Okay, here we are again; another week in which I was unable to accomplish some of the tasks I had hoped to get to because the evil doers of this world are once again trying new ways to steal from the computer users. This week has brought to my attention some brand new schemes and the polishing of some older schemes to trick even the most wary of computer users out of their money. I, myself, received a couple emails that looked very official from Microsoft, Oracle, and Adobe trying to trick me into logging in by clicking directly from the email and providing a username and password to a website that looked very authentic; but, was not.
The sophistication of some of these malicious schemes is frightening; my father received a request for account verification from what appeared to be his stock broker. Only the day before he had received a warning regarding such schemes and was wary enough to check with the broker to see if they had sent such a request. On top of these the folks behind ransom ware attacks have significantly improved their attacks and are, once again, getting past most of the anti virus products on the market.
How do we protect ourselves? As has been the case for some time, knowledge and wariness on the part of the user is the first line of defense. If you have doubts, is there a way to check and see if the supposed source did actually produce the web page or email you encounter? If it is an email, is the return address correct for the business it purports to be from; if it is a web page, is the address (URL) appropriate for the business in question? Sometimes it is hard to tell what the URL of a page actually is; so, I have a few helpful hints. URL’s will appear in the address bar and maybe in the status bar of your browser (usually the second or third row on your screen); the computer reads them from left to right starting with HTTP or HTTPS, this followed with the address of the page, keep reading left to right until you hit .com, .net, .org, or similar, the name to the left of the first top level domain (that .com, .net, .org we found) is the name of the website you are interacting with. If you think you are on your bank’s web site, and you see an address like http://wfbank.ci/ you can be certain it is not your bank’s actual web site. In this example there are a couple indications of trouble: banks use https exclusively; the .ci top level domain indicates the business is registered in Christmas Island, unless your bank is from there, this should be a giveaway too.
Do I really need to be able to recognize the URL of all my financial service providers and all the major software providers I work with? I would recommend that you do; the current scams tend to rely on the user not being able to tell that they are interacting with a scammer instead of a trusted business. One of the services my business provides is to help clients by teaching their employees how to recognize an authentic page from a replaced page, by teaching them what kinds of activities tend to be more dangerous than others and do so within the scope of your business’s regular activities. This is a case where knowledge is very important in prevention.
One final word on scams of all kinds but primarily internet based scams. If your anti virus or your firewall or the safety features of your browser warn you about a page or an activity, there is a real good chance, nay likelihood that danger does lurk in your path; please get a second opinion before proceeding. I would much rather take multiple phone calls or even be called onto a site to prevent a client getting had in a scam than have to clean up the mess after the scam.