Please don’t complete these surveys, or click on the links.

It’s a scam to get your personal information which will then be used to spam you until your inbox explodes!

Remember the golden rule:

IF IT SEEMS TOO GOOD TO BE TRUE – IT USUALLY IS!

I Can’t Keep Up!

A “Clear as Crystal” guide to keeping your family safe online

by Charles Conway

The Internet is fantastic!

But it can also be a dangerous place for our kids.

Internet safety trainer Charles Conway offers practical tips and advice on topics including:

How to monitor your child’s Facebook account without violating their privacy

The signs and effects of Cyberbullying

How and where online predators find their victims

Using parental controls effectively and

Deciphering the ‘Netspeak’ jargon that looks like a foreign language

This guide won’t turn you into an expert overnight, but it WILL help you to level the playing field…

I Can’t Keep Up! is available now in the following formats:

Paperback: £6.99 (+ £2.99 p&p in the UK)

Buy Now at Lulu.com

ePub: £5.99 (compatible with most ebook readers)

Buy Now at Lulu.com

Kindle: £5.14

Buy Now at Amazon.co.uk

photo by Freestyle Interactive.

Is this THE most ridiculous use of a QR code in the world?

We picked up this picture on Twitter this morning, captioned “The award for the most stupid use of QR codes goes to…”

At Scam Detectives HQ we couldn’t agree more.

Let’s just take a moment to look at the sheer stupidity of this poster, shall we?

What is the poster there for?

To warn London Underground users to keep their valuables out of site, so that pickpockets can’t steal them.

So why is it stupid?

Because it then encourages those same London Underground users to get their phone out of their pocket and stand there scanning the QR code which links to a website advising them how to keep their valuables safe from pickpockets.

Won’t this then let those same pickpockets know that a) you have a cool smartphone  and b) which pocket you’re keeping it in?

Advice on the British Transport Police website (which the QR code links to) includes:

Keep wallets, mobile phones and mp3 players in a secure inside pocket

Except when you’re scanning QR codes on posters. Apparently.

Remember:

When you’re on the Tube, or any crowded public place, you should be aware of where your valuables are at all times, and preferably keep your wallet, iPod and mobile phone in an insite pocket (with a zip if you have one). Don’t advertise that you have the latest tech, keep it hidden and you’re less likely to make yourself a target.

Today, they’ve REALLY outdone themselves.

What’s the problem then?

It’s that black block thingy – the one that looks like this:

Scan me with your phone to see what I do...

What is it?

It’s a QR code, and if you scan it with your phone’s camera, it’ll take you to the MBNA mobile site, where you can check your credit card balance, make payments, view statements and transfer money.

Sounds useful – Isn’t it?

There’s absolutely nothing wrong with MBNA offering a mobile version of their site. It enhances the availability of their credit card servicing website to those who want/need to access it when they’re out and about, or those whose only access to the ‘net is via their mobile.

HOWEVER, at Scam Detectives HQ we’re concerned that if banks or credit card suppliers get their users used to trusting QR codes in genuine emails, it’s only a short step away from scammers including them in phishing emails, which could lead to users inadvertently visiting dodgy websites or downloading fake apps which could:

• Make your calendar, contacts and credit card information (if you shop or bank online using your smartphone) visible to cybercriminals.
• Attempt to steal your Google or Facebook password – many apps are integrated with various social networks.
• Track your location.
• Install keylogging software.
• Send an SMS to a premium number, racking up your phone bill.
• “Jailbreak” a device and distribute additional malware.
• Redirect users to malicious applications.

For more information about how QR codes could be used as part of a scammer’s toolkit, see our guest blog from Norman Feiner, MD of Simply Fone

OK, so QR codes can be risky – Why are you having a go at MBNA?

If users think it’s OK to scan QR codes that appear in emails from MBNA, why would they hesitate to scan them when they receive “phishing” emails that purport to come from their bank?

Bearing in mind that smartphone users are less likely to have anti-virus or other security software installed on their phones, it’s a recipe for disaster and MBNA have a responsibility to their customers to educate them about safe practices, and not to encourage unsafe ones.

So what’s your advice?

If you want to visit MBNA’s mobile offering, open your phone’s web browser and type in the following URL:  http://www.mbna.co.uk/m/

NEVER scan QR codes in emails that look like they come from your bank or ANY institution with whom you have a financial relationship. In fact, we’d probably go further. NEVER scan QR codes in emails. Full stop.

Apart from the obvious problem (Scam Detectives don’t use Vodafone) you’ll see from the email below that it’s a bog standard “phishing” expedition.

Dear valuable customer,

We recently detected an unusual activity on your account. We will now place a hold
on your account until this issues have been resolved online by verify your identity a
as the authorized access holder.

You are strictly advised to match your information rightly to avoid
service suspension., click on

Log In to My account to restore your access.

Important: You will be asked to verify your personal details.

Vodafone Limited

* This e-mail has been sent for information purposes only, please do
not reply to this e-mail as it is routed to an unmonitored mailbox.

How can you tell it’s a phishing email?

1) It’s addressed to “Dear Valuable Customer” – Surely Vodafone knows your name?

2) It contains some very strange sentence structure – “We will now place a hold
on your account until this issues have been resolved online by verify your identity a
as the authorized access holder.” and “You are strictly advised to match your information rightly to avoid service suspension.” Either Vodafone have employed Yoda in their customer contact team, or it’s very badly written by a scammer without a decent grasp of English…

3) It threatens service suspension if the request is not complied with. (Commonly seen in more traditional phishing emails targeting online banking)

4) It contains a link to log in to your account (which actually goes to a domain not remotely connected with Vodafone – “http://ns2.compro.cz/online.vodafone.co.uk/dispatch/Portal/appmanager/vodafone/wrp.html”)

So, what would a scammer want with your mobile phone account?

Once they have access to your online account they can:

1) Change your delivery address and order additional handsets on your account to be delivered to a “drop” address anywhere in the country.
2) Access your online statements and bank details
3) Receive your bills to facilitate identity theft
4) Report your handset as lost and request a new SIM card, allowing them to make calls at your expense

All of this can cause you innumerable problems. At best, you’ll find yourself paying Vodafone for services you haven’t ordered. At worst, you could find that your identity is being used to apply for credit cards, loans and other financial products which could destroy your credit rating and take months to sort out.

If you’ve already clicked on the link and given over your details – Contact Vodafone Customer Services by dialling 191 from your handset (or 08700 700191 from a landline) and ask to speak to the fraud team.

If you’ve received the email but haven’t clicked the link yet – Just delete it. Now.

If you think that there might actually be a problem with your account, delete the email and call Vodafone Customer Services on 191 (from your handset) or 08700 700191 (from a landline) and speak to customer services. They’ll know if there’s a problem and will help you to resolve it.

Remember: NEVER click on links in emails from anyone with whom you have a financial relationship. Ever.

What’s it all about?

At Scam Detectives HQ we received an email from Twitter advising us of a DM from one of our followers.

It looked like this:

So, was someone really saying horrible things about us? No.

This is a classic phishing scam.

Clicking on the link took us to a fake twitter login screen where we were told that our Twitter session had expired and we needed to login again.

If we’d fallen for it, our followers would soon be receiving similar DMs from us and wouldn’t exactly be happy about it!

What should you do if your account has already been compromised?

If you can, change your password. Log in to your Twitter account, (by typing www.twitter.com into your browser, NOT from a link in an email) and click on your name in the top right hand corner. Click “Settings” and change your password to something that you’ll remember but won’t mean anything to anyone else (remember to include numbers, letters and special characters). That’s it, job done.

If you can’t change your password (because the spammer has already locked you out) you’ll need to reset it. To do this, visit https://twitter.com/account/resend_password

Remember to be very careful about clicking on links you find on Twitter and especially in DMs, even if they come from someone you know and trust.

We’ll give the last word to Twitter, who offer this advice in the help centre.

Evaluating Links on Twitter

Lots of links are shared on Twitter, and many are posted with URL shorteners. URL shorteners, like bit.ly or TinyURL, create unique, shortened links that redirect to your longer link so it can be more easily shared. URL shorteners can also obscure the end domain, making it difficult to tell where the link goes to.

Some browsers have free plug-ins that will show you the extended URLs without you having to click on them. Here are links to plug-ins for Internet Explorer and Firefox (which is a free-to-download browser):

URL Expanders for Internet Explorer
URL Expanders for Firefox

In general, please use caution when clicking on links. If you click on a link and find yourself unexpectedly on a page that resembles the Twitter login page, don’t give up your username and password! Just type in Twitter.com into your browser bar and log in directly from the Twitter homepage.

Today, they’ve come pretty close.

We received this email in one of our “catcher” accounts today:

DEAF LOTTERY ASSOCIATION
WINNER NOTIFICATION

Dear Winner,

CONGRATULATIONS!! You have won the Deaf Lottery!!

Your e-mail address was drawn at random from 300,000 registered deaf people around the world , You are therefore to receive a cash prize of £2.8 Million (TWO MILLION and Eight Hundred Thousand Pounds) from the total payout.Your prize award has been insured with your e-mail address and will be transferred to you upon meeting our requirements, statutory obligations, verifications, validations and satisfactory report.

Draw Details:
Ref Number: PW 9520 ES 9414
Batch Number: 575881545-NL/2010
Draw Date: Sat Jan 21 2012

To claim your prize please contact our claims agent giving these details:
——————–
Names:
Address:
Telephone/Fax number:
Nationality:
Age:
Sex:
Country:
Occupation:
State:
E-mail:
————————
Claims Agent:-
Mrs Angela Lott
Email: (lottangle@aol.com) or (deaf_lottery@rediffmail.com)
———————–
Draw Details:

Draw Details:
Ref Number: PW 9520 ES 9414
Batch Number: 575881545-NL/2010
Draw Date: Sat Jan 21 2012

Yours Faithfully,
Mrs Angela Lott
Lottery Coordinator.
HOT LOTTO.”

It’s a pretty standard “lottery” scam, and anyone who responds will be asked to pay a fee to claim their prize.

Of course, there is no prize, and the victim will lose every penny that they send chasing the fictional millions.

If you have any deaf family members, friends or colleagues, please make them aware of this scam.

Thank you.

This morning we received an email from one of our clients which read as follows:

 

Hi there.

I’m really sorry to reach out to you this manner and I’m sorry for not informing you about my urgent trip to Scotland. I am here for a Seminar and to complete a project.

I want this issue to be confidential between You and I because I don’t want people to get worried about my situation.

Everything was fine until I got robbed on my way back to the hotel and I lost my Wallet, mobile phone and some valuables during this incident. I had to block my account and bank cards immediately.

I am facing a hard time here because I have no money on me to clear Hotel bills and some expenses. I’m sending you this message because I need your help with a loan of £3350 to pay up the bills and make arrangements to get back home.

Am sorry for the inconvenience this message might cause you but please understand that am in a very bad situation right now and would appreciate if you could help me out.

Best regards,

(name removed)

You’ll need to check that your computer isn’t infected with a backdoor virus, keylogger or other malware that has led to your password being compromised. Run a full virus scan and deal with any infections BEFORE you log in to any other online services.

1) Be very careful when using public computers or networks to log in to your email or other subscription services.  There’s a useful guide from “LifeHacker” on using public networks safely here

2) Make sure that you’re using a strong password that consists of numbers, letters and special characters (*, $, !, £ etc.) to make life difficult for hackers

3) Use a different password for every site you use.

4) If possible, don’t use webmail (hotmail/aol/yahoo/gmail) for sites that require a password. Once a hacker has control of your email account, they can request password reminders from the websites you use and compromise these accounts. Use your ISP email address for anything that requires a password.

5) Keep a list of the sites that you use somewhere safe offline so you know who you need to get in touch with if your email account is hacked

6) Keep a list of your contacts somewhere other than your webmail account, so you don’t lose them if your account is hacked

This may all seem like a lot of work, (and a pain in the arse!) and it is, but prevention is ALWAYS better than cure and a few minutes work now could save you long hours of running around if your account is ever compromised.

The strange black squares that have been cropping up in increasing numbers in magazines and newspapers; on posters, tickets and websites are likely to become even more commonplace in 2012 with many companies utilising them in increasing numbers.

However, presuming they are harmless could be playing into the hands of cyber criminals.

According to a recent study around 50% of the 1,200 consumers surveyed interacted with a QR code when they saw one, with 21% then going on to share personal information.

Curiosity and information-gathering were the primary reasons for wanting to scan a code, and the promise of discounts and special offers seemed to be the most effective way to generate interest.

A QR matrix barcode can store alphanumeric characters in the form of text or URLs – all you need to “visualise” such a code is a smartphone with a camera and a QR reader application to scan it.
The code would typically direct you to a website, however, it can also promote online videos, send text messages and e-mails, or install and launch apps.

Fast, easy and very popular, QR codes are clearly a convenient way to stay informed anytime, anywhere. But the downside is that you often don’t know the content of a QR code until you scan it.

For this very reason you should take the same degree of care when scanning a QR code as you would when downloading an unknown file on the internet.

Cyber-attackers might use these codes to redirect you to malicious websites that ask you to download applications that may be infected with malware.
These, in turn, could:
Make your calendar, contacts and credit card information (if you shop or bank online using your smartphone) visible to cybercriminals.

Attempt to steal your Google or Facebook password – many apps are integrated with various social networks.

As a result, some users may enter their information without suspecting that it is being sent to an illegitimate source.

Track your location.

Install keylogging software.

Send an SMS to a premium number, racking up your phone bill.

“Jailbreak” a device and distribute additional malware.

Redirect users to malicious applications.

So if you care about your mobile security, you’d be wise to stay away from malicious QR codes!

One notable attack via QR code took place in Russia in 2011, and involved a Trojan disguised as a mobile app called Jimm. Once installed, “Jimm” started to send a series of expensive text messages (which cost £4 each), racking up unwanted charges.

This is just one of the ways malicious users can take advantage of these codes in order to gain control over a smartphone, so it goes without saying that users should take particular care of what they’re scanning and be aware of what they’re expecting to find.

So how can you spot and avoid malicious QR codes:

1. Educate children on the nature of QR codes – with many youngsters now sporting smartphones it could be all too tempting for them to scan these codes simply out of curiosity, which could leave them at risk of attacks similar to those described above. Better yet, installing a mobile security suite can help protect them against hidden threats, offering you significant peace of mind.

2. Use a mobile QR code-/barcode-scanning app that previews URLs. Avoid scanning suspicious codes and links that don’t seem to match the ads they’re incorporated in; also avoid shortened links.

3. Don’t scan QR codes in the form of stickers placed randomly on walls or billboards. QR codes can be generated by anybody and placed in public places with the intention of peaking an individual’s curiosity, and unless the message gets out there that these may not all be from legitimate sources, scammers will look to take advantage of this relatively new technology to further their own ends.

4. Be extra careful if your smartphone works on the Android mobile operating system. Android is an open platform, which means that its source code can be examined by criminals and exploited more easily when they find a weakness in, for example, the Android browser. That’s why most malicious apps transmitted via QR codes target the Android-based smartphones. So, make sure your Android browser is always up-to-date and only scan QR codes from trusted sources.

5. Be particularly wary of QR codes that are linked to monetary and transaction services – these direct links to money are typically prioritised by malicious third parties when choosing how and where to attack.

6. Consider installing a mobile security app.

So be careful out there folks; the world of technology is rapidly evolving, mostly for the better, but we must remain fully aware of possible misuses and abuses & apply our common sense whenever possible…

Norman Feiner, Managing Director – SimplyFone Ltd

(Idea for Blog, Source: Comms Business)

About SimplyFone Ltd

Simply-Fone was established to provide competitive telephone services to UK Businesses & Residential Clients…

For over 20 years we have been providing low-cost, innovative, cost-effective telephony solutions to residential and business customers in the UK and beyond.

Today, Simply-Fone is one of the fastest growing telecom companies in the UK and a recognised brand name with a loyal customer base and a wide range of reliable and competitive products on offer.

Our mission is to provide home and business users superb value but without compromising on quality.

We offer amongst the lowest phone rates and line rentals in the UK

Simply-Fone currently provide telecoms solutions to 1000′s of home & office users and are a UK leader in the provision of low-cost international call services from mobiles and landlines with 100,000′s of regular users.

I haven’t really embraced Facebook as a promotional avenue (although Scam Detectives has it’s own page) but many of you do.

So, I thought you’d be interested in a little experiment I carried out this week, to see just how secure pages created by Facebook’s “Places” feature are.

If you’re not familiar with it, Facebook Places allows you to “tag” yourself and your friends when you visit business premises, such as your favourite coffee shop, cinema, restaurant or shop.

Once you’ve “checked in” to a place, the feature creates a “Places” page for your business automatically. Here’s one for Starbucks in Wrexham

See the line highlighted in yellow? It says “Is this your business?”

If it is your business, you have an opportunity to claim the place, merge it with your official business Facebook page and make sure that anyone who checks in or visits that place is directed to your official fan page.  Sounds like a good idea, doesn’t it?

Clicking on the link will take you through “verification” where you have to prove you are an official representative of the business, so Facebook can be sure that you are authorised to take control of the page.

So how secure is it?

Some of you will know that outside of my activities on Scam Detectives I have two arms to my business. The first is a web design business at www.clearascrystal.we.bs and the second is an e-safety training firm at www.clearascrystal.co.uk

Because the two divisions are so different in their aims, objectives and target market, there’s nothing to connect the two, and they have very separate marketing strategies.

So, I checked into Clear as Crystal Web Design and, as expected, my Facebook Places page was created.  I claimed the page using the same Facebook account that I use to administrate Clear as Crystal Web Design’s Facebook page, and because of the existing link, I didn’t have to verify my credentials. Fair enough.

Then I logged in using an (obviously fake) alternative Facebook account.  I visited the Facebook Places page and clicked “Is this your business?”

I completed the verification details, as below

BUT, instead of using my “charles@clearascrystal.we.bs” email address, I used “charles@clearascrystal.co.uk” to confirm that I represent the business.

See the subtle difference?

3 Days Later….

Hi SD,

Thanks for your interest in Facebook Places! We’ve approved your claim. Now you can manage your place on Facebook and publish News Feed updates to people who like it. We hope you enjoy this additional opportunity to promote and grow your business on Facebook.

1. Get Started
You can manage your place from your personal Facebook account. Get started here: http://www.facebook.com/pages/manage/

2. Merge Your Place with a Page
Do you admin a page that’s similar to this place? If so, you may be able to merge the two. Go to your page and click the ‘Edit Page’ button in the top right corner. Then click Resources in the left column menu. If the option is available, you’ll see a ‘Merge duplicate pages’ link that will allow you to complete the merge.

3. Learn More
Read common questions and answers in out Help Center: http://www.facebook.com/help/?page=1159

Thanks,

Chuck
User Operations
Facebook

 

SO, if your competitor registers a similar enough domain to yours, using an alternative extension such as .com, .org, .tv, .net, .info or any one of a hundred different top level domains, Facebook could think it’s “close enough” to allow them to take control of your business Places page.

Search Facebook for your business name. Now. Then claim your Places page before somebody else does.