Information Security Tips from Westfield Insurance

Post-holiday phishes

I trust everyone had a good holiday break and hope you have a good new year. With the way 2008 ended, many people are making plans for the future. Unfortunately, some of those planners include phishers and social engineers. And as I'm sure you've seen, they are getting more and more creative and professional in their scams. The days when you could delete a message just because it was poorly written are long gone. Today's scams are targeted, well-written and spell-checked.

In particular, we are already an increase in phishing messages that reference the recipient's holiday credit care spending pattern. The messages will claim to be requests for confirmation, reports of transactions and even a few of the traditional "your account has been frozen" scams. During the holiday season, many people have more transactions and shop with more different merchants; the scammers are attempting to exploit any confusion over those transactions in order to trick you into disclosing your account information, passwords, etc. If last year is any indication, expect that phishing campaign to accelerate during this week and last until the middle of next month or so.

We are also seeing a number of scams related to the economy. The number of work-at-home scam messages is up dramatically. As you may remember from prior tips, these scams promise easy money either for helping transfer funds or to conduct "quality control checks" on merchandise. In the first case, you become part of a money laundering operation, in the second, a fence. Either way, you're like to get a visit from some federal law enforcement agency. If it were that easy to make money, they wouldn't need to be sending out random emails about it.

Interestingly, the old "Nigerian fraud" is back in large numbers. These are fairly transparent messages alleging that someone needs your help to get money out of a foreign country (usually in Sub-Saharan Africa) and offering you a percentage if you will allow the person to transfer the money through your bank account. Foreign lottery scams are also back in significant numbers. I believe that by now most people know that these messages are scams but in times of financial difficulty, sometimes hope trumps common sense.

If an email asks for your personal information or if it contains an offer that looks too good to be true, trust your intuition and delete the message. To learn more about how to identify common scams, check out some of the links in our archived Tips on phishing. Have a safe New Year.

Get ready for a Storm of holiday-related scams

For the past year or so, we've seen a significant uptick in attempted scams and frauds around every holiday. Many of them trace back to the Storm Warn gang, a crime ring based out of Germany that sells hacker software. Their last big attack was at the Fourth of July and tricked many thousands of users into downloading the 'storm-bot' trojan by offering a fake video clip of "the largest fireworks" celebration in the nation. Victims found their computer hijacked as part of a bot-net or had keystroke loggers and other malicious software loaded onto their computer.

If past patterns hold true, we can expect to see a dramatic rise in the volume of spam and phishing attempts during this holiday season. Some of their cons last holiday season included dedicated sites like the Merrychristmasdude.com website (a site offering suggestive holiday-themed photos along with a very malicious download) and spam emails such as the Happy New Year phishes. This group develops very sophisticated software with hundreds of variants that attempt to evade and outrun standard anti-virus software.

To combat these scams, first be suspicious. Never open unexpected messages or attachments.

Second, keep your anti-virus up to date at all times. Set your anti-virus to automatically update itself as often as the software allows. And if you're particularly suspicious about an email or website, force a manual update before clicking the link. Remember that if your kids have a computer at home that runs under parental controls, their computer may not be able to complete the update under the restricted ID. Their computer may be at risk until you log on under your parental ID so the updates can take hold.

Finally, keep your firewall turned on and be very suspicious of any 'free' video or other offer sent through the internet. In particular, be cautious about electronic greeting cards. While some are legit, many are frauds. See this tip for some thoughts on how to sort out e-card invitations.

Phone scam targets insurance policyholders

The Ohio Department of Insurance has confirmed an on-going scam targeting insurance policyholders. According to the ODI, the scam is currently targeted primarily at auto policies. In this scam, the caller alleges that "there was a problem with your insurance payment" and asks for confidential information such as bank account numbers, birthdates, SSNs, etc. The call often includes a threat that "your coverage will lapse" if the customer does not comply.

You can read the full ODI press release at ohioinsurance.gov.

Insurance companies (like Westfield) do sometimes ask for confidential information such as SSNs and birthdates in the normal course of business. However, it would be highly unusual for the insurance carrier to contact the customer directly or to do so other than in writing. If you receive a call that strikes you as suspicious, hang up and call the number printed on your last policy statement. If the call was legitimate, the customer service representative will be able to look up your account and confirm it.

Be very cautious about handing out your personal information to anyone you do not know well. Ohio customers who have already received one of these fraudulent calls, are asked to report it to the ODI at 1-800-686-1527.

Lastly, if you believe that you may have given up your confidential information to a fraudulent caller, you should check your credit report and consider putting a fraud alert on your account. For more on how to check your credit report, you can follow this link to our archive of tips on this topic.

OnGuard Online

As the holidays get closer, many of us will turn to online shopping. Done right, online shopping is about as safe as catalog shopping - and much more convenient. If you don't take basic precautions, though, you could lose your shirt. Take the time to learn about the kinds of scams and cons that are used online.

The Federal Trade Commission hosts a terrific site with lots of content on identifying and deflecting these kinds of scams. If you haven't already been out to visit www.onguardonline.gov, I strongly recommend the site. It has some excellent overview material on security at the personal and small business level. The site also has a set of games covering a variety of topics like spyware, online auctioneering, peer-to-peer, phishing and spam. Test your knowledge of internet security and safe shopping. It's well worth the time to visit the site.

The site's material comes from a number of public and private sources but is all released for public use. If you run your own personal website, you can post their games, videos and handouts to your own site and help spread the word. (Instructions are here.)

Addendum:
This tip has inspired me to create a more permanent set of links to some of the better games and awareness quizzes that I've run across. I'll try to get them posted in a permanent sidebar on the blog but in the meantime, here are a few good links.

• CMU Anti-Phishing Game - Learn to identify fraudulent URLs
• Mission:Laptop Security - Protect your laptop while traveling
• Anti-phishing Father's Day card - Flash video on phishing
• Auction Action - Test your knowledge of online auctioning
• P2P Threeplay! - a quick quiz on file-sharing
• Invest Quest|http://www.onguardonline.gov/games/invest-quest.aspx - a simple quiz but the 'disclaimers' are pretty funny

Spam, phish or secure mail?

For several years now, we've been telling everyone that email is a postcard – everything in the message is exposed to anyone who wants to read the message as it flashes by. A couple of companies have figured out how to solve this problem and their solutions are finally hitting critical mass. If you have a secure mail solution, you can finally put your message in an 'envelope' and keep outsiders from reading it.

The problem is that we've also told you as a reader to delete any message that appears suspicious or that asks you to click through some "convenient" link. The 'envelope' around a secured message looks a lot like a phish. (See "How it works" below.)

Here are some tips on telling the difference between a secure mail message and a spam or phish.

• In a legitimate message, you will still be able to read the subject line and the sender. If you are not expecting a message from that sender, be suspicious.
• Once you start working with a business partner who uses a secure mail system, all secure messages from that company should look basically the same. If the logo, the layout or the text look different, be suspicious.
• A legitimate message will take you to the sender's website to verify your login. A phish will try to take you someplace else to steal your password. If the message alleges to come from someone at redcross.org but the link is trying to take you to yahoo.com, be suspicious.
  Reminder: The only part of the domain that matters is the part immediately before the top-level domain (.com, .org, etc). Ignore everything to the left or right of the dots. In the link voltage-pp-0000.westfieldgrp.com/mail/32/, only 'westfieldgrp' matters for verifying the legitimacy of the message. The rest is set up by the company's IT department to point to specific places within the company's domain.
• Legitimate messages are written by professionals. Scam messages want to panic you into acting without thinking and often use phrases like "URGENT" and "log in now or your account will be closed". If the language seems inflammatory, be suspicious.

If you are suspicious, call the sender and confirm the message. Please do not just delete these messages, though. There's a fair chance they are legitimate and you wouldn't want to lose good messages.

How it works
There are several ways to put your message in the secure 'envelope'.
One technique doesn't actually put the content in email at all. What you really send is a placeholder saying "You have a message waiting. Please sign in at my website to read it." The message content stays on the sender's webserver and never actually travels by email. Some large financial and medical institutions use this kind of secure messaging.
The other way is to pull the content off the message, encrypt it and reattach it to the message. The content travels by email and but can't be read except by someone who knows the password. (If you don't already have a password set up, you will be asked to verify your identity and create one.)
A third technique is Transport Layer Security (TLS), a method that protects the message from one email server to another. This requires some setup between the two companies but is otherwise invisible to both the sender and the reader. These messages can't be easily mistaken for a phish so we won't discuss them in this tip.
An example of that second kind of 'envelope' – the encrypted attachment solution - is attached below.

How to spot an email scam

PC World magazine put together a short tutorial on recognizing eleven common email scams. Each page includes an actual example, most culled from recent messages being sent out by the notorious Storm Warn gang, a group of hackers based out of Germany who not only run the scams themselves, but also sell their hacker toolkits to others.

Some of the scams seem pretty obvious (like number 10, the IRS scam) but others are very sophisticated in their tactics such as number 9 where the hacker is impersonating an indignant eBay customer accusing you of not responding to his question or number 11 where the hacker took the time to personalize the attack based on the victim's alumni listing.

Number 5, the NFL stat-tracking software, is particularly effective because the webpage is so professionally done. And there really are some good free software programs out there. (Well, not completely free since they're ad-supported but for an avid fan a few ads might not be too much to pay.) The problem is that there are a few very dangerous landmines hidden among the legitimate tools. Short of completely rewriting the code yourself, there is no way to tell the safe ones from the scams.

Never download "free" software unless you are completely sure of the reliability of the source and never load any software onto your work computer yourself. Always call your IT department.

Fathers Day card from the FTC

I normally tell people to avoid ecards like the plague. Once upon a time, they were fun and cute. Now, they are too often loaded with phishes and viruses. Very few ecard announcements are legitimate anymore.

That said, here is a Fathers Day ecard from the Federal Trade Commission on phishing and other information security tips. This is a great card. (And, yes, I will certify that it's legitimate. The music's a little hokey, though so you might want to turn down the volume before you play it.)

Take a few minutes to check it out and maybe forward the link on to someone who taught you how to stay safe.

www.ftc.gov/dad

Phishers spoofing the HR Department

Phishers and hackers continue to get more creative and more sophisticated in their attacks. A recent trend is to write very specialized attack messages targeting rank-and-file employees. One example is a personal email that appears to come from the company's HR manager. The message included the HR manager's name (it was posted on the company's website) and asked the employee to review a .pdf attachment to confirm vacation accruals. The attachment was a malicious trojan.

Luckily, many of these attacks are blocked by our anti-virus software but some will always get through. Be on the lookout for these kinds of scams. If you see a message that looks suspicious, do not open it, even if it appears to come from someone you know. If you're unsure about the message, call the alleged sender and just ask if he/she really sent it.

If you run a business, make sure that your staff know about these scams, too. Make sure you set a culture of security where it's safe for the employee to call you and confirm a message's legitimacy. (If you're the one writing the messages and you're getting a lot of calls, check out "How not to look like a phish".)

based in part on a CSO Online column

Fake check scams

Earn millions! Help a damsel in distress! Win the lottery! Work at home! Whoops, I overpaid – please send back the overpayment!

These are just a few of the scams out there. The average adult American receives 4½ emails, phone calls or pieces of mail per week attempting one of these scams. Thirty percent say they receive 10 or more a week and 18% admit that they or a family member have fallen for one of them.

The National Consumers League (NCL) recently launched a website fakechecks.org to help educate consumers about check-fraud scams like these. The website includes a "fraud test" and some great videos that show exactly how these six scams work and how to recognize them when they come in . Take a few minutes at home to see how many of these you would fall for. And remember, this is what these scammers to for a living. Some of them are very good at building a rapport and sounding trustworthy. They play on our inherent trust and desire to be helpful and courteous.

Remember also that in a check fraud scheme, the victim is responsible for the lost money and any overdraft or returned check fees. The fraudster ought to be responsible but given the odds of catching him/her, that is dangerous wishful thinking. The bank has no responsibility if you fall victim to check fraud like the ones above.

If you are a victim who recently wired money to fraudsters, report the incident immediately to the security department of the business that handled the wire transfer. If the payment hasn't been processed yet, they might be able to get your money back. If it's an older scam, report it at fakechecks.org.

How not to look like a phish

Phishing is an increasing and serious problem. Luckily, consumers and even some tools are getting better at identifying and deleting them. Unluckily, many legitimate messages get thrown away because they look too much like phishing messages. TRUSTe and Ernst & Young recently published a white paper on "How Not to Look Like a Phish". Here are a few thoughts that can help you keep your messages from looking too much like a phish:

• Don't request personal information from customers via a hyperlink in an email. If you need information (such as an updated address), tell the customer to go to your company's website and log in. Don't provide a "convenient" link.
• Personalize the email whenever possible. This proves that you know your customer's name. For example, use "Dear John" instead of "Dear Sir".
• Don't get your customers in the habit of linking through someone else to get to you. For example, if you are going to provide a link in the email, if should look like www.yourdomain.com, not www.somebodyelse.com?redirect=www.yourdomain.com;. Never use the IP address in the link. http://12.168.68.50 will still take you to westfieldgrp.com but customers can't be expected to know that or to recognize when the address has been tampered.
• Be very cautious about using click here links. You may think they read better but customers should rightly be suspicious of any attempt to obscure the destination of a link. Written-out addresses are better.
• Use simple and intuitive domain names and directory paths. The longer the address line, the more likely it is for something to be spoofed and the harder it will be for your customers to recognize the falsification.
• Proofread and spell-check all your communications. While more phishers are improving their English, many users still rightly assume that a grammar or spelling mistake is evidence of a possible phish by someone whose native language is not English.
• Avoid messages with an urgent, threatening or time-sensitive tone. (I had an example in here but it made this message look too much like a phish and got blocked. Don't say anything about passwords and account cancellation.)

For the full report, go to truste.org.

CMU Anti-Phishing Game

How good are you at identifying a phishing con? Do you delete the message or do you take the bait? How often can you get hooked?

Carnegie Mellon's Usable Privacy and Security Lab (CUPS) has developed a game to teach people how to identify several common clues that a message is a phish. The game takes about 10 minutes to play and is suitable for all ages. You will play PHIL, a "young fish living in Interweb Bay" as your father teaches you how to find food (legitimate links) and avoid dangers (fraudulent links) .

The game focuses on how to dissect the URL in the phishing message in order to sort out the scams from the good messages. According to the researcher who developed the game, users improved their accuracy in spotting fake sites from 69% before playing the game to 87% after.

Phishing works by tricking you into following a link and volunteering the confidential information to a scammer. Phishers will attack both your personal and work accounts. Phishers have recently been very effective at mimicking trusted sites such as the Better Business Bureau. The only way to protect yourself is to be alert to the scam. There are plenty of other scams out there but this game hits some of the most common tactics.

The game can be found at cups.cs.cmu.edu/antiphishing_phil/ quiz/ .

Phishing for senior executives

Last week, Westfield's top executives were targeted with a very specific phishing email alleging to be from the Better Business Bureau. As you can see below, this phish uses the BBB's official logo and colors and follows the format and structure of a legitimate message. When the victim clicks on the "convenient" link in the message, it installs a trojan downloader onto the computer. The downloader then starts loading up the computer with keyloggers, back doors and other spyware. If not caught in time, the hacker will have complete control of the computers of the top executives of the company.

This was not a wide-spread spam attack. The phishers knew exactly who in the company would normally receive these kinds of complaints. They knew the correct names and email addresses of their targeted victims. They also spoofed the return address so the email appears to have come from someone at bbb.com – a registered alternate to their main address, bbb.org. This was a well-crafted phish.

Nevertheless, there are a few clues that this was a phish.

1. Float your mouse over the bold blue link in the message BUT DO NOT CLICK THE LINK. Look in the gray bar at bottom left of your computer screen and you should see the link's destination. In this case, the link goes to http://document-repository.com/redirect.htm?... The BBB's real website is bbb.org. While there are sometimes legitimate reasons for an organization to use an alternate internet domain, it is more often illegitimate. If you see a mismatch, be very suspicious.
2. The case number in the subject line does not match the case number in the body of the message. The odds are that the "case number" in the subject line is a code used by the hacker to see which messages were successful and which were blocked.
3. The date of the complaint is 14 May 2007 but the message was sent in late August. Even the BBB isn't that slow.

If you are an executive or work in close support to an executive, recognize that you are a special target. Hackers know that you have exactly the kind of access and permissions that they most want to target. They believe that you don't have a lot of time to stay current on technological threats. And they know exactly who you are - with all the automated databases and executive listings, there is no anonymity. Hackers (or anyone else) can by listings with your name, title and email address. See here for an example. And yes, this company requires you to sign a written statement promising to abide by the CAN-SPAM law but the kind of person who will steal credit card numbers, fraudulently register internet domains and send out a phish is probably willing to forge a signature on their form.

Always be suspicious of any unsolicited email asking you for information or to follow a link. Double-check the link before clicking it and never disable your anti-virus and anti-spyware protections.

"You've received a greeting ecard" trojan horse

I still remember the first time someone sent me an electronic greeting card. It was kind of hokey but it really brightened up my day. Sending one back was convenient, fun and best of all, free. Unfortunately, someone has recently launched an aggressive campaign that combines the worst aspects of spam and malicious software and is exploiting the popularity of e-cards. The hacker is using pre-packaged software to spam millions of messages across the internet that read with some variation of "You have received an ecard from" a school mate, a colleague or a family member.

If you open the message, you'll see a standard text-only message describing the e-card and offering you a link to a website where you can download your e-card. The messages claim to be from any of several legitimate ecard websites but in the versions that I've seen, the link is a raw IP address (such as http://12.345.67.89), not a domain name (www.example.com). Other versions may get more sophisticated and cover the IP address with a fraudulent domain. The IP addresses trace back to hundreds of different owners. My suspicion is that these are individual machines which have been hijacked as part of someone's botnet.

Opening the email won't do anything immediately bad to your computer (other than waste your time) but following one of the links is another story. Do not under any circumstances follow these links. Merely opening the page will trigger the download of a particularly nasty computer trojan horse which will then attempt to download even more malicious software onto your machine.

If your anti-virus program is up-to-date and running, it should catch and stop this trojan. However, if you get any kind of alert or think that you might have triggered one of these downloaders, you should run a full virus scan on your system. Call your IT department for instructions. Never open a message from an unrecognized sender and never open an attachment or follow a link in a message that you were not expecting.

Note: If you think the email card might be legitimate, you can check by opening a browser and typing the address of the greeting card company (for example, www.hallmark.com or www.bluemountain.com) and follow the instructions on the site to 'pick up an e-card'. This will usually involve entering the email address of the sender and a confirmation number from the email. If the message was legit, it will show up on the website. As long as you type in the address yourself (rather than following a possibly faked link) and you're going to a major company that you trust, it should be safe to check.

Anti-Phishing Toolbar Review

Phishing is a continuing and serious problem for all of us. In the past few months, a number of companies have come out with anti-phishing toolbars – applications that you add to your internet browser and/or email program to help identify and block phishing websites and other web-based scams. Several of these tools are available for free.

Despite all the marketing hype, a recent independent study of these tools found them to be of only limited use. This study, conducted by four researchers at Carnegie Mellon University, found that even the best of the available anti-phishing toolbars only identified about 85% of fraudulent websites in their test. Worse, the toolbar created a false sense of security among users. Users tended to assume that the toolbar was working and that the website was safe even when it was not.

The anti-phishing toolbars also had problems with false-positives – good websites which were incorrectly identified by the tool as a probable phishing site. While 85% is a good start and shows that a technology solution might be someday possible, it is not yet safe to rely on these toolbars to identify phishing websites. Remain cautious whenever visiting a website that asks for any personal information.

For more, here are links to the full study (including descriptions of each of the tested toolbars) and a ComputerWorld article about the study.

Phishing IQ Test

When was the last time you got an urgent email warning you that your account was about to be disabled unless you reregistered the account? Did you fall for it? How good are you at sorting out the phishing emails from the legitimate requests?

With the huge increase in spam recently, it's a guarantee that you either have received or soon will receive a phishing email – and you probably have received several in the past week alone. Take this test to see how good you are at sorting the good from the bad.

Note: According to the makers of this test,
       19% of phishing emails are incorrectly identified as legitimate by the test takers
       48% of good messages are incorrectly identified as phishing.

Remember, never follow the "convenient" link in an unsolicited or unverified email. If you think it might be a legitimate message, contact the sender directly.

New phishing attacker pretends to be a journalist

Last week, we began a series on particularly targeted phishing attacks - scams using personalization to try to convince you to click on their link. A recently reported case targeted workers at a specific bank and was based on correct email addresses and personal names. The email read:

"Dear John, I am a reporter for Finance News doing a follow up story on the recent leak of customer records from ABC Bank. I saw your name come up in the article from Central News and would like to interview you for a follow-up piece. If you have time I would greatly appreciate an opportunity to further discuss the details of the above article. Regards, Gordon Reily."

The message included what appeared to be a link to the Central News story. The URL included the bank’s name in its characters.

The names in this copy have been changed but the rest of the message is unchanged. Note that there are no misspellings, grammatical errors or typos in the message. It is personalized, professional and has all the earmarks of a legitimate message. This message will sail right through the spam filters.

The message appeals to the natural vanity or curiosity of recipients. A high proportion of readers want to see their own names in print and click on the link.

The link in the email actually took the reader to a website in China. Clicking on the link automatically installed a keystroke logger on the user's machine. The clear goal was to compromise the computer account of a bank employee – an insider who likely has deep access to accounts and customer information. Hackers know that even if the first employee didn't have direct access to sensitive information, they can use the compromised account as an entry point to attack other points of the company's network.

In this case, the bank was able to quarantine its infected computers and blacklisted the chinese website but similar attacks are occurring every day. Hackers are using increasing sophistication in their attempts to compromise the accounts of employees at financial institutions like Westfield. Never click on the link in an unsolicited email. If you are unsure about the message, forward it to InfoSec for investigation.

Read more at CSOonline.

Pink slip scam

Email scammers have been developing some creative new attacks lately which play on human fears, insecurity and/or vanity. We will be discussing several of these attacks over the next few weeks. First, a scam using fraudulent pink slips.

In this attack, the phisher sent emails to some employees at the target company telling them that they had been laid off. The subject line read "Urgent – employment issue". The from: line was successfully spoofed so that the message appeared to come inside the company. Other content in the message was consistent with the target company's operations (a hospital) and reinforced the victims' belief that this was a real message.

The message included a link to a website where the victim could get career-counseling information. Concerned about their employment status and being justifiably upset over being laid off by email, at least two employees at the target company clicked on the link. In fact, opening that website loaded a keystroke logger on the victims' computers.

Spam and phishing attacks are being increasingly customized to the specific company under attack. Because the content is so customized and because this particular message was so intimidating, the scammer knew that he/she could send out far fewer fraudulent messages and still find an unwary victim. Such low volume, highly targeted attacks are almost impossible for the spam filters to identify and block ahead of time. You must remain on guard when you see a suspicious message.

No reputable company will notify you of any such personnel action solely by email. If you receive a message that concerns you, talk to your manager or to HR department directly. Never click on any link in a suspicious email or IM message.

Trends in Phishing

A survey by First Data Corp. in 2005 found 43% of US adults had received at least one fraudulent email, in most cases purporting to be a financial institution. Of those, about 1 in 20 – or 4.5 million people – provided the requested information and about half of those ended up being victims of theft or identity fraud. According to antiphishing.org, 89.3% of all phishing attacks target financial institutions.

Those are some large numbers but I have to admit that my first reaction was to ask "who are those lucky 57% who have not yet received a phishing email?" Many of them simply do not have email. For the remainder, unfortunately the question answers itself. They are the people who have not yet received their first phish.

Phishing emails attempt to trick the reader into believing that the message is from a trusted source and following their "convenient" link to a fraudulent site which looks and feels just like the official site but which is designed to steal the user's private information. Even though this doesn't fool most consumers, phishers rely on "spam economics" – they can make money even if only a fraction of a percent of their scams succeed.

Phishers are beginning to add to their tactics. Many are providing a fraudulent telephone number in the email rather than just a fraudulent hyperlink. The criminal then sets up his/her own IVR system to steal your information when you call in. Others are making increased use of trojan horses – programs which are covertly installed onto your computer and which either log all your keystrokes or install a backdoor through with the criminal can take control of your computer.

Never trust anything sent in an unsolicited email. Never directly answer any request for your private information. If you think the request might be legitimate, type the company's address into your web-browser yourself. If this is a real request, expect it to be prominently displayed on your account page on the company's real website. If you are going to call them by phone, get the phone number off of your last paper statement. Never trust the "convenient" number on the email. Finally, remember that no reputable financial institution will ever ask for your personal information via email.

Incidentally, in 2005 the Federal Trade Commission estimated that 9.93 million persons were affected by identity theft, causing a loss to financial institutions of $46.9 billion. Combining that with the statistics above, phishing accounts for only about one quarter of all identity theft cases. This is consistent with other studies which show that most ID theft is based on paper documents. We should still be vigilant against these kinds of scam messages but we should be even more vigilant about making sure that our paper waste is properly destroyed.

Banking Authentication Scam

Banks and other financial institutions have until 1 January to implement multi-factor authentication to confirm the identities of their customers when accessing internet-based services. That means that banks can no longer rely on a single PIN or password to give you access to your account. They must use some other method in addition to the PIN or password.

Some banks have recently implemented the new procedures. Others are in the midst of changing their procedures. In the meantime, a large number of scams are attempting to exploit these changes in authentication procedures. They are trying to take advantage of the natural confusion of users during the transition.

Banking regulators are warning the public to be alert for scams attempting to exploit the change in authentication procedures. One popular scam describes the federal requirement for the new procedures and then asks the reader to re-register his/her online banking accounts.

• You should never respond to any email that is requesting information that your bank already has in its possession.
• Never click on the "convenient" link provided in the email. Too often, it takes you to an imposter site run by the scammer. Type the bank's URL into your web browser yourself.
• Keep your online password secure – even your banker should not know your password!

As the deadline approaches, you should receive communications directly from your bank with details of any new procedures. When in doubt, play it safe and contact your financial institution.