The Latest Phone Scam Targets Your Bank Account

Posted in: Data Security,Scams & Scammers,The Ugly | June 26th, 2010
Imagine getting hundreds or thousands of calls on your home, business, or cell phone, tying up the lines. And when you answer, you hear anything from dead air to recorded messages, advertisements, or even phone sex menus.
It’s annoying, no doubt. But it could be more than that—it could be a sign that you’re being victimized by the latest scam making the rounds. This ”telephone denial-of-service attack“ could be the precursor to a crime targeting your bank accounts.
Denial-of-service attacks, by themselves, are nothing new—computer hackers use them to take down websites by flooding them with large amounts of traffic.
In a recent twist, criminals have transferred this activity to telephones, using automated dialing programs and multiple accounts to overwhelm the phone lines of unsuspecting citizens.
share.gif
Why are they doing it? Turns out the calls are simply a diversionary tactic: while the lines are tied up, the criminals—masquerading as the victims themselves—are raiding the victims’ bank accounts and online trading or other money management accounts.
Here, in a nutshell, is how the whole thing works:
*
Weeks or months before the phone calls start, a criminal uses social engineering tactics or malware to elicit personal information from a victim that this person’s bank or financial institution would have—like account numbers and passwords. Perhaps the victim responded to a bogus e-mail phishing for information, inadvertently gave out sensitive information during a phone call, or put too much personal information on social networking sites that are trolled by criminals.
*
Using technology, the criminal ties up the victim’s various phone lines.
*
Then, the criminal either contacts the financial institution pretending to be the victim…or pilfers the victim’s online bank accounts using fraudulent transactions. Normally, the institution calls to verify the transactions, but of course they can’t get through to the victim over the phone.
*
If the transactions aren’t made, the criminals sometimes re-contact the financial institution as the victim and ask for it to be done. Or they add their own phone number to victims’ accounts and just wait for the bank to call.
By the time the victim or the financial institution realizes what happens, it’s too late.
Law enforcement and industry response
While the lines are tied up, the criminals are raiding victims’ accounts.
The FBI first learned about this emerging scheme through one of its private industry partners, which told us how a Florida dentist lost $400,000 from his retirement account after a denial-of-service attack on his phones.
And as of April of this year, there has definitely been a noticeable surge in telephone denial-of-service attacks, with numerous incidents having been reported in several Eastern states.
To help fight these schemes, the FBI has teamed up with the Communication Fraud Control Association—comprised of security professionals from communication providers—to analyze the patterns and trends of telephone denial-of-service attacks, educate the public, and identify the perpetrators and bring them to justice.
Ultimately, though, it’s individual consumers and small- and medium-sized businesses on the front line of this battle. So take precautions: never give out personal information to an unsolicited phone caller or via e-mail; change online banking and automated telephone system passwords frequently; check your account balances often; and protect your computers with the latest virus protection and security software.
And if you think you may have been targeted by a telephone denial-of-service attack, contact your financial institution and your telephone provider, and file a complaint with the FBI’s Internet Crime Complaint Center.

Imagine getting hundreds or thousands of calls on your home, business, or cell phone, tying up the lines. And when you answer, you hear anything from dead air to recorded messages, advertisements, or even phone sex menus.
It’s annoying, no doubt. But it could be more than that—it could be a sign that you’re being victimized by the latest scam making the rounds. This ”telephone denial-of-service attack“ could be the precursor to a crime targeting your bank accounts.
Denial-of-service attacks, by themselves, are nothing new—computer hackers use them to take down websites by flooding them with large amounts of traffic.
In a recent twist, criminals have transferred this activity to telephones, using automated dialing programs and multiple accounts to overwhelm the phone lines of unsuspecting citizens.
share.gifWhy are they doing it? Turns out the calls are simply a diversionary tactic: while the lines are tied up, the criminals—masquerading as the victims themselves—are raiding the victims’ bank accounts and online trading or other money management accounts.
Here, in a nutshell, is how the whole thing works:
*      Weeks or months before the phone calls start, a criminal uses social engineering tactics or malware to elicit personal information from a victim that this person’s bank or financial institution would have—like account numbers and passwords. Perhaps the victim responded to a bogus e-mail phishing for information, inadvertently gave out sensitive information during a phone call, or put too much personal information on social networking sites that are trolled by criminals.
*      Using technology, the criminal ties up the victim’s various phone lines.
*      Then, the criminal either contacts the financial institution pretending to be the victim…or pilfers the victim’s online bank accounts using fraudulent transactions. Normally, the institution calls to verify the transactions, but of course they can’t get through to the victim over the phone.
*      If the transactions aren’t made, the criminals sometimes re-contact the financial institution as the victim and ask for it to be done. Or they add their own phone number to victims’ accounts and just wait for the bank to call.
By the time the victim or the financial institution realizes what happens, it’s too late.
Law enforcement and industry response
While the lines are tied up, the criminals are raiding victims’ accounts.
The FBI first learned about this emerging scheme through one of its private industry partners, which told us how a Florida dentist lost $400,000 from his retirement account after a denial-of-service attack on his phones.
And as of April of this year, there has definitely been a noticeable surge in telephone denial-of-service attacks, with numerous incidents having been reported in several Eastern states.
To help fight these schemes, the FBI has teamed up with the Communication Fraud Control Association—comprised of security professionals from communication providers—to analyze the patterns and trends of telephone denial-of-service attacks, educate the public, and identify the perpetrators and bring them to justice.
Ultimately, though, it’s individual consumers and small- and medium-sized businesses on the front line of this battle. So take precautions: never give out personal information to an unsolicited phone caller or via e-mail; change online banking and automated telephone system passwords frequently; check your account balances often; and protect your computers with the latest virus protection and security software.
And if you think you may have been targeted by a telephone denial-of-service attack, contact your financial institution and your telephone provider, and file a complaint with the FBI’s Internet Crime Complaint Center.

1 Comment »

WARNING! Windows Passwords EZ to delete

Posted in: Data Security,Windows Tips and Tricks | April 5th, 2009

I just learned something new today.  A customer called to say that she forgot her Windows login password, and wanted to know if I could help her access her computer.   Oddly, I’ve never had this particular request before.

I did some research and found (fairly easily) a free Linux-based program that I could put on a CD.  The program boots the computer then runs through a routine by which you are able to access any Windows account on the computer, and blank out the password for that account.

I tried it on my own computer, and it worked quite well.  This was a good solution for my customer.

But it occurred to me that a tool like this can be used by the Dark Forces as well.  Anyone with a little computer knowledge can follow the instructions that come with the program I found (and there are surely others like it) and hack past a windows password like a breeze through a wind chime.

I don’t plan on posting the link to the software or the instructions for using it here, because I don’t want to provide anyone with the tools to steal data from others. 

But I thought that it was worth mentioning that this is possible, and for someone who knows enough about computers to burn a CD, it’s pretty easy.

So the moral of the story is, if you have sensitive data on your computer, don’t trust your Windows login password to keep it safe.  The best way to keep your data completely safe from prying eyes is to use encryption software to password protect a folder or files.

Just do a Google search on “freeware file encryption tools” and you’ll surely find plenty of security. 

Just don’t encrypt your files and then forget your password, because then you are really hosed!

No Comments »
Email Extractor european union