hackers and data breaches, and several name-brand establishments have suffered the problem recently. Do don't want your debit card information to sit in a system for four months, waiting for you to arrive.

9. Gas Stations and Hotels. This one depends on the individual business. Some gas stations and hotels will place holds to cover customers who may leave without settling the entire bill. That means that even though you only bought $10 in gas, you could have a temporary bank hold for $50 to $100.

The same can go for hotels, where there are sometimes holds or deposits in the hundreds to make sure you don't run up a long distance bill, empty the mini bar or trash the room. The practice is almost unnoticeable if you're using credit, but can be problematic if you're using a debit card and have just enough in the account to cover what you need. At hotels, ask about deposits and holds before you present your card. At the pump, select the pin-number option, which should debit only the amount you've actually spent.

10. Checkouts or ATMs That Look 'Off'. Criminals are getting better with skimmers and planting them in places you'd never suspect - like ATM machines on bank property. So take a good look at the machine or card reader the next time you use an ATM or self-check lane. Does the machine fit together well or does something look off, different or like it doesn't quite belong. Make sure it doesn't look like it's been tampered with.

Disposal - PC, smart phone & tablet

Wipe data on your old phone / tablet before you donate, resell or recycle it.

Your Smartphone or tablet contains personal data you want to keep private when you dispose your old phone. To protect your privacy, completely erase data off of your phone and reset the phone to its initial factory settings. Now having wiped your old device, you are free to donate, resell, recycle or otherwise properly dispose of your phone / tablet.

Disposing of your phone / tablet:

You can't just throw an old cell phone / tablet in the garbage. The Toxic chemicals contained in its batteries, and other parts can escape from the phone while it is in a landfill, and they can eventually leak into the groundwater, thereby poisoning the water of the surrounding area. Also, in many cases, city disposal workers have been burned, blinded, and poisoned while trying to crush garbage that contained ill disposed of electronics, such as cell phones.

1. There are special garbage bins for old cell phones / tablets that you can find in your local tech shop.

2. Consider donating your phone / tablet to a charity that recycles old cell phones, like Cell Phones for Soldiers, which recycles old cell phones, and uses the money to buy phone cards for soldiers to call their families.

3. If your cell phone / tablet is still functioning, and you just don't want it anymore, you can give it to a friend who doesn't have a phone, to save them money.

PC Disposal

Computers often hold all kinds of personal and financial information. If you're getting rid of your old computer, there are things to do before you log off for the last time so your hard drive doesn't become a 21st century treasure chest for identity thieves.

Quick Facts

1. Save important files on an external storage device - for example, a USB drive, a CDRom, or an external hard drive - or transfer them to a new computer.

2. "Wipe" your hard drive clean - use software available both online and in stores where computers are sold. They're generally inexpensive; some are available on the Internet for free.

3. If your old computer contains sensitive information that would be valuable to an identity thief, consider using a program that overwrites or wipes the hard drive many times. Or, remove the hard drive, and physically destroy it.

4. If you use your computer for business purposes, check with your employer about how to manage business-related information on your computer. The law requires businesses to follow data security and disposal requirements for certain information that's related to customers.

Once you have a "clean" computer, consider recycling, donating, or reselling it - and keep the environment in mind when disposing of your computer.

If you want to get rid of your old computer, options include recycling, reselling, and donating. But before you log off for the last time, there are important things to do to prepare it for disposal.

Computers often hold personal and financial information, including passwords, account numbers, license keys or registration numbers for software programs, addresses and phone numbers, medical and prescription information, tax returns, and other personal documents. Before getting rid of your old computer, it's a good idea to use software to "wipe" the hard drive clean. If you don't, consider your old hard drive a 21st century treasure chest for identity thieves and information pirates.

The Federal Trade Commission (FTC), the nation's consumer protection agency, says you can deter identity theft and information piracy by taking a few preventive steps.

Understanding Hard Drives

A computer's hard drive stores data, and maintains an index of files. When you save a file, especially a large one, it is scattered around the hard drive in bits and pieces. Files also are automatically created by browsers and operating systems. When you open a file, the hard drive checks the index, then gathers the bits and pieces and reconstructs them.

When you delete a file, the links between the index and the file disappear, signaling to your system that the file isn't needed any longer and that hard drive space can be overwritten. But the bits and pieces of the deleted file stay on your computer until they're overwritten, and they can be retrieved with a data recovery program. To remove data from your hard drive permanently, it needs to be wiped clean.

Cleaning Hard Dives

Before you clean your hard drive, save the files that are important to you on an external storage device? for example, a USB drive, a CDRom, or an external hard drive? or transfer them to a new computer. Check your owner's manual, the manufacturer's website, or its customer support line for information on how to save data and transfer it to a new computer.

Utility programs to wipe your hard drive are available both online and in stores where computers are sold. They're generally inexpensive; some are available on the Internet for free. Wipe utility programs vary in their capabilities: some erase the entire disk, while others allow you to select files or folders to erase. They also vary in their effectiveness: programs that overwrite or wipe the hard drive many times are very effective; those that overwrite or wipe the drive only once may not prevent information being wiped from being recovered later. If your old computer contains sensitive information that would be valuable to an identity thief, consider using a program that overwrites or wipes the hard drive many times. Or, remove the hard drive, and physically destroy it.

One more thing to keep in mind: If you use your home or personal computer for business purposes, check with your employer about how to manage information on your computer that's business-related. The law requires businesses to follow data security and disposal requirements for certain information that's related to customers.

Disposal Options

Once you have a 'clean' computer, here's how to dispose of it:

1. Recycle it. Many computer manufacturers have programs to recycle computers and components. Check their websites or call their toll-free numbers for more information. The Environmental Protection Agency (EPA) has information on electronic product recycling programs at http://www.epa.gov/epaoswer/hazwaste/recycle/ecycling/donate.htm. Your local community may have a recycling program. Check with your county or local government, including the local landfill office for regulations.

2. Donate it. Many organizations collect old computers and donate them to charities.

3. Resell it. Some people and organizations buy old computers. Check online.

4. Keep the environment in mind when disposing of your computer. Most computer equipment contains hazardous materials that don't belong in a landfill. For example, many computers have heavy metals that can contaminate the earth. The EPA recommends that you check with your local health and sanitation agencies for ways to dispose of electronics safely.

Email safety

Properly managing your email accounts

1. Using just one email account. Individuals new to email often think about their email account like they do their home address, you only have one home address, so you should only have one email. Instead, you should think about your email address like you do your keys; while it may be OK to use the same key for your front and your back door, having a single key open everything is both impractical and unsafe.

A good rule of thumb for the average email user is to keep a minimum of three email accounts. Your work account should be used exclusively for work-related conversations. Your second email account should be used for personal conversations and contacts, and your third email account should be used as a general catch-all for all hazardous behavior. That means that you should always sign up for newsletters and contests only through your third email account. Similarly, if you have to post your email account online, such as for your personal blog, you should only use your third email account (and post a web friendly form of it at that).

While your first and second email accounts can be paid or freebie, your third 'catch-all' account should always be a freebie account such as those offered by Gmail or Yahoo! You should plan on having to dump and change out this account every six months, as the catch-all account will eventually become spammed when a newsletter manager decides to sell your name or a spammer steals your email address off a Web site.

2. Holding onto spammed-out accounts too long. It is simply a fact of life that email accounts will accumulate spam over time. This is especially true of the account you use to sign up for newsletters and that you post online (which as stated above should not be your main email account). When this happens, it is best to simply dump the email account and start afresh. Unfortunately, however, many new email users get very attached to their email accounts and instead just wade through dozens of pieces of spam every day. To avoid the problem, prepare yourself mentally ahead of time for the idea that you will have to dump your 'catch all' account every six months.

3. Not closing the browser after logging out. When you are checking your email at a library or other public computer, you not only need to log out of your email when you are done, but you also need to make sure to close the browser window completely. Some email services display your username (but not your password) even after you have logged out. While the service does this for your convenience, it compromises your email security.

4. Forgetting to delete browser cache, history and passwords. After using a public terminal, it is important that you remember to delete the browser cache, history, and passwords. Most browsers automatically keep track of all the web pages that you have visited, and some keep track of any passwords and personal information that you enter in order to help you fill out similar forms in the future.

If this information falls into the wrong hands, it can lead to identity theft and stolen bank and email information. Because the stakes are so high, it is important that new internet users be aware of how to clear a public computers browser cache so that they can delete private information before lurking hackers can get a hold of it.

For those of you using Mozilla's Firefox, simply press Ctrl+Shift+Del. Opera users need go to Tools>>Delete Private Data. And users of Microsoft's Internet Explorer need to go to Tools>>Internet Options then click the 'Clear History', 'Delete Cookies', and 'Delete Files' buttons.

5. Using un-secure email accounts to send and receive sensitive corporate information.

Large corporations invest huge amounts of money to ensure that their computer networks and email remain secure. Despite their efforts, careless employees using personal email accounts to conduct company business and pass along sensitive data can undermine the security measures in place. So make sure that you don't risk your company's security, and your job, by transmitting sensitive company data via your own personal computer or email address.

6. Forgetting the telephone option. One of the most important lessons about email security is that no matter how many steps you take to secure your email, it will never be foolproof. This is never truer than when using a public computer. So unless you need a written record of something or are communicating across the globe, consider whether a simple phone call rather than an email is a better option. While a phone conversation may require a few extra minutes, when compared with accessing email through a public computer, a phone call is a far more secure option and it does not leave a paper trail.

Emailing the right people

1. Not using the Blind Carbon Copy (BCC) option. When you put a person's email addresses in the BCC: rather than the CC: window, none of the recipients can see the addresses of the other email recipients.

New email users often rely too much on the TO: because it is the default way of sending emails. That is fine as long as you are writing to just one person or a few family members. But if you are sending mail out to a diverse group of people, confusing BCC: and CC: raises some serious privacy and security concerns. It takes just one spammer to get a hold of the email and immediately everyone on your email list gets spammed.

Even if the honesty of the group isn't in question, many email programs are setup to automatically add to the address books any incoming email addresses. That means that some people in the group will inadvertently have added the entire list to their address book, and as a result, if one of their computers is infected with "Zombie" malware and silently sends out spam emails, you will have just caused the entire list to get spammed.

2. Being trigger happy with the "Reply All" button. Sometimes the mistake isn't in deciding between CC: and BCC: but between hitting Reply All instead of Reply. When you hit Reply All, your email message is sent to everyone included on the original email, and if you didn't intend to include them, the information can be disastrous from both a security and personal humiliation perspective.

3. Spamming as a result of forwarding email. Forwarding emails can be a great way to quickly bring someone up to speed on a subject without having to write up a summary email, but if you aren't careful, forwarding emails can create a significant security threat for yourself and the earlier recipients of the email. As an email is forwarded, the recipients of the mail (until that point in time) are automatically listed in the body of the email. As the chain keeps moving forward, more and more recipient ids are placed on the list.

Unfortunately, if a spammer or someone just looking to make a quick buck gets a hold of the email, they can then sell the entire list of email ids and then everyone will start to get spammed. It only takes a few seconds to delete all the previous recipient ids before forwarding a piece of mail, and it can avoid the terrible situation of you being the cause of all your friends or coworkers getting spammed.

Making backups and keeping records

1. Failing to back up emails. Emails are not just for idle chatting, but can also be used to make legally binding contracts, major financial decisions, and conduct professional meetings. Just as you would keep a hard copy of other important business and personal documents, it is important that you regularly back up your email to preserve a record if your email client crashes and loses data (It happened to Gmail as recently as December 2006).

Thankfully, most email providers make it rather simple to back up your email by allowing you to export emails to a particular folder and then just creating a copy of the folder and storing it onto a writeable CD, DVD, removable disk, or any other type of media. If that simple exporting process sounds too complicated, you can just buy automated backup software that will take care of the whole thing for you. Whether you purchase the software or decide to back up manually, it is important that you make and follow a regular backup schedule, as this is the sort of thing that new email users tend to just put off. The frequency of backups necessary for you will of course depend on your email usage, but under no circumstances should it be done less frequently than every 3 months.

2. Mobile access: Presuming a backup exists. Mobile email access, such as through BlackBerry, has revolutionized the way we think about email; no longer is it tied to a PC, but rather it can be checked on-the-go anywhere. Most new BlackBerry users simply assume that a copy of the emails they check and delete off the BlackBerry will still be available on their home or office computer.

It is important to keep in mind, however, that some email servers and client software download emails to the Blackberry device and then delete them from the server. Thus, for some mobile email access devices, if you delete it from the device, you have deleted it from your Inbox.

Just be aware of the default settings of your email client and make sure that if you want a copy of the email retained, you have adjusted the email client's settings to make it happen. And preferably make sure of this before you decide to delete that important email.

3. Thinking that an erased email is gone forever. We've all sent an embarrassing or unfortunate email and sighed relief when it was finally deleted, thinking the whole episode was behind us. Think again. Just because you delete an email message from your inbox and the sender deletes it from their 'Sent' inbox, does not mean that the email is lost forever. In fact, messages that are deleted often still exist in backup folders on remote servers for years, and can be retrieved by skilled professionals.

Avoiding fraudulent email

1. Believing you won the lottery - and other scam titles. Spammers use a wide variety of clever titles to get you to open emails which they fill with all sorts of bad things. New email users often make the mistake of opening these emails. So in an effort to bring you up to speed, let me tell you quickly:

- You have not won the Irish Lotto, the Yahoo Lottery, or any other

big cash prize. There is no actual Nigerian King or Prince trying to send you $10 million.

- Your Bank Account Details do not need to be reconfirmed immediately.

- You do not have an unclaimed inheritance.

- You never actually sent that "Returned Mail".

- The News Headline email is not just someone informing you about the daily news.

- You have not won an iPod Nano.

2.       Not recognizing phishing attacks in email content. While never opening a phishing email is the best way to secure your computer, even the most experienced email user will occasionally accidentally open up a phishing email. At this point, the key to limiting your damage is recognizing the phishing email for what it is.

Phishing is a type of online fraud wherein the sender of the email tries to trick you into giving out personal passwords or banking information. The sender will typically steal the logo from a well-known bank or PayPal and try to format the email to look like it comes from the bank. Usually the phishing email asks for you to click on a link in order to confirm your banking information or password, but it may just ask you to reply to the email with your personal information.

Whatever form the phishing attempt takes, the goal is to fool you into entering your information into something which appears to be safe and secure, but in fact is just a dummy site set up by the scammer. If you provide the phisher with personal information, he will use that information to try to steal your identity and your money.

Signs of phishing include:

1. A logo that looks distorted or stretched.

2. Email that refers to you as "Dear Customer" or "Dear User" rather than including your actual name.

3. Email that warns you that an account of yours will be shut down unless you reconfirm your billing information immediately.

4. An email threatening legal action.

5. Email which comes from an account similar, but different from, the one the company usually uses.

6. An email that claims 'Security Compromises' or 'Security Threats' and requires immediate action.

If you suspect that an email is a phishing attempt, the best defense is to never open the email in the first place. But assuming you have already opened it, do not reply or click on the link in the email. If you want to verify the message, manually type in the URL of the company into your browser instead of clicking on the embedded link.

1. Sending personal and financial information via email. Banks and online stores provide, almost without exception, a secured section on their website where you can input your personal and financial information. They do this precisely because email, no matter how well protected, is more easily hacked than well secured sites. Consequently, you should avoid writing to your bank via email and consider any online store that requests that you send them private information via email suspect.

This same rule of avoiding placing financial information in emails to online businesses also holds true for personal emails. If, for example, you need to give your credit card information to your college student child, it is far more secure to do so over the phone than via email.

2. Unsubscribing to newsletters you never subscribed to. A common technique used by spammers is to send out thousands of fake newsletters from organizations with an "unsubscribe" link on the bottom of the newsletter. Email users who then enter their email into the supposed "unsubscribe" list are then sent loads of spam. So if you don't specifically remember subscribing to the newsletter, you are better off just blacklisting the email address, rather than following the link and possibly picking up a Trojan horse or unknowingly signing yourself up for yet more spam.

Avoiding malware

1. Trusting your friends email. Most new internet users are very careful when it comes to emails from senders they don't recognize. But when a friend sends an email, all caution goes out the window as they just assume it is safe because they know that the sender wouldn't intend to hurt them. The truth is, an email from a friend's ID is just as likely to contain a virus or malware as a stranger's. The reason is that most malware is circulated by people who have no idea they are sending it, because hackers are using their computer as a zombie.

2. Deleting spam instead of blacklisting it. An email blacklist is a user created list of email accounts that are labeled as spammers. When you 'blacklist' an email sender, you tell your email client to stop trusting emails from this particular sender and to start assuming that they are spam.

Unfortunately, new internet users are often timid to use the blacklist feature on their email client, and instead just delete spam emails. While not every piece of spam is from repeat senders, a surprising amount of it is. So by training yourself to hit the blacklist button instead of the delete button when confronted with spam, you can, in the course of a few months, drastically limit the amount of spam that reaches your Inbox.

3. Disabling the email spam filter. New email users typically do not start out with a lot of spam in their email account and thus do not value the help that an email spam filter can provide at the beginning of their email usage. Because no spam filter is perfect, initially the hassle of having to look through one's spam box looking for wrongly blocked emails leads many new email users to instead just disable their email spam filter altogether.

However, as an email account gets older it tends to pick up more spam, and without the spam filter an email account can quickly become unwieldy. So instead of disabling their filter early on, new internet users should take the time to white-list emails from friends that get caught up in the spam filter. Then, when the levels of spam start to pick up, the email account will remain useful and fewer and fewer friends will get caught up in the filter.

4. Failing to scan all email attachments. Nine out of every ten viruses that infect a computer reach it through an email attachment. Yet despite this ratio, many people still do not scan all incoming email attachments. Maybe it is our experience with snail mail, but often when we see an email with an attachment from someone we know, we just assume that the mail and its attachment are safe. Of course that assumption is wrong, as most email viruses are sent by 'Zombies' which have infected a computer and caused it to send out viruses without the owner even knowing.

What makes this oversight even more scandalous is the fact that a number of free email clients provide an email attachment scanner built-in. For example, if you use Gmail or Yahoo! for your email, every email and attachment you send or receive is automatically scanned. So if you do not want to invest in a third-party scanner and your email provider does not provide attachment scanning built-in, you should access your attachments through an email provider that offers free virus scanning by first forwarding your attachments to that account before opening them.

Keeping hackers at bay

1. Sharing your account information with others. We've all done it - we need an urgent mail checked, and we call up our spouse or friend and request them to check our email on our behalf. Of course, we trust these people, but once the password is known to anybody other than you, your account is no longer as secure as it was.

The real problem is that your friend might not use the same security measures that you do. Your friend might be accessing his email through an unsecured wireless account, he may not keep his anti-virus software up to date, or he might be infected with a keylogger virus that automatically steals your password once he enters it. So ensure that you are the only person that knows your personal access information, and if you write it down, make sure to do so in a way that outsiders won't be able to understand easily what they are looking at if they happen to find your records.

2. Using simple and easy-to-guess passwords.

Hackers use computer programs that scroll through common names to compile possible user names, and then send spam emails to those usernames. When you open that spam email, a little hidden piece of code in the email sends a message back to the hacker letting him know that the account is valid, at which point they turn to the task of trying to guess your password.

Hackers often create programs which cycle through common English words and number combinations in order to try to guess a password. As a consequence, passwords that consist of a single word, a name, or a date are frequently "guessed" by hackers. So when creating a password use uncommon number and letter combinations which do not form a word found in a dictionary. A strong password should have a minimum of eight characters, be as meaningless as possible, as well as use both upper and lowercase letters. Creating a tough password means that the hacker's computer program will have to scroll through tens of thousands of options before guessing your password, and in that time most hackers simply give up.

3. Failing to encrypt your important emails. No matter how many steps you take to minimize the chance that your email is being monitored by hackers, you should always assume that someone else is watching whatever comes in and out of your computer. Given this assumption, it is important to encrypt your emails to make sure that if someone is monitoring your account, at least they can't understand what you're saying.

While there are some top-of-the-line email encryption services for those with a big budget, if you are new to email and just want a simple and cheap but effective solution, you can follow these step-by-step 20 minute instructions to install PGP, the most common email encryption standard. Encrypting all your email may be unrealistic, but some mail is too sensitive to send in the clear, and for those emails, PGP is an important email security step.

4. Not encrypting your wireless connection. While encrypting your important emails makes it hard for hackers who have access to your email to understand what they say, it is even better to keep hackers from getting access to your emails in the first place.

One of the most vulnerable points in an emails trip from you to the email recipient is the point between your laptop and the wireless router that you use to connect to the internet. Consequently, it is important that you encrypt your wifi network with the WPA2 encryption standard. The upgrade process is relatively simple and straightforward, even for the newest internet user, and the fifteen minutes it takes are well worth the step up in email security.

5. Failing to use digital signatures. The law now recognizes email as an important form of communication for major undertakings such as signing a contract or entering into a financial agreement. While the ability to enter into these contracts online has made all of our lives easier, it has also created the added concern of someone forging your emails and entering into agreements on your behalf without your consent.

One way to combat email forgery is to use a digital signature whenever you sign an important email. A digital signature will help prove who and from what computer an email comes from, and that the email has not been altered in transit. By establishing the habit of using an email signature whenever you sign important emails, you will not only make it harder for the other party to those agreements to try to modify the email when they want to get out of it, but it will also give you extra credibility when someone tries to claim that you have agreed to a contract via email that you never did.

You might have been hacked if:

- friends and family are getting emails or messages you didn’t send

- your Sent messages folder has messages you didn’t send, or it has been emptied

- your social media accounts have posts you didn’t make

- you can’t log into your email or social media account

In the case of emails with random links, it’s possible your email address was “spoofed,” or faked, and hackers don’t actually have access to your account. But you’ll want to take action, just in case.

What to do when you’ve been hacked:

1. Update your system and delete any malware

Make sure your security software is up-to-date

If you don’t have security software, get it. But install security software only from reputable, well-known companies. Then, run it to scan your computer for viruses and spyware (aka malware). Delete any suspicious software and restart your computer.

Set your security software, internet browser, and operating system (like Windows or Mac OS) to update automatically.  Software developers often release updates to patch security vulnerabilities. Keep your security software, your internet browser, and your operating system up-to-date to help your computer keep pace with the latest hack attacks.

2.       Change your passwords

That’s IF you’re able to log into your email or social networking account. Someone may have gotten your old password and changed it. If you use similar passwords for other accounts, change them, too. Make sure you create strong passwords that will be hard to guess.

3.       Check the advice your email provider or social networking site has about restoring your account. You can find helpful advice specific to the service. If your account has been taken over, you might need to fill out forms to prove it’s really you trying to get back into your account.

4.       Check your account settings

Once you’re back in your account, make sure your signature and "away" message don’t contain unfamiliar links, and that messages aren’t being forwarded to someone else’s address. On your social networking service, look for changes to the account since you last logged in — say, a new “friend.”

5.       Tell your friends

A quick email letting your friends know they might have gotten a malicious link or a fake plea for help can keep them from sending money they won’t get back or installing malware on their computers. Put your friends’ email addresses in the Bcc line to keep them confidential. You could copy and send this article, too.

Red Flags You're About to Get Scammed

Here's a list of 13 scam indicators you should watch out for when going through your inbox. Keep your guard up and you'll have nothing to worry about.

1. Links that are the only content in the body of an email

2. Bit.ly or otherwise shortened links that don't display the actual address

3. Hyperlinked text (for the same reason as shortened links — there's no indication of what you would be clicking)

4. When in doubt, don't click. But to help you out, browsers like Google Chrome can reveal a link's full address when you hover over it with your mouse cursor.

5. Inordinate Number of Recipients. If you get an email with hundreds of email addresses in the recipient field, yet the message seems directed toward one person, your scam sense should be on high alert.

6. Vague, Generic or Nonexistent Subject Lines

Sure, you send emails without subjects to your friends all the time, but if an email pops up from an unrecognizable address with "(no subject)," be careful. The same goes for vague or generic subject lines, including "Fwd: private" or "Free to look!" If you have no idea what you're opening, it's probably best to leave it alone.

7. Intense Enthusiasm. WHEN IT COMES TO EMAIL SECURITY, CAPS LOCK CAN BE MORE THAN JUST ANNOYING — it can indicate spam. Overly enthusiastic emails with emphasis and exclamations (e.g. "I JUST LOST 45lbs W/ THE X-Fit fitness program!!1!!") are surefire signs that the information isn't what it seems.

8. Grammar and Spelling. You don't have to be a grammar nut to notice odd mistakes in scam emails. Look out for questionable syntax and major typos, especially if the email supposedly comes from a reputable company or bank. Also watch out for scammers that purposely misspell things to avoid your spam filter, such as "V1agr@" instead of "Viagra."

9. Strange Requests. This one's easy: If someone is emailing you for medical assistance or writes, "Help me cheat on my husband," it's just not legit. That's what emergency contacts are for.

10. Urgency. People don't typically use email to send urgent messages of an emergency nature. If you get an email that claims a situation is a matter of life or death (or a desperate person who needs money wired now), it's safe to assume the sender wouldn't be targeting you, a stranger, in the first place.

11. Sensitive Information Requests. Unfortunately, people accidentally send secure information to scammers more often than you would expect. This is how scammers (that is, smart scammers) operate — many ask for personal information (credit card numbers, passwords) and disguise emails to look official. Companies, schools, banks and other institutions won't ask you to transmit sensitive information in an email.

12. Name-Sender Disagreement. Scam email addresses often have different names to dupe the recipient. Check the address before assuming something is true.

13. Surefire Guarantees. You should know by now that nothing on the Internet is guaranteed. Promises to boost your sex life or quick money via working from home shouldn't be taken seriously. "Watch this video and women will adore you?" More like, "Click this link and regret it."

Visit http://www.FraudSmarts.com/tools for resources that will help you stay safe and test for fraud, viruses and malware.

Gift / Reward cards

There are several traps that target people selling gift cards.

1. In one scam, fraudsters pay you for a card (or the code on the card), but then dispute or cancel the charge after they have already used the gift card.

2. In another, they ask you to buy a bunch of gift cards in exchange for an item on an auction site—and then never actually send you the purchase.

To avoid becoming a victim, take several precautions when you use gift card websites.

1. Check reviews of any website you use.

2. Always review gift card balances before and after purchasing the card.

3. If you are selling a gift card, don’t ever give out the card’s PIN until your payment transaction is complete.

4. Be wary of auction sites selling gift cards at a discount or in bulk.

5. If you are buying a gift card in a store, examine the protective scratch-off area on the back of the card for evidence of tampering.

6. Beware of social media postings offering vouchers or gift cards: Fraudulent messages can sometimes appear to have been shared by a friend when they really come from a scam artist.

You can protect yourself from gift card fraud by following a few simple precautions.

1. Don't buy gift cards displayed prominently within the store. Ask sales clerks to sell you cards from the back room or behind the customer service desk.

2. Examine cards and packaging for signs of tampering. Don't buy a card where the coating covering the PIN number has been scratched away or the activation sticker isn't firmly affixed.

3. Spend the gift card as soon as possible. Don't put the card in a drawer for months. The longer consumers take to spend their gift cards, the more time thieves have to do it for them.

4. Beware of online exchanges and auction sites. Online buy cards from reputable online exchanges or auction sites because of the possibility of buying stolen cards.

Home banking

The beauty of online accounts is that you can monitor them almost in real time. That means you can catch crooks long before a statement arrives in the mail.

1. Don't use your account on an unknown computer. Unless you are sure a computer is secure, be wary of using an unknown computer. Computers can record pages viewed and keystrokes entered among other possible security violations. Granted, this will not be your experience on most computers, but be careful.

2. Don't use your computer at work. Even if it's on your lunch hour and on your own time, employers can monitor computer usage and even typing (although most don't). While your company might not care how much money is in your accounts, those who are paid to monitor Internet and email use will also have access to this information. You can use your computer at work, just be aware of the risks.

3. Shred or securely store your paper bank statements. One of the advantages of online banking is that your records are stored securely online. However, if your financial institution sends you monthly statements about your account or another account you have with them, be aware that these statements can include log-in information as well as account numbers that can be used to access your account. You should shred these documents when you are done with them or store them in a secure place.

4. Understand security and online banking. You have taken a good first step by reviewing the information on this site and this list of security measures that you can take, but make sure you continue to be aware of the security measures your financial institution employs.

5. Passwords. Don't use your full or partial Social Security number as a Personal Identification Number (PIN), user ID or password. Make sure that your password is 8 or more characters and combines letters, numerals and symbols. Don't use the same user ID and password for your financial accounts as you do for other sites.

6. Consider a screen lock on your mobile device. Many mobile phones offer this option, as well as other customizable security settings, that can help keep your phone and information secure.

7. Smart Phones. Don't use your mobile device to store sensitive personal information or bank account numbers.

8. Email. Never respond to urgent email claiming to be from a bank or any company that requests your account information or personal details. Forward these emails to your financial institution.

9. Social Networks. Limit the amount of personal information you provide on social networking sites. The more information you post, the easier it may be for a criminal to use that information to steal your identity, access your data or commit other crimes.

Be cautious about messages you receive on social networking sites that contain links. Even links that look like they come from friends can sometimes be harmful or fraudulent – and in fact may be attempts to gain control of your computer or steal your personal information. If you're suspicious, don’t click the link. Contact your friend or the business directly to verify the validity of the email.

10.    Computer. Keep your computer operating system and browser up to date with the latest software and security downloads. Often called patches or service packs, these should be installed as soon as possible.

11.    Email. Don’t open attachments or install free software from unknown sources; this may expose your computer and the information on it to unauthorized sources.

Home network

How to secure an 802.11b/g/n wireless home network. Securing a wireless network is very important because if you don't, criminals can not only borrow your Internet connection, but also access your files and check up on what you're doing. Even worse, hackers can use your internet connection to upload illegal materials.

1. Connect to your router via your browser, by inputting something called a Gateway IP Address.

To find your Gateway IP Address and connect to it in Windows

- Click Start > Run > type 'cmd' > Click 'Enter'

- Once the Command Prompt window opens, type 'ipconfig /all' and hit 'Enter'

- Locate the line labeled 'Gateway' and make note of the number that follows. It will look similar to '192.168.1.1'

- Open Internet Explorer (or your favorite browser)

- Enter the Gateway IP Address into the address bar and click 'Enter

To find your Gateway IP Address and connect to it on a Mac

- Open your Finder and run 'Terminal' inside of Applications > Utilities

- Once the terminal window opens, type 'ipconfig -a' and hit 'Enter'

- Locate the line labeled 'Gateway' and make note of the number that follows. It will look similar to '192.168.1.1'

- Open Safari (or your favorite browser)

- Enter the Gateway IP Address into the address bar and click 'Enter'

2.       Enable encryption on your access point. Using 128-bit encryption or higher makes your Wireless Network more secure. WEP and WPA are entirely different encryption schemes. WEP has been proven insecure and can be cracked in a few minutes using free utilities that can be downloaded from the Internet. Using at least WPA is recommended, because it is much more secure, but is sometimes a bit harder to set up correctly than WEP is, and isn't completely secure.[1] [2] Some older access points or wireless cards do not support WPA2. If you have one of these, it is recommended that you purchase a newer one that supports WPA2, depending on how important you consider your security.

3.       Set the router access password. Anybody who gains access to the router configuration settings can disable the security you have set up. If you forget the password, most routers have a hardware reset that will restore all of the settings to factory defaults. The best option is to use a random sequence of the maximum length of characters - you only have to type that once, so it is not a big thing. When you connect to the router via LAN cable while setting it up, you can copy and paste the password onto the router and onto your local setting, so you never need to type it again.

Use a secure password. Don't use easily guessed passwords for your WPA2 or router access passwords, such as "ABC123", "Password", or a string of numbers in order. Use something hard to guess that contains both upper and lowercase letters as well as numbers. Special characters such as !@#$% are not supported by some routers. The longer the key, the better, although the WPA2 key has a minimum and maximum length. Try to make a little mental effort - good passwords might be hard to remember, but they are harder to crack.

If you use a weak key then even WPA and WPA2 can be easily cracked within a day using a combination of special precomputed tables and dictionary attacks. The best way to generate a secure key is to use an offline random number generator or write the entire alphabet in uppercase and lowercase and numbers 0-9 on separate pieces of paper, mix the paper up and randomly pick up pieces and return them, mixing them up again each time; each character you pull out becomes a character in your key. You can also try throwing a pair of dice and using the resulting numbers as your password.

4.       Change the Service Set Identifier (the network name or "SSID") from the default to something unique. A default SSID indicates to hackers that the network was set up by a novice and that other options (such as the password) are also left as the default. Use a name you can remember and identify, as the SSID has no influence on the security of your network (not even if you choose not to broadcast it).

5.       Enable MAC Address filtering on your Access Point or router. A MAC (not to be confused with the computer model 'Mac') address is a code unique to every wireless networking card in existence. MAC Address filtering will register the hardware MAC Address of your networked devices, and only allow devices with known MAC Addresses to connect to your network. However, hackers can clone MAC addresses and still enter your network, so MAC address filtering should not be used in place of proper WPA2 encryption.

6.       Don't disable the 'SSID Broadcast'. Do not disable the 'SSID Broadcast' feature of your Access Point or router. This seems counter-intuitive, but it is actually a bad idea.[3] Although this would make your network invisible to your neighbors, any determined hacker can still sniff out your SSID; and you are implicitly forcing your computer to shout out your SSID anywhere you are, while it is trying to connect to it. Anyone could then impersonate your router with that SSID, and get your credentials that way.

7.       Disable remote login. The first router worm brute forces its way into the router in this manner. Most default usernames are set to Admin. It isn't hard for a virus/worm to crack the password if the username is known. The good thing is that routers normally have this disabled by default. Be sure to confirm that it is disabled when you first set up your router and periodically thereafter. If you need to update your router setting remotely, only set up access for the time you are going to be connected.

8.       Disable wireless administrating. Finally, change the setting that allows administrating the router through a wireless connection to 'off' (meaning that you need to connect with a LAN cable for administration). This disables any wireless hacking into the router.

Visit http://www.FraudSmarts.com/tools for more resources to help you secure your home network.

I.D. theft

What Do Thieves Do With Your Information?

Once identity thieves have your personal information, they can drain your bank account, run up charges on your credit cards, open new utility accounts, or get medical treatment on your health insurance. An identity thief can file a tax refund in your name and get your refund. In some extreme cases, a thief might even give your name to the police during an arrest.

Warning Signs of Identity Theft

1. You see withdrawals from your bank account that you can’t explain.

2. You don’t get your bills or other mail.

3. Merchants refuse your checks.

4. Debt collectors call you about debts that aren’t yours.

5. You find unfamiliar accounts or charges on your credit report.

6. Medical providers bill you for services you didn’t use.

7. Your health plan rejects your legitimate medical claim because the records show you’ve reached your benefits limit.

8. A health plan won’t cover you because your medical records show a condition you don’t have.

9. The IRS notifies you that more than one tax return was filed in your name, or that you have income from an employer you don’t work for.

10. You get notice that your information was compromised by a data breach at a company where you do business or have an account.

11. If your wallet, Social Security number, or other personal information is lost or stolen, there are steps you can take to help protect yourself from identity theft.

How to keep your identity private

The only thing an identity thief needs is your Social Security Number, your birth date or, sometimes, identifying information as basic as your address, driver’s license number and phone number.

Some of the places identity thieves get this information include:

1. Purses/wallets

2. Personal information kept in your car (especially your glove box)

3. Receipts tossed in the trash

4. Overhearing conversations you have in public

5. Information stolen from your mailbox

6. Diverting your mail to another location by filling out a “change of address form”

7. Looking over your shoulder when you use your credit cards or the ATM.

8. Observing users typing their login credentials, credit/calling card numbers etc. into IT equipment located in public places.

9. Rummaging through rubbish for personal information (dumpster diving)

10. Retrieving personal data from redundant IT equipment and storage media including PCs, servers, PDAs, mobile phones, USB memory sticks and hard drives that have been disposed of carelessly at public dump sites, given away or sold on without having been properly sanitized

11. Using public records about individual citizens, published in official registers such as electoral rolls

12. Stealing bank or credit cards, identification cards, passports, authentication tokens ... typically by pickpocketing, housebreaking or mail theft

13. Common-knowledge questioning schemes that offer account verification and compromise: "What's your mother's maiden name?", "what was your first car model?", or "What was your first pet's name?” etc.

14. Skimming information from bank or credit cards using compromised or hand-held card readers, and creating clone cards

15. Using 'contactless' credit card readers to acquire data wirelessly from RFID-enabled passports

16. Stealing personal information from computers using breaches in browser security or malware such as Trojan horse keystroke logging programs or other forms of spyware

17. Hacking computer networks, systems and databases to obtain personal data, often in large quantities

18. Exploiting breaches that result in the publication or more limited disclosure of personal information such as names, addresses, Social Security number or credit card numbers

19. Advertising bogus job offers in order to accumulate resumes and applications typically disclosing applicants' names, home and email addresses, telephone numbers and sometimes their banking details

20. Exploiting insider access and abusing the rights of privileged IT users to access personal data on their employers' systems

21. Infiltrating organizations that store and process large amounts or particularly valuable personal information

22. Impersonating trusted organizations in emails, SMS text messages, phone calls or other forms of communication in order to dupe victims into disclosing their personal information or login credentials, typically on a fake corporate website or data collection form (phishing)

23. Brute-force attacking weak passwords and using inspired guesswork to compromise weak password reset questions

24. Obtaining castings of fingers for falsifying fingerprint identification.

25. Browsing social networking websites for personal details published by users, often using this information to appear more credible in subsequent social engineering activities

26. Diverting victims' email or post in order to obtain personal information and credentials such as credit cards, billing and bank/credit card statements, or to delay the discovery of new accounts and credit agreements opened by the identity thieves in the victims' names

27. Using false pretenses to trick individuals, customer service representatives and help desk workers into disclosing personal information and login details or changing user passwords/access rights (pretexting)

28. Stealing checks to acquire banking information, including account numbers and bank routing numbers

29. Guessing Social Security numbers by using information found on Internet social networking sites.

30. Low security/privacy protection on photos that are easily clickable and downloaded on social networking sites.

31. Befriending strangers on social networks and taking advantage of their trust until private information are given.

Child Identity Theft

Identity theft on a child can go undiscovered for years. While parents may have a system of alerts and credit checks to protect their own credit, kids are easier targets. Identity theft on a child can go undiscovered for years. You may not become aware until your child is turned down for a job or loan due to a horrible credit history.

Signs that your child’s credit history has been compromised include:

1. Your child is denied a bank account or driver’s license

2. Credit card and loan offers addressed to your child

3. Collection calls or bills addressed to your child

4. Being turned down for government benefits because the Social Security number is already in use

5. A notice from the IRS that your child owes income taxes or was claimed as a dependent on another return

Don’t immediately panic if you receive a credit card offer in your child’s name. Financial companies sometimes mistakenly send credit card offers to a minor but be on alert if you suddenly start receiving a lot of mail that would typically be for adults.

Check Your Child’s Credit Report

It isn’t as easy to check a child’s credit report as it is to check your own. You’ll have to mail or fax in documentation proving you are the parent or guardian. Experian, Equifax, and TransUnion each have their own process for checking a minor’s credit report. To learn more, please visit: https://www.fraudsmarts.com/identity

Internet of Things

As consumers buy more smart watches, activity trackers, holographic headsets, and other Internet of Things (IoT) devices, the need for improved security on these devices will become more pressing. Online criminals could exploit these new devices to conduct data breaches, corporate or government espionage, and damage critical infrastructure like electrical grids.

For Smart T.V. Security

1. If your smart TV runs on the Android platform, go to the Google Play store and download any of the security apps designed to protect your Android smart phone.

2.       If your Wi-Fi router allows you to create multiple accounts, set up a guest account for your TV. This way they're not on the same network as my PC and laptop where you do all of my sensitive stuff.

3.       Make sure that "firmware" - permanent software built into a computing device's read-only memory - is up to date when you first use the TV and set it to automatically accept future firmware updates as they become available.

4.       Be careful when installing new applications because they could be hiding malware. Your best bet: Avoid apps from unknown sources and non-official locations.

5.       Limit what you do online via that television. Even though these TVs make it easy to get online, don't use them to do anything that involves account numbers, PINs, passwords or other sensitive information.

6.       Don’t do any kind of financial transaction through your TV is a really bad idea.

The top 10 internet of things vulnerabilities

Insecure Web interface

Overview: An attacker uses weak credentials, captures plain-text credentials or enumerates accounts to access the web interface.

How Do I Make My Web Interface Secure?

1. Default passwords and ideally default usernames to be changed during initial setup

2. Ensuring password recovery mechanisms are robust and do not supply an attacker with information indicating a valid account

3. Ensuring web interface is not susceptible to XSS, SQLi or CSRF

4. Ensuring credentials are not exposed in internal or external network traffic

5. Ensuring weak passwords are not allowed

6. Ensuring account lockout after 3 -5 failed login attempts

Insufficient authentication or authorization

Overview: An attacker uses weak passwords, insecure password recovery mechanisms, poorly protected credentials or lack of granular access control to access a particular interface.

How Do I Make My Authentication/Authorization Better?

1. Sufficient authentication/authorization requires:

2. Ensuring that the strong passwords are required

3. Ensuring granular access control is in place when necessary

4. Ensuring credentials are properly protected

5. Implement two factor authentication where possible

6. Ensuring that password recovery mechanisms are secure

7. Ensuring re-authentication is required for sensitive features

8. Ensuring options are available for configuring password controls

Insecure network services

Overview: An attacker uses vulnerable network services to attack the device itself or bounce attacks off the device.

How Do I Secure My Network Services?

1. Ensuring only necessary ports are exposed and available.

2. Ensuring services are not vulnerable to buffer overflow and fuzzing attacks.

3. Ensuring services are not vulnerable to DoS attacks which can affect the device itself or other devices and/or users on the local network or other networks.

4. Ensuring network ports or services are not exposed to the internet via UPnP for example

Lack of transport encryption

Overview: An attacker uses the lack of transport encryption to view data being passed over the network.

How Do I Use Transport Encryption?

1. Ensuring data is encrypted using protocols such as SSL and TLS while transiting networks.

2. Ensuring other industry standard encryption techniques are utilized to protect data during transport if SSL or TLS are not available.

3. Ensuring only accepted encryption standards are used and avoid using proprietary encryption protocols

Privacy concerns

Overview: An attacker uses multiple vectors such as insufficient authentication, lack of transport encryption or insecure network services to view personal data which is not being properly protected or is being collected unnecessarily.

How Do I Prevent Privacy Concerns?

1. Ensuring only data critical to the functionality of the device is collected

2. Ensuring that any data collected is of a less sensitive nature (i.e., try not to collect sensitive data)

3. Ensuring that any data collected is de-identified or anonymized

4. Ensuring any data collected is properly protected with encryption

5. Ensuring the device and all of its components properly protect personal information

6. Ensuring only authorized individuals have access to collected personal information

7. Ensuring that retention limits are set for collected data

8. Ensuring that end-users are provided with "Notice and Choice" if data collected is more than what would be expected from the product

Insecure cloud interface

Overview: An attacker uses multiple vectors such as insufficient authentication, lack of transport encryption and account enumeration to access data or controls via the cloud website.

How Do I Secure My Cloud Interface?

1. Default passwords and ideally default usernames to be changed during initial setup

2. Ensuring user accounts cannot be enumerated using functionality such as password reset mechanisms

3. Ensuring account lockout after 3- 5 failed login attempts

4. Ensuring the cloud-based web interface is not susceptible to XSS, SQLi or CSRF

5. Ensuring credentials are not exposed over the internet

6. Implement two factor authentication if possible

Insecure mobile interface

Overview: An attacker uses multiple vectors such as insufficient authentication, lack of transport encryption and account enumeration to access data or controls via the mobile interface.

How Do I Secure My Mobile Interface?

1. Default passwords and ideally default usernames to be changed during initial setup

2.       Ensuring user accounts cannot be enumerated using functionality such as password reset mechanisms

3.       Ensuring account lockout after an 3 - 5 failed login attempts

4.       Ensuring credentials are not exposed while connected to wireless networks

5.       Implementing two factor authentication if possible

Insufficient security configuration

Overview: An attacker uses the lack of granular permissions to access data or controls on the device. The attacker could also us the lack of encryption options and lack of password options to perform other attacks which lead to compromise of the device and/or data.

How Do I Improve My Security Configurability?

1. Ensuring the ability to separate normal users from administrative users

2.       Ensuring the ability to encrypt data at rest or in transit

3.       Ensuring the ability to force strong password policies

4.       Ensuring the ability to enable logging of security events

5.       Ensuring the ability to notify end users of security events

Insecure software or firmware

Overview: Attacker uses multiple vectors such as capturing update files via unencrypted connections, the update file itself is not encrypted or they are able to perform their own malicious update via DNS hijacking.

How Do I Secure My Software/Firmware?

1. Ensuring the device has the ability to update (very important)

2. Ensuring the update file is encrypted using accepted encryption methods

3. Ensuring the update file is transmitted via an encrypted connection

4. Ensuring the update file does not expose sensitive data

5. Ensuring the update is signed and verified before allowing the update to be uploaded and applied

6. Ensuring the update server is secure

Poor physical security

Overview: Attacker uses vectors such as USB ports, SD cards or other storage means to access the Operating System and potentially any data stored on the device.

How Do I Physically Secure My Device?

1. Ensuring data storage medium cannot be easily removed.

2. Ensuring stored data is encrypted at rest.

3. Ensuring USB ports or other external ports cannot be used to maliciously access the device.

4. Ensuring device cannot be easily disassembled.

5. Ensuring only required external ports such as USB are required for the product to function

6. Ensuring the product has the ability to limit administrative capabilities

Investment fraud

These schemes, sometimes referred to as high yield investment fraud, involve the illegal sale or purported sale of financial instruments. Financial instruments are defined broadly as any contract that gives rise to a financial asset of one entity and a financial liability or equity instrument to another entity. These instruments can be a tradeable asset of any kind, to include registered securities and commodities and unregistered securities (e.g. a simple promissory note between the fraudster and his/her victim investors). Schemes take on many forms, and perpetrators quickly alter schemes as they are thwarted by law enforcement.

1. Ponzi Schemes: A Ponzi scheme is an investment fraud that involves the payment of purported returns to existing investors from funds contributed by new investors. Ponzi schemes often share common characteristics, such as offering overly consistent returns, unregistered investments, high returns with little or no risk, or secretive or complex strategies. This arrangement gives investors the impression there is a legitimate, money-making enterprise behind the subject’s story, but in reality, unwitting investors are the only source of funding.

2. Affinity Fraud: Perpetrators of affinity fraud take advantage of the tendency of people to trust others with whom they share similarities—such as religion or ethnic identity—to gain their trust and money.

3. Pyramid Schemes: In pyramid schemes, as in Ponzi schemes, money collected from new participants is paid to earlier participants. In pyramid schemes, however, participants receive commissions for recruiting new participants into the scheme.

4. Prime Bank Investment Fraud: In these schemes, perpetrators claim to have access to a secret trading program endorsed by large financial institutions such as the Federal Reserve Bank, Treasury Department, World Bank, International Monetary Fund, etc. Perpetrators often claim the unusually high rates of return and low risk are the result of a worldwide “secret” exchange open only to the world’s largest financial institutions. Victims are often drawn into prime bank investment frauds because the criminals use sophisticated terms, legal-looking documents, and claim the investments are insured against loss.

5. Advance Fee Fraud: Advance fee schemes require victims to advance relatively small sums of money in the hope of realizing much larger gains. Not all advance fee schemes are investment frauds. In those that are, however, victims are told that in order to have the opportunity to be an investor (in an initial offering of a promising security, investment or commodity, etc.); the victim must first send funds to cover taxes or processing fees, etc.

6. Promissory Notes: These are generally short-term debt instruments issued by little-known or nonexistent companies. The notes typically promise high returns with little or no risk and are typically not registered as securities with the appropriate regulatory agency.

7. Commodities Fraud: Commodities fraud is the sale or purported sale of a commodity through illegal means. Commodities are raw materials or semi-finished goods that are relatively uniform in nature and are sold on an exchange (e.g., gold, pork bellies, orange juice, and coffee). Most commodities frauds involve illicit marketing or trading in commodities futures or options. Perpetrators often offer investment opportunities in the commodities markets that falsely promise high rates of return with little or no risk. Two common types of commodities investment frauds include:

8. Foreign Currency Exchange (Forex) Fraud: The perpetrators of Forex frauds entice individuals into investing in the spot foreign currency market through false claims and high-pressure sales tactics. Foreign currency firms that engage in this type of fraud invest client funds into the Forex market—not with the intent to conduct a profitable trade for the client, but merely to “churn” the client’s account. Churning creates large commission charges benefiting the trading firm. In other Forex frauds, the perpetrator creates artificial account statements that reflect purported investments when, in reality, no such investments have been made. Instead, the money has been diverted for the perpetrator’s personal use.

9. Precious Metals Fraud: These fraud schemes offer investment opportunities in metals commodities such as rare earth, gold, and silver. The perpetrators of precious metals frauds entice individuals into investing in the commodity through false claims and high-pressure sales tactics. Oftentimes in these frauds, the perpetrators create artificial account statements that reflect purported investments when, in reality, no such investments have been made. Instead, the money has been diverted for the perpetrators’ personal use.

10. Market Manipulation: These schemes, commonly referred to as “pump-and-dumps,” are effected by creating artificial buying pressure for a targeted security, generally a low-trading volume issuer in the over-the-counter securities market that is largely controlled by the fraud perpetrators. This artificially increased trading volume has the effect of artificially increasing the price of the targeted security (i.e., the “pump”), which is rapidly sold off into the inflated market for the security by the fraud perpetrators (i.e., the “dump”). These actions result in illicit gains to the perpetrators and losses to innocent third-party investors. Typically, the increased trading volume is generated by inducing unwitting investors to purchase shares of the targeted security through false or deceptive sales practices and/or public information releases. A modern variation on these schemes involves largely foreign-based computer criminals gaining unauthorized access and intruding into the online brokerage accounts of unsuspecting victims in the United States. These intruded victim accounts are then used to engage in coordinated online purchases of the targeted security to affect manipulation while the fraud perpetrators sell their preexisting holdings in the targeted security into the inflated market.

11. Broker Embezzlement: These schemes involve illicit and unauthorized actions by brokers to steal directly from their clients. Such schemes may be facilitated by the forging of client documents, doctoring of account statements, unauthorized trading/funds transfer activities, or other conduct in breach of the broker’s fiduciary responsibilities to the victim client.

12. Late-Day Trading: These schemes involve the illicit purchase and sale of securities after regular market hours. Such trading is restricted in order to prevent individuals from profiting on market-moving information which is released after the close of regular trading. Unscrupulous traders attempt to illegally exploit such opportunities by buying or selling securities at the market close price, secure in the knowledge that the market-moving information will generate illicit profits at the opening of trading on the following day.

Notice the Signs of Fraud

1. Legitimate investment professionals encourage you to ask questions and to have as much information as possible. They want you to clearly understand the risks involved. They want you to feel comfortable with the investments you are making. Con artists want you to believe them and not ask questions. All they're after is your money.

2. Educate Yourself and Recognize the Signs of Fraud

3. High Pressure Sales Tactics

4. Beware of sales pitches, whether from individuals or in ads, that urge you to get in on the ground floor or to act at once. Avoid being pressured to make a quick purchase at a “low, low price,” to buy now because “tomorrow will be too late,” or overreact to being told “don’t be a fool,” or “when this becomes public knowledge people will be lined up to take advantage of this golden opportunity.” Shady promoters may even offer to have an express delivery service pick up your check! They don't want you to take time to think, read the small print, or talk to others.

5. Promises of Exorbitant Profits

6. No honest investment or business is built on quick, astronomical profits. If it sounds too good to be true, it probably is.

7. Claims of No Risk or Minimal Risk

8. Return on investment is guaranteed. Assurances that “you can’t go wrong” are a sure tip that you are being conned.

9. Not Answering Questions or Allowing You to Ask Questions

10. Con artists don’t want you to ask questions. Instead, they will answer by asking you questions. These are usually ones intended to get a positive response. “You would like to make more money, wouldn’t you?” Reputable investment professionals encourage you to ask questions. Con artists don’t want you to.

11. Evasive Answers and Lack of Communication

12. A promoter’s failure to provide details and a disclosure document or to respond directly to inquiries should diminish your enthusiasm. He or she is probably hiding something.

13. Claims that the Investment Doesn’t Have to be Registered

14. Avoid Any Investment that isn't Clearly Described in Detail, Without Hedging

15. Swindlers often declare that the specifics are “too technical” to describe in layman’s terms or that the information is “classified” or “confidential.” Don’t buy it.  A prospectus must accompany all investments. If it is that complicated, you probably don’t want to be involved.

16. Unprofessional Businesslike Conduct

17. They refuse to return phone calls, answer correspondence, or give out their phone number and physical address. Callers can only get an answering machine. They always want to meet you someplace other than their offices. These are all warning signs of fraud. There are, however, con artists who have fancy offices, cars, and professional receptionists.

18. Promises of “Inside Information”

19. Never buy on the basis of rumors or hot tips. And acting on “insider information” is illegal and could land you in lots of trouble. Always rely on fact rather than emotion. If the urge gets too strong, call your broker and ask for a research paper on the security you have in mind.

20. When hounded on the phone by a promoter, don’t be afraid to hang up without explanation. You do not owe the caller anything. This kind of solicitation is an invasion of your privacy. If you have any doubts make no promises or commitments, no matter how tentative. It is far better to wait and lose an opportunity than to take the plunge and lose everything.

Ten Self-Defense Tips

1. Don’t be a courtesy victim. Con artists will not hesitate to exploit the good manners of the potential victim. Remember that a stranger who calls and asks for your money is to be regarded with utmost caution and skepticism. You have absolutely no obligation to stay on the phone with a stranger who wants your money. It's not impolite to say you are not interested and hang up.

2. Don’t be rushed - check it out. Say no to any salesperson that pressures you to make an immediate decision. If he or she doesn’t have the time to explain the investment to your regular investment professional, or other party, or if they ask “Can’t you make your own investment decisions?” Say NO! You have the right and responsibility to check out the salesperson, firm, and the investment opportunity itself. Almost all investment opportunities must be registered with the SEC. Extensive background information on investment professionals and firms is available from the SEC. Before you even consider investing, get the prospectus, review it carefully, and make sure you understand all the risks involved. But remember, even written material sent from the promoter can be fraudulent or misleading.

3. Always stay in charge of your money. Don't be taken in by anyone who wants your money and assures you that he or she is a professional and can handle everything. Beware of any financial professional who suggests putting your money into something you don’t understand. And never let yourself be talked into leaving everything in his or her hands.

4. Always watch over and protect your nest egg. Never trust anyone who wants you to turn over your money to them and then sit back and wait for results. If you understand little about the world of investments, take the time to educate yourself. Constant vigilance is a necessary part of being an investor.

5. Never judge a person’s integrity by how they look or sound. Far too many investors who are wiped out by con artists later explain that the swindler “looked and sounded so professional." Successful con artists sound extremely professional and have the ability to make even the flimsiest investment deal sound as safe as putting money in the bank. Remember that sincerity in a voice, especially on the phone, has no bearing on the soundness of an investment opportunity. Always do the necessary homework.

6. Watch out for salespeople that prey on your fears. Con artists know that many investors, particularly older investors, worry that they will either outlive their savings or see all of their financial resources vanish overnight as the result of a catastrophic event. It's quite common for swindlers and abusive salespeople to pitch their schemes as a way to build up life savings to the point where such fears are no longer necessary. Remember that fear and greed can cloud your good judgment and leave you in a much worse financial posture. An investment that is right for you will make sense because you understand it and feel comfortable with the degree of risk involved. High return almost always means high risk.

7. Exercise particular caution if you have limited or no experience handling money. Ask a con artist to describe his ideal victim and you're likely to hear "elderly widow or widower." Many people now in their retirement years have limited knowledge about handling money. They often relied on their spouses to handle most or all money decisions. Those who have received windfall insurance in the wake of the death of a spouse are prime targets for con artists. People who are on their own for the first time in years should always seek advice of family members or impartial professionals before deciding what to do with their money.

8. Monitor your investments and ask tough questions. Too many investors trust unscrupulous investment professionals and outright con artists to make financial decisions for them. They then compound their error by failing to keep an eye on the progress of the investment. Insist on regular written reports. Check the written information. Look for excessive or unauthorized trading in your funds. Don’t be swayed by assurances that such practices are routine or in your best interest. Don’t permit a sense of friendship or trust to keep you from demanding this information. If you suspect something is wrong and you don’t get satisfactory answers, call the Securities Division and let us help.

9. Look for trouble retrieving your principal or cashing out profits. If a stockbroker, financial planner, or other individual stalls you when you want to pull out your principal or profits, demand to know why. Since unscrupulous investment promoters have probably pocketed the funds of their victims, they will go to great lengths to explain why your savings are not available. They may even pressure you to “roll over” non-existent profits into new and even more alluring investments. This will only further delay the fraud being uncovered. If you're not investing in a product with a fixed term, such as a bond, you should be able to receive your funds or profits within a reasonable amount of time.

10. Don’t let embarrassment or fear keep you from reporting investment fraud or abuse. Investors who fail to report that they've been victimized often hesitate out of embarrassment. Older investors fear they'll be judged incapable of handling their own affairs and be forced into a nursing home or other facility. Sophisticated investors don't want to admit that a smooth talker took them in. Con artists know all about such sensitivities. They count on these fears preventing or delaying the time when the authorities will be notified about the scam. It's true that most money lost to investment fraud is rarely recovered beyond pennies on the dollar. In many cases, however, when investors recognized early that they'd been misled, they were able to recover some or all of their funds by being a “squeaky wheel”. One of the best resources for investors who fear they have been victimized is the Securities Division of the Department of Financial Institutions.

Social media investing

While social media can provide many benefits for investors, it also presents opportunities for fraudsters. Social media and the Internet generally, offer a number of attributes criminals may find attractive. Social media lets fraudsters contact many different people at a relatively low cost. It is also easy to create a site, account, email, direct message, or webpage that looks and feels legitimate - and that feeling of legitimacy gives criminals a better chance to convince you to send them your money. Finally, it can be difficult to track down the true account holders that use social media. That potential for anonymity can make it harder for fraudsters to be held accountable. As a result, investors need to use caution when using social media when considering an investment.

What You Can Do to Avoid Investment Fraud

1. Ask questions. Fraudsters are counting on you not to investigate before you invest. Fend them off by doing your own digging. It’s not enough to ask for more information or for references - fraudsters have no incentive to set you straight. Take the time to do your own independent research.

2. Research before you invest. Unsolicited emails, message board postings, and company news releases should never be used as the sole basis for your investment decisions. Understand a company’s business and its products or services before investing. Look for the company’s financial statements on the SEC’s website, or contact your state securities regulator.

3. Know the salesperson. Spend some time checking out the person touting the investment before you invest - even if you already know the person socially. Always find out whether the securities salespeople who contact you are licensed to sell securities in your state and whether they or their firms have had run-ins with regulators or other investors. You can check out the disciplinary history of brokers and advisers for free using the SEC’s and FINRA’s online databases. Your state securities regulator may have additional information.

4. Be wary of unsolicited offers. Be especially careful if you receive an unsolicited pitch to invest in a company, or see it praised online, but can’t find current financial information about it from independent sources. It could be a “pump and dump” scheme. Be wary if someone recommends foreign or “off-shore” investments. If something goes wrong, it’s harder to find out what happened and to locate money sent abroad.

Red flags for fraud and common persuasion tactics

How do successful, financially intelligent people fall prey to investment fraud? Researchers have found that investment fraudsters hit their targets with an array of persuasion techniques that are tailored to the victim’s psychological profile

1. If it sounds too good to be true, it is. Watch for “phantom riches.” Compare promised yields with current returns on well-known stock indexes. Any investment opportunity that claims you’ll receive substantially more could be highly risky - and that means you might lose money.

2. “Guaranteed returns” aren’t. Every investment carries some degree of risk, which is reflected in the rate of return you can expect to receive. If your money is perfectly safe, you’ll most likely get a low return. High returns entail high risks, possibly including a total loss on the investment. Most fraudsters spend a lot of time trying to convince investors that extremely high returns are “guaranteed” or “can’t miss.” They try to plant an image in your head of what your life will be like when you are rich. Don’t believe it.

3. Beware the “halo” effect. Investors can be blinded by a “halo” effect when a con artist comes across as likeable or trustworthy. Credibility can be faked. Check out actual qualifications.

4. “Everyone is buying it.” Watch out for pitches that stress how “everyone is investing in this, so you should, too.” Think about whether you are interested in the product. If a sales presentation focuses on how many others have bought the product, this could be a red flag.

5. Pressure to send money RIGHT NOW. Scam artists often tell their victims that this is a once-in-a-lifetime offer and it will be gone tomorrow. But resist the pressure to invest quickly and take the time you need to investigate before sending money. If it is that good an opportunity, it will wait.

6. Reciprocity. Fraudsters often try to lure investors through free investment seminars, figuring if they do a small favor for you, such as supplying a free lunch, you will do a big favor for them and invest in their product. There is never a reason to make a quick decision on an investment. If you attend a free lunch, take the material home and research both the investment and the individual selling it before you invest. Always make sure the product is right for you and that you understand what you are buying and all the associated fees.

Look out for “Affinity Fraud” Never make an investment based solely on the recommendation of a member of an organization or group to which you belong, especially if the pitch is made online. An investment pitch made through an online group of which you are a member, or on a chat room or bulletin board catered to an interest you have, may be an affinity fraud. Affinity fraud refers to investment scams that prey upon members of identifiable groups, such as religious or ethnic communities, the elderly or professional groups. Even if you do know the person making the investment offer, be sure to check out everything - no matter how trustworthy the person seems who brings the investment opportunity to your attention. Be aware that the person telling you about the investment may have been fooled into believing that the investment is legitimate when it is not.

Be Thoughtful About Privacy and Security Settings

Investors who use social media websites as a tool for investing should be mindful of the various features on these websites in order to protect their privacy and help avoid fraud. Understand that unless you guard personal information, it may be available not only for your friends, but for anyone with access to the Internet - including fraudsters.

Ask Questions and Check Out Everything

Be skeptical and research every aspect of an offer before making a decision. Investigate the investment thoroughly and check the truth of every statement you are told about the investment. Never rely on a testimonial or take a promoter’s word at face value. You can check out many investments using the SEC’s EDGAR filing system or your state’s securities regulator. You can check out registered brokers at FINRA’s BrokerCheck website (http://brokercheck.finra.org/ )and registered investment advisers at the SEC’s Investment Adviser Public Disclosure website.

A Few Common Investment Scams Using Social Media and the Internet

While fraudsters are constantly changing the way they approach victims on the Internet, there are a number of common scams of which you should be aware.

Here are a few examples of the types of schemes you should be on the lookout for when using social media:

1. “Pump-and-Dumps” and Market Manipulations

“Pump-and-dump” schemes involve the touting of a company’s stock (typically small, so-called “microcap” companies) through false and misleading statements to the marketplace. These false claims could be made on social media such as Facebook and Twitter, as well as on bulletin boards and chat rooms. Pump-and-dump schemes often occur on the Internet where it is common to see messages posted that urge readers to buy a stock quickly or to sell before the price goes down, or a telemarketer will call using the same sort of pitch. Often the promoters will claim to have “inside” information about an impending development or to use an “infallible” combination of economic and stock market data to pick stocks. In reality, they may be company insiders or paid promoters who stand to gain by selling their shares after the stock price is “pumped” up by the buying frenzy they create. Once these fraudsters “dump” their shares and stop hyping the stock, the price typically falls, and investors lose their money.

2. Fraud Using “Research Opinions,” Online Investment Newsletters, and Spam Blasts

While legitimate online newsletters may contain useful information about investing, others are merely tools for fraud. Some companies pay online newsletters to “tout” or recommend their stocks. Touting isn’t illegal as long as the newsletters disclose who paid them, how much they’re getting paid, and the form of the payment, usually cash or stock. But fraudsters often lie about the payments they receive and their track records in recommending stocks. Fraudulent promoters may claim to offer independent, unbiased recommendations in newsletters when they stand to profit from convincing others to buy or sell certain stocks - often, but not always, penny stocks. The fact that these so-called “newsletters” may be advertised on legitimate websites, including on the online financial pages of news organizations, does not mean that they are not fraudulent.

3. High Yield Investment Programs

The Internet is awash in so-called “high-yield investment programs” or “HYIPs.” These are unregistered investments typically run by unlicensed individuals - and they are often frauds. The hallmark of an HYIP scam is the promise of incredible returns at little or no risk to the investor. A HYIP website might promise annual (or even monthly, weekly, or daily!) returns of 30 or 40 percent - or more. Some of these scams may use the term “prime bank” program. If you are approached online to invest in one of these, you should exercise extreme caution - they are likely frauds.

4. Internet-Based Offerings

Offering frauds come in many different forms. Generally speaking, an offering fraud involves a security of some sort that is offered to the public, where the terms of the offer are materially misrepresented. The offerings, which can be made online, may make misrepresentations about the likelihood of a return.

Where can I go for help?

Investors who learn of investing opportunities from social media should always be on the lookout for fraud. If you have a question or concern about an investment, or you think you have encountered fraud, please contact the SEC, FINRA, or your state securities regulator to report the fraud and to get assistance.

U.S. Securities and Exchange Commission

Office of Investor Education and Advocacy

100 F Street, NE

Washington, DC 20549-0213

Telephone: (800) 732-0330

Fax: (202) 772-9295

Financial Industry Regulatory Authority (FINRA)

FINRA Complaints and Tips

9509 Key West Avenue

Rockville, MD 20850

Telephone: (301) 590-6500

Fax: (866) 397-3290

North American Securities Administrators Association (NASAA)

750 First Street, NE

Suite 1140

Washington, DC 20002

Telephone: (202) 737-0900

Fax: (202) 783-3571

Mailbox

Prevention Advice:

1. Limit Exposure: You can limit your exposure to mail fraud by utilizing online conveniences like eStatements, online bill pay, direct deposit and online banking.

2. Opt-Out: You should opt out of receiving credit card and insurance offers. You can do so by calling 1-888-5OPTOUT or on the web at https://www.optoutprescreen.com. This tells credit card companies from sending pre-approved credit card applications to your house. By filing a simple change of address form with the post office or by contacting your creditors, an identity thief can have your personal mail sent to his or her own address. Banks and other companies now send letters to both the new address and old address when a change is made in order to stop this type of fraud.

3. Lock your mailbox: If your postal carrier is willing, you can buy a padlock for your mailbox. Place it unlocked inside your mailbox. When the carrier delivers your mail, he or she locks the box. This works well with rural-delivery style boxes with a hole to accommodate a lock, or you can drill holes in a wall-mounted box. The method is not foolproof, however. persistent thieves have been known to use hacksaws to remove locks; some smash open mailboxes with baseball bats - or even steal the mailbox, lock and all. 2. Keep your mailbox visible: Trim shrubbery to keep your mailbox as visible as possible, eliminating hiding places for thieves.

4. Replace a wall-mounted mailbox with a mail slot: If you have door-to-door delivery, ask your local Post Office if you can replace your mailbox with a mail slot on your front or garage door. The postmaster needs to approve any changes in delivery. If you add a mail slot, make it large enough to accommodate catalogs and boxes of checks. Mail slots are not allowed, however, in rural delivery areas or newer neighborhoods with cluster boxes.

5. Buy a security mailbox: Check the yellow pages under "mailboxes" for listings of companies that sell tamper-resistant mailboxes. Heavy-duty metal boxes are available in both wall-mounted and free-standing models (the latter may be sunk in concrete to prevent vandalism.) Security mailboxes typically have a slot for the carrier to deliver mail. Mail goes down a chute and into a locked compartment.

6. Ask your apartment manager to improve security: If you're a renter and your mailbox lock doesn't work, insist that the management repair the damage. Counterfeit keys are another problem in rental communities, since often the same key opens all the boxes. Managers can counter these problems by installing security cameras or moving mailboxes into a mail room where residents must use an access key to get inside.

7. Get a post office box: If theft is a concern, the cost of renting a post office box may be worth the investment, since thefts from such boxes are rare, according to postal authorities.

8. Consider a parcel locker: If you own a home-based business and receive frequent shipments of valuable goods, you may wish to invest in a parcel locker. If you use multiple delivery services, however, you'll need one for postal deliveries and a separate locker for others, such as Federal Express or United Parcel Service.

9. Pick up mail promptly: Mail thieves often follow carriers on their routes, striking within 15 minutes after delivery. If you're home during the day, pick up mail as soon after delivery as possible. If you're not home, ask a trusted neighbor to get your mail. Thieves can steal mail from your mailbox in order to get credit card applications and other sensitive data.

10. Outgoing Mail: Outgoing mail is especially lucrative for thieves because it can include bills that you are paying by check or credit card. It's more common for mail to be stolen from apartment or housing complex mailboxes because they combine several households - mail in one place.

Theft of your Mail

If you have had your mail stolen from your mailbox then you have become a victim of mail fraud, a federal crime. It is important to report this crime immediately and to take steps to protect your assets and credit rating.

Here's a checklist of actions you should take:

1. Notify your local postal authority. Ask to fill out Form 2016, available at your local post office, or by mail.

2. Call your local police agency. Report the theft to police or the sheriff's department, particularly if you suspect that checks or other valuables were stolen. Local law-enforcement authorities have caught some thieves by circulating lists of stolen checks to local banks, then nabbing suspects who showed up to clear out a victim's bank account.

3. Close accounts: If you suspect the thief obtained a credit card, checks or bank statement, cancel your accounts immediately and notify creditors both by telephone and in writing.

4. Take action on missing checks: If a check payable to you is stolen, ask the sender to stop payment and issue a new one. Give police the stolen check number.

5. Protect your credit: Make a list of creditors and see if any bills are overdue to arrive. Call creditors and obtain duplicate copies to avoid late payments, which could damage your credit rating-or worse. Be sure to pay your mortgage payment and car payment to avoid the risk of foreclosure or repossession. Don't forget other bills that could be missing, such as an annual insurance premium, property-tax levy or income tax refund.

6. Determine what else is missing: Contact professional organizations to learn if you've missed meeting notices or dues statements. Ask friends and relatives if they've mailed anything to you recently. Were you expecting a new driver's license? If so, contact your state Division of Motor Vehicle (DMV) promptly.

7. Talk to neighbors: Find out if their mail was stolen. Ask if anyone saw a strange person around your home or an apartment mailbox, then pass any information along to postal and law enforcement authorities.

Malware

Consumer Tips

Scam artists try to trick people into clicking on links that will download malware and spyware to their computers, especially computers that don't use adequate security software. To reduce your risk of downloading unwanted malware and spyware:

1. Keep your security software updated. At a minimum, your computer should have anti-virus and anti-spyware software, and a firewall. Set your security software, internet browser, and operating system (like Windows or Mac OS) to update automatically.

2. Don't click on any links or open any attachments in emails unless you know who sent it and what it is. Clicking on links and opening attachments - even in emails that seem to be from friends or family - can install malware on your computer.

3. Download and install software only from websites you know and trust. Downloading free games, file-sharing programs, and customized toolbars may sound appealing, but free software can come with malware.

4. Minimize "drive-by" downloads. Make sure your browser security setting is high enough to detect unauthorized downloads. For Internet Explorer, for example, use the "medium" setting at a minimum.

5. Use a pop-up blocker and don't click on any links within pop-ups. If you do, you may install malware on your computer. Close pop-up windows by clicking on the "X" in the title bar.

6. Resist buying software in response to unexpected pop-up messages or emails, especially ads that claim to have scanned your computer and detected malware. That's a tactic scammers use to spread malware.

7. Talk about safe computing. Tell your kids that some online actions can put the computer at risk: clicking on pop-ups, downloading "free" games or programs, opening chain emails, or posting personal information.

8. Back up your data regularly. Whether its text files or photos that are important to you, back up any data that you'd want to keep in case your computer crashes.

Detect Malware

Monitor your computer for unusual behavior. Your computer may be infected with malware if it:

1. slows down, crashes, or displays repeated error messages

2. won't shut down or restart

3. serves up a barrage of pop-ups

4. displays web pages you didn't intend to visit, or sends emails you didn't write

Other warning signs of malware include:

1. new and unexpected toolbars

2. new and unexpected icons in your shortcuts or on your desktop

3. a sudden or repeated change in your computer's internet home page

4. a laptop battery that drains more quickly than it should

Get Rid of Malware

If you suspect there is malware is on your computer, take these steps:

1. Stop shopping, banking, and doing other online activities that involve user names, passwords, or other sensitive information.

2. Update your security software, and then run it to scan your computer for viruses and spyware. Delete anything it identifies as a problem. You may have to restart your computer for the changes to take effect.

3. If your computer is covered by a warranty that offers free tech support, contact the manufacturer. Before you call, write down the model and serial number of your computer, the name of any software you've installed, and a short description of the problem.

4. Many companies - including some affiliated with retail stores - offer tech support on the phone, online, at their store, and in your home. Decide which is most convenient for you. Telephone and online help generally are the least expensive, but you may have to do some of the work yourself. Taking your computer to a store usually is less expensive than hiring a repair person to come into your home.

5. Once your computers is back up and running, think about how malware could have been downloaded to your machine, and what you could do differently to avoid it in the future.

Online dating

Here’s how the romance scam usually works.

You’re contacted online by someone who appears interested in you. He or she may have a profile you can read or a picture that is emailed to you. For weeks, even months, you may chat back and forth with one another, forming a connection. You may even be sent flowers or other gifts. But ultimately, it’s going to happen; your new-found “friend” is going to ask you for money.

Don’t be a victim, check out these tips and take them to heart:

1. If you’re suspicious, Google the message text he/she sends you. Unlike spam, dating scams require a fair amount of work from the criminals - so they tend to cut corners. Often, the ‘romantic’ message you receive has been sent to dozens of other people. Put quotes around it and Google it: if it brings up results from former victims, you should start to worry. If the messages are in broken English, but your lover claims to be American, it’s another good reason to be cautious. Ask advice from a site administrator, or a friend.

2. Don’t be ashamed to ‘play detective’. Millions of people use dating sites, but they DO carry risks that normal dating does not. You don’t know whether the person you are speaking to is real, where they’re from, or whether the photos are them, or someone different. In the old days, you would often meet people via friends of friends-but you don’t have this reassurance online. So play detective. If they won’t tell you where they work, worry. Likewise, if they keep asking questions about you, but never answers any about themselves, worry. Search for them on LinkedIn, or just via Google - it’s almost impossible NOT to leave traces online these days. If someone has not, they probably are not real.

3. If their photos are really glossy, be afraid. Oddly, one of the giveaways that your lover may not be who they seem is that they look too good-as in, the photographs are professional. Few normal people would make this much effort-but for a cybercriminal, the easiest way to create a fake profile is to use glamorous pictures from the web, shot by professional photographers.

4. Don’t hand over information bit by bit. Dating sites are a huge growth area for cybercrime, and scams vary from simple cons, where people are asked for money for visas, to classic phishing. The problem is that handing over information is a normal part of romance-but perfect for identity thieves. Until you have verified that the person is genuine, do not give out your address, ever, and if possible limit other details such as workplaces and contact details.

5. Don’t share ‘racy’ photos with people you have not met. One variation of today’s dating scams is a simple one - blackmail. Do not hand over pictures you would be embarrassed to see published online-otherwise, you’re at risk from blackmailers. Even racy messages can be a tool for criminals - particularly if you’re attached. Keep things clean until you know your ‘romance’ is real. Allowing someone to see you via webcam, or to, for instance, undress on webcam, is particularly risky.

6. If your ‘lover’ sends you a photo which you need to click on, worry. Keep antivirus software running and be wary of profiles without images in the first place. If they have an image, ask them to add it to their profile.

7. Long-distance love DOES happen - but be wary. Profiles without pictures, details and interests are a clear warning of a fake profile. US law enforcement say that common signs are people who claim to be American but say they are working abroad, then suddenly need plane fare home.

8. Stick to reputable sites. Match.com and other ‘major’ sites such as eHarmony have a reputation to protect so their systems will help to keep you safe (accusations of fake profiles notwithstanding). On Match, for instance, you can instantly flag any email or message as suspicious, and flag any profile you think isn’t quite right. Match will investigate rapidly. Other large, reputable sites have similar systems. Smaller, specialist sites-particularly those focused on short-term relationships-won’t offer the same peace of mind. However, sites which cater to a particular cultural group may achieve higher levels of trust if they fly under the radar of cyber criminals. Expect ‘Free’ sites to be the most dangerous the barrier to entry is low for enterprising cybercriminals.

9. Don’t be persuaded to switch to another social network, email or IM. Millions of people use dating sites, and the ‘big’ sites are facing epidemic levels of fake profiles, phishing and other scams, so cybercriminals will often persuade victims to switch to another site, either a social site, or simply email. This way, they can continue the fraud in private.

10. If you think, “It’s all happening so fast!” It’s time to worry. Dating scams are one of the few areas of cybercrime where gangs play a ‘long game’ - sometimes stringing victims along for weeks or months. But most are impatient to be paid - so any online ‘lover’ who declares undying love in the space of a few emails should be regarded with extreme suspicion.

11. Do not send money, ever. The ‘red flag’ moment comes when your ‘lover’ asks for money. Do not send it-whether it’s for flights, or for life-saving surgery. Even if the story is so tragic you feel you HAVE to help.

If the subject of money comes up early in a relationship, be wary. If someone asks outright for a Western Union payment or bank wire transfer, you may well be dealing with a criminal. Speak to a site administrator if possible. Talk to a friend - or ask advice from an independent agency, or local law enforcement.

Passwords

We now use the Internet for a wide range of activities, including online banking, online shopping and online research. Increasingly, we’re also using the Internet to socialize. In the last few years there's been a massive growth in the number of social networking sites. We share all kinds of personal details as well as music, pictures, and videos. Unfortunately, the more personal details we make available, the more exposed we are to online identify theft.

Given that passwords protect such valuable data, they're clearly very important. You should protect all your online accounts with passwords - but you must be careful when choosing them. Passwords help safeguard you against identity theft. They make it harder for cybercriminals to profile you, access your bank account (or other online accounts) and steal your money.

Choosing a good password is an important part of lowering the risk of becoming a victim of cybercrime. The following guidelines should help you when choosing passwords for your online accounts.

How to choose a strong password and other safety precautions:

1. Don't use variations of any obvious people, numbers, or things related to your life. This includes names, addresses, phone numbers, social security numbers, or variations of any of these. Don't use words or phrases. Don't use the first letters of each word in common phrases. Do use a combination of random numbers and letters. Many financial institutions will provide a random password and/or user name for you; use these. If possible change the password to one only you know, and change it online over a secure connection into the bank or credit union's official web site. Don’t recycle passwords, e.g. don’t use 'password1', 'password2', 'password3', etc. for different accounts.

2. Don't write your password down. Make your passwords memorable, so that you don’t have to write them down or store them in a file on your computer (remember, this file could be stolen by cybercriminals).

and if you do . . . If you right down your password you make it possible for anyone who has access to your house, whether legally or not, to gain access to your account. If you do want to have it in writing, in case you forget it, write it down, and place it in your physical deposit box (yes, sometimes you still need a physical place) or a safe.

3. Don't use the same password or user name again. Many online stores and even some information based web sites require that you register to use their service, and that requires having a user name and password. No matter how easy it seems to have one user name and password for all your Internet accounts, don't do it. If you desire convenience, create one password and user name combination that you use for all your non-bank accounts. If an online store, or any web site, sends you an email confirmation that contains a new password, login again and change your password immediately.

4. Don’t use the same password for multiple accounts. If a cybercriminal finds the password to one account, they can use to access other accounts.

5. Create a different password for your financial institution. Remember, many web sites don't have the security your online financial institution does. Don't allow your password to inadvertently be revealed or misused.

6. Don't save the password on your computer. Many modern browsers allow you to save passwords on the computer's hard drive and have them come up as you type in your username. It may be convenient, but you allow anyone with access to your computer, whether for a couple of minutes or hours, the ability to access your account. It may never happen, but don't make it easy for your account to be accessed.

7. Log-off your account and close your browser when done. Many financial institutions will automatically log you out of your account if you don't use it for a set amount of time, usually five or ten minutes. This step is to make sure only you use your account. If you happen to step away, your account will not be open for hours to anyone who could come along. Even if your financial institution offers this service you should log-off of your account immediately when you are done using it. Additionally, if others people use the computer, you should shut down your entire browser to insure that previously viewed pages will not be accessible.

8. Anti-Virus / Malware Software. Check that your Internet security software blocks attempts by cybercriminals to intercept or steal passwords.

9. Change Passwords Often. It is best to periodically change your passwords as an added precaution to remain as safe as you can. It is recommended to change your passwords every few months.

Create a Strong Password that is Easy to Remember:

A strong password:

1. Is at least eight characters long.

2. Does not contain your user name, real name, or company name.

3. Does not contain a complete word.

4. Is significantly different from previous passwords.

5. Contains characters from each of the following four categories:

- Uppercase letters - A, B, C

- Lowercase letters - a, b, c

- Numbers - 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

- Symbols found on the keyboard - ` ~ ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | : ; " ' < > , . ? /

Help yourself remember your strong password by following these tips:

1. Create an acronym from an easy-to-remember piece of information. For example, pick a phrase that is meaningful to you, such as My son's birthday is 12 December, 2004. Using that phrase as your guide, you might use Msbi12/Dec,4 for your password.

2. Substitute numbers, symbols, and misspellings for letters or words in an easy-to-remember phrase. For example, My son's birthday is 12 December, 2004 could become Mi$un's Brthd8iz 12124 (it's OK to use spaces in your password).

3. Relate your password to a favorite hobby or sport. For example, I love to play badminton could become ILuv2PlayB@dm1nt()n.

Add extra security with 2-Factor-Authentication: Two-factor authentication adds a second level of authentication to an account log-in. When you have to enter only your username and one password, that's considered a single-factor authentication. 2FA requires the user to have two out of three types of credentials before being able to access an account.

Two-factor authentication adds a second level of authentication to an account log-in. When you have to enter only your username and one password, that's considered a single-factor authentication. 2FA requires the user to have two out of three types of credentials before being able to access an account.

The three types are:

1. Something you know, such as a personal identification number (PIN), password or a pattern

2. Something you have, such as an ATM card, phone, or fob

3. Something you are, such as a biometric like a fingerprint or voice print

HOW DOES TWO-FACTOR AUTHENTICATION WORK?

When you have two-factor authentication activated, you need two pieces of information to get into your account:

- Something you know — like a password, PIN or pattern

- Something you have — like a Smartphone, ATM card or FOB

- Something you are, such as a bio-metric like a fingerprint or voice print

Why is two-factor so effective? It’s pretty easy for bad guys to guess weak passwords — especially with all the personal information available today via social media. But hackers will have a heck of a time obtaining that something you have — such as the hardware or software security token or mobile phone you’ve authorized for verification texts. You need to have that mobile phone or token in hand to get the information you need to access your account.

EXPERT TIP - Use one form of two-factor for logging in, and a second, different two-factor combo for recovery.

Listing of web sites that offer two-factor authentication: http://www.FraudSmarts.com/twofactor

Phishing

Here are some qualities that identify an attack through an email:

- They duplicate the image of a real company.

- Copy the name of a company or an actual employee of the company.

- Include sites that are visually similar to a real business.

- Promote gifts, or the loss of an existing account.

Phishing doesn't only pertain to online banking

Most phishing attacks are against banks, but can also use any popular website to steal personal data such as eBay, Facebook, PayPal, etc.

Phishing knows all languages

Phishing knows no boundaries, and can reach you in any language. In general, they’re poorly written or translated, so this may be another indicator that something is wrong. If you never you go to the Spanish website of your bank, why should your statements now be in this language?

Have the slightest doubt, don't risk it

The best way to prevent phishing is to consistently reject any email or news that asks you to provide confidential data. Delete these emails and call your bank to clarify any doubts.

Social media sites can have infected links. For example, you receive an Instagram picture from a friend. It's a great picture so you decide to share it by clicking the Facebook "like" button underneath the image. This can be dangerous even if the picture came from a trusted source, it's a real Facebook button and you are not downloading anything. If you can see the picture, you could have downloaded Malware. If the Facebook "like" link was fake, you also could have inadvertently download Malware. Malicious software (Malware) can be disguised as a Facebook "Like" button, picture or audio clip. When you click a link or open an attachment, malware installs on your device. Unlike early PC malware, it doesn't ask your permission, and your device is figuratively in the hands of a criminal.

Free wireless can be dangerous. While at local coffee shop, airport, or public gathering place DO NOT connect to the "free wireless" network if you are asked to create a temporary LOGIN to get access to the free wi-fi. Don’t Assume a Wi-Fi Hotspot is Secure. Most Wi-Fi hotspots do not encrypt the information you send over the internet and are not secure. When using a Wi-Fi hotspot, only log in or send personal information to websites that you know are fully encrypted. If you use an unsecured network to log in to an unencrypted site - or a site that uses encryption only on the sign-in page - other users on the network can see what you see and what you send.

Free public wi-fi network can be dangerous. Whenever you have access to a free public wi-fi network, you should NOT use that free wi-fi connection instead use your mobile wireless connection. Be smart on open Wi-Fi networks. When you access a Wi-Fi network that is open to the public, your phone can be an easy target of cybercriminals. You should limit your use of public hotspots and instead use protected Wi-Fi from a network operator you trust or mobile wireless connection to reduce your risk of exposure, especially when accessing personal or sensitive information. Always be aware when clicking web links and be particularly cautious if you are asked to enter account or log-in information.

Do not include information do you include on your social networking profile:

- Your date of birth, including the year

- Your phone number

- Your physical address

- The name of your high school

- Your pets name

Users of social media sites were at greater risk of physical and identity theft because of the information they were sharing. If you participate in social networking, you should safeguard your information. Posting your full birthdate and place of birth, phone number, physical address, and any information that could be used to guess your password - such as your mother's maiden name - could provide fraudsters with information to help them gain access to your financial accounts. So be sure to keep this information safe and update the privacy settings for your profile.

Be careful when you click on a Pinterest "pin" to enter a any type of promotion. Pay close attention to the URL these pins lead to before clicking on them. If the URL doesn't seem like anything official to you, don't click it and don't re-pin it. licking the pin can redirect you to a third party website, have you rep-in the pin or fill in a survey providing personal details. These tricks can install malware or gain access to information about you in order to steal your identity.

Be wary of social network invites. If you receive a message from a friend on Facebook inviting you to join a new social network, you should suspect that the message is fraudulent and contact your friend to verify. Don't trust that a message is really from who it says it's from. Hackers can break into accounts and send messages that look like they're from your friends, but aren't.

Do not allow access about your contacts. If you join a new social network and receive an offer to enter your email address and password to find out if your contacts are on the network, you should decline the offer and DO NOT allow the social network site access to your email address book. To avoid giving away email addresses of your friends, do not allow social networking services to scan your email address book. The site might use this information to send email messages to everyone in your contact list or even everyone you've ever sent an email message to with that email address. Social networking sites should explain that they're going to do this, but some do not.

DO NOT accept a social media connection request from a stranger of the opposite sex as long as the person looks honest and knows other people you know. Be selective about who you accept as a friend on a social network. Identity thieves might create fake profiles in order to get information from you. That lack of caution can be extremely costly. Most networking sites contain personal information. When you friend someone, you give them access to that information and that can be used by fraudsters.

Deleting pictures or videos from your social networking sites will NOT permanently remove them from the Internet. You need to contact the support department at the social networking site to make sure they are removed. Assume that everything you put on a social networking site is permanent. Even if you can delete your account, anyone on the Internet can easily print photos or text or save images and videos to a computer.

You can be at risk even if you download Apps on social networking sites that look official and the App install link is within the social networking site. Be careful about installing extras on your site. Many social networking sites allow you to download third-party applications that let you do more with your personal page. Criminals sometimes use these applications to steal your personal information. To download and use third-party applications safely, take the same safety precautions that you take with any other program or file you download from the web. Modify your settings to limit the amount of information apps can access.

Do not respond to social media requests. If you receive an e-mail requesting you to update your Facebook, Twitter, LinkedIn, eBay, or PayPal accounts, do NOT click on the link in the email and DO NOT LOGIN and update your account as requested. Before writing your username and password look at the web address in the browser. The fake ones look similar to this: http://k2nxw.com/cgi-bin/login/ or www.paypal5281.com. If you are not sure, log into your real account just like you usually do, by typing the web address in the browser by yourself and not using the links provided.

Use multiple passwords everywhere. It is NOT okay to use the same passwords for social networking sites as long as you use different passwords for home banking type sites. It is correct to use a different password for home banking type sites. However, social networking sites may not have the security your online financial institution but using the same password on those sites is like trusting the weakest link in a chain to carry the same weight. Every site has vulnerabilities, plan for them to be exploited.

If you do receive offers of pre-approved credit, you should shred the offer before putting them in the trash. First you should purchase a cross-cut shredder and shred all your pre-approved credit card offers. Next you should remove your name and opt-out of receiving these offers by visiting the web site https://www.optoutprescreen.com

Understand how your financial institution communicates with you. If you receive an e-mail with your bank's name and e-mail address, explaining that, for security reasons, you had to click on a particular Internet link and log in to your account to update your settings. You should delete the email without taking any action, call or otherwise contact your bank to ensure credibility and report it to your bank as SPAM. Financial institutions DO NOT ask for personal or account information via email.

Always be skeptical of attachments. If you receive a message to view a file or video on a social networking site and from someone within your network (a trusted source), it is still NOT safe to open the attachment. Criminals are avid fans of social networking sites. They hijack user accounts to send phishing invites to an account holder’s entire contact list, post poisoned links to a variety of malicious sites, and send credible emails with malicious links - abusing the trust that friends normally share. Some creative criminals have tailored messages to appear to come from the social networking site itself, designed so that users will divulge their login credentials or download a Trojan.

Technology-based security measures such as firewalls, encryption, anti-virus, spam filters, and strong authentication will NOT prevent social engineering fraud. No matter how much security technology you implement, you can never get rid of the weakest link - the human factor. A social engineer is someone who uses deception, persuasion and influence to get information that would otherwise be unavailable.

If you receive an email from a friend or trusted source, it is NOT always safe to click on a link or attachment within that email. The email account of your friend or trusted source could have been compromised and is being sent to you by a criminal with the intent of getting information or to have you click a link or open an attachment.

Feedback when incorrect: The email account of your friend or trusted source could have been compromised and is being sent to you by a criminal with the intent of getting information or to have you click a link or open an attachment.

It is NOT always safe to click a link as long as the link is through a popular search site like Yahoo, Google or Bing. Search engine poisoning makes up 40% of malware delivery on the Web. The practice is when malware and spam attackers inundate search results with links to bait pages that will take users to malicious websites that will download malware to a computer. People want to be able to trust that what they search for in Google, Bing or Yahoo is safe to click on.

Access web sites through your web browser. Typing the address of a web site directly into your Web browser will ensure that you are going to the legitimate Web site and not a phishing site that was designed to mimic the look of the real thing. Unless the site was hijacked or your computer has a virus, typing the web address yourself is the best way to guarantee the authenticity of a web site.

Tech support scams are very popular. If you receive an e-mail from a Microsoft support person saying that your computer is infected by a virus and suggests that you install a tool available on their Internet site to eliminate the virus from your computer. You should NOT click on the link even though the email looks official and has the legitimate support@microsoft.com email address. Email spoofing is e-mail activity in which the sender's address and other parts of the e-mail header are altered to appear as though the e-mail originated from a different source.

Be skeptical when there are big news events happening. If you hear on the news that your insurance company has recently been breached and soon after you receive an email from your insurance company that explains the breach and provides the necessary steps for you to take. These steps include clicking on a link to update your personal information and change your user name and password. You should NOT follow all instructions to keep your information protected. Now that the criminals have information about you, they may try to trick you into giving up more information through fraudulent emails. Be suspicious of urgent emails requesting information and never open attachments you aren’t expecting even if it’s from someone you know.

If you are unsure about a link in your email, do NOT copy and paste the link in your web browser. You could still end up at the malicious site and potentially load malware on your computer or network. If you are unsure whether a link you received in an email is safe, it is not safe to copy and paste the link in the URL section of your web browser.

If you are unsure about a link in your email, it is NOT safe to forward the link to have it tested by someone else. By forwarding an email, all you've done is forward a potentially dangerous and malicious email that could infect someone else's computer or network.

Criminals could strike very quickly. For example, within hours of hurricane, you receive an email from the Red Cross asking for a donation to help the victims. This email is most likely a high-profile phishing scam that receives media attention and is on the forefront of people’s minds. These scams are effective because they rely on your emotions and compassion.

Be aware of web site extensions. For example, out of these six web addresses, the "whitehouse.com" is phony because any official U.S. government web site will end in .gov and not .com.

- https://www.usa.gov

- https://cio.gov

- http://www.ssa.gov

- https://www.ssa.gov

- http://www.fdic.gov

- https://www.whitehouse.com

Clues that an email is fake can include: poor spelling, grammatical errors, offer of a reward, typos, information request, threatening tone.

Ransomware

For computer users, a form of malicious code dubbed ransomware can be among the most frightening forms of computer invasion - suddenly, your screen is replaced by a message that appears to be from the police, demanding money, or a message saying your files are lost unless you pay a ransom to unlock them. One particular form of ransomware, referred to as filecoders, are designed to extort money by encrypting a user’s files and demanding payment to access them. One of the most prevalent examples of this type of malware is called CryptoLocker.

Below are some tips that can help - even if you’ve already fallen victim.

1. Don’t pay the money. No police force on Earth will lock your computer and demand money - the message is NOT from the FBI. Do not pay the money. Contact a computer professional instead, if you can’t unlock it yourself. In some cases - especially filecoders - there may be nothing you can do, but an IT professional should be your first stop.

2. Don’t pirate software, music or movies. Pirate sites offering free music, games or films are often infested with malware - but this year, cybercriminals have been “gaming” Google searches to infect wannabe pirates with ransomware. Ordinary Internet searches lead people to such sites - with cybercriminals using “black hat” SEO to push infected sites high up in Google results.

3. Don’t think that if you get past the lock screen, it’s “gone”. It is sometimes possible to get “past” the lock screen displayed by some forms of ransomware - but that doesn’t mean you’re safe. Your computer is probably still infected. Either invest in AV software or contact an IT professional for help.

4. If you are backed up, you’re “immune” to filecoders. Filecoders rely on one thing - that you keep unique, precious files on your PC. Don’t. You don’t keep family heirlooms in your car - you keep them in a safe. Do the same with your data. If they have backups, than the malware is merely a nuisance. So, the importance of doing regular backups should be strongly reiterated.

There are, however, at least two “fortunate points” about this malware: It’s visible, not hidden, the user knows he’s infected - unlike many other malware types that could be stealing money/data silently (of course, that doesn’t mean that he’s not infected with something else together with the filecoder!)

5. Try and rescue your files. Unless you have in-depth knowledge, you should contact an IT professional to help with filecoders - and don’t get your hopes up, as many use strong encryption which is basically impossible to break. In some cases, when the filecoder uses a weak cipher, or a faulty implementation, or stores the encryption password somewhere to be recovered, it may be possible to decrypt the files. Unfortunately, in most cases, the attackers have learned to avoid these mistakes and recovering the encrypted files without the encryption key is nearly impossible.

6. Learn what “backup” means - and choose the right solution for you. For home users, a simple way to start “backing up” - without delving into complex solutions - is to use cloud services such as Google Drive, Amazon, Dropbox and Flickr to store documents, music, videos and photos. These services offer free versions, and can at least save some of the most personal files on your computer from being devoured by malware.

How Ransomware Works

There are many state of ransomware, these include CryptoWall, TorrentLocker and CTB-Locker, to name a few. CTB-Locker is a ransomware variant that encrypts files on a victim’s hard disk before demanding a ransom be paid to decrypt the files.

The CTB-Locker malicious spam campaign attack vector is an email with a ZIP or a CAB attachment claiming to be a FAX or invoice. These ZIP or CAB containers hold a downloader that are likely new variants of several different families of ransomware. These downloaders are generally a portable executable file type (.EXE, .SCR, .BAT, .PIF, .CMD) and are responsible from downloading the secondary threat, which is an encrypted file that performs the actual encryption routine.

Senior citizens

Seniors are at a greater risk for identity theft than most people. Learn how to guard against identity theft and spot suspicious signs of fraud. Catch identity theft early, before it damages your finances.

The Issue

1. Identity theft is a rapidly growing crime in the United States. About 10 million people are victims of this damaging crime each year. Seniors are especially vulnerable to these crimes because:

2. Seniors often have higher cash reserves and home equity than others

3. Seniors are usually less technologically savvy and do not research scams online

4. Seniors do not monitor their credit and financial accounts very closely

5. Retirement home staff and other assistants may have access to and take advantage of a senior's personal records

6. According to a recent survey by Experian, 11% of people over the age 65 reported that they have had their financial information stolen.

The Crimes

The types of identity theft crimes seniors experience are similar to those impacting the rest of the population. Along with basic credit card fraud, seniors are at risk for large identity theft compromises involving loans, Social Security numbers, and insurance. Here are some of the ways that thieves can obtain personal data:

1. Dumpster diving - Digging for personal information in the trash of homes and businesses.

2. Phone scams - Senior citizens are particularly vulnerable to fraud by phone. Thieves may pose as insurance companies, charities, or other businesses in order to gather personal data over the phone.

3. Personal theft - Theft of personal information by an employee, nurse, relative, or friend.

4. Wallet theft - The theft of a purse or wallet. Seniors are more likely to carry their Social Security card or Medicare card with them, making them a prime target.

5. Record theft - Medical records, Social Security records, and other forms of personal documents are a potential goldmine for thieves.

6. Online fraud - Fake emails and websites are set up as data traps for unsuspecting consumers.

Identity thieves may drain bank accounts, open new accounts, rack up credit card charges, obtain loans, apply for jobs, refinance their victim's home, obtain medical care, or even commit crimes using stolen personal data. The more serious the crime, the more difficult it is for the victim to recover from identity theft.

The Steps

It is impossible to completely prevent identity theft, but there are some important precautions that can be taken to guard against this crime. Here are some identity theft prevention tips for seniors:

1. Do not give out personal information over the phone unless you initiated the call.

2. Do not carry your Social Security card or Medicare card in your wallet.

3. Research the authenticity of charities and other organizations before you donate money.

4. Sign up for the Do Not Call Registry.

5. Keep sensitive documents at home in a locked file cabinet.

6. Use a cross-cutting shredder to destroy sensitive mail and other documents before throwing them away.

7. Opt-out of receiving pre-screened offers based on your credit data.

8. Regularly review your financial and credit records for signs of fraud.

If you do become a victim of identity theft despite these precautions, it is crucial that you report the crime immediately.

Health Insurance Fraud

1. Never sign blank insurance claim forms.

2. Never give blanket permission to a medical provider to bill for services rendered.

3. Ask your medical providers what they will charge and what you will be expected to pay out-of-pocket.

4. Carefully review your insurer’s explanation of the benefits statement. Call your insurer and provider if you have questions.

5. Do not do business with door-to-door or telephone salespeople who tell you that services of medical equipment are free.

6. Give your insurance/Medicare identification only to those who have provided you with medical services.

7. Keep accurate records of all health care appointments.

8. Know if your physician ordered equipment for you

Medicare Scams

1. Protect your Medicare number as you do your credit card numbers and do not allow anyone else to use it.

2. Be wary of salespeople trying to sell you something they claim will be paid for by Medicare.

3. Review your Medicare statements to be sure you have in fact received the services billed.

4. Report suspicious activities to 1-800-MEDICARE.

Telemarketing Scams

1. Don’t buy from an unfamiliar company.

2. Always ask for and wait until you receive written material about any offer or charity.

3. Obtain a salesperson’s name, business identity, telephone number, street address, mailing address, and business license number before you transact business.

4. Always take your time in making a decision.

5. If you have information about a fraud, report it to state, local, or federal law enforcement agencies

Home Repair or Contractor Fraud

1. Be an informed consumer. Take the time to call and shop around before making a purchase. Take a friend with you who may offer some perspective to help you make difficult decisions.

2. Carefully read all contracts and purchasing agreements before signing and make certain that all of your requirements have been put in writing.

3. Make sure you understand all contract cancellation and refund terms.

4. As a general rule take control of all of your transactions as a consumer.

5. Do not allow yourself to be pressured into making purchases, signing contracts, or committing funds. These decisions are yours and yours alone.

Grandparent Schemes

1. A grandparent receives a phone call (or sometimes an e-mail) from a “grandchild.” If it is a phone call, it’s often late at night or early in the morning when most people aren’t thinking that clearly. Usually, the person claims to be traveling in a foreign country and has gotten into a bad situation, like being arrested for drugs, getting in a car accident, or being mugged…and needs money wired ASAP. And the caller doesn’t want his or her parents told.

This is an example of what’s come to be known as “the grandparent scam”—yet another fraud that preys on the elderly, this time by taking advantage of their love and concern for their grandchildren.

Other scenarios include:

2.       Sometimes, instead of the “grandchild” making the phone call, the criminal pretends to be an arresting police officer, a lawyer, a doctor at a hospital, or some other person. And we’ve also received complaints about the phony grandchild talking first and then handing the phone over to an accomplice…to further spin the fake tale.

3.       Military families can be victimized: after perusing a soldier’s social networking site, a con artist will contact the soldier’s grandparents, sometimes claiming that a problem came up during military leave that requires money to address.

4.       While it’s commonly called the grandparent scam, criminals may also claim to be a family friend, a niece or nephew, or another family member.

How to avoid being scammed

1. Resist the pressure to act quickly.

2. Try to contact your grandchild or another family member to determine whether or not the call is legitimate.

3. Never wire money based on a request made over the phone or in an e-mail...especially overseas. Wiring money is like giving cash—once you send it, you can’t get it back.

What to do if you have been scammed.

The financial losses in these cases—while they can be substantial for an individual, usually several thousand dollars per victim—typically don’t meet the FBI’s financial thresholds for opening an investigation.

The FBI recommends contacting your local authorities or state consumer protection agency if you think you’ve been victimized. They also suggest you file a complaint with IC3, which not only forwards complaints to the appropriate agencies, but also collates and analyzes the data—looking for common threads that link complaints and help identify the culprits.

Shopping Online

1. Search the Internet safely

Even though search engines are very useful when you’re looking for products, reviews, or price comparisons, you run the risk of unintentionally clicking on ‘poisoned’ search results that could lead you to malware instead of your intended destination. These poisoned search results are created by cybercriminals that use search engine optimization (SEO) tricks – sometimes referred to as Black SEO – to manipulate search engine results to include malicious links.

2.       Type the URL into the address bar

Instead of just clicking a link to take you to your chosen retailer’s website, it’s safer to type the retailer’s URL into the address bar on your web browser. It may take a little more effort, but this simple action can help to prevent you visiting a fake or malicious website.

3.       Credit Cards

Use the safest way to pay on the Internet. Pay for your order using a credit card. The safest way to purchase items via the Internet is by credit card because you can often dispute the charges if something is wrong.

Get a temporary credit card - some credit card companies will issue a temporary credit card number for their customers. These temporary numbers can be useful for one-time purchases. However, you should avoid using them for any purchases that require auto-renewal or regular payments.

Don't give out your credit card number(s) online unless the site is a secure and reputable site. Sometimes a tiny icon of a padlock appears to symbolize a higher level of security to transmit data. This icon is not a guarantee of a secure site, but might provide you some assurance.

Check on your credit card statements. Check your bank statements on a monthly basis. Don't let them sit and pile up, anyone who uses a credit card could potentially be hacked and could become a victim through no fault of their own.

4.       Dedicate a computer to online banking and shopping

For added security, you could use a dedicated machine for online banking and shopping. This should be a ‘clean’ computer that is totally free of computer viruses and any other infections. In order to help keep it clean, the machine should not be used for any casual web browsing, social networking, or email. Install Google Chrome, with forced HTTPS.

5.       Use a dedicated email address

It’s worth considering creating an email address that you only use for online shopping. This can help you to reduce the risk of opening potentially malicious email or spam messages that are disguised as sales promotions or other notifications. If such messages are sent to your primary email address, you’ll be aware that there’s a fair chance that they’re fake or malicious.

6.       Manage and protect your online passwords

Using a password manager can help you to deal with multiple accounts and passwords – and to encrypt passwords that would otherwise be in plain text. Some antivirus and Internet security software products include password management and password security features.

7.       Beware of using public Wi-Fi

When you’re in a shopping mall – about to make a purchase – it can be useful to make a last minute comparison with the best deals that Internet retailers are offering. However, there can be security risks if you access the Internet via a public Wi-Fi network . Cybercriminals can intercept your data and capture your passwords, login details, and financial information. If you need to access the Internet when you’re out shopping, it’s safer to do so via your cellular network.

8.       Consider using your tablet

If you have a Linux-based device – such as a Samsung tablet or another device that runs the Linux operating system – it may be safer to use that for online transactions. Apple iPads may also be less likely to be exploited while you’re shopping online – provided that your device has not been jailbroken. However, always remember to avoid using a public Wi-Fi network – or there’s a risk your passwords and other data could be stolen.

9.       Before using the site, check out the security/encryption software it uses.

10.    Make sure you are purchasing merchandise from a reputable source.

11.    Send them e-mail to see if they have an active e-mail address and be wary of sellers who use free e-mail services where a credit card wasn't required to open the account.

Consider not purchasing from sellers who won't provide you with this type of information.

12.    Check with the Better Business Bureau from the seller's area.

13.    Check out other web sites regarding this person/company.

14.    Don't judge a person/company by their web site.

15.    Be cautious when responding to special offers (especially through unsolicited e-mail).

16.    Be cautious when dealing with individuals/companies from outside your own country.

17.    Make sure the transaction is secure when you electronically send your credit card numbers.

18.    Trust your instincts. If you don't feel comfortable buying or bidding on an item over the web, or if you feel pressured to place your order immediately, maybe you shouldn't.

19.    Be knowledgeable about web-based auctions. Take special care to familiarize yourself not only with the rules and policies of the auction site itself but with the legal terms (warranties, refund policy, etc.) of the seller's items that you wish to bid on.

20.    Double check pricing. Be suspicious of prices that are too good to be true. Also consider carefully whether you may be paying too much for an item, particularly if you're bidding through an auction site. You may want to comparison shop, online or offline, before you buy. Make sure there are not extra shipping or handling costs.

21.    Find and read the privacy policy. Read the privacy policy carefully to find out what information the seller is gathering from you, how the information will be used, and how you can stop the process. If a site does not have a privacy policy posted, you may not want to do business with it. If it does have a privacy policy, there will probably be a link to it from the seller's home page, or it could be included with the Legal Terms.

22.    Review the return, refund, and shipping and handling policies as well as the other legal terms. If you can't find them, ask the seller through an e-mail or telephone call to indicate where they are on the site or to provide them to you in writing.

23.    Make sure the Internet connection is secure. Don't trust a site just because it claims to be secure. Before you give your payment information, check for indicators that security software is in place.

24.    Print the terms. You should print out and date a copy of terms, conditions, warranties, item description, company information, even confirming e-mails, and save them with your records of your purchase.

25.    Insure the safe delivery of your item. If you're concerned you may not be home when your package is delivered and that someone may take it if it is left on the doorstep, ask whether you can specify that the shipper must receive a signature before leaving the package. Or, it may be safer to have the package delivered to your office.

26.    Inspect your purchase. Look at your purchase carefully as soon as you receive it. Contact the seller as soon as possible if you discover a problem with it. Tell the seller in writing about any problems you have, ask for a repair or refund, and keep a copy of your correspondence.

Security for your online purchases:

Before purchasing online, you should assess the security of both your computer and the seller's systems. You can limit the risk of identity theft by shopping only on websites that disclose an effective data security policy. A data security policy explains how an online seller aims to protect your personal information. When guarding yourself against Internet crimes, also consider your payment options, account security, and malware protection.

How can I tell how an online seller secures my personal information?

Many online sellers describe their methods of protecting your personal information in the security, privacy, or FAQ section of their website. Typically, the description of a data security policy discusses technological security, physical security, and other relevant issues.

What happens if my personal information is stolen from an online seller that I have done business with?

Most online sellers will notify customers, affected businesses, and law enforcement agencies when a data breach occurs. The notification letter to customers usually describes how personal information was compromised and the seller's response to the data breach. While federal law generally does not mandate data breach notification to consumers, most states do require such notification.

What should I do if I am notified of a data breach?

Once you receive notification of a data breach, you should immediately place a fraud alert on your credit files. Instructions for placing a fraud alert can be found here. You should also monitor your accounts for evidence of unauthorized transactions. Some sellers offer free credit-monitoring services after a data breach to mitigate its effects. Check with the seller to find out if it offers these protections.

What if there are unauthorized charges on my credit card?

If you find charges on your credit card statement that you do not recognize, you should contact the issuer of the credit card. Federal law allows you to dispute and obtain records of the fraudulent actions resulting from the theft. The Fair Credit Reporting Act requires the seller (and other targeted businesses) to provide you and/or law enforcement agencies with transaction records related to the identity theft within 30 days of your written request.

How does the payment method I use affect the security of online shopping?

When selecting a payment method, you should give some thought to security. Most online sellers accept a variety of payment methods to make purchases, such as credit cards, debit cards, checks, prepaid cards, and gift cards. Some sellers accept payment through third-party payment processors such as PayPal, Google Wallet, and Amazon Payments.

Third-party payment processors pay the seller directly so you can avoid submitting payment information to the seller, which reduces the risk of dealing with a seller you are not familiar with.

Some credit card companies allow you to reduce the risk of fraud by offering single-use or virtual credit card numbers. Most major card issuers offer zero-liability policies, so that if your card is used fraudulently you will not have to pay anything. This goes beyond the requirements of federal law, which limits your liability to $50.

If you are uncomfortable submitting your payment information online, some sellers allow you to pay by phone or fax, or through the mail (a small additional fee may be assessed). Keep in mind that any payment information you submit offline likely is stored on the seller's servers.

Why does password security matter?

Your accounts with online sellers generally require a password for access. Anyone who obtains your password can access the account and make purchases without your knowledge, or acquire your personal information. So guard your accounts with strong passwords, and never disclose a password except when accessing the account yourself.

Records: How should you keep records about your purchase?

What documents should you keep when purchasing online?

- A printout of the web pages indicating the seller's name, postal address, and telephone number;

- A printout of the web pages describing the item(s) that you ordered;

- A printout of the web pages or pop-up screens that provide the seller's legal terms;

- Printouts of any e-mail messages (for example, confirmation messages) that you send to or receive from the seller. This includes:

Those that might show that the seller indicated that the product would be suitable for the specific purpose for which you needed it,

Those in which you notify the seller of problems with the merchandise that you have received; and

Those that would show your good faith attempt to resolve with the merchant a charge that you do not feel should have been made to your credit card.

- Notes or e-mail confirmations of any telephone conversations that you have with the seller.

Smart phones

1. Auto-lock your phone. They’re small, we carry them everywhere, and unfortunately mobile phones are lost or stolen all too often. If your phone falls into the wrong hands, a password is the first line of defense for your personal data. To keep your information private, create a strong password for your phone and set your screen to auto-lock within five minutes. Arrange phone settings so a password is required to wake up your phone after an inactive period. Use a password that’s different from your others (ATM, email accounts, online bill-paying accounts). Encrypt smart phones used for sensitive business communications, activate a timeout password and install an updated anti-malware program and on-device personal firewall.

2. Keep your apps and device software up to date. Hackers work diligently to discover new vulnerabilities in our apps or the software that operates our phones. Device manufacturers and app developers frequently update their software to fix newly exploited security gaps, but if you don’t download and install these updates your information is still at risk.

3. Use discretion when downloading apps. One of the most exciting things about getting a new Smartphone is downloading all the great apps that are available. Unfortunately, even the most innocent-looking app can contain software designed to steal personal data, make fraudulent charges or even hijack your phone. Only download apps from sites you trust, check the app’s rating and read reviews to make sure they’re widely used and respected before you download.

4. Don’t open unfamiliar attachments, emails or text messages from unknown sources. They’re likely to be harmful. Be judicious about the type of applications that you download. Many apps come with spyware or other malicious software. Consider using a more secure computer for sensitive tasks such as online banking.

5. Stick to window-shopping on public WiFi. Public WiFi networks have become ubiquitous, but security for these networks is scarce. Be careful what you do on public WiFi networks as there may be others watching network traffic. In particular stay away from making purchases and banking transactions—any communication that conveys a password, account number or credit card number—unless you are certain that you are on a secure connection.

6. Protect your phone like you protect your PC. Most people already use software to shield their PC from viruses and spyware. With so much personal data on our phones and mobile malware on the rise, our mobile devices now need the same attention. Protect yourself and your private data from malware, spyware and malicious apps by downloading a reputable security app.

7. Password-protect your mobile device and voicemail with a PIN. Make the password strong and hard to guess by using numbers, upper- and lower-case letters, and at least one symbol. Memorize your PIN. Don’t record it on anything you carry with you. Change your PIN periodically. Use “strong” PINs that are hard to guess. These will have numbers, upper- and lowercase letters, and at least one symbol. Never use a PIN (or password) with the last four digits of your Social Security number, your date of birth, your middle name or anything else that’s easily guessed or subject to ready access via other sources

8. Keep records. Make a physical list of everything on your Smartphone—all the accounts and documents (or types of documents) it can access.

9. Don't Save Information. Delete voice and text messages with financial or personal information.

10. Data-wipe mobile devices. Use programs to destroy a device’s data if the password is entered incorrectly a certain number of times—say

11. Software. Take advantage of software that locks the phone or erases the data remotely if the phone is lost or stolen.

Text Message Safety

Here are a few steps to prevent text message spam:

1. Delete text messages that ask you to confirm or provide personal information: Legitimate companies don’t ask for information like your account numbers or passwords by email or text.

2. Don’t reply, and don’t click on links provided in the message: Links can install malware on your computer and take you to spoof sites that look real but whose purpose is to steal your information.

3. Treat your personal information like cash: Your Social Security number, credit card numbers, and bank and utility account numbers can be used to steal your money or open new accounts in your name. Don’t give them out in response to a text.

4. If you are an AT&T, T-Mobile, Verizon, Sprint or Bell subscriber, you can report spam texts to your carrier by copying the original message and forwarding it to the number 7726 (SPAM), free of charge.

5. Review your cell phone bill for unauthorized charges, and report them to your carrier.

6. To block spam messages - but not all incoming texts from friends and family -- call your carrier’s customer service number (usually 611) and instruct them to “Block all text messages sent to you as email” and “Block all multimedia messages sent to you as email.” You also might be able to log into your account online and activate these blocks there.

7. If dialing 611 or going into your phone settings online does not slow down spam, check with your mobile provider about other options to block future spam messages.

8. Set up and use a free email account that’s only for things like promotions, contests, and the like. This way, you can easily segregate those messages from your personal and work correspondence.

More prevention tips:

1. Attacks using verification codes to bypass 2 Factor Authentication.  Be suspicious of SMS messages asking about verification codes, particularly if they you request one. Legitimate messages from password recovery services will simply tell you the verification code and will not ask you to respond in any way.

2. Don’t fall for texts from your network which ask for details.  Your phone network will often text you – if you’re abroad, for instance, to warn of data roaming rates. But networks won’t ever ask you to confirm or verify your details. If you see a “security” text which asks for a password, or any other details, don’t click the link, and don’t call any numbers in it. Contact your network via their website, or via their phone number (the real one, not the one in the SMS).

3. If you see a “business” phone number in a text, it’s no guarantee it’s real.  Many SMS phishing attacks will include “toll free” numbers that look like legitimate business ones – they’re not.

4. Don’t reply with “STOP” if you’re being spammed  contact your network instead.  If you’re being spammed repeatedly, and the SMS contains an instruction to text back with “STOP” to cut off the emails, don’t. This will simply tell the spammers that you’re there, and they’ll intensify their attacks. Your network will be able to block SMS from specific numbers.

5. Be very suspicious of  “special offers”  especially ones where you have to “act fast”.  Phishers commonly send out SMS attacks in the form of “special offers” from big companies – such as a $1,000 gift card, where only a limited number are available, and you have to click a link to cash in.

6. High-value “special offers” that sound too good to be true usually are. If it’s your local pizza place offering two-for-one on Tuesdays, you might be safer. Think first, and think hard if you’re being asked to click a link.

7. Set your phone to block apps from unknown sources.  Many SMS phishing attacks aim to fool you into installing malicious apps – particularly on Android. As a precaution, block installation from unknown sources (it’s in Android’s Settings menu). If you have to unblock this (for instance to install a work app), set it back to “blocked” when you’ve finished. If you do make a mistake, this gives you another line of defense. It’s also worth using Google’s built-in “Verify Apps” function, which monitors apps for suspicious activity.

8. Don’t fall for texts from your bank which ask for “confirmation details”.  Your bank may well text you – for instance to confirm a transaction on PC – but bank texts will not, ever, ask you to confirm details, or for passwords. Banks also won’t update their apps in this way. If you’re suspicious, don’t click links, don’t call any numbers in the text. Instead, call your bank on its “normal” number – Google it if you don’t know – and check whether the text is from them.

9. Don’t fall for warnings saying, “Your phone is infected”.  Recent SMS phishing scams use a bogus “security alert” to scare users into installing fake antivirus apps. Reputable security companies will not “push” products in this way. ESET’s Cameron Camp says, “Malware posing as security apps, also known as “scareware”, are some of the most pervasive scams on Android in recent months.”

10. Don't trust caller ID.  Just because your caller ID displays a phone number or name of a legitimate company you might recognize, it doesn't guarantee the call is really coming from that number or company.

11. Register your number with the National Do Not Call registry at donotcall.gov. Even though criminals and unscrupulous telemarketers may ignore the list, if you are on the list and get a call from a supposed telemarketer, that could be a tip that the offer is bogus. Most legitimate telemarketers obey the rules and laws about contacting consumers. Also, the Website provides a place where complaints can be filed.

12. Report incidents. Report fraud to www.ftc.gov  or call (888) 382-1222. The FTC wants the number and name that appeared on the caller ID as well as the time of day and the information talked about or heard in a recorded message. If you think you've been a victim of a vishing attack you can also contact, the Internet Crime Complaint Center.   File a complaint with the FCC if you receive an unwanted commercial email message sent to your mobile phone, an autodialed/prerecorded telephone voice message or an unwanted text message to your mobile phone. There is no charge for filing a complaint. Call 1-888-CALL-FCC (1-888-225-5322).  For those outside the US, the following numbers can help out. In Canada report vishing or phishing attempts online at the Reporting Economic Crime Online government organization, or call 1-888-495-8501. In the UK, you should make your report directly to the bank indicated in the scam.

Instant messaging

Instant messaging (IM) has some of the same security and privacy risks as e-mail, but there are a few unique dangers that you should be aware of.

1. Choose a non identifiable, non gender specific screen name.

2. Never give out any personal information using IM. That means your real name, telephone or cell phone number[s], mailing address, passwords, banking details etc.

3. Never accept files or downloads from people you don't know or from people you do know, if you weren't expecting them. This includes URLs.

4. Never arrange to meet someone offline that you only know through IM conversations.

5. Never open pictures, download files, or click links in messages from people you don't know. If they come from someone you do know, confirm with the sender that the message (and its attachments) is trustworthy. If it's not, close the instant message.

6. Be careful when creating a screen name. Each IM program asks you to create a screen name, which is similar to an e-mail address. Your screen name should not provide or allude to personal information.

7. Create a barrier against unwanted instant messaging. Do not list your screen name or e-mail address in public areas (such as large Internet directories or online community profiles) or give them to strangers.

8. Some IM services link your screen name to your e-mail address when you register. The easy availability of your e-mail address can result in your receiving an increased number of spam and phishing attacks.

9. Never provide sensitive personal information, such as your credit card numbers or passwords, in an IM conversation.

10. Only communicate with people who are on your contact or buddy lists.

11. If you decide to meet a stranger that you know only from IM communication, take appropriate safety precautions. For example, do not meet that person alone, (take a friend or parent with you), and always meet and stay in a public place, such as a cafe.

12. Don't send personal or private instant messages at work. Your employer might have a right to view those messages.

13. If you use a public computer, do not select the feature that allows you to log on automatically. People who use that computer after you may be able to see and use your screen name to log on.

14. Monitor and limit your children's use of IM. One way to do this is to sign up for Windows Live Family Safety. If you use Windows Vista, it comes with parental controls built-in.

15. When you're not available to receive messages, be careful how you display this information to other users. For example, you might not want everyone on your contact list to know that you're "Out to Lunch."

Using mobile devices in public

With people increasingly using tablets in public places, users are at risk of sharing more than they might want to with the people around them. If others can clearly see what you're doing with your device, it can put your privacy at risk.

Protect Your Smart Device

1. Consider your surroundings and use your device discreetly at locations in which you feel unsafe.

2. Never leave your device unattended in a public place. Don't leave it visible in an unattended car; lock it up in the glove compartment or trunk.

3. Write down the device's make, model number, serial number and unique device identification number - either the International Mobile Equipment Identifier (IMEI), the Mobile Equipment Identifier (MEID) number or the Electronic Serial Number (ESN) - which you may find in your device settings or printed on a label affixed to your device underneath the battery. The police may need this information if the device is stolen or lost.

4. Review your warranty or service agreement to find out what will happen if your phone is stolen or lost. If the policy is not satisfactory, you may wish to consider buying device insurance.

How to Protect the Data on Your Phone

1. Establish a password to restrict access. Should your device be stolen or lost, this will help protect you from both unwanted usage charges and from theft and misuse of your personal data.

2. Install and maintain anti-theft software.

- Apps are available that will:

- Locate the device from any computer;

- Lock the device to restrict access;

- Wipe sensitive data from the device, including contacts, text messages, photos, emails, browser histories and user accounts such as Facebook and Twitter;

- Make the device emit a loud sound (“scream”) to help the police locate it.

3.       Make your lock screen display contact information, such as an e-mail address or alternative phone number, so that the phone may be returned to you if found. Avoid including sensitive information, such as your home address.

Be careful about what information you store. Social networking and other apps may allow unwanted access to your personal information.

What to Do if Your Wireless Device Is Stolen

1. If you are not certain whether your device has been stolen or if you have simply misplaced it, attempt to locate the device by calling it or by using the anti-theft software's GPS locator. Even if you may have only lost the device, you should remotely lock it to be safe.

2. If you have installed anti-theft software on your device, use it to lock the phone, wipe sensitive information, and/or activate the alarm.

3. Immediately report the theft or loss to your carrier. You will be responsible for any charges incurred prior to when you report the stolen or lost device.

4. If you provide your carrier with the IMEI, MEID or ESN number, your carrier may be able to disable your device and block access to the information it carries. Request written confirmation from your carrier that you reported the device as missing and that the device was disabled.

If the device was stolen, also immediately report the theft to the police, including the make and model, serial and IMEI, MEID or ESN number. Some carriers require proof that the device was stolen, and a police report would provide that documentation.

Safeguard Your Mobile Wallet Smartphone

1. Consider your surroundings and use your Smartphone or mobile device discreetly.

2. Do not use mobile wallet services to conduct financial transactions over an unsecured Wi-Fi network.

3. Never leave your Smartphone unattended in a public place. Don't leave it visible in an unattended car; lock it up in the glove compartment or trunk.

4. The police may need your Smartphone’s unique identifying information if it is stolen or lost. Write down the make, model number, serial number, and unique device identification number (either the International Mobile Equipment Identifier (IMEI) or the Mobile Equipment Identifier (MEID) number). Some phones display the IMEI/MEID number when you dial *#06#. The IMEI/MEID can also be found on a label located beneath the phone's battery or on the box that came with your phone.

5. Review the service agreement for the financial account used in your mobile wallet to find out what will happen and who to contact if your Smartphone is stolen or lost, or if your mobile wallet application is hacked.

6. Monitor the financial account used in your mobile wallet for any fraudulent charges.

7. Choose a unique password for your mobile wallet. Should your Smartphone be lost or stolen, this may help protect you from both unwanted charges and from theft and misuse of your personal data.

8. Install and maintain security software. Apps are available to:

Locate your Smartphone from any computer;

Lock your Smartphone to restrict access;

Wipe sensitive personal information and mobile wallet credentials from your Smartphone; and

Make your Smartphone emit a loud sound ("scream") to help you or the police locate it.

9. Adjust your "locked screen" display to show your contact information so that your Smartphone may be returned to you if found.

10. Be careful about what information you store. Social networking and other apps may pose a security risk and allow unwanted access to your personal information and mobile wallet data.

What to Do if Your Mobile Wallet Smartphone Is Stolen

1. If you are not certain whether your Smartphone or mobile device has been stolen or if you have simply misplaced it, attempt to locate the Smartphone by calling it or by using the security software's GPS locator. Even if you may have only lost the Smartphone, you should remotely lock it to be safe.

2. If you have installed security software on your Smartphone, use it to lock the device, wipe sensitive personal information, and/or activate the alarm.

3. Immediately report the theft or loss to your wireless carrier. You will typically be responsible for any charges incurred prior to when you report the stolen or lost Smartphone. If you provide your carrier with the IMEI or MEID number, your carrier may be able to disable your Smartphone, your mobile wallet services, and block access to your personal information and sensitive mobile wallet data. Request written confirmation from your carrier that you reported the Smartphone as missing and that the Smartphone was disabled.

4. If your Smartphone or mobile device was stolen, also immediately report the theft to the police, including the make and model, serial and IMEI or MEID number. Some carriers require proof that the Smartphone was stolen, and a police report can provide that documentation.

5. If you are unable to lock your stolen or lost Smartphone, change all of your passwords for mobile wallet services and banking accounts that you have accessed using your Smartphone service.

Mobile apps

If you have a smart phone or other mobile device, you probably use apps - to play games, get turn-by-turn directions, access news, books, weather, and more. Easy to download and often free, mobile apps can be so much fun and so convenient that you might download them without thinking about some key considerations: how they’re paid for, what information they may gather from your device, or who gets that information.

Mobile App Basics

What’s a mobile app? A mobile app is a software program you can download and access directly using your phone or another mobile device, like a tablet or music player.

What do I need to download and use an app?

You need a smart phone or another mobile device with internet access. Not all apps work on all mobile devices. Once you buy a device, you’re committed to using the operating system and the type of apps that go with it. The Android, Apple, Microsoft and BlackBerry mobile operating systems have app stores online where you can look for, download, and install apps. Some online retailers also offer app stores. You’ll have to use an app store that works with your device’s operating system.

Why are some apps free?

1. Some apps are distributed for free through app stores; the developers make money in a few ways:

2. Some sell advertising space within the app. The app developers can earn money from the ads, so they distribute the app for free to reach as many users as possible.

3. Some apps offer their basic versions for free. Their developers hope you’ll like the app enough to upgrade to a paid version with more features.

4. Some apps allow you to buy more features within the app itself. Usually, you are billed for these in-app purchases through the app store. Many devices have settings that allow you to block in-app purchases.

5. Some apps are offered free to interest you in other products. These apps are a form of advertising.

Questions about your privacy

What types of data can apps access?

When you sign up with an app store or download individual apps, you may be asked for permission to let them access information on your device. Some apps may be able to access:

1. your phone and email contacts

2. call logs

3. internet data

4. calendar data

5. data about the device’s location

6. the device’s unique IDs

7. information about how you use the app itself

Some apps access only the data they need to function; others access data that’s not related to the purpose of the app.

If you’re providing information when you’re using the device, someone may be collecting it - whether it’s the app developer, the app store, an advertiser, or an ad network. And if they’re collecting your data, they may share it with other companies.

How can I tell what information an app will access or share? It’s not always easy to know what data a specific app will access, or how it will be used. Before you download an app, consider what you know about who created it and what it does. The app stores may include information about the company that developed the app, if the developer provides it. If the developer doesn’t provide contact information - like a website or an email address - the app may be less than trustworthy.

If you’re using an Android operating system, you will have an opportunity to read the “permissions” just before you install an app. Read them. It’s useful information that tells you what information the app will access on your device. Ask yourself whether the permissions make sense given the purpose of the app; for example, there’s no reason for an e-book or “wallpaper” app to read your text messages.

Why do some apps collect location data? Some apps use specific location data to give you maps, coupons for nearby stores, or information about who you might know nearby. Some provide location data to ad networks, which may combine it with other information in their databases to target ads based on your interests and your location.

Once an app has your permission to access your location data, it can do so until you change the settings on your phone. If you don’t want to share your location with advertising networks, you can turn off location services in your phone’s settings. But if you do that, apps won’t be able to give you information based on your location unless you enter it yourself. Your phone uses general data about its location so your phone carrier can efficiently route calls. Even if you turn off location services in your phone’s settings, it may not be possible to completely stop it from broadcasting your location data.

Questions about advertising. Why does the app I downloaded have ads in it? Developers want to provide their apps as inexpensively as possible so lots of people will use them. If they sell advertising space in the app, they can offer the app for a lower cost than if it didn’t have ads. Some developers sell space in their apps to ad networks that, in turn, sell the space to advertisers.

Why do I see the ads I do? Advertisers believe you’re more likely to click on an ad targeted to your specific interests. So ad networks gather the information apps collect, including your location data, and may combine it with the kind of information you provide when you register for a service or buy something online. The combined information allows the mobile ad network to send you targeted ads - ads that may be relevant to someone with your preferences and in your location.

Malware and Security Concerns. Should I update my apps? Your phone may indicate when updates are available for your apps. It’s a good idea to update the apps you’ve installed on your device and the device’s operating system when new versions are available. Updates often have security patches that protect your information and your device from the latest malware.

Could an app infect my phone with malware? Some hackers have created apps that can infect phones and mobile devices with malware. If your phone sends email or text messages that you didn’t write, or installs apps that you didn’t download, you could be looking at signs of malware. If you think you have malware on your device, you have a few options: you can contact customer support for the company that made your device; you can contact your mobile phone carrier for help; or you can install a security app to scan and remove apps if it detects malware. Security apps for phones are relatively new; there are only a few on the market, including some with free versions.

Mobile App User Reviews. Can I trust all the user reviews I read about an app? Most app stores include user reviews that can help you decide whether to download. But some app developers and their marketers have posed as consumers to post positive comments about their own products. In fact, the Federal Trade Commission recently sued a company for posting fake comments about the apps it was paid to promote.

Apple iPhone Safety

To prevent losses associated with fraudulent apps, we suggest all iOS users read the reviews and check ratings before buying an application. Do not believe in magical features that do not exist in your phone, no app is able to do things that Apple does not allow.

If you were the victim of such apps, you can try asking Apple to refund your money, by following these steps:

1. Open iTunes and select the iTunes Store link in the left-hand column;

2. Near the top right corner, click the arrow next to your username (email address) and then select Account;

3. About halfway down the screen, click the Purchase History button;

4. In the bottom portion of the screen, you will see your App Store purchase history - click the Report a Problem button;

5. Locate the iTunes invoice with the application you would like a refund for, and click the Report a Problem link

6. Fill out the form that follows and be sure to be as detailed as possible - when finished, click Next

7. If your reason for requesting a refund is valid, Apple should respond within a few days and process your refund within a week.

Android App Safety

When an app is installed, the system will always display the permissions requested. The user can use this at a glance to evaluate an app’s intentions. If a relatively simple app, like a wrapper for a website, asks for permission to send and receive SMS messages, which is a serious red flag. In fact, a large number of these so-called “SMS Trojans” are in circulation around the seedier parts of the web. When installed, they text premium rate numbers to rack up charges. The same concern exists for apps that include phone calling permissions; they could call premium rate numbers without the user’s knowledge.

Android permissions

1. Another important permission to be on the lookout for is access to the contact list, and Google accounts. If an app has no business looking at this data, there is a chance that it’s just malware designed to harvest user data for spamming or phishing scams. The only time one might expect to see this permission is in apps that auto complete contact names, or handle legitimate messaging actions.

2. Of less concern financially, but still a sign of shady behavior, is the location permission. This can come in either Fine (GPS) or Coarse (Network) varieties. An app that doesn’t need this data for its essential function could be using it for something as innocuous as location-aware ads, but there is a darker possibility as well. Questionable app could harvest a user’s exact location, store it over time, and sell that to advertisers.

3. The best way to stay safe on Android is to just stick to established apps from the official Android Market or the Amazon Appstore. While bad apps do occasionally show up in the Market, Google removes them swiftly and can remotely kill the apps on phones.

4. Most of the truly dangerous threats have been detected on forums and third-party websites masquerading as well-known apps. Basically, don’t install a version of “Cut the Rope” obtained from a Chinese pirated software forum. By leaving the Unknown Sources option disabled in the Android settings, apps cannot even be side loaded from other sources, which blocks this vector completely.

5. It just takes a little forethought to avoid the most serious Android malware threats out there. Sticking to the official application repositories is a good policy, as is checking out the permissions for an app. Users might even prefer to leave the Unknown Sources option disabled. There is now good evidence that free Android antivirus apps just don’t work, and could even cause users to believe they are protected, and thus take more risks. Paid antivirus apps work better, detecting more threats, but still fall short of the mark. In the end, it is still very much up to the user to be on the lookout for suspicious behavior in order to stay safe.

Mobile banking

Mobile banking offers account access with the same tight security measures as the full desktop websites counterpart.

By following these steps, it is possible to make things much harder for criminals and to significantly lower your safety risks:

1. Always use a pin or gesture code to lock mobile devices. If a physical device falls into the hands of a criminal, the first thing they should be faced with is security, particularly where access to finances and other data is concerned.

2. Only use official routes to communicate with financial institutions. Ensuring users stick to the official ways of contacting and receiving information from their banks is key. Mobile banking shouldn't dramatically change the way banks communicate, so ignoring links to sites in emails requesting details, unusual texts or other messages, is advice worth noting when using a Smartphone as it is when using a desktop PC, tablet or laptop.

3. Be aware of connection services. Public Wi-Fi is far easier to 'sniff' for data than mobile data connections provided by a network operator. Unless the user is 100% sure of the security, or trust the connection on offer, think twice about dealing with personal finances over it. Installing trusted security software, like Norton Mobile Security or Norton Tablet Security, will help prevent malware - the cybercriminal's number one tool - from logging keystrokes or gaining access to a device. It can also scan emails to provide support in avoiding phishing attacks seeking bank account information.

4. Be careful what you download. It's possible that mobile banking sessions could come under threat from code carried by other applications downloaded. While security software can scan for threats on a device, be aware of information entered onto a device and try to stick to well -regarded or official sources of applications or content.

5. Read the fine print. Does your financial institution's app allow you to delete all banking-related messages, pictures and other data saved on the phone? Can you disable the feature that automatically signs you in to your online bank account the minute your phone is turned on? Once connected to your account, will the app automatically disconnect after a certain period of inactivity?

6. Set up your phone to encrypt data. Make sure your phone has an application to encrypt all stored data. Then, use it to protect sensitive messages from your financial institution and pictures of valid checks. Photos of checks and other sensitive banking data may be stored on your phone’s memory expansion card. Even if the phone itself is secured with encryption, the card probably is not. Note that older phones may not have enough power to run encryption software.

7. Download anti-virus software and enable firewall protection for your cell phone. Make sure to update it regularly.

8. Never respond to email messages from your bank that request personal information. Banks or Credit Unions never ask for this information by email. Mark it as spam, and delete it. Next, delete all your cached content (sent messages, received messages, etc.) on a regular basis. Finally, check your browser security settings to help filter out phishing emails.

9. Be skeptical about text messages. Before opening a text that appears to be from your bank, and especially before hitting “reply,” call your financial institution first to make sure the message is actually from them.

Android

Download apps only from the Google Play Store

Indeed, the most ‘dangerous’ thing about Android is not the OS itself, but apps that a user can install. Contrary to iOS, installing an app by oneself or with ‘help’ from another user is super easy on Android. Just never download an app from third-party platforms and websites: they might be infected. It is easier to fully disable this capability in settings and deploy an integrated app security check. Also, say no to root access, as it significantly elevates the risks of running into infected applications.

How it helps: significantly lowers your chances of getting malware.

How to set it: go to “Settings” -> “Security”, un-check the “Unknown Sources” box, check “Verify Apps.”

Watch out for app permissions

First, you’d want to install apps only by known developers, or rely on Google recommendations. Second, check the apps’ permissions every time you install to see what exactly a certain app is asking to access. If a wallpaper app or game wants to access your accounts, SMS, mic, location and to enjoy unlimited Internet, that looks fishy.

How it helps: significantly lowers your chances of getting malware

How to set it: upon installation, the list of permissions is shown on the screen, and also there is the “See Permissions” link on the bottom of the app page. If a suspicious app has been installed already, go to “Google Settings” -> “Enabled Apps” and disable the ones you don’t want to run.

Use strong passwords

This is more of a ‘one-size-fits-all’ tip. To unlock your phone, use sophisticated passwords, not a PIN or graphic code. The best solution is a password that contains at least ten characters, including lower case and upper case letters, numbers, and symbols. But it’s not easy to enter that many symbols each time that you unlock your phone, so you should try several passwords to find the optimal one. The password should be changed on a regular basis. Also, set the minimal idle time to enable the lock, and disable the option to show passwords when entering them. Note that many apps also use password-based security.

How it helps: significantly lowers the chances for other people to access your phone and its content.

How to set it: go to “Setting” -> “Security” -> “Screen Lock” and choose “Password” as a means of locking the screen. Then go to “Settings” -> “Security” and un-check “Make passwords visible” box.

Encrypt your data

It’s simple! If the data on your phone is encrypted, then no one is able to access it even if the phone is lost or stolen. It is better to choose a password rather than a PIN code because in the current Android version, encryption is based on password/PIN only and is only as strong as the password is. Android 5.0 should improve upon this.

How it helps: protects data in case your device is lost

How to set it: go to “Settings” -> “Security” -> “Encrypt Phone”, and check the “Encrypt SD Card” in addition.

Watch out for your Wi-Fi connections

By default, Android tries to connect to any wireless network you ever accessed. In the case of open access points, it may well be that it is not a hotspot you are used to but rather a malicious hotspot created by a cybercriminal. With that in mind, first try to avoid public hotspots, and second, run a regular audit of your remembered Wi-Fi networks list. Also, disable default search for open wireless connections.

How it helps: lowers the chances of inadvertently connecting to potentially malicious Wi-Fi networks.

How to set it: go to “Settings” -> “Wi-Fi”, press and hold a remembered hotspot name to call up the menu which allows you to delete the network; go to “Advanced Settings” to un-check “Always Search for Wireless Networks.”

Always use VPN

This tip is especially relevant when using a public hotspot or an untrusted network connection. Using VPN will protect the data you transfer and (as a bonus) allow you to access resources that are somehow restricted on public networks. Today, robust VPN access is not that expensive and the latest models of home routers have their own VPN servers, making VPN access completely free for you. It is better to use L2TP or OpenVPN, which sport even more reliable protection than the widely used PPTP. To prevent a data leak prior to establishing a VPN connection, do not forget to make VPN ‘always-on’, or disable automatic syncing of your apps.

How it helps: encrypts inbound and outbound data.

How to set it: go to “Settings”, choose “More…” -> VPN in “Wireless Connections and Networks”; in the context menu check “Always-on VPN” and choose the connection; autosyncing can be disabled in “Settings” -> “Accounts.”

Disable notifications

Even if your phone is locked, different notifications can be pushed to the status bar or to the display. Notifications may include one-time codes to confirm transactions, account status alerts and other sensitive data. Unfortunately, there is no single Android notification center where these can be disabled. Also, many device OEMs use different skins which are not secure in this respect. That means that you will have to disable all app notifications manually.

How it helps: no outsider is able to see your notifications, which might contain sensitive information.

How to set it: go to “Settings” -> “Apps”; choose an app and un-check the “Show notifications” box. In some cases it is even easier to disable notifications in the program’s settings.

Apply settings to Google services

There may be good reasons to set some limits for the search giant, as any leak of Google account information might lead to negative consequences for a user: any culprit able to gain access might not only read your messages but may also find out where you have been, see your photos and contacts and other meaningful things.

How it helps: minimizes damage done in case of data leakage.

How to set it: in the “Google Settings” app, in “My Location” entry, disable “Sending Geolocation Data” and “History of Location” options for all accounts; in “Search and Tips,” disable Google Now; in “Android Remote Management” you may want to enable “Remote Device Search” and “Remote Lock and Reset” options; in the “Google Photo” app, go to “Settings” -> “Auto Back Up” and disable the default automated backup of all of your photos on Google servers.

Get rid of unnecessary apps

See tips 1 and 2 above. The more apps that you have, the higher the risk is that some of them are involved in malicious activities. Also, in the Android world, there is this bad habit of selling devices with tons of pre-installed services and apps. You may not use them, but it doesn’t mean that their creators don’t use you. Some, but not all, of them, can be deleted. Refer to an app’s website to know which of them are good to go.

How it helps: minimizes damage done in case of data leakage.

How to set it: go to “Settings” -> “Apps” -> “All,” tap on the app you need to delete in the list and press “Wipe data” and “Disable”.

Use two-factor authentication for Google and other apps

Two-factor authentication is likely the best method to ensure maximum user account security available today. It is simple: besides using the password, it requires you to also enter a one-time code sent via text message or within specialized apps or even hardware. Without this code, an intruder cannot log in to your accounts, even if they have laid hands on your password.

How it helps: significantly lowers the chances of an outsider using your accounts.

How to set it: go to https://accounts.google.com/SmsAuthConfig in your browser and follow the instructions.

iPhone

iPhone safety

1. Smartphones continue to grow in popularity and are now as powerful and functional as many computers. It is important to protect your Smartphone just like you protect your computer to avoid growing mobile cyber threats. Mobile security tips can help you reduce the risk of exposure to mobile security threats.

Understanding passcodes - http://support.apple.com/kb/HT4113

2. Set PINs and passwords. To prevent unauthorized access to your phone, set a password or Personal Identification Number (PIN) on your phone’s home screen as a first line of defense in case your phone is lost or stolen. When possible, use a different password for each of your important log-ins (email, banking, personal sites, etc.). You should configure your phone to automatically lock after five minutes or less when your phone is idle, as well as use the SIM password capability available on most smart phones.

3. Do not modify your Smartphone’s security settings. Do not alter security settings for convenience. Tampering with your phone’s factory settings, jailbreaking, or rooting your phone undermines the built-in security features offered by your wireless service and Smartphone, while making it more susceptible to an attack.

Backup and restore overview - http://support.apple.com/kb/HT4859

4. Backup and secure your data. You should backup all of the data stored on your phone - such as your contacts, documents, and photos. These files can be stored on your computer, on a removal storage card, or in the cloud. This will allow you to conveniently restore the information to your phone should it be lost, stolen, or otherwise erased.

5. Only install apps from trusted sources. Before downloading an app, conduct research to ensure the app is legitimate. Checking the legitimacy of an app may include such thing as: checking reviews, confirming the legitimacy of the app store, and comparing the app sponsor’s official website with the app store link to confirm consistency. Many apps from untrusted sources contain malware that once installed can steal information, install viruses, and cause harm to your phone’s contents. There are also apps that warn you if any security risks exist on your phone.

6. Understand app permissions before accepting them. You should be cautious about granting applications access to personal information on your phone or otherwise letting the application have access to perform functions on your phone. Make sure to also check the privacy settings for each app before installing.

- Apple iOS: Set up Find My iPhone - http://support.apple.com/kb/PH2697

- Apple iOS: Locate your device on a map - http://support.apple.com/kb/PH2698

- Apple iOS: Lock and track your device - http://support.apple.com/kb/PH2700

7. Install security apps that enable remote location and wiping. An important security feature widely available on smart phones, either by default or as an app, is the ability to remotely locate and erase all of the data stored on your phone, even if the phone’s GPS is off. In the case that you misplace your phone, some applications can activate a loud alarm, even if your phone is on silent. These apps can also help you locate and recover your phone when lost.

8. Accept updates and patches to your Smartphone’s software. You should keep your phone’s operating system software up-to-date by enabling automatic updates or accepting updates when prompted from your service provider, operating system provider, device manufacturer, or application provider. By keeping your operating system current, you reduce the risk of exposure to cyber threats.

How to update your iPhone - http://support.apple.com/kb/HT4623

9. Be smart on open Wi-Fi networks. When you access a Wi-Fi network that is open to the public, your phone can be an easy target of cybercriminals. You should limit your use of public hotspots and instead use protected Wi-Fi from a network operator you trust or mobile wireless connection to reduce your risk of exposure, especially when accessing personal or sensitive information. Always be aware when clicking web links and be particularly cautious if you are asked to enter account or log-in information.

10. Wipe data on your old phone before you donate, resell or recycle it. Your Smartphone contains personal data you want to keep private when you dispose your old phone. To protect your privacy, completely erase data off of your phone and reset the phone to its initial factory settings. Now having wiped your old device, you are free to donate, resell, recycle or otherwise properly dispose of your phone.

Understanding ‘erase all contents and settings’ - http://support.apple.com/kb/ht2110

11. Report a stolen Smartphone. The major wireless service providers, in coordination with the FCC, have established a stolen phone database. If your phone is stolen, you should report the theft to your local law enforcement authorities and then register the stolen phone with your wireless provider. This will provide notice to all the major wireless service providers that the phone has been stolen and will allow for remote “bricking” of the phone so that it cannot be activated on any wireless network without your permission.

Social media

Use caution when you click links that you receive in messages from your friends on your social website. Treat links in messages on these sites as you would links in email messages.

1. Don't trust the sender information in an e-mail message. Even if the e-mail message appears to come from a sender that you know and trust, use the same precautions that you would use with any other e-mail message. Fraudsters can easily spoof the identity information in an e-mail message.

2. Know what you've posted about yourself. A common way that hackers break into financial or other accounts is by clicking the "Forgot your password?" link on the account login page. To break into your account, they search for the answers to your security questions, such as your birthday, home town, high school class, or mother's middle name. If the site allows, make up your own password questions, and don't draw them from material anyone could find with a quick search.

3. Think twice before sharing personal information that would make you vulnerable. Social networking means opening up and sharing information online with others, but there's some information you should never share online. Protecting yourself from sharing Too Much Information (TMI) can save you from identity theft and even protect your physical safety. So let's start with the obvious - never share your social security number (including even just the last 4 digits), your birth date, home address or home phone number (although sharing your business phone is ok ). Of course, you should protect all of your passwords, PIN numbers, bank account, credit card information and never share the state where you were born as this information can be used to obtain your social security number and other identity information.

4. Don't trust that a message is really from who it says it's from. Hackers can break into accounts and send messages that look like they're from your friends, but aren't. If you suspect that a message is fraudulent, use an alternate method to contact your friend to find out. This includes invitations to join new social networks.

5. To avoid giving away email addresses of your friends, do not allow social networking services to scan your email address book. When you join a new social network, you might receive an offer to enter your email address and password to find out if your contacts are on the network. The site might use this information to send email messages to everyone in your contact list or even everyone you've ever sent an email message to with that email address. Social networking sites should explain that they're going to do this, but some do not.

6. Type the address of your social networking site directly into your browser or use your personal bookmarks. If you click a link to your site through email or another website, you might be entering your account name and password into a fake site where your personal information could be stolen. For more tips about how to avoid phishing scams, see Email and web scams: How to help protect yourself.

7. Be selective about who you accept as a friend on a social network. Identity thieves might create fake profiles in order to get information from you. According to a recent survey by Harris Interactive, nearly 13 million Americans age 18+ who are on social networking sites will accept any social media connection request from a member of the opposite sex, regardless of whether or not they know that person. That lack of caution can be extremely costly. Most networking sites contain personal information. When you friend someone, you give them access to that information and that can be used by fraudsters.

8. Choose your social network carefully. Evaluate the site that you plan to use and make sure you understand the privacy policy. Use privacy settings - The default settings on most social networking sites allow anyone to see your profile. Customize your settings to restrict access only to certain users. Despite the use of privacy settings, there is still a risk your information could be compromised so don’t post anything you wouldn’t want the public to see. Review your privacy settings periodically. Find out if the site monitors content that people post. You will be providing personal information to this website, so use the same criteria that you would to select a site where you enter your credit card.

9. Assume that everything you put on a social networking site is permanent. Even if you can delete your account, anyone on the Internet can easily print photos or text or save images and videos to a computer.

10. Be careful about installing extras on your site. Many social networking sites allow you to download third-party applications that let you do more with your personal page. Criminals sometimes use these applications to steal your personal information. To download and use third-party applications safely, take the same safety precautions that you take with any other program or file you download from the web. Use caution when deciding which apps to enable and take the same safety precautions you would take with any other program or file you download from the web. Modify your settings to limit the amount of information apps can access.

11. Think twice before you use social networking sites at work. If you do, here are some ways to use that access more safely:

12. Find out if your company has a policy about visiting certain Web sites using your corporate network.

- When you sign up for a social networking site, use your personal e-mail address, not your company e-mail address.

- Use caution when you click links that you receive in messages from your friends on your social networking site. Treat links in messages on these sites as you would links in e-mail messages.

- Be choosy about who you accept as a "friend" on a social network. Identity thieves may create fake profiles in order to glean information from you. This is known as social engineering.

- Be careful about the information you reveal about your workplace or company on your social networking site. (This is a good rule to follow for blogs too.)

13. Talk to your kids about social networking. If you're a parent of children who use social networking sites.

14. Search yourself. Do regular searches for yourself on a site such as Google. Know where you show up and what information is readily available online about you. Also, check out your social networking profiles as they appear to others and adjust your settings accordingly for privacy and security. You can also set up a Google alert with your name which could point to suspicious information and whether someone else is using your identity online.

15. Customize privacy options. Social networking sites increasingly give users more control over their own privacy settings. Don't assume you have to take whatever default settings the site gives you.

Check out the settings, configuration and privacy sections to see what options you have to limit who and what groups can see various aspects of your personal information.

Limit work history details on LinkedIn: If you feel you need the added information to help in a job search, expand the details during the job hunting process and then cut back later after you have a position, leaving just enough information to entice recruiters to contact you with interesting new positions. LinkedIn also offers some capabilities to restrict information. You can close off access by others to your network of contacts, something you don't have to share if you don't want.

16. Don't trust, just verify. There are lots of reasons (most of them bad) why someone might impersonate or falsify an identity online. The question becomes, how can you verify that the page belongs to who you think it does before sharing too much information or clicking on links? Start by being on the lookout for anything unusual or out of the ordinary. If the content on the site doesn't look like or sound like the person you know, avoid it. E-mail or call your friend to verify the site is legit. Let them know, too, if you think someone else is faking your friend's identity online.

17. Avoid accidentally sharing personal details. Social networking sites make it easy to let details slip you wouldn't otherwise tell friends or strangers. Be aware of what information you put out there which others might use for nefarious purpose.

18. Forget the popularity contest. Put a number on something and suddenly you have a competition. The person with the most "friends" isn't necessarily the winner in social networking, unless of course you are running for president or you are in some type of recruiting, sales or media business. That's just more people, including possibly strangers, who now have access to more of your information. It is best to only friend people who really are or have become your friends. Your personal information has less opportunity for misuse. If you do get an unsolicited invite to connect, check them out first and try to figure out why you know them or if you even do at all.

19. Create a smaller social network. Bigger isn't always better. There's more to social networks than MySpace, Facebook and Twitter. Self forming communities often form around very narrow topics and these can easily get lost on the bigger sites. You may be better served creating a smaller, more focused network using tools aimed to help narrow or smaller groups. By narrowing your purpose and using tools appropriate for smaller groups, you can keep unwanted solicitations, invites to connect, applications and spam to a minimum. You'll also find you build closer relationships with community member.

20. Setup an OpenID account. OpenID is an open source standard for creating a single sign-on to multiple online services and applications.

Facebook Safety

How to Protect Your Facebook Account from Spammers?

Review your security settings: Check out Facebook's information on setting your privacy settings to be sure you aren't sharing personal information with strangers. Look here for information on what can be found publicly in search engines.

Who Can Contact You:  Click on the padlock icon on the top toolbar (on the right hand side), then click ‘Who can contact me’.

Basic Filtering:  By default this is set up as ‘Basic Filtering’ to allow friends and people you may know the opportunity to send you a message.  If you want only friends to be able to contact you, you can increase the filtering on your inbox. Other messages will then be diverted to your ‘other’ folder which you can access from the Messages screen.

Strict Filtering: To do this, click ‘Strict Filtering’ under ‘Whose messages do I want filtered into my Inbox?’  From this area of the screen you can also limit who is able to send you a friend request, choosing between everyone or just friends of your friends.

Friend Requests:  Never accept Facebook friend requests from unknown people.

Scammers find your information through Facebook or other social media accounts. Some set up fake accounts and send out friend requests. When you accept the request, they can view your friends and personal and contact information. Other scammers rely on social media users not locking down their privacy settings, so basic information, such as your name, email address and friends' names, is publicly available.

Links: Don't click on strange links, even if they're from friends. Notify the person who sent you the email if you see something suspicious.  For example, you receive an email that appears to be sent by a friend or family member. The message addresses you by name, but the content is strange. Usually, it's just a link to a website. If you click on it, you could end up downloading malware to your computer.

Notifications: Consider enabling login notifications, so you will know when someone uses a new device to access your account.

Public Wifi:  When accessing Facebook from public wi-fi in places like hotels and airports, text "otp" to 32665 to receive a one-time password to your account.

Timeline Posts:  Make sure only your friends can see your timeline posts.   While certain elements of your profile are viewed by everyone, many other aspects of your timeline can be blocked.

Future Posts: Make sure all your future posts are locked down. Click on the padlock icon on the top toolbar (on the right hand side), then click ‘Who can see my stuff?’.

Under ‘Who can see my future posts’, choose from:  Public. Friends, Only me, Custom (which allows you to limit some of your friends from seeing your posts).  Pick what’s best for you, but make sure ‘Public’ isn’t selected. Whatever you choose will then become the default every time you post an update (though you still have the option of selectively changing this for each individual update you post in the future).

Previous Posts: Click the arrowhead on the top toolbar (on the right hand side). Choose  'Settings' > 'Privacy Settings'

Login Approvals:  You can choose to have an extra layer of security when accessing your account from an unknown browser. Facebook will send a code to your phone which you will then need to use to login.

Click the arrowhead at the top right of any page and choose ‘Settings’, then ‘Security’ from the left hand menu, then 'Login' approvals. Check the box that says ‘Require a security code to access my account from unknown browsers’. Facebook will then take you through the process of setting up login approvals so click on ‘Get Started’ to begin.

Once you have set up login approvals you will only need to enter a code when you try to login from a new device. It is a feature that makes it that much harder for a hacker to gain access to your account and as such is well worth enabling.  Note: if your browser clears your history on exit, or has private browsing switched on, you may need to enter a code every time you log in.

Privacy Settings:  Scammers are tapping into the personal data available through social networks to pose as your friends in fraudulent emails. Watch out for these personalized scam messages and take steps to prevent them.

Click Privacy on the left hand menu, and under ‘Who can see my stuff’, click ‘Limit past posts’. From here you can change all your past post visibility to ‘Friends’.

About Us Section:  It’s also worth checking out the visibility of the stuff listed under the ‘About’ section of your profile.

On your timeline, click ‘Update info’ and then click ‘Edit’ next to the area you wish to change the visibility for. Choose from the options of ‘Public’, ‘Friends’, ‘Only me’ or a 'Custom' list of people.

Angler Phishing

What is angler phishing?

This attack is named after the anglerfish, which uses a bioluminescent lure to entice and attack smaller prey. In this case, the glowing lure is a fake customer support account that promises to help your customers but secretly steals their credentials instead.

How does it happen?

Fraudsters create highly convincing fake customer service accounts and then monitor social media channels for customer support requests. Angler phishing hackers often wait to strike on evenings or weekends when your brand is less likely to monitor social media interactions. When the hacker sees a customer contact your brand, they hijack the conversation by responding directly to that customer using their fake support page.

Example 1: Fake customer service accounts on Twitter

Online criminals set up fake customer service accounts to phish for bank login and password information and other sensitive data. These imposter accounts look very similar to that of real businesses, but are often one character off -- or they include an extra underscore or other keyboard character.

When someone tweets at their bank or example, scam artists will intercept the conversation, and reply to that message with what seems like an authentic answer.

Let's say John Smith tweeted his request to @mybank, the hackers were able to intercept his tweet and respond using their fake account @askmybank. The link in the fraudulent response will lead John to a perfect replica of the bank’s login page. There the hackers can steal his online banking credentials, ATM pin, security questions and answers, and more.

Example 2:  PayPal fraud

In this attack, an angler phisher targeted PayPal users from two fake PayPal Twitter accounts. The tweet encourages recipients to click over to the actual PayPal Twitter account, @PayPal, for assistance in an urgent matter. However, the fraudsters are monitoring the replies on the official PayPal Twitter page in order to sweep up replies to exploit for their attacks.

In addition, when victims receive a reply from the phony PayPal Twitter accounts, they're fooled again as the reply has the PayPal logo emboldened as an account image, and the handle seems official, except it amends the word “Ask” at the beginning of the handle.

Targets are lured into entering their PayPal credentials into the seemingly legitimate, but fake page. The bad actors are thus provided with the personal information they need to gain access to accounts and transfer out funds held there.

Who is at risk?

Fraudulent customer support accounts are a problem for any business that provides customer service on social media. However, 2016 research from the Anti-Phishing Working Group shows that more than 75% of phishing attempts target financial service and ecommerce organizations to steal banking credentials and make fraudulent purchases.

How can I stop angler phishing attacks?

For Consumers:

Never LOGIN to an account if the link is provided to you through email or social media.

If you are unsure about a link in a social media post, do NOT copy and paste the link in your web browser. You could still end up at the malicious site and potentially load malware on your computer or network. If you are unsure whether a link you received in a post is safe, it is not safe to copy and paste the link in the URL section of your web browser.

Access web sites through your web browser.  Typing the address of a web site directly into your Web browser will ensure that you are going to the legitimate Web site and not a phishing site that was designed to mimic the look of the real thing. Unless the site was hijacked or your computer has a virus, typing the web address yourself is the best way to guarantee the authenticity of a web site.

Technology-based security measures such as firewalls, encryption, anti-virus, spam filters, and strong authentication will NOT prevent social engineering fraud. No matter how much security technology you implement, you can never get rid of the weakest link - the human factor. A social engineer is someone who uses deception, persuasion and influence to get information that would otherwise be unavailable.

Use caution when you click links that you receive in messages from your friends on your social website. Treat links in messages on these sites as you would links in email messages.

Don't trust the sender information in an e-mail message. Even if the e-mail message appears to come from a sender that you know and trust, use the same precautions that you would use with any other e-mail message. Fraudsters can easily spoof the identity information in an e-mail message.

Know the social media account handle for the company you are dealing with.  Make sure you communicate only with the legitimate account.

Look closely at the reply you receive and be skeptical.  Look for misspelled Twitter handles, email addresses, etc.

For Businesses:

These types of attacks will be a problem for any business that provides customer service on social media. The following is a list of some key actions an organization can take to help prevent angler phishing attacks:

Identify your organization’s social media platforms, accounts and key individuals.

Document who is responsible for the corporate accounts. These accounts should have strong passwords that are continuously being changed every few months.

When applicable, use verified accounts. Twitter and Facebook offer an option for verified accounts to help ensure authenticity.

Continually monitor for fraudulent accounts. Make sure you take down any suspicious activity and report it to your IT team or service provider.

Enhance your security by leveraging email security solutions.

Fake news & hoaxes

The dangers of misinformation & how to outsmart fake news

The amount of misinformation that is spread on the web is staggering. It is spread mainly via Websites, Social Networks, and Email. The Hot Topics for such misinformation are Politics, Government Policies, Religion and various Scams and Hoaxes. Research reveals false rumors really do travel faster and further than the truth. What is important to understand is that sharing misinformation can lead to fraudulent web sites and malware.

Social networking sites provide users with the capabilities to spread information quickly to other users without confirmation of its truth. We tend to take written information as truth and assume it is accurate unless we know for certain that it is not. If we read something about a subject which we are not very knowledgeable about, we assume that the author has the credentials to be posting that information.

Malware from clickbait

The real trouble is that clickbait is often more than just a simple insult to our intelligence - it can lead to real trouble like malware and scams that can lead to identity theft or monetary loses. Often times clicking on a seemingly harmless article will lead you to nothing more than a useless pop-up for a fake video player or a fake survey, no article in sight. But if you click the link and download the player or fill in the survey, you'll wind up with a PC full of malware and viruses.

Prevention Tips:

Be cautious: Approach sharing and opening posts from friends as cautiously as you would your emails. Social media can be a wonderful tool but it can be really dangerous as well and it's beyond important to keep that in perspective. Another good piece of advice is to never trust the links, especially those clickbait ones.

Be careful closing pop-ups: Closing a POP-UP by clicking the X can inadvertently share the malicious code without your knowledge. This is why most people that shared it say they never clicked on anything suspicious.

Here are some options in closing a POP-UP:

- Chrome on Windows or Mac: Shift + Esc, select the tab containing the pop-up, then click "End Process".

- Windows: Press Ctrl + Shift + Esc, select the web browser, then click "End Task."

- Mac: Command + Option + Esc, select your web browser, then click "Force Quit."

- Android: Press the square button at the bottom right corner of the screen, then swipe all browser windows off the screen.

- iPhone: Double-press the home button (if you're using iPhone 6s, 3D Touch press the left side of the screen), then swipe all instances of the browser off the screen.

Another option: Since the popup is controlled by JavaScript, the best option is to disable the execution of any scripts (by configuration or browser add-ons). This will impact how most websites look and feel, however you can always add sites to the exception list once you know they are safe.

The dangers of misinformation

We tend to take written information as truth and assume it is accurate unless we know for certain that it is not. If we read something about a subject which we are not very knowledgeable about, we assume that the author has the credentials to be posting that information.

- Misinformation regarding drugs and health remedies have proven deadly for many people around the world.

- Misinformation through sharing emails or social media spam can expose you to fraudulent phishing web sites.

- Misinformation regarding investment advice has lead to personal financial losses.

Tips for analyzing news sources

- Avoid websites that end in "lo" ex: Newslo. These sites take pieces of accurate information and then packaging that information with other false or misleading "facts" (sometimes for the purposes of satire or comedy).

- Watch out for websites that end in ".com.co" as they are often fake versions of real news sources

- Watch out if known/reputable news sites are not also reporting on the story. Sometimes lack of coverage is the result of corporate media bias and other factors, but there should typically be more than one source reporting on a topic or event.

- Odd domain names generally equal odd and rarely truthful news.

- Lack of author attribution may, but not always, signify that the news story is suspect and requires verification.

- Some news organizations are also letting bloggers post under the banner of particular news brands; however, many of these posts do not go through the same editing process (ex: BuzzFeed Community Posts, Kinja blogs, Forbes blogs).

- Check the "About Us" tab on websites or look up the website on sites like Wikipedia for more information about the source.

- Bad web design and use of ALL CAPS can also be a sign that the source you're looking at should be verified and/or read in conjunction with other sources.

- If the story makes you really angry it's probably a good idea to keep reading about the topic via other sources to make sure the story you read wasn't purposefully trying to make you angry (with potentially misleading or false information) in order to generate shares and ad revenue.

- If the website you're reading encourages you to DOX (researching and broadcasting private or identifiable information about an individual or organization), it's unlikely to be a legitimate source of news.

It's always best to read multiple sources of information to get a variety of viewpoints.

There is a role everyone should play in stopping the spread of rumors and hoaxes. Misinformation and misleading or incorrect figures when presented as facts and repeated frequently should be refuted before they become accepted as genuine and used to promote specific agendas or spread malware.

To help you determine if something is fact or fiction, go to: www.FraudSmarts.com/hoax   Here you’ll be able to simply paste the text of a story or post in a search box below. The results will help you determine whether the topic being discussed is true or just a rumor.

Social Media ID theft

There are several things you can and should do in order to manage your social media identity, which may prevent social media identity theft.

What exactly is social media identity theft? It’s a form of cybersquatting using social media sites.

1. If you’ve ever attempted to join a social media, more commonly known as a social networking site, or applied for an email account, and found that your first and last name were already taken, that may or may not have been social media identity theft, or cybersquatting.

2. There may be someone out there who shares your exact name and happened to register first, or else there is someone out there who took your name so that you can’t have it, or who wants to sell it back to you, or wants to pose as you and disrupt your life. These are all possibilities.

3. The most damaging possibility occurs when someone wants to pose as you in order to disrupt your life. This disruption can take on many forms. They may pose as you in order to harass and stalk you, or to harass and stalk people you know. Or they may steal your social media identity for financial gain. The thieves use a combination of email and social media to extract funds from others, or to open new accounts.

4. There are hundreds, or maybe even thousands, of social media sites, web-based email providers and domain extensions. Then there are all the blog portals, such as WordPress and Blogspot. Even your local online newspaper has a place for user comments, and most people would want to register their own names before someone else comments on their behalf.

5. Social media websites offer the option to provide your real name as well as a user name. The user name may be a fun chat handle or an abbreviation of your real name. The key is to give your real name where requested and also to use your real name as your user name. Even if you don’t plan on spending any time on the site, or to use the domain or email, you want to establish control over it.

6. The goal is to obtain your real first and last name without periods, underscores, hyphens, abbreviations or extra numbers or letters. This strategy won’t prevent someone else from registering with your name and adding a dot or a dash, but it trims down the options for a thief.

7. Some names are very common, or are also owned by someone famous. If that applies to your name, you can still take actions to manage your online reputation. If there is any uniqueness to your name or the spelling of your name, it’s still a good idea to claim your name in social media and work toward managing your online reputation.

8. Understand that your name is your brand. Your name is front and center on every document you sign and every website that shows up when your name is searched. The phrase, “All I have is my good name,” has never rung truer than today. If you are a writer, blogger, personality of any sort, or anyone who “puts it out there,” you probably already know enough to do these things. But there is more to do.

Manage Your Social Identity

If someone, perhaps a potential employer or mate or client, searches your name on Google Web, Google Blogs or Google News, what will they find? Will it be someone else posing as you? Will it be a picture of you doing a keg stand? Or will it be you in your nicest outfit, accepting an award for an accomplishment? Either way, you need to manage your online identity and work toward preventing social media identity theft.

1. Register your full name and those of your spouse and kids on the most trafficked social media sites, blogs, domains or web based email accounts. If your name is already gone, include your middle initial, a period or a hyphen. It’s up to you to decide whether or not to plug in your picture and basic bio, but consider leaving out your age or birthday.

2. Set up a free Google Alerts for your name and get an email every time your name pops up online.

3. Start doing things online to boost your online reputation. Blogging is best. You want Google to bring your given name to the top of search in its best light, so when anyone is searching for you they see good things. This is a combination of online reputation management and search engine optimization for your brand: YOU.

4. If you ever stumble upon someone using your likeness in the social media, be very persistent in contacting the site’s administrators. They too have reputations to manage and if they see someone using your photo or likeness they would be smart to delete the stolen profile.

Spear phishing risks

One of the most sophisticated types of phishing attacks is called spear phishing. This is when a hacker will target a specific group or organization and will tailor their attacks to make them look relevant to the recipient. Hackers will carry out these types of attacks in order to gain access to sensitive corporate data, and because the emails they send will look genuine they can often be very successful.

1. However, despite these worrying statistics there are a number of steps which can help to identify potential phishing emails. When receiving emails, users should look at the following:

2. Do you know the sender, and is the email address one you would expect them to use? An email purporting to be from your CEO, but sent from a Gmail account, should always ring alarm bells.

3. Are you expecting a message from the person? Does the email look suspicious? Does the link look genuine?

4. The content of the email can be a giveaway. One of the most basic reasons that phishing attacks work is that they prey on a user’s emotional response - fear, curiosity or reward, and emails that evoke strong emotions such as these should be considered triggers.

5. Is the email specific? Does it make sense? Although criminals have a lot of information about individuals they will still keep messages generic to pique your interest, and make you take action.

6. Grammar mistake. While grammar has improved in recent years, mistakes are often an indicator that all is not as it seems.

Phishing is one of the most common attack methods for cyber-criminals, however an effective training program and user awareness will minimize the risk of employees falling victim. Once employees know what to look for they will be able to quickly identify any potential phishing emails and report them before any damage is done.

Anatomy of a Spear Phishing Attack:

Tax filing

Identity theft is a crime that's anonymous in many cases, but in the case of tax identity theft, the government doesn't have in place the level of protection that many other financial institutions do to prevent fraud. At this moment, the IRS is one of the weakest links in the financial services world and as a result is highly targeted. The IRS allows filing of taxes as early as Jan. 19, and prompt thieves will file immediately with the hopes of beating more cautious individuals to their own returns.

What Rebate? Far more advanced than simply intersecting a rebate check or prepaid card, thieves are stealing year-end statements, W-2s and other income information to file returns on victims' behalf. Americans can legitimately receive their refunds in a variety of ways: direct deposit (often the fastest), loaded onto a prepaid card, or via check mailed to a location of their choosing. Thieves will often choose prepaid cards. Prepaid cards are a source of significant amounts of fraud. If you use tax filing assistant like HR Block or Turbo Tax you could get a refund on a prepaid card. They're beautiful from a tax ID theft perspective because they're just like cash.

How to Protect Yourself

1. Shred any paperwork not needed for tax preparation.

2. What to Shred. Checks from a credit card company offering low annual percentage rates for balance transfers and other pre-approved credit offers should be shredded upon receipt if you don't plan to use them. Once reconciled with corresponding accounts, ATM receipts, canceled checks, and pay stubs can all be shredded.

3. What to Keep. Hang on to monthly banking, brokerage account, and credit card statements. "Many people just make the payment and don't look at the fees and charges," Person says. "Compare the current statement to the previous statement. Verify that there were no mistakes or differences between last month's ending balance and this month's starting balance." Once you've reviewed the statements and addressed any inaccuracies, you can shred them when the year-end statement arrives. Certain papers should be kept for life, including divorce and estate documents and annual retirement plan forms. Per IRS recommendation, keep filed tax returns that don't require additional payments for three years.

4. Go Digital. The best way to minimize year-end paperwork is to minimize paperwork in general. Whenever possible, opt out of credit card offers, request that banks not send blank checks if you don't plan to use them, and choose to receive forms digitally. Sign up for online banking when it's available to eliminate the need for physical checks (as well as envelopes and stamps), and opt to get digital alerts when bills have arrived and payments are due.

Tax returns can also be filed digitally on secure servers, and copies of the completed forms downloaded directly to a personal computer. Users can opt to have their Social Security number partially stricken from the download for additional security. Be wary of a slow-running computer or out-of-place pop-ups when filing taxes online.

5. Be suspicious of any phone calls or emails claiming to be from the IRS, even with the appropriate logos. According to the IRS website: "The IRS does not initiate contact with taxpayers by email to request personal or financial information. This includes any type of electronic communication, such as text messages and social media channels."

6. Don't put your return in your office mailbox or in outgoing mail bin at work. When filing taxes by paper, take them directly to the post office and put them right into a postal worker's hands. Tax returns are usually pretty obvious, and can easily be snatched.

7. Finally, don't get complacent. Odds are you will file your tax returns without incident this year, but tax ID theft is a growing trend. The best way to avoid being a victim this year, and in future tax seasons, is to remain vigilant.

Taxpayers who suspect they've been victims of identity fraud should call the IRS Identity Theft department at 800-908-4490 with a copy of a police report, the completed IRS affidavit Form 14039 and state-issued identification. You'll find more information in the Taxpayer Guide to Identity Theft (http://www.irs.gov/uac/Taxpayer-Guide-to-Identity-Theft) on the IRS website.

Debt Collection Scams:

Here’s what to know if contacted about delinquent taxes by an IRS private collector:

1. Private collectors for the IRS cannot accept direct payments - all payments should be made to the U.S. Treasury. The agency will not require specific types of payments such as wire transfers or prepaid debit cards. Scammers prefer these methods because they are hard to trace and can be redeemed anywhere in the world.

2. Unless the IRS has an incorrect address, both the agency and its private collectors should first make contact by mailed letter.

3. Those who owe tax debt but cannot pay in full will be offered an installment plan for up to five years. If five years isn’t enough, “the collector asks for taxpayer financial information to see what sort of deal the taxpayer should get,” explains Robert W. Wood, who covers taxes and litigation for Forbes.

4. The same rules on other collectors apply: No calls before 8 a.m. or after 9 p.m. You must be sent a written “validation notice” telling you how much money you owe within five days after first contact. No harassing, abusive or threatening language allowed.

5. Certain tax bills (and therefore phone calls) cannot be handled by private collectors for the IRS: those for taxpayers who are deceased, under age 18, in a designated combat zone, or a victim of identity theft. Debtors currently in audit, litigation or criminal investigation are also off-limits to third-party hired guns.

Tech support scams

Scammers have been peddling bogus security software for years. They set up fake websites, offer free “security” scans, and send alarming messages to try to convince you that your computer is infected. Then, they try to sell you software to fix the problem. At best, the software is worthless or available elsewhere for free. At worst, it could be malware — software designed to give criminals access to your computer and your personal information.

The latest version of the scam begins with a phone call. Scammers can get your name and other basic information from public directories. They might even guess what computer software you’re using.

Once they have you on the phone, they often try to gain your trust by pretending to be associated with well-known companies or confusing you with a barrage of technical terms. They may ask you to go to your computer and perform a series of complex tasks. Sometimes, they target legitimate computer files and claim that they are viruses. Their tactics are designed to scare you into believing they can help fix your “problem.”

Once they’ve gained your trust, they may:

1. ask you to give them remote access to your computer and then make changes to your settings that could leave your computer vulnerable

2. try to enroll you in a worthless computer maintenance or warranty program

3. ask for credit card information so they can bill you for phony services — or services you could get elsewhere for free

4. trick you into installing malware that could steal sensitive data, like user names and passwords

5. direct you to websites and ask you to enter your credit card number and other personal information=

Regardless of the tactics they use, they have one purpose: to make money.

If You Get a Call

If you get a call from someone who claims to be a tech support person, hang up and call the company yourself on a phone number you know to be genuine. A caller who creates a sense of urgency or uses high-pressure tactics is probably a scam artist.

Keep these other tips in mind:

1. Don’t give control of your computer to a third party who calls you out of the blue.

2. Do not rely on caller ID alone to authenticate a caller. Criminals spoof caller ID numbers. They may appear to be calling from a legitimate company or a local number, when they’re not even in the same country as you.

3. Online search results might not be the best way to find technical support or get a company’s contact information. Scammers sometimes place online ads to convince you to call them. They pay to boost their ranking in search results so their websites and phone numbers appear above those of legitimate companies. If you want tech support, look for a company’s contact information on their software package or on your receipt.

4. Never provide your credit card or financial information to someone who calls and claims to be from tech support.

5. If a caller pressures you to buy a computer security product or says there is a subscription fee associated with the call, hang up. If you’re concerned about your computer, call your security software company directly and ask for help.

6. Never give your password on the phone. No legitimate organization calls you and asks for your password.

7. Put your phone number on the National Do Not Call Registry, and then report illegal sales calls.

If You’ve Responded to a Scam

If you think you might have downloaded malware from a scam site or allowed a cybercriminal to access your computer, don’t panic. Instead:

1. Get rid of malware. Update or download legitimate security software and scan your computer. Delete anything it identifies as a problem.

2. Change any passwords that you gave out. If you use these passwords for other accounts, change those accounts, too.

3. If you paid for bogus services with a credit card, call your credit card provider and ask to reverse the charges. Check your statements for any other charges you didn’t make, and ask to reverse those, too.

4. If you believe that someone may have accessed your personal or financial information, visit the FTC’s identity theft website. You can minimize your risk of further damage and repair any problems already in place.

How to Spot a Refund Scam

If you paid for tech support services, and you later get a call about a refund, don’t give out any personal information, like your credit card or bank account number. The call is almost certainly another trick to take your money.

The refund scam works like this: Several months after the purchase, someone might call to ask if you were happy with the service. When you say you weren’t, the scammer offers a refund.

Or the caller may say that the company is going out of business and providing refunds for “warranties” and other services.

In either case, the scammers eventually ask for a bank or credit card account number. Or they ask you to create a Western Union account. They might even ask for remote access to your computer to help you fill out the necessary forms. But instead of putting money in your account, the scammers withdraw money from your account.

If you get a call like this, hang up.

Telephone

When you send money to people you do not know personally or give personal or financial information to unknown callers, you increase your chances of becoming a victim of telemarketing fraud. Some of the most successful scams come in the form of a phone call from an organization or person you think you can trust. To protect yourself from the damage of identity theft and fraud, exercise caution in how you respond to these callers.

1. The IRS

Tax scams persist year-round, threatening people with jail time or prosecution if they don’t pay debts to the Internal Revenue Service.

Given that fake IRS phone calls continue to plague consumers, the IRS itself has repeatedly published a list of things you will not experience with a legitimate IRS representative, including phone calls demanding payment, threatening arrest and asking for specific payment methods like a prepaid debit card.

1. Yourself

If your own phone number ever pops up on your phone screen, don’t answer. It may seem harmless in the moment, but this scam reportedly collects and classifies numbers of people who answer the phone as good numbers to target with other scams. It may be tempting to see who’s on the other end of the line — since it clearly isn’t you — but you may be signing yourself up for many more unwanted phone calls.

2.       Your Grandkids

A call from the grandkids is a treat for many Americans, but this isn’t that kind of phone call. In this heist, a scammer calls the victim and poses as a family member (grandchild) in need of financial help. The idea is to create a sense of urgency so the victim will quickly wire money to the desperate family member.

In a more frightening version of this common ruse, scammers will “virtually kidnap” a loved one and call a relative to demand ransom.

3.       A Payday Lender

“Congratulations, you’ve been approved for a payday loan!” This is a variation on the sweepstakes scam and the call from “your credit card company” offering you lower interest rates. A good rule of thumb: If you didn’t apply for a loan, ask for a rate adjustment or enter a sweepstakes, it’s probably a scam.

4.       Tech Support

Most people know to avoid suspicious-looking emails, because they may contain malware that will infect your computer and compromise the information on it. Hackers know people are aware of this, so they’ll try to get into your computer by way of a phone call.

You may get a call from someone claiming to be part of a well-known tech company saying the company has detected malware on your computer, and they need remote access to your machine to resolve the issue. By agreeing, you’re letting the scammer into your computer, when he or she didn’t have access in the first place.

Conclusion: All of these tactics can put you at risk for identity theft, fraud or financial losses that could damage your credit or financial stability. If you receive a suspicious phone call, you can report it to the Federal Trade Commission, and as a fraud-monitoring precaution, it’s a good idea to regularly review your credit scores and reports for signs of abuse.

Warning signs - what a caller may tell you:

- "You must act 'now' or the offer won't be good."

- "You've won a 'free' gift, vacation, or prize." But you have to pay for "postage and handling" or other charges.

- "You must send money, give a credit card or bank account number, or have a check picked up by courier." You may hear this before you have had a chance to consider the offer carefully.

- "You don't need to check out the company with anyone." The callers say you do not need to speak to anyone including your family, lawyer, accountant, local Better Business Bureau, or consumer protection agency.

- "You don't need any written information about their company or their references."

- "You can't afford to miss this 'high-profit, no-risk' offer."

If you hear these-or similar-"lines" from a telephone salesperson, just say "no thank you," and hang up the phone.

Tips to Avoid Telemarketing Fraud:

1. Don't buy from an unfamiliar company. Legitimate businesses understand that you want more information about their company and are happy to comply. It's never rude to wait and think about an offer. Be sure to talk over big investments offered by telephone salespeople with a trusted friend, family member, or financial advisor. Always take your time making a decision. Legitimate companies won't pressure you to make a snap decision.

2. Always ask for and wait until you receive written material about any offer or charity. If you get brochures about costly investments, ask someone whose financial advice you trust to review them. But, unfortunately, beware - not everything written down is true.

3. Do your research. Always check out unfamiliar companies with your local consumer protection agency, Better Business Bureau, state Attorney General, the National Fraud Information Center, or other watchdog groups. Unfortunately, not all bad businesses can be identified through these organizations.

4. Ask for information. Obtain a salesperson's name, business identity, telephone number, street address, mailing address, and business license number before you transact business. Some con artists give out false names, telephone numbers, addresses, and business license numbers. Verify the accuracy of these items.

5. Sending money. Before you give money to a charity or make an investment, find out what percentage of the money is paid in commissions and what percentage actually goes to the charity or investment. Never send money or give out personal information such as credit card numbers and expiration dates, bank account numbers, dates of birth, or social security numbers to unfamiliar companies or unknown persons.

6. You must not be asked to pay in advance for services. Pay services only after they are delivered. Some con artists will send a messenger to your home to pick up money, claiming it is part of their service to you. In reality, they are taking your money without leaving any trace of who they are or where they can be reached.

7. Don't pay for a "free prize." If a caller tells you the payment is for taxes, he or she is violating federal law.

8. Before you receive your next sales pitch, decide what your limits are - the kinds of financial information you will and won't give out on the telephone.

9. Never respond to an offer you don't understand thoroughly. Before you send money, ask yourself a simple question. "What guarantee do I really have that this solicitor will use my money in the manner we agreed upon?"

Travel

Before Traveling:

1. Checks. Leave checkbooks and checks at home, in a locked safe. Use cash, traveler’s checks or credit cards for purchases. Chances are that you will not be writing checks. Leave these and any extra debit cards or credit cards that you will not be using at home.

2. ATM / Debit Cards & Credit Cards. Consider restricting the use of your ATM card to securely located Automated Teller Machines. Fake ATM machines are known to have been placed in high traffic tourist areas. Debit cards also provide thieves with a direct pipeline to your bank accounts. When used with a PIN, you need not sign for the purchase. When used for a “credit” purchase with a signature, no confirming PIN is needed.

3. Use credit cards while traveling. Only credit cards are protected by federal law as to the amount of money that you are responsible for if lost or stolen, and most companies now extend a zero liability policy to customers.

4. Leave bills at home. Business travelers often take advantage of quiet evenings in hotels to catch up with bookkeeping and paying bills. Unfortunately many people have access to your room while you are at meetings and victims have reported that account information and check information has been stolen this way.

5. Wallets. Don’t take anything in your wallet that is not absolutely necessary. Leave all cards with Social Security Numbers on them at home. If necessary, make a photocopy of a health card, cut off the last 4 numbers of the Social Security Number from the photocopy and carry that with you. Make sure that you have an emergency phone number (contact person) for emergency medical personnel to use.

6. Put Things On Hold. Put your mail on “postal hold” stating that for a period of time you wish to have your mail held at the post office. We prefer that term rather than “vacation hold” so that postal clerks will not know that you will be gone. Learn more at: https://holdmail.usps.com/holdmail

7. Make your home look lived-in. Arrange for friends or family you trust to pick-up newspapers, mail, and advertisement flyers in order to avoid drawing attention to your home. This will reduce the risk of break-ins which may result in the loss of valuables, including your identity. Nothing says “we’re out of town” more than a pile of newspapers. Don’t forget to stop delivery until you return. Also stop any other automatic deliveries, such as bottled water.

8. Neighbors, relatives and house-sitters. If you have someone that is going to check the house and has a key to your house, then lock up any documents with account numbers or Social Security Numbers.

9. Register in the Smart Traveler Enrollment Program: Visit https://step.state.gov/step/ to enroll in STEP, which provides comprehensive traveler information, including travel alerts and restrictions; information on visas or vaccinations; crime, stability and road conditions; laws of the country you’re visiting; and consular contact information.

Go through your wallet, purse and/or briefcase and remove any of the following items prior to travel:

- Social Security card

- Check book & deposit slips

- Birth certificate

- Credit card receipts

- Bills

- Extra Credit Cards

- Library card

- Video rental card

10.    Scan important travel documents and store them in a secure online repository. In the event that your information is lost or stolen, using an online repository allows you to easily access copies of your passport, drivers license, visa, and any other vital identification from anywhere in the world. Remember to do this for every person traveling with you, including children.

11.    Leave your debit card at home. Make credit cards, not ATM cards, your card of choice.

12.    Minimize number of credit cards in wallet. No more than two (2).

13.    Place all the removed items above into a locked safe.

14.    Pay bills before you go out of town.

15.    Place mail on “postal hold” with the Post Office. Arrange so mail may only be picked up by you and request that identification must be shown to receive held mail.

16.    Stop delivery of newspapers or any other items you may normally have delivered (water, automatically scheduled deliveries of products, etc).

17.    Make copies of your itinerary, passport data page, visas and driver’s license to leave with designated emergency contact.

18.    Notify a neighbor to watch your house. Let them know you are not moving.

During Travel:

1. Don't leave important documents in your car. Very often people leave their important documents in the car thinking that the documents are safe. Your documents will be as safe as your car might be.

2. Never leave your personal documents unsecured in the hotel rooms. This rule specially applies to global travel security where certain passports may be valuable. Lock up all valuables in room safes or hotel safes while you are out of your room. That includes laptops, PDA's, jewelry, passports, and other documents that contain personal identifying information or that would be of interest to a thief. A suitcase is not a secure way to lock up information.

3. Beware of pickpockets. While pickpocketing has been on the decline in the U.S for the past fifty years or so, it’s still a major problem in Europe. Pickpockets often work in groups, are often children and are typically well-dressed. Be extra vigilant around tourist attractions, public transportation, restaurants, bars and hotel lobbies.

4. Carry valuables safely. Your valuables and identification are a mere swipe away from a purse snatcher or pickpocket. Money belts kept under clothing are the safest. For stowing cash, credit cards and identification, inside pockets and sturdy shoulder bags with straps across the chest are much better than handbags, fanny packs or outside pockets. Vacation travelers should use fanny packs or travel pouches that are worn inside your shirt to carry important documents. Business travelers should be aware that pickpockets are also looking for laptops and PDA's that are temporarily out of your control- at airports, in lobbies and in dining areas.

5. Shoulder surfers. Besides pickpockets, identity thieves take advantage of people via shoulder surfing. "Shoulder Surfing" used to only apply to those who looked "over your shoulder" to see information. With the common use of cell phones, it is important to remember that you are in a public venue and may talk about things that a thief can use.

6. Back-up material: Carry photocopies of all travel documents including plane tickets, hotel reservations and passports. Keep these in a separate location from the originals.

7. Public restrooms. Ladies, do not hang your purse from a hook on the door. It is too easy for someone to reach over the top of the door and take it before you have time to react. The best place to store your purse while in the restroom is beside you or hung around your body.

8. Don't place valuable information on computers. Unless you secure that computer like you secure your ID card or driver's license. More often than not, sensitive information is placed on laptops which are carried around to public areas like restaurants, pools and bars without any regard for travel security risks. Individuals and businesses need to understand the identity theft risks associated with taking laptops containing sensitive information with them when they travel and develop policies and procedures to properly address the security of their information.

9. Take the copies. Carry photocopies instead of the originals when necessary and possible. For example, copies of passports are not acceptable forms of identification; however, copies of birth certificates may be in some cases when presented with other original documents. So, it is not necessary to carry all originals all the time.

10. Beware of your surroundings. When using your secret codes to access cash at ATMs, use your debit card at stores where you have to enter a PIN, access your personal or business laptop computer in public areas like airports, send e-mails, or access your voicemails, beware of your surroundings and the eyes looking over your shoulders. Cover your hand when typing the secret code. Don't be embarrassed as we all might get sometimes when we try hard to be secretive. It's better to be safe than sorry. After all, you are your own true travel security agent. Read about access code exposure.

11. Be prepared to deal with a lost or stolen passport case. Know what to do immediately in case of stolen or lost passport during your trips or at home to prevent identity theft. Always be prepared for the worst case scenario. Assuming you may lose your passport or other travel and personal information during a trip, be prepared and have a plan 'B' to notify and get passport replacement in order to move on with your travel arrangements. Copies of your birth certificate and passport or phone numbers of your credit card companies come in very handy when you need them, especially, if you're out of town and lose your credit card or passport. So, be prepared and have a contingency plan for any personal document loss, as part of your overall travel security plans.

12. Don't check-in your personal documentation. Never place your personal and travel documents in a luggage which you intend to check-in at the airports. Once you do that, you have just lost control over security of your personal documents.

13. Avoid identity theft when you visit the gym. If you think your personal items are safe at your favorite gym and health club while you work out, think again. Protect your personal belongings while you work out at the gym.

14. Watch your belongings on the plane. To ensure travel security by air, always place your personal belongings in an overhead compartment on the opposite side of the aisle you are seating. This way, you can detect any unauthorized search and theft of your personal items during the flight. In any full flight, people reorganize the overhead compartments to make room for their own items and someone may go through your items or even steal your items while pretending to be looking for extra space.

15. Travel with your items in the security chain. When you go through the travel security checks at the airports, make sure your items don't travel in the x-ray machine faster than you go through your body scan as they may be vulnerable to theft at the end of the scan process if you encounter delays in your own body scan process. Make sure you send your family members through the scans first and submit your valuable personal items right when you're ready to go through the scans yourself.

16. Take caution with public computers and Wi-Fi. If possible, avoid using public computers to access anything sensitive, such as conducting online banking, making purchases, or accessing email accounts. These computers could potentially have malware that is designed to capture the information you have entered. Avoid these same activities when using a public Wi-Fi connection as the information can easily be captured by criminals on the same connection. Make sure to use an encrypted Internet connection whenever you go online.

17. Be aware of social media updates. We all like to share photos online with our family and friends as we are traveling. However, when you tell people where you are, you are also telling them where you are not - at home.

Wi-Fi

Wi-Fi hotspots in coffee shops, libraries, airports, hotels, universities, and other public places are convenient, but often they’re not secure. If you connect to a Wi-Fi network, and send information through websites or mobile apps, it might be accessed by someone else.

To protect your information when using wireless hotspots, send information only to sites that are fully encrypted, and avoid using mobile apps that require personal or financial information.

1. Remember – any device could be at risk. Laptops, smartphones, and tablets are all susceptible to the wireless security risks.

2.       Treat all Wi-Fi links with suspicion. Don’t just assume that the Wi-Fi link is legitimate. It could be a bogus link that has been set up by a cybercriminal that’s trying to capture valuable, personal information from unsuspecting users. Question everything – and don’t connect to an unknown or unrecognized wireless access point.

It's pretty easy for someone who wants to intercept your data in a man-in-the-middle attack to set up a network called "Free Wi-Fi" or any other variation that includes a nearby venue name, to make you think it's a legitimate source.

WINDOWS: If you are connecting via Windows, make sure to turn off file sharing and mark the Wi-Fi connection as a public network. You can find this option in the Control Panel > Network and Sharing Center > Change Advanced Sharing Settings. Under the Public heading, turn off the file sharing toggle. You may also want to turn on the Windows Firewall when connecting to a public network if it's not already activated. These settings are also found in Control Panel > Windows Firewall.

MAC: Open up System Preferences and navigate to the Sharing icon. Then, untick the checkbox next to File Sharing. Here's a full rundown on how to disable sharing and removing public home folder sharing options in OS X. You can also turn on the firewall within OS X by heading to System Preferences, Security & Privacy and click the Firewall tab.

3.       Don’t Assume a Wi-Fi Hotspot is Secure. Most Wi-Fi hotspots do not encrypt the information you send over the internet and are not secure.

4.       When using a Wi-Fi hotspot, only log in or send personal information to websites that you know are fully encrypted. If you use an unsecured network to log in to an unencrypted site - or a site that uses encryption only on the sign-in page - other users on the network can see what you see and what you send.

They could hijack your session and log in as you. New hacking tools — available for free online — make this easy, even for users with limited technical know-how. Your personal information, private documents, contacts, family photos, and even your login credentials could be up for grabs.

An imposter could use your account to impersonate you and scam people in your contact lists. In addition, a hacker could test your username and password to try to gain access to other websites – including sites that store your financial information.

5.       Don’t stay permanently signed in to accounts. When you’ve finished using an account, log out.

6.       Do not use the same password on different websites. It could give someone who gains access to one of your accounts access to many of your accounts.

7.       Many web browsers alert users who try to visit fraudulent websites or download malicious programs. Pay attention to these warnings, and keep your browser and security software up-to-date.

8.       If you regularly access online accounts through Wi-Fi hotspots, use a virtual private network (VPN). VPNs encrypt traffic between your computer and the internet, even on unsecured networks. You can obtain a personal VPN account from a VPN service provider. In addition, some organizations create VPNs to provide secure, remote access for their employees. By using a VPN when you connect to a public Wi-Fi network, you’ll effectively be using a ‘private tunnel’ that encrypts all of your data that passes through the network. This can help to prevent cybercriminals – that are lurking on the network – from intercepting your data.

9.       Try to verify it’s a legitimate wireless connection. Always confirm the legitimacy of a Wi-Fi network before connecting to it; do not rely on the name alone. If there are multiple access points for the same venue, ask a staff member which one to use. Some bogus links – that have been set up by malicious users – will have a connection name that’s deliberately similar to the coffee shop, hotel, or venue that’s offering free Wi-Fi. If you can speak with an employee at the location that’s providing the public Wi-Fi connection, ask for information about their legitimate Wi-Fi access point – such as the connection’s name and IP address.

10.    Avoid using specific types of website. It’s a good idea to avoid logging into websites where there’s a chance that cybercriminals could capture your identity, passwords, or personal information – such as social networking sites, online banking services, or any websites that store your credit card information.

11.    Software. Never install software while using public Wi-Fi, as it could introduce viruses into your computer. For example, a common attack is to inform the user that his browser is using outdated Flash and then redirect the user to a fake Adobe website that will install a virus instead of the real software.

12.    Forget the network. Once you are all done with your Web browsing, make sure to log off any services you were signed into. Then, tell your device to forget the network. This means that your phone or PC won't automatically connect again to the network if you're in range.

Windows: Uncheck the "Connect Automatically" checkbox next to the network name before you connect, or head to Control Panel > Network and Sharing Center and click on the network name. Click on "Wireless Properties" and then uncheck "Connect automatically when this network is in range."

Mac: Go to System Preferences, go to Network, and under the Wi-Fi section click Advanced. Then uncheck "Remember networks this computer has joined." You can also individually remove networks by selecting the name and pressing the minus button underneath.

Android: Enter into your Wi-Fi network list, long press the network name and select "Forget Network." On iOS, head to Settings, select Wi-Fi networks, click the "i" icon next to the network name and choose "Forget This Network." As an extra precaution, you should also turn on "Ask To Join Networks" which is also found in the Wi-Fi networks menu.

13.    Enable two-factor authentication. It's good practice to enable two-factor authentication on services that support it. This way, even if someone does manage to sniff out your password when on public Wi-Fi, you have an added layer of protection. Also, use one form of two-factor for logging in, and a second, different two-factor combo for recovery.

Here is a list of sites that offer two-factor authentication: http://www.FraudSmarts.com/twofactor

Test your knowledge

Interactive calculators to find out what you know and what you need to know to reduce your risk

- Safe Social Networking

How well do you protect your I.D. on social sites?

www.FraudSmarts.com/test/socialnetworking

- Travel & Mobile Safety

Are you staying safe in hot-spots and when traveling?

www.FraudSmarts.com/test/travel

- Social Engineering

Are you able to avoid being tricked by a hacker?

www.FraudSmarts.com/test/socialengineering

- ATM, Credit & Debit Card

Are you doing everything you can to protect yourself?

www.FraudSmarts.com/test/cards

- Preventing Identity Theft

What is your risk of becoming an I.D theft victim?

www.FraudSmarts.com/test/idtheft

- Smart Phone Security

Are you protected against mobile security threats?

www.FraudSmarts.com/test/smartphones

- Senior Citizens

Are you a safe, protected & security minded senior citizen?

www.FraudSmarts.com/test/seniors

- Data Breach

Can you put yourself at less risk when there's a data breach?

www.FraudSmarts.com/test/data

- Removable Devices

How vulnerable is your valuable business data?

www.FraudSmarts.com/test/devices

- Small Business Fraud

Is your company or organization at risk for fraud?

www.FraudSmarts.com/test/business

- For Employees & Managers

Understanding fraud laws and regulations.

www.FraudSmarts.com/test/employees

- College Students

College students are at the most risk for identity theft.

www.FraudSmarts.com/test/students

- Phishing

Are you able to navigate the dark waters and avoid a phishing scam?

www.FraudSmarts.com/test/phishing

- Investment Fraud

Do you make sure your investments are safe?

www.FraudSmarts.com/test/investment

- Computer & Home Network

Are you sure that you're protected at home?

www.FraudSmarts.com/test/home

- Online Shopping

Do you know how to keep your money safe?

www.FraudSmarts.com/test/shopping

More Resources

- Online Tools & Free Software

www.FraudSmarts.com/tools

- Video Library

www.FraudSmarts.com/watch

- Print Planning Guides & Handouts

www.FraudSmarts.com/print

Victim help & resources

What to do right away if your identity is stolen:

Did someone steal and use your personal information? Act quickly to limit the damage.

Step 1: Call the companies where you know fraud occurred.

1. Call the fraud department. Explain that someone stole your identity.

2. Ask them to close or freeze the accounts. Then, no one can add new charges unless you agree.

3. Change logins, passwords and PINS for your accounts.

Tip: You might have to contact these companies again after you have an Identity Theft Report.

Step 2: Place a fraud alert and get your credit report.

Contact one of the three credit bureaus. That company must tell the other two.

Equifax.com/CreditReportAssistance

1-888-766-0008

Experian.com/fraudalert

1-888-397-3742

TransUnion.com/fraud

1-800-680-7289

Tip: A fraud alert is free. It will make it harder for someone to open new accounts in your name. You’ll get a letter from each credit bureau. It will confirm that they placed a fraud alert on your file.

Get your free credit report right away. Go to annualcreditreport.com or call 1-877-322-8228.

Did you already order your free annual reports this year? If so, you can pay to get your report immediately. Or follow the instructions in each fraud alert confirmation letter to get a free report, but it might take longer.

Review your reports. Make note of any account or transaction you don’t recognize. This will help you report the theft to the FTC and the police.

Step 3: Report identity theft to the FTC.

1. Complete the FTC’s online complaint form (http://www.ftc.gov/complaint). Give as many details as you can. The complaint form is not available on mobile devices, but you can call 1-877-438-4338 to make your report.

2. Ask them to close or freeze the accounts. Then, no one can add new charges unless you agree.

3. Print and save your FTC Identity Theft Affidavit immediately. Once you leave the page, you won’t be able to get your affidavit.

Tip: Based on the information you enter, the FTC complaint system will create your Identity Theft Affidavit. You’ll need this to complete other steps.

Do you need to update your affidavit? Call 1-877-438-4338.

Step 4: File a report with your local police department.

Go to your local police office with:

1. a copy of your FTC Identity Theft Affidavit

2. a government-issued ID with a photo

3. proof of your address (mortgage statement, rental agreement, or utilities bill)

4. any other proof you have of the theft (bills, IRS notices, etc.)

5. FTC's Memo to Law Enforcement.

Tell the police someone stole your identity and you need to file a report. If they are reluctant, show them the FTC's Memo to Law Enforcement (http://www.consumer.ftc.gov/sites/default/files/articles/pdf/pdf-0088-ftc-memo-law-enforcement.pdf).

Ask for a copy of the police report. You’ll need this to complete other steps.

Create your Identity Theft Report by combining your FTC Identity Theft Affidavit with your police report.

Tip: Your identity theft report proves to businesses that someone stole your identity. It also guarantees you certain rights. Know your rights, go here: https://www.identitytheft.gov/Know-Your-Rights

What To Do Next

Close new accounts opened in your name.

- Explain that someone stole your identity.

- Ask the business to close the account.

- Ask the business to send you a letter confirming that:

- the fraudulent account isn’t yours

- you aren’t liable for it

- it was removed from your credit report

- Keep this letter. Use it if the account appears on your credit report later on.

The business may require you to send them a copy of your Identity Theft Report or complete a special dispute form. This sample letter can help (https://www.identitytheft.gov/sample-letters/identity-theft-dispute-new-account.html).

Write down who you contacted and when.

Remove bogus charges from your accounts.

Call the fraud department of each business

- Explain that someone stole your identity.

- Tell them which charges are fraudulent. Ask the business to remove them.

- Ask the business to send you a letter confirming they removed the fraudulent charges.

- Keep this letter. Use it if this account appears on your credit report later on.

The business may require you to send them a copy of your Identity Theft Report or complete a special dispute form. This sample letter can help (https://www.identitytheft.gov/sample-letters/identity-theft-dispute-new-account.html).

Write down who you contacted and when.

Correct your credit report.

Write to each of the three credit bureaus. This sample letter can help

(https://www.identitytheft.gov/sample-letters/identity-theft-credit-bureau.html).

- Include a copy of your Identity Theft Report and proof of your identity,

like your name, address, and Social Security number.

- Explain which information on your report came from identity theft.

- Ask them to block that information.

Equifax.com

P.O. Box 105069

Atlanta, GA 30348-5069

1-800-525-6285

Experian.com

P.O. Box 9554

Allen, TX 75013

1-888-397-3742

TransUnion.com

Fraud Victim Assistance Department

P.O. Box 2000

Chester, PA 19022-2000

1-800-680-7289

Resolve tax-related identity theft.

If you get an IRS notice in the mail, follow the instructions provided.

Complete IRS Form 14039, Identity Theft Affidavit (http://www.irs.gov/pub/irs-pdf/f14039.pdf) Mail or fax the form according to the instructions. Include proof of your identity, like a copy of your Social Security card, driver’s license or passport.

Did the notice say you were paid by an employer you don't know? Send a letter to the employer explaining that someone stole your identity, and that you don’t work for the employer.

File your tax return, and pay any taxes you owe. You might have to mail paper tax returns.

Write down who you contacted and when. Keep copies of any letters you send.

If these steps don’t resolve your situation, contact the IRS for specialized assistance at 1-800-908-4490.

Report a misused Social Security number.

Social Security card lost or stolen?

Apply online (http://www.ssa.gov/ssnumber/) for free to get a replacement card.

Do you think someone else is using your Social Security number for work?

Review your Social Security work history by creating an account at socialsecurity.gov/myaccount .

If you find errors, contact your local SSA office (https://secure.ssa.gov/ICON/main.jsp).

Stop debt collectors from trying to collect debts you don't owe

Write to the debt collector within 30 days of getting the collection letter. This sample letter can help (https://www.identitytheft.gov/Sample-Letters/identity-theft-debt-collector).

- Tell the debt collector someone stole your identity, and you don’t owe the debt.

- Send copies of your Identity Theft Report and any other documents that detail the theft.

Contact the business where the fraudulent account was opened.

- Explain that this is not your debt.

- Tell them to stop reporting this debt to the credit bureaus.

- Ask for information about the debt, and how it happened. The business must give you details if you ask. This sample letter can help

( https://www.identitytheft.gov/Sample-Letters/request-records-related-identity-theft ).

For example, if someone opened a credit card in your name, ask for a copy of the application and applicant’s signature.

If you haven’t already, ask the credit bureaus to block information about this debt from your credit report.

Write down who you contacted and when. Keep copies of any letters you send.

Replace government-issued IDs.

Social Security card lost or stolen? Apply online for free to get a replacement card

( http://www.ssa.gov/ssnumber/ ).

Driver’s license lost or stolen? Contact the nearest DMV branch to report it

( http://www.usa.gov/Topics/Motor-Vehicles.shtml ).

The state might flag your license number in case someone else tries to use it, or they might suggest that you apply for a replacement license.

Passport lost or stolen? Call the State Department at 1-877-487-2778 or TTY 1-888-874-7793. If you want to replace the passport, you have several options:

(http://travel.state.gov/content/passports/english/passports/information/where-to-apply/agencies.html.)

- If you are traveling within the next two weeks, make an appointment to apply in person at a Passport Agency or Center.

- If you are not traveling within two weeks, submit Form DS-11

( http://www.state.gov/documents/organization/212239.pdf ) and DS-64

( http://www.state.gov/documents/organization/212245.pdf ) in person at an authorized Passport Application Acceptance Facility ( http://iafdb.travel.state.gov/ ).

Resolve child identity theft.

Follow the usual steps for What To Do Right Away and What To Do Next with 2 exceptions:

1. When requesting a credit report, ask for a search based only on your child’s Social Security number (SSN). You’ll need to do this by phone or email

2. The SSN-only search means that any items associated with your child’s SSN are included in the report - even if the thief used your child’s SSN with a different name.

Equifax

1-800-525-6285

Experian

1-888-397-3742

TransUnion.com

childidtheft@transunion.com

When you correct your child’s credit report, send each credit reporting agency the Minor’s Status Declaration form (http://www.consumer.ftc.gov/articles/pdf-0095-uniform-minor-status-declaration.pdf). It provides proof that your child is a minor. Include a letter with the form that asks for all information associated with your child’s name or SSN to be removed. If you do this, you don’t have to send a "blocking" request for the child.

Because a minor cannot legally agree to contracts, any debts on your child’s credit report are fraudulent by definition.

Resolve medical identity theft.

If you think a thief used your personal information to get medical services, get copies of your records.

1. Contact each doctor, clinic, hospital, pharmacy, laboratory, and health plan where the thief may have used your information. Ask for copies of your medical records.

2. Complete the providers’ records request forms and pay any fees required to get copies of your records.

3. Check your state’s health privacy laws (http://www.healthinfolaw.org/comparative-analysis/individual-access-medical-records-50-state-comparison). Some state laws make it easier to get copies of your medical records.

Federal law gives you the right to know what’s in your medical files.

Did your provider refuse to give you copies of the records to protect the identity thief’s privacy rights? You can appeal. Contact the person listed in your provider’s Notice of Privacy Practices, the patient representative, or the ombudsman. Explain the situation and ask for your file.

If the provider refuses to provide your records within 30 days of your written request, you may complain to the U.S. Department of Health and Human Services Office for Civil Rights (http://www.hhs.gov/ocr).

Review your medical records, and report any errors to your health care provider.

1. Write to your health care provider to report mistakes in your medical records.

2. Include a copy of the medical record showing the mistake.

3. Explain why this is a mistake, and how to correct it.

4. Include a copy of your Identity Theft Report.

5. Send the letter by certified mail, and ask for a return receipt.

Your health care provider should respond to your letter within 30 days. Ask the provider to fix the mistake and notify other health care providers who may have the same mistake in their records.

Notify your health insurer.

1. Send your Identity Theft Report to your health insurer’s fraud department. Tell them about any errors in your medical records.

- If there are medical billing errors on your credit report, notify all 3 credit reporting companies.

- Write down who you contacted and when. Keep copies of any letters you send.

For more information, visit: https://www.identitytheft.gov

Government & Law Enforcement Agencies

International Government Agencies

- CA Canada Parliament - http://www.parl.gc.ca/

- CA Department of Justice - http://canada.justice.gc.ca/

- UK Her Majesty Treasury - http://www.hm-treasury.gov.uk/

- UK CCTA Government Information - http://www.open.gov.uk/

Banking & Finance

- American Bankers Association - http://www.aba.com/

- American Express - http://www.americanexpress.com/

- MasterCard International - http://www.mastercard.com/

- Mondex - http://www.mondex.com/

- NOVUS - http://www.novusnet.com/

- Visa International - http://www.visa.com/

- Wall Street Journal - http://wsj.com/

- World Bank - http://www.worldbank.org/

U.S. Government Agencies

- Department of the Treasury - http://www.ustreas.gov/

- Federal Trade Commission - http://www.ftc.gov/

- FedWorld Information Network - http://www.fedworld.gov/

- Financial Crimes Enforcement Network - http://www.fincen.gov/index.html

- Office of the Director of Central Intelligence - http://www.odci.gov/

- Securities and Exchange Commission - http://www.sec.gov/

- The United States Senate - http://www.senate.gov/

- The White House - http://www.whitehouse.gov/

- THOMAS - U.S. Congress on the Internet - http://thomas.loc.gov/

- U.S. House of Representatives - http://www.house.gov/

- Dept of State - FINANCIAL CRIMES - http://www.state.gov/g/inl/

- US Supreme Court - http://www.supremecourtus.gov/

- U.S. Marshals - http://www.usmarshals.gov/

Law Enforcement Agencies

- Canada - Royal Canadian Mounted Police - http://www.rcmp-grc.gc.ca/

- Interpol - http://www.interpol.int/

- U.S. Alcohol Tobacco & Firearms - http://www.atf.treas.gov/

- U.S. Federal Bureau of Investigation - http://www.fbi.gov/

- U.S. Immigration and Customs Enforcement - http://www.ice.gov/cornerstone

- U.S. Internal Revenue Service - http://www.irs.ustreas.gov/

- U.S. Postal Inspection Service - https://postalinspectors.uspis.gov/

- U.S. Secret Service - http://www.treas.gov/usss/

- FindLaw - http://www.findlaw.com/

Forensic & Biometrics Sciences

- American Academy of Forensic Sciences - http://www.aafs.org/

- American Society of Crime Laboratory Directors - http://www.ascld.org/

- Canadian Society Of Forensic Science - http://www.csfs.ca/

- FBI Crime Lab - http://www.fbi.gov/programs/lab/fsc/current/index.htm

- National Association of Document Examiners - http://expertpages.com/org/nade.htm

Healthcare & Drugs

To report problems with a medication or medical device:

- FDA - Find out where your complaint should go at:

http://www.fda.gov/opacom/backgrounders/problem.html.

To report scams and suspicious activity involving Medicare:

- HHS Office of Inspector General (OIG) - Call the OIG’s fraud hotline at

1-800-447-8477 (TTY: 1-800-377-4950).

- FTC - Visit ftc.gov/complaint, or call 1-877-382-4357 (TTY: 1-866-653-4261).

To report fraud or abuse related to a Medicare Part D prescription drug plan:

- Medicare Drug Integrity Contractors (MEDICs) - Call 1-877-772-3379.

For help with a complaint about a long-term care facility:

- Your state long-term care ombudsman— Find an ombudsman with the Ombudsman

Locator: at: ltcombudsman.org.

To report suspected elder abuse, neglect, or exploitation:

- National Center on Elder Abuse - Visit: http://www.ncea.aoa.gov/, or call 1-800-677-1116.

Report Phishing & Spam

Forward spam that is phishing for information to spam@uce.gov and to the company, bank, or organization impersonated in the phishing email. Most organizations have information on their websites about where to report problems.

You also may report phishing email to reportphishing@antiphishing.org. The Anti-Phishing Working Group, a consortium of ISPs, security vendors, financial institutions and law enforcement agencies, uses these reports to fight phishing. If you believe you've been scammed, file your complaint at https://www.ftccomplaintassistant.gov. Victims of phishing can become victims of identity theft.

Credit bureaus & advocacy groups

Credit Bureaus

- Annual Credit Report - https://www.annualcreditreport.com

Obtain your free annual credit through this official site.

- Opt Out of Pre-Approved Credit Offer - https://www.optoutprescreen.com

Register with credit bureaus to permanently remove your name from pre-approved credit lists.

- Equifax - http://learn.equifax.com/identity-theft

Find out about fraud in your local area and the difference between a fraud alert and a security freeze.

- Experian - http://www.experian.com/credit-education/identity-fraud-index.html

Learn the warning signs of fraud and how to prevent it.

- TransUnion - http://www.transunion.com/corporate/personal/fraudIdentityTheft.page

Discover how to spot and recover from fraud and identity theft.

- Dun & Bradstreet - http://www.dnb.com

Consumer Guides

- USPS - Know Your Rights - https://about.usps.com/publications/pub308.pdf

A guide for victims and witnesses of crimes

- Fraud.org - http://www.fraud.org

A project of the National Consumer League

Financial Reporting Organizations

- ISO Insurance Services - http://www.iso.com/Products/A-PLUS/Consumers-Order-Your-Free-A-PLUS-Loss-History-Report.html

Obtain an A-Plus Report on your insurance loss history.

- Medical Information Bureau (MIB Group)

http://www.mib.com/html/request_your_record.html

Get a copy of your MIB consumer file containing information on medical conditions and treatment.

Advocacy Organizations and Tools

- Identity Theft Resource Center (ITRC) - http://www.idtheftcenter.org

Acquire information, research, prevention tips, victim information guides, and other resources from this nonprofit organization.

- National Do-Not-Call Registry - http://www.fcc.gov/cgb/donotcall

Register your phone numbers, including wireless numbers, on the FCC's National Do-Not-Call Registry.

- Direct Marketing Association Name Deletion List - https://www.dmachoice.org

Add your name to the mail and email "name deletion lists" used nationwide by marketers.

- Privacy Rights Clearinghouse - http://www.privacyrights.org

Access additional identity theft resources, consumer information and other resources.

Legal Resources

- FindLaw - http://www.findlaw.com

Information about a specific legal topic

- Australasian Legal Information Institute - http://www.austlii.edu.au

A joint facility of UTS and UNSW Faculties of Law

- CA Canadian Bar Association - http://www.cba.org

- U.S. Supreme Court - http://www.supremecourtus.gov

- U.S. American Bar Association - http://www.abanet.org

- U.S. Law Library of Congress - http://www.loc.gov/rr/law

Online sources of information on government & law by region, country or U.S. state.

- U.S. National Association of Attorneys General (NAAG) - http://www.naag.org

Data Breach Safety

When Information Is Lost or Exposed

Did you recently get a notice that says your personal information was exposed in a data breach? Did you lose your wallet? Or learn that an online account was hacked? Depending on what information was lost, there are steps you can take to help protect yourself from identity theft.

Social Security number

- If a company responsible for exposing your information offers you free credit monitoring, take advantage of it.

- Get your free credit reports from annualcreditreport.com . Check for any accounts or charges you don’t recognize.

- Consider placing a credit freeze . A credit freeze makes it harder for someone to open a new account in your name.

- If you place a freeze, be ready to take a few extra steps the next time you apply for a new credit card or cell phone - or any service that requires a credit check.

- If you decide not to place a credit freeze, at least consider placing a fraud alert .

- Try to file your taxes early - before a scammer can. Tax identity theft happens when someone uses your Social Security number to get a tax refund or a job. Respond right away to letters from the IRS.

- Don’t believe anyone who calls and says you’ll be arrested unless you pay for taxes or debt - even if they have part or all of your Social Security number, or they say they’re from the IRS.

- Continue to check your credit reports at annualcreditreport.com . You can order a free report from each of the three credit reporting companies once a year.

Online login or password

- Log in to that account and change your password. If possible, also change your username.

If you can’t log in, contact the company. Ask them how you can recover or shut down the account.

- If you use the same password anywhere else, change that, too. Learn more about password here

- Is it a financial site, or is your credit card number stored? Check your account for any charges that you don’t recognize.

Debit or credit card number

- Contact your bank or credit card company to cancel your card and request a new one.

- Review your transactions regularly. Make sure no one misused your card.

If you find fraudulent charges, call the fraud department and get them removed.

- If you have automatic payments set up, update them with your new card number.

- Check your credit report at annualcreditreport.com.

Bank account information

- Contact your bank to close the account and open a new one.

- Review your transactions regularly to make sure no one misused your account.

If you find fraudulent charges or withdrawals, call the fraud department and get them removed.

- If you have automatic payments set up, update them with your new bank account information.

- Check your credit report at annualcreditreport.com.

Driver's license information

- Contact your nearest motor vehicles branch (link is external) to report a lost or stolen driver’s license. The state might flag your license number in case someone else tries to use it, or they might suggest that you apply for a duplicate.

- Check your credit report at annualcreditreport.com.

Copyright

Copyright © 2017 by Dan Szabo

All rights reserved. This book or any portion thereof may not be reproduced or used in any manner whatsoever without the express written permission of the publisher except for the use of brief quotations in a book review or scholarly journal.

Second Printing: 2017

ISBN 978-1-365-62251-9

eFraud Prevention, LLC

P.O. Box 832

Southbury, CT 06488

www.fraudsmarts.com

Table of Contents

ACH & Wire Fraud Prevention

ATM Machine Safety

ATM Skimming

Bitcoin

Business basics

Car security

Children & teens

Cloud safety

College Students

Computers

Credit cards

Data breaches

Debit cards

Disposal - PC, smart phone & tablet

Email safety

Gift / Reward cards

Home banking

Home network

I.D. theft

Internet of Things

Investment fraud

Mailbox

Malware

Online dating

Passwords

Phishing

Ransomware

Senior citizens

Shopping Online

Smart phones

Social media

Spear phishing risks

Tax filing

Tech support scams

Telephone

Travel

Wi-Fi

Test your knowledge

More Resources

Victim help & resources

Copyright