Unprecedented Growth in the Fight to Eradicate Scam

   My first thought when I saw this email was that it's from someone with the same name as the guy
from Arrested Development.  Of course, that's Michael Cera!

   The only thing missing is a link or attachment.

   Of course, there are tons of emails like this around.  And people do respond.

   Would you respond?  How many people at your workplace would respond?  How would you help people recognize this kind of email and not respond?

---

International Debt Funds Recoup Unit of
United States Department of the Treasury Washington DC.
1500 Pennsylvania Avenue, NW;
Washington, DC 20220


Hello,


International Debt Funds Recoup Unit, incorporated November, 2016 as affiliate of United States Department of the Treasury Washington DC, established for the control of recouped international debt funds, within the short time of this establishment, we have experienced unprecedented growth in the fight to eradicate scam and terrorism.

With Our vast experience cutting across several facets of the world and affiliations with numbers of reputable foreign and local organizations, International Debt Funds Recoup Unit has brilliantly done very well in contributing to the effort of the American Government to curtail fictitious and nefarious activities of scam via the internet, which is perpetually taken out on citizens of United States and innocent citizens of other part of the world by impostors through our vast networking.

We implore your earnestly attention on our resent activities in affiliation with Federal Bureau of Investigation FBI. Your computer and telephone communication  were under surveillance device manipulation on discovery that you have been in communication with impostors, imposing as important dignitaries to the undisclosed organization.

The transaction database of Western Union and Wal-Mart Money Gram recently went through screening on evidence for transaction made on your name overseas and the statements of your bank account were properly studied on evidence for transaction made within the states and overseas. However, the collective findings urged the setup of multifaceted maximum security on your everyday activities most specially your email correspondence and telephone communications.

The state of affairs grows to be interesting that intelligent agent of International Debt Funds Recoup Unit and Federal Bureau of Investigation FBI,
where deployed to investigate on issues of debt funds as a result of Contract Payment Funds, Lottery Winning Funds and Inheritance Funds owe to you by the undisclosed conglomerate under impersonation of impostors imposing as important dignitaries to rip you off your hard earned money and to our dismay, it was discovered that your name appeared as owner of funds valued US$10.5Million United States Dollars.

Representatives of American Government bureaus sent on your behalf on this exploit confirmed that the blueprint of your funds recoup was plain and the outcome of the event was a solution to curtail activities of con artist and indeed a perfect solution to your quest on your funds. The recouped funds are deposited in the pecuniary basement of the International Debt Funds Recoup Unit here in Washington.

To apply for claims, we urge you to reconfirm your personal information stated as following below; the details will be used to conduct lawful underlying principles of verification on your reputation as the beneficiary own of the recouped funds lodged in our basement.

1.  First Name:
2.  Middle Name:
3.  Last Name:
4.  Home Phone Number:
5.  Cell Phone Number:
6.  Home Address:
7.  Date of Birth (mm/dd/yyyy)
8.  Driver's License/ Passport Copy:
9.  Marital Status:
10. Current Employer Name:
11. Position/Title:

This is compulsory instruction. REPLY BACK TO THIS ADDRESS ONLY IF YOU WANT FAST RESPONSE TO YOUR E-MAIL ( mrmichealcenadesk@webmail.hu )

God Bless America.
Sincerely yours,
Mr. Michael Cena

---

   I do enjoy these kinds of emails!  It unfortunate that some people do fall for these scams.  Interesting that this one doesn't ask for my SSN, but wants a copy of my driver's license and/or passport - that can be very valuable to the scammer.

   While there are no links or attachments here, but is still danger.  I've written about these kinds of scams in the past, and the prior advice still holds.

1. You didn't win!  An unsolicited email promising some kind of prize or payoff is not real.
2. Don't respond to unsolicited email.  It just lets the spammer know you are a live person.  And definitely don't respond and provide information about yourself.
3. Use care with links in unsolicited email.  There's a good chance that link leads somewhere you don't want to go... like a phishing site or a malware download.
4. Watch out for attachments... even pictures.  Stop and think before you click on that attachment.  Even if it looks like it came from a friend.  Were you expecting the email and attachment?
5. Be stingy with your personal information.  Much of what happens in today's world happens online.  And you will have to provide some information sometimes.  But every site doesn't need all your personal information.  And just because a site asks for information doesn't mean you have to provide it.  Before you fill out that form, stop and think, then decide how much information you want to provide.

   You can find a few more tips here.  These steps can help you at home and at the office.

   What's your favorite example of this kind of scam?

Keeping Up with the Podcasts!

   I listen to a lot of podcasts.  Probably way to many.

   But podcasts are just such a great way to keep up with timely information in security, technology, news, finance, sports and other topics.  So I listen... a lot!

   I did a post on this topic nearly 6 years ago!  In that post I provided a list of podcasts.  It's way short compared to the list I'll be sharing here.  I also wrote about using podcasts as a learning resource here and here.

   Before I provide the actual list, here are few important notes:

• I’ve tried to put these into categories
• Within each category, the order is not how much I like the podcast but just the order they are in my podcatcher (and that order has little rhyme or reason)
• Yes, I am crazy
• Yes, I do constantly have earbuds in my ears
• I do use a podcatcher that has variable speed and I typically listen at 2.2x! (I still use DoggCatcher)  Yes, we’ve already established that I’m crazy.  And, I have a lot of casts to get through.
• Some of these podcasts may no longer exist.  Since my list is so long, if some drop out of existence I really don’t notice unless they are one of my few top favs.
• I actually left some off – I have an casual interest in real estate investing and subscribe to 6-8 casts on that subject

   With that... let's get to the list!

We Encounter a Serious Issue

   I just received this voice message on my home phone (landline).

   Here's the text:

   We encounter a serious issue coming out of your computer.  It seems to be someone is trying to hijack your computer and try to steal your personal information.  If it's not fixed right away then your computer will become obsolete and all of your credential information may got compromised.  If you are the one who is using Microsoft Windows in your computer then please call 302-316-9259 or press 1 now to speak with security team now.  Please ignore if we called you by mistake.  Thank you.

   The only serious issue here is that people fall for these scams.  Let's break it down:

• The Voice - who wouldn't believe a bad computer-generated voice?  Seriously though, there are plenty of pre-recorded and generated junk voice messages we get all the time.  My general rule of thumb - ignore them all and erase is your friend.
• Bad Grammar - this is practically a throw-back to the old days of spam.  I've written about this in the past.  Someone willing to get past the bad grammar is more likely to continue on to other poor choices.
• Fear Factor - the message is playing on many people's fear of technology and loss of their personal information.  While we've become almost numb to breach announcements, the idea that there is an attack on our personal home computer is still a scary concept.  Words like "hijack", "steal", "obsolete", and "compromised" invoke fear.
• Call To Action - "if it's not fixed right away...".  For a person who doesn't understand the complex issues of their computer, the call for immediacy further plays upon the fear state.
• Microsoft Windows - what are the odds that if a call was made to any household, someone would be using, or would have used int eh past 24 hours, Microsoft Windows?  I'd guess that's pretty high.
• Politeness - bad voice and grammar aside, the call does say please and thank you.  That further instills a sense of confidence in a person already affected by fear and the call to action.

   As I covered in a past posts, while I did not call the number (and I suspect it's already been disconnected), if I did get through to someone I bet that they would be very helpful!  That is, as long as I was cooperating.  If I was not forthcoming with information, then these kinds of folks often get forceful.

   Obviously, the best course of action is to just have a good laugh and hit delete when you get a message like this.  We also need to assure that less technical, or more vulnerable, people understand the issues and are prepared when the call comes.

   Have you, or someone you know, received a call like this?  What happened?

ID Fraud and Your Taxes - Take Action!

   It's that time of year again.  Brian Krebs just put out two articles on the ongoing issue of tax fraud.  As is so often the case, the advice to protect yourself hasn't changed - and be assured, you must protect yourself because no one else will, certainly not the IRS!

   As noted below and in the Krebs' article, what you need to do now and always is:

1. file your taxes early
2. monitor your credit (I covered that topic here... in 2013!)
3. freeze your credit (two articles from Krebs, also from 2015)
4. become you before someone else becomes you (I wrote about that subject here and here)

   Here's a re-run of my article on this subject from three years ago.  It's all still true!  As I wrote nearly 5 years ago, the more things change the more they stay the same.

---

   I did a series of posts last year (2014) on the problem of ID Fraud.  This is an ongoing issue, certainly because organizations struggle to protect information, there are cyber attackers out there, and also individuals don't often take steps to protect their own information.

   The bottom line is that your personal information, primarily your financial information, has tangible dollar value to a cyber attacker.

   We usually think about credit card fraud or maybe bank account fraud as the results of these kinds of data breaches.  But in this post and the next I'd like to talk about two other scenarios that have happened, are happening... and you need to be aware.

   It's that wonderful time of year again in the US.  Crisp weather, snow (most places), the days are starting to get a bit longer... and it's the beginning of tax filing season.

   Imagine you are doing your civic duty, filling out and filing your tax return.  You send it in to the IRS, only to find out that "you" already filed your return and "you' have already received your rather sizable refund - surprise!

   Unfortunately, this has happened.  And, as we've discussed in the past, these attackers are smart.  This is a business.  They need to be able to maximize profits because there is a limited timeframe in which to commit the crime.  So they need to attack a sub-population who:

1. makes good money;
2. might have many deductions;
3. might have complex returns, and;
4. for whom a large refund might not raise red flags.

   How about... Doctors!

   And, just as I finishing writing this article, we have new news out about tax fraud this year!  Reports say this is connected with Turbo Tax software, but it is more likely that scammers got people's info through other means and filed the fraudulent returns.  Maybe Turbo Tax is just the scammers software of choice! :-)

   As always, we want to talk about what you can do.

   In addition to the steps outlined in these previous blog posts, here is the IRS Guide on Identity Theft.  The IRS guide and my previous tips talk about not only what you should do if you are a victim, but tips to avoid the problem in the first place including:

• protecting your personal information, primarily your social security number
• don't click on links sent to you via email or in social media - type the link in yourself or do a search
• use link rating applications like Web Of Trust (WOT)
• don't give our your personal information via web, email, phone unless you can positively identify the person on the other end
• review your bills, credit record and other information that might provide early warning of a problem.

   Have you been the victim of tax-related ID Fraud?  Do you have any additional tips to share?

   Of course, this issue is not just about doctors!  Next time we'll talk about something perhaps even closer to your wallet... payroll fraud and misuse.

Speculative Speculation

   Patch.

   NO WAIT!... DON’T Patch!

   It may cause unexpected reboots (as opposed to the expected kind???? J).

   It may cause system slowdowns.

   It may conflict with your other system controls.

   It sounds kind of like the “fine print” in one of those pharmaceutical adds… patching side effects may include arrhythmia, faintness, moderate to severe amnesia, flushing of the face, dry mouth, blurry vision, visual distortions or white spots, nausea and vomiting, constipation, muscle twitches, confusion, euphoria, sedation, itchiness, and increased anxiety, respiratory or cardiac arrest, coma, hypoventilation (inadequate ventilation), and possibly death.

   This whole Spectre/Meltdown thing has gotten so much attention lately. But the reports are loaded with misinformation, speculation (!), and even some facts.  I’ve have seen some uber-geeky explanations of what is going on.  If you haven’t seen the major rant by the father of linux Linus Torvalds, check this out.

   One thing that has been lacking is more simple, straightforward explanations of this complex topic.  I think Steve Gibson did a great job talking about this recently in his SecurityNow! podcast.  He actually explained the underlying mechanism of speculative execution years ago when he was talking about how modern processors work.

   Speculative Execution is really pretty cool.  It can be complex, but a good example is when there are two choices in how some code may execute, i.e. GO here or GO here, the processor does both!  And it executes steps ahead from where you are in the code now.  The overall effect is that the code executes faster.  It’s kind of like paying it forward with extra computing cycles.  Here's a great explanation.

   Here’s the point about this vulnerability… we’ve had plenty of named vulnerabilities.  They are all the rage these past few years – a name and a logo.  But most of these vulnerabilities are code or protocol problems.  Yes, some of those were very wide ranging.  However, this newly discovered problem is a vulnerability in the underlying architecture of nearly every modern computer chip created since 1995.  Everywhere.

   And while this has not been exploited in practice, that will happen.  The Fix is not yet in.  For now, the advice is to not panic, patch selectively and we’ll all watch and wait!

Meta-Predictions

   Well, it's a new year and we all know what that means... every security publication, and plenty of non-security publications, come out with their annual security predictions.

   I predict that this year's predictions will be as boring and vanilla as last year's.  And we don't even have to wait until the end of the year to see if I'm right!

   So, rather than adding to the noise, I'll save you some clicks.  Everybody's saying the same things... cybercrime, blockchain, cryptocurrency, breaches, yada yada.

   But some people went above and beyond to make the prediction reading experience special!  Here are my favorites:

   Best presentation.  Kudos on the production value of this prediction post by Watchguard.  Between the nice graphics and videos, I was engaged.  They didn't say anything new... but the way they said it makes it worth a look.
https://www.watchguard.com/wgrd-resource-center/2018-security-predictions

   Best use of AI.  This is a great idea... how about machine-generated predictions!  Great fun.  And I, for one, welcome our AI overlords.  Even the text that doesn't make sense makes more sense than some other predictions!  Well done Kelly and Medium.
https://medium.com/@kshortridge/2018-cyber-security-predictions-d493e25162e7

   Best prediction of the death of passwords.  Well, really they said that password-only authentication will decrease faster.  OK, either way, we've been down this road many times before and, unfortunately, passwords ain't goin' nowhere.  We're stuck with them.
https://www.csoonline.com/article/3242866/security/our-top-7-cyber-security-predictions-for-2018.html

   Remembering what we said in 2017 award.  This post doesn't say anything particularly interesting, but I like that they go back and grade their 2017 predictions.  Of course, those predictions were pretty bland but they only gave themselves a generous 9.5 out of 10.  http://resources.infosecinstitute.com/2018-cyber-security-predictions/

   tl;dr award.  I seriously did not even read this one.  Really Forbes?  60 predictions?  I guess all the ad networks you hit us with aren't enough?  I guess quantity wins.
https://www.forbes.com/sites/gilpress/2017/11/26/60-cybersecurity-predictions-for-2018/

   What are your favorite predictions?

   Here's to a great 2018!

BBB - Best Business Books

   As we close out this year and think about the new year, it's a great time to think about your own development and learning.

   I really enjoy audiobooks.  While SciFi is typical favorite, I also mix in business and self-development titles.  I've been keeping a list of my top self-development books and had been meaning
to share them here... and now here they are!

   This list is not exactly in priority order, however my favorites are definitely at the top.  So, more or less, the first third of the list is 5-star books, middle third 4.5-stars, and the final third are 4-star.  These are all great books, regardless of where they are on this list.

   Here we go...

• Start With Why – Simon Sinek
• The 5 Levels of Leadership – John C. Maxwell
• The Chrisma Myth – Olivia Fox Cabane
• Pitch Anything – Oren Klaff
• What Makes an Effective Executive – Peter F Drucker
• A Whole New Mind – Daniel H. Pink
• Eat That Frog! – Brian Tracy
• Getting Things Done – David Allen
• The New One Minute Manager – Ken Blanchard , Spencer Johnson
• The Introvert Advantage: How to Thrive in an Extrovert World – Marti Olsen Laney, PsyD
• It’s Your Ship by D. Michael Abrashoff
• Multipliers by Liz Wiseman
• Just Listen – Mark Goulston
• Influencer – David Maxfield

Ho-Ho-Holiday Spams and Scams

   It's that time of year again folks.  And whatever holiday you may, or may not, celebrate... there's something we're all likely to see.  It's not presents, though maybe there are some for you.  It's not snow, though we're already seeing that here in the upper midwest US.

   It's malware and holiday scams!

   Unfortunately, it happens every year.  Sometimes it's malicious attachments.  Sometimes it's links to malware to download or phishing sites with forms ready to collect your personal and financial information.

   Here is my 2017 edition of my Top 10 Tips To Avoid Holiday Spams and Scams...

You Don't Have to Outrun the (Fancy) Bear

   Two hikers are walking through the woods.  They come around a bend in the trail into a clearing where they can take a break, when suddenly a bear steps out of the woods and roars.  One hiker quickly bends down to tighten his boot laces.  The other hiker says, "what are you doing? You can't outrun a bear!".  The first hiker says, "I don't have to outrun the bear, I only have to outrun you!".

   One of the biggest changes in information security over the past two decades has been with the attackers.  Rather than the old stereotype of a hoodie-wearing loner in the basements with Mountain Dew, Twinkies and old computers, today's attacker is typically trained, smart and well-funded.  Instead of defacing websites for fun and notoriety, attacks today are a business.

   It's a simple risk/reward equation.  There is a cost to any attack.  Email-based attacks are very inexpensive to launch.  Developing sophisticated malware is expensive.  And the more expensive an attack is pull off, the higher the potential gains need to be to make a profit.

   Information security is very complex.  It's as much an art as it is a science.  There are basic things that everyone should do, like patching systems and using strong, long passwords.  And then there are complex solutions to complex problems that need to be artfully implemented to compliment the way people do their work.

   There are so many high profile breaches in the news.  Some of these are the result of highly skilled and motivated attackers going after a specific target.  But many more are "crimes of opportunity".

   As I see it, there are basically three kinds of online attacks:

It's All About the Squirrels!

   Did you know that in 2016 there were more selfie-related deaths than shark-related deaths?  Same is true in 2015.  We'll see what happens in 2017!

   That might seem counter-intuitive.  And that's exactly the point... we are programmed through evolution to focus on the sensational risks.

   We've been hearing plenty about cyber-war and state-sponsored attacks.  These are big and scary things.  It seems that the power grid is a key target.  Well, it turns out that cyber attack is not the top issue that effects the power grid.  Not even close.  And what's a more serious and regular threat???  Squirrels!  No, that's not a joke.

Here's a great presentation at this year's ShmooCon, an annual security conference:

   But here's the point of all this... while it's fun to laugh at, or dislike, squirrels, there's an important lesson here.  We do need to speculate and consider the future when conducting risk assessments.  But we also need to have strong focus on reality!  That means assuring you are considering mundane, but very real threats and vulnerabilities that are actually happening.  It's far to easy for us to focus on high impact, very low likelihood events to the exclusion of those high-probability, common attacks like phishing.

   So skip the sharks and watch out for the squirrels!

Easy as 1-2-3

   It's US Cyber Security Month and the key themes I've been discussing here for years are very bit as relevant today.  In honor of Cyber Security Month I'm re-running a post from 2016.  The more things change, the more they stay the same.  Happy Cyber Security Month!

---

   Well, I was trying for something catchy like Stop, Drop and Roll.  That's a saying we learned in school, back in the day, for what you should do if your clothes catch on fire.

   Fortunately, it seems like everyone has heard that saying and it rolls off the tongue.

   Unfortunately, my three word phrase Patch, Vault and Fob, is not nearly as catchy.

   Fortunately, the odds of your clothes catching on fire is low.

   Unfortunately, the odds of your software, browsers or accounts being compromised is very high.

   A couple of weeks ago the internet was hit with the highly impact-full and publicized distributed denial of service (DDoS) attack on Dyn, a DNS provider.  I won't go into the details here but I think I will cover DDoS in a future post.  Anyway, shortly after that I was chatting with someone at a dinner who asked me about this attack, internet safety in general and what they could do.  To keep it simple and because, as a math person I like things in 3's!, I provided these 3 simple (well, maybe straight-forward is more accurate) things that absolutely everyone should do at home...

Internet Safety for our Parents

   It's US Cyber Security Month and the key themes I've been discussing here for years are very bit as relevant today.  In honor of Cyber Security Month I'm re-running a post from 2016.  The more things change, the more they stay the same.  Happy Cyber Security Month!

---

   I've written about Internet safety for families, kids, teens and I've even spoken on safety for pre-schoolers.  But it's important to think about online safety for parents as well.

   That's true both for parents of young children was well seniors with grown children.  The safety challenges for seniors are similar but there are some differences.  They may not be as familiar with technology and, according to the FBI:

• they are often financially secure and/or have good credit
• they may be more trusting and they don't think they'd be a target

   This article by the AARP lists some common scams against seniors including some we've discussed like fake Microsoft support calls or IRS-related tax fraud.

   What got me thinking about this topic was a great article entitled "10 Ways to Help Our Parents With Online Security".  The article touches on a number of themes we've discussed in the past.  I'll list the 10 items with links back to some past editions of this blog - typically they:

1. don't think they have anything worth stealing
2. have bad password habits - just like most people
3. are confused by 2-factor authentication - something we all should use
4. leave mobile devices unattended and without security measures
5. don't recognize phishing emails
6. don't understand social media and how it can be used in scams
7. share too much information
8. can be manipulated by online media
9. place too much trust in an anti-virus product
10. don't understand how sophisticated scams and attacks can be

   In what ways can you help your parents stay safe online?

Still Can't Live With 'Em

   It's US Cyber Security Month and, like clockwork, we have Yahoo! in the news again telling us that the worst case from the past just keeps getting worster (I can make up words, can't I??? :-).  They are now counting their breached accounts at over 3 billion!  How many people are there in the world these days?...  Last year at this time, they announced the breach of 500 million Yahoo! account passwords and other info (while announced in 2016, the breach actually took place in 2014, and is not the same as the password breach they had in 2012! - yes, I know... it's hard to keep up!).  In honor of both Cyber Security Month and Yahoo!, I'm re-running a post I wrote in... wait for it... 2012!  Not only is everything I wrote in that post 100% relevant today, but I even commented on that 2012 Yahoo! breach.  The more things change, the more they stay the same.  Happy Cyber Security Month!

---

   They're dead.  They're here to stay.

   They're safe.  They're breached.

   They're encrypted.  They're visible.

   They're complex.  They're too simple.

   Once again, the topic we love to hate... Passwords!  And, you know what else???  It's also that greatest of holiday celebrations... US Cyber Security Month!

   Passwords are a mess!  A "good" password has these features:

• hard to create
• hard to remember
• hard to enter
• probably has to be changed as soon as you memorize it
• plus other inconsistent, random rules depending upon the site

   Perfect!

Thoughts about Change

   We've all heard the cliche, the only thing that is constant is change.  Many of our organizations are undergoing all kinds of change.  We may have professional changes.  And, of course, there are personal or life changes.

   Sometimes you have control over changes - they can be choices.  Sometimes you don't have control over the change.  But you do have control over how you respond to change.

I've spoken with many people whose organizations are undergoing change.  That can lead to some uncertainty, but that is not necessarily a bad thing.  It's really just something new.  And change often brings opportunity!

   One model that can be used to help people through change is the Bridges Model of Transition.  Bridges defines a transition path that begins when a change is announced or recognized. and ends when people are successfully in the changed state.  The key is what happens in between!  Bridges describes 3 stages that people must move through.

1. Letting Go - this means both understanding and coming to terms with the change.  It can be characterized by fear or other negative emotions.  Leaders can help by communicating, listening, and empathizing.  Recognize that different people change at different rates.  Individuals can help by talking things through with their leaders.
2. The Neutral Zone - this occurs once people get past their initial reaction to change.  This can be a period of uncertainty.  Leaders can help by providing direction and continuing to communicate.
3. The New Beginning - this occurs when the organization has arrived at the new state.  Since people do change at different rates, all team members may not arrive here together. Leaders can help by recognizing the state of team, providing extra direction where needed, and celebrating successes of the transition.

   I've been thinking about the topic of change for a couple of reasons.  First, my current organization is undergoing the change of integrating in a new organization.  This is actually a great synergy and creates many great opportunities both for the business and for individuals.  But as we discussed above, change affects different people differently.

   In addition, I'll be undergoing my own change soon as I transition to a new and exciting opportunity!

   Thank you to all my current colleagues for their partnership and support!  I know our paths will cross in the future.

Equi-Fail!

   Or maybe we should say Equi-Fiasco!

   By now you've certainly heard about the Equifax breach including leaked social security numbers and other personal information on over 143 million people.  And there's plenty more info to come with this one as the facts continue to get uncovered.

   I certainly don't mean to be jumping on the bandwagon here.  There has already been so much coverage of this breach, but it is a big deal.  And, while I've seen a number of articles on what to do now, I haven't seen any that really cover everything you must do to protect yourself.

   Let's do that now!

   The bottom line is this... it's 2017... no one can or will protect your personal information.  You must take appropriate steps to protect yourself.  And here they are... in no particular order... the top-10 things you should do to protect your personal and financial information:

I Have Neither Read Nor Understood

   The site masthead starts out with the statement:“I have read and agree to the Terms” is the biggest lie on the web. We aim to fix that.

   This is the lead statement on the tosdr.org website.  tosdr is an acronym for "Terms of Service; Didn't Read".  It's a play on words (play on acronyms? :-)) of tl;dr, Too Long; Didn't Read.  tl;dr has been a term floating around the interwebs for many years.  It simply expresses a sentiment that many people can relate to... that we're busy, so when there is a long article, post, whitepaper, document, documentation, etc., we might just not read it.  That also leads to the idea of the tl;dr version, i.e. executive summary!

   Clearly, Terms of Service statements fit into this category.  They tend to be exceedingly long.  They are often written FLBL (For Lawyers, By Lawyers)! :-)  You see them all over the place... on your bank's website, on social media sites, when you sign up for just about any kind of service, and with just about every app you install.

   So, if no one reads them, what's the problem?  Like a contract, the Terms of Service or EULA (End User License Agreement) provides some very important information.  For example, it may cover:

• how the app, website or company can use your personal data;
• if the site can sell your data,
• whether or not you own any content you upload (such as to a social media site);
• how, when, how much you can use the app, service or website;
• if the site can charge you money, either one time or ongoing;
• if you have any rights to seek damages against the company if you don't like how they conduct business
• and more...

Don't Blame The IRS

  In a post last month, I include a recording of an obviously fake voice message warning about payment and fines due to the IRS.  If you've read my blog in the past, I talk a lot about scams and give tips to avoid them.  We've often discussed that legitimate organizations should not just contact you and ask for personal information.

   That just makes sense.

   But telling the difference between a legitimate call and a scam call has gotten harder.

   A reader let me know that the IRS is now using collection agencies to collect back taxes!  That just makes it even tougher to tell the difference between a legit collection call and a scam!

You Gotta Be You

   I just received an update from the Social Security Administration.  Yes, it was real! :-)  It was a reminder to log in to the SSA website to check my information online.  That also made me think about advice I've written about in the past... it's critical that you connect and establish your presence on critical government websites before someone else can create an account in your name.

   Here's a rewind of a 2016 post with all the information...

---

   I recently received a letter from the SSA (Social Security Administration).  It provided instructions for me to finish setting up my online account.  As I've written in the past you can, and need to, create personal accounts on the SSA and IRS websites.  The key issue is that you need to reserve and establish your identity on these critical government websites before someone else does it for you!  This is ID Fraud is still a big issue.

   These accounts are straightforward to set up.  One thing you will need to do is go through an Identity Proofing process.  That process asks you for some personal information that, in theory, only you should know.  I list info about the irs.gov account creation process in this post.

   Here is some info from the ssa.gov website:

You can create a my Social Security account if you’re age 18 or older, have a Social Security number, a valid email, a U.S. mailing address, and a cell phone that can receive text messages. You’ll need to provide some personal information to confirm your identity; you’ll be asked to choose a username and password; and then provide your cell phone number. You’ll then receive a security code via text that you will be required to enter when you first create an account. We’ll send your cell phone a new security code each time you log in with your username and password. The security code is part of our enhanced security feature to protect your personal information. Keep in mind that your cell phone provider's text message and data rates may apply.

   Now SSA has increased their security by offering two-factor authentication (2FA) on their site.  We've written about 2FA a number of times in the past.  SSA had said this was coming and now it's available.

   I highly recommend that you create accounts on these sites and use 2FA where available.  Here are the instructions for SSA.  Here for the IRS.  You can enable 2-factor authentication on the SSA site when you create your account.  Here's a link to a previous post looking at other sites where 2FA is available.  Double up wherever you can!

The Matter at the Hand

   Check this out!...



   Here's a transcript:

   Calling from Criminal Investigation Division of I-R-S.  The matter at the hand is extremely time sensitive and urgent, as after all that, we found that, there was a fraud and misconduct on your tax which you are hiding from the federal government. This need to be rectified immediately so do return the call as soon as you receive the message. The toll free number is 1-8-6-6-9-7-8-6-6-1-8. I repeat again, 1-8-6-6-9-7-8-6-6-1-8. Thank you.

   Needless to say, this is a scam.  You can look at all of these reports on phone number lookup sites.

   Now, you may think that this obviously sounds like a scam.  However, it unfortunately works.

   So what should you do if you or someone you know receives one of these calls?

1. Don't respond.  Just leave that alone.
2. Report it.  Here is the FTC info page on reporting scams, spams, do not call or telemarketing violations and other issues.  Here is the complaint reporting page.

   I did file a report with the FTC.  It doesn't take long and it's the right thing to do.

   While these calls can be either annoying or entertaining, the bottom line is that they work and some people do fall for these scams.  So educate yourself and others.

   Do you have any interesting robo-call or scam stories to share?

All Your Bitcoin Are Belong To Us

   If you're old enough... and geeky enough, you may remember this:

   All Your Base Are Belong To Us was one of the famous early internet memes.  You can take a break and read more about it here and here.

   Memes are fun!  But ransomware isn't.  We've talked about ransomware many times in the past.  It's a kind of virus or malware (malicious software).  It's been in the news quite a bit and the healthcare industry has had particular ransomware problems.  And the news will continue after May's "WannaCry" and June's Petya/GoldenEye global attacks.

   Basically, in a ransomware attack, infected computers cause data to be encrypted.  Normally encryption is a good thing, but only when you can also decrypt your data.  In this attack, only the attacker can restore your access to the information, and will do so for a "small consulting fee".

   Payment is typically made using Bitcoin.  Bitcoin has also been in the news.  It is what is called a "crypto-currency".  It's basically an online way to pay for things, kind of like an online debit card where you already have the funds in your account.  The main reason Bitcoin is used for ransomware is that it is fairly anonymous, particularly when compared with traditional credit cards or banking.  It's not completely anonymous - it does protect identity during transactions, but eventually someone may have to turn that bitcoin into other traditional currency.

   With all the ransomware attacks, some organizations are getting bitcoins so that they are ready in case they need to pay ransom!