Social Engineering Fraud Losses Doubled in 2015

Consider the largest breaches of 2015 and realize they weren’t about getting financial data directly. It was all about personal details. Identity theft is a hotter commodity on the dark web, than credit card numbers.

• Anthem
  • 80 million (Personal Details)
• Ashley Madison
  • 37 million (Personal Details)
• OPM Data Breach
  • 22 million affected (Personal Details)
• Experian/T-Mobile
  • 15 million (Personal Details)
• Premera
  • 11 million (Personal Details)
• mSpy
  • 400,000  (Personal Details)
• IRS
  • 330,000 users (Personal Details)
• VTech
  • 12 million users, a little more than half of them children. (Personal Details)

The hotter the commodity, the more bold the fraudsters are though. Identity theft is a big ticket item, especially in children’s details. Credit cards can be de-activated and numbers can be changed, but a person’s identity can be used to open accounts with a line of credit, or health benefits; giving a fraudster much more money and time.

Credit cards have a cap on how much can be withdrawn, but a properly stolen and used identity can be used to take out a loan, especially if the victim had great credit scores.

As I was saying, children’s details are of higher demand because nobody checks credit and the identity theft status of their 2 year old; giving the fraudsters about 16 years of use of the identity.

Fraudster tactics include:

Telecom fraud Fraudsters obtain the phone number of an individual, often an elderly person, then call them pretending to be a family member or public service and claiming to be in urgent need of cash.
They ask for money to be deposited in a designated bank account or delivered by hand in order to settle a traffic accident claim, loan shark debt, or other pressing financial need.
Email scams Pretexting involves creating a scenario to engage a targeted victim; for example, impersonating a bank manager or tax inspector to convince the target to share personal information such as account numbers or passwords. This type of scam requires the criminal to conduct research on the victim, in order for the story to appear plausible.
Phishing is similar to pretexting, phishing uses a more generic scenario which is sent to a large number of people in an attempt to draw in as many victims as possible. This is usually done by e-mail and appears as if it comes from a legitimate source which many people frequent, such as popular online shopping websites, e-mail companies or computer tech support companies. The same techniques can also be executed by phone (Vishing) or by text message (SMishing).
CEO fraud / Manager fraud Fraudsters gather publicly available information – usually through the Internet – about the company to be targeted.
They find out details of the Head of the company, and those managers and employees who are authorized to handle cash transfers.
The criminals use this data in order to impersonate the head of company and coerce employees into making an urgent and high-value cash transfer to a designated bank account.
Hacking of e-mail accounts A cybercriminal hacks into an individual’s e-mail account and sends messages to their friends, relatives or colleagues claiming to be in trouble, for example, and needing money.
The recipient is unaware that the e-mail is not actually coming from the person they know, making them more inclined to assist – and thereby assist the criminal in gaining money or accessing their accounts.
Sweepstakes or lotteries A person receives a message along the following lines: ‘Congratulations, you are the grand prize winner! To claim your prize, all you need to do is pay a processing fee so we can release your winnings.’
Very often, names of popular companies or organizations are misused to give the lottery a trustworthy impression.
Despite making the requested payment, the victims never receive the expected prize winnings.
Other techniques include:
Forensic recovery -Analysis of non-securely disposed materials (USB keys, hard drives);
Quid pro quo – Exchange of sensitive information under a misunderstanding;
Baiting – Leaving an infected storage device to be picked up and plugged into a computer;
Tailgating – Following someone to access secured premises;
Diversion theft – Redirecting a courier or transport delivery to another location.

How to report a scam
Individuals
Follow the steps below:
Immediately contact your financial institution and report any unusual activity;
Change any passwords or credentials possibly hijacked. Where possible, choose a second layer of authentication, for example, combining a password and SMS verification;
Report the incident to police or the appropriate agency in your country;
Save all received and sent emails and text messages;
Save all documents of any transactions and remittances.
Companies
If you think you have revealed sensitive information about your company or organization, follow the steps described above.
In addition, report the details to the relevant people in your company, including your security and IT departments.

How to avoid a scam in the first place:
Follow my website, Facebook, or Twitter to stay updated on the latest news, awareness is key that you can use to unlock bad-guys secrets!

Here is an awesome post about Vishing and Smishing by the BBC.