You get a text out of the blue from a number you don’t recognize. It might say “Hey,” or “Are you coming by at 9:00 PM?” or “When are we getting dinner?” The request is so innocent that you feel like you should recognize it, and your first instinct is to ask, “Who is this?”
Don’t. It’s a way to get you talking, and the conversation can go in a lot of different directions. Many of them won’t seem like they can do any damage to you, but they will. John Oliver’s show has a great piece on it.
What to do: Simply block the number.
PayPal and bank scams
You get a message from PayPal that looks legitimate and says you owe some money. Or a bank email that says something similar and asks you to log in.
What to do: Do not log in from an email. Look at who sent it and make sure it’s the exact email address. Then log into your PayPal or bank account the way you normally do and see if any of that information is there.
“We paid you too much”
Connected to any financial scam, they make it look like they’ve paid you too much. You’ll even see money in your account. All you need to do, they say, is pay it back.
What to do: Don’t. If someone truly paid you too much, that’s their problem, not yours. The one exception is if you’re in business with them. Then yes, pay them back. I’ve had to do this a number of times.
“Update your password”
Very similar to the one above, but they’re just asking you to log in to check your information. Requests to update your password can also be legitimate, and that’s fine.
What to do: Don’t click any links in the email. Go to the site like you normally would and change your password there.
“You’ve won a prize”
You’re a winner! To claim your prize, you just need to pay some taxes or processing fees up front.
What to do: Don’t pay. You didn’t win anything.
MFA code scams
MFA stands for multi-factor authentication, the code you get when you log in to an account. If you ever get a support call where they ask you for your MFA code, you’re in a scam.
What to do: Do not give your MFA code over the phone, text, or email. Once you do, they’re in your system and can do whatever they want.
Gift card scams
This is probably the most well known. It tends to happen at an office, where you get a request from your boss to order a bunch of gift cards.
What to do: Pick up the phone, call your boss, and ask if they really made the request.
Online merchandise scams
You order a product from an online ad and don’t get what you paid for. This happened to me. I ordered what looked like a self-solving Rubik’s Cube. It turned out to be a regular knock-off cube that maybe cost $2. Because I paid with a credit card, I was able to dispute the charge, and I got my money back.
What to do: Never use debit cards. If something goes wrong, you wouldn’t be able to dispute the charge.
Family member scams
You get a call from a loved one who’s in trouble, and you need to send money right away. With AI, anyone’s voice and face can be faked. You can and will easily be fooled.
You get a call out of the blue saying they’re seeing some bizarre activity on your computer. Maybe they’ll say they’re from Microsoft. They need access so they can update your software.
What to do: Don’t give it to them.
Credential stuffing
Chances are you’re reusing passwords, and criminals know it. Many of your passwords have already been exposed on the Internet and are sitting in clear text on the dark web for anyone to see. Criminals take those lists of usernames and passwords and see what other accounts they can get into.
What to do: Find out which of your accounts have been exposed at haveibeenpwned.com. Type in whatever emails you use to log into accounts and you’ll see.
How to protect yourself
GAP IT
Never respond directly to any kind of message. These scams can come through any type of messaging tool. Instead of responding directly, log into whatever system you think may be at issue like you normally would, or call the organization by looking up the number on their site, not the message you received. Kudos to CISO Series reporter Steve Prentice for bringing this term to my attention.
Don’t click
If an email looks too legitimate or phishy, do not click. See GAP IT above. If you have tech support at your organization, flag it for your support staff. That lets them block it in the future and keep others from getting caught.
Have a family password
Our voices and faces are so prevalent on the Internet that if someone wanted to fake you or any of your family members, they could do it very easily and fool everyone. We have a family password, and you should too. It’s a word you’d say out loud in normal conversation, so don’t pick something like “pineapple.” If my family gets a message from me that sounds really urgent and I don’t say the password, they know it’s bogus.
Use different passwords
Especially for financial sites.
Use a password manager
I can’t see how anyone can operate online anymore without one. 1Password is the one I use for my business. I barely know any of my passwords. I just know my master password, and that’s pretty much it. With a password manager you can create really complicated passwords and not worry about it.
Use MFA
Multi-factor authentication is a great way to protect yourself, especially if your password is compromised. Make sure you’re using it on all your financial accounts.
Use a VPN
If you’re traveling and using hotel, airport, or coffeehouse Wi-Fi, use a VPN (virtual private network). It hides you on public Wi-Fi, which can easily be scanned. Most antivirus programs also have a VPN tool. Use it.
Freeze all your credit accounts
If you haven’t already, freeze all your credit accounts. This is how criminals steal your identity, by changing your credit accounts. By default, they’re on 24/7, and they don’t need to be. They only need to be open at the moment a business has to do a credit check, like when you get a new phone carrier or buy a car. Mine are frozen. I open them for 24 hours when I need a credit check, and then they automatically freeze again.