Every year it seems scammers get more and more clever, with new techniques designed
to steal from us.
And the best thing you can do to fight them is learn their ways so you can spot the scams
from a mile away, so that’s what we’re going over today.
I’ve got about 7 scam techniques that are either brand new, or have become more prevalent
leading into 2020, most of which are internet and phone based, and how you can also defend
against each one of them.
So the first one you need to watch out for is a pretty clever email-based scam.
With this, the scammer will basically impersonate some high level manager or executive.
They might do this by either spoofing the email address, or use the person’s actual
email account to send it out if they manage to break in with a stolen password.
Then for the scam, they will email multiple people at the company below them, telling
them they need to go buy gift cards usually, saying it will be a gift for other employees
on your team or whatever.
The scammer might tell the victim to put it on a company credit card, or to buy it themselves
and they’ll be reimbursed, and also tell the victim to send the gift card codes to
them.
Then once the scammer gets the gift card codes, they’ll just disappear.
This type of scam has been reported by several people on reddit, who have either fallen for
it or come close to, and is probably going to be more common around holidays when the
whole lie about needing the cards for gifts makes more sense.
This scam may also be tougher to detect because it can be more personalized.
But now that you know about it, you can easily defend against it by simply calling the person
who supposedly needs these gift cards and actually speak to them to confirm, or go talk
to them in person.
Ok the next scam is a variation of a phishing scam, which has become a lot more popular.
The idea is a scammer will send out a ton of fake shipping confirmation emails pretending
to be Target, Amazon, or some other online store, and then give you some kind of login
link to ‘track your order’.
But then it takes you to a phishing site designed to look like the real site, requiring you
to log in, and then it just steals your credentials.
There are a lot of possible variations to this, for example the scammer might say something
like “there’s a problem with your order, log in here to fix it” or whatever.
They may even be able to personalize it by using information from previous data breaches
to actually include your real name in the email to make it seem more legitimate.
This is another one that will be more common during holiday months where people make lots
of orders online, so if the scam email happens to arrive soon after you actually order something,
you might not think twice and then fall for it.
Now there are a few ways you can defend against this scam.
First, be highly suspicious of any shipping confirmations or purchase-related emails if
you didn’t actually make any orders.
Next, remember that usually stores will include the names of the products you ordered in the
email.
Not always but usually.
So if the email is overly generic, don’t click any links, and just go to the site directly
yourself to check any order status.
Ok up to number 3, this is another email-based scam having to do with online stores, but
it’s not a phishing scam.
This particular scam technique occurs when a scammer has already gotten access to one
of your online shopping accounts.
They may have done this in any number of ways, whether it was a previous phishing attempt,
or a stolen password database or something, but that’s not the point here.
The trick is that the scammer will place an order to buy a bunch of crap to themselves
using your online store account using saved payment details, and then hide the fact that
they did this by signing you up for a ton of spam emails, which hides the order confirmation
email.
Because normally if they ordered something with your account, you would just see the
email and become suspicious if you didn’t order anything, and hopefully check it out.
So they sign you up for a ton of spam to bury this order confirmation mail, hoping you won’t
see it.
One example from someone on reddit who spotted this spam gave the example that they got a
ton of spam from government newsletter, all from the ‘govdelivery.com’ domain.
Fortunately they still spotted the order email and was able to cancel it.
So the way to defend against this scam is become very suspicious if you all of a sudden
start getting a ton more spam than usual, especially if it’s from one source, and
actually go through all the emails making sure nothing is hidden in there.
Because remember, this is a technique scammers may use if they’ve already got you somehow.
Alright up next is a really devious one, where ironically, scammers initially call a victim
pretending to be government officials warning them that their identity was stolen.
In one specific example, scammers called someone and said they were from the Social Security
Administration, telling the victim that their social security number was stolen and used
to rent a car.
They then scared the victim by saying the rented car was found with a bunch of illegal
drugs inside, and they needed to comply with the investigation or face prosecution.
They even had someone pretending to be a border patrol agent, saying the supposedly rented
car was found near the border and was used for smuggling, or all sorts of scare tactics.
Eventually, you guessed it, they convinced the victim to buy thousands of dollars worth
of Google Play gift cards, which scammers these days love.
Now, it might not always be this obvious, for example the scammer might demand a wire
transfer, saying your bank account was compromised,
or that there is stolen money in your account
or god knows what reason.
The primary way to defend against this scam is to know that the government is not going
to call you to tell you your identity is stolen, and definitely won’t threaten you with prosecution
by phone.
And OBVIOUSLY, for god’s sake, the government is not going to ever ask you to buy freakin’
gift cards.
Seriously, I feel bad for the guy who lost a bunch of money to this scam, and I guess
he was under heavy pressure, but he’s still a moron for falling for it.
Just always be suspicious, ESPECIALLY when give cards are involved, and you’ll be fine.
Ok the next scam is actually really sophisticated and one that even the most tech savvy of you
might still fall for.
This one takes advantage of a feature of all those virtual assistants these days, like
Amazon Echo, Google Assistant, Siri, and all those.
You see, when someone asks AI assistants to call a certain business, they often will use
search engines to look up the top result for that business for the customer support number
to use.
Then they’ll either give you that number it finds, or just call it depending on what
you asked it to do.
But here’s the really tricky part.
Turns out scammers have started setting up fake customer service phone numbers, then
pay to promote these numbers with ads or other sketchy tactics, so they end up near the top
of the results.
And even I am not 100% sure how this works.
It seems like these AI assistants apparently can’t tell the difference between an ad
and an actual search result.
But regardless, the way the scam works is the virtual assistant will call the fake scam
customer support number instead of a real one, then the fake representative will try
to get you to do all sorts of stuff.
Depending on the company you think you’re calling, they may instruct you to install
malware, or have you log into a fake website and steal your info, or anything really.
And the worst part about all this is most people will assume they’re safe because
they called the company, it’s not like they received some suspicious call, without realizing
the number they called isn’t real.
So the way to defend against this, I would say, is don’t use virtual assistants to
just auto-dial for you.
Always do a search yourself, and make sure the number comes from the official company’s
website, and never call a phone number that’s listed in an ad in search results.
Alright we still got a couple more scams to go over.
This next one really sucks because it has to do with directly stealing your money, and
you don’t even have much control over defending against it.
What the scammer does is first get some of your basic information, probably from a breached
online database, which you can’t control, and then either emails or calls up your company’s
HR department, or payroll department.
Then, they pretend to be you and tell the person that you want to change the bank account
where you receive your paycheck via direct deposit.
If the HR representative falls for it, you probably won’t even realize what’s happened
until your next payday when you don’t get your money.
I believe you wouldn’t be on the hook for the cash, the company would, but you still
have to deal with the stress of missing a paycheck and having to sort it out with your
employer.
Apparently these scammers are pretty smart, and the emails they send can seem very legitimate.
Like here’s one example, it just said, “do you have a minute?
I need you to help me take car of something important.
I need to update my direct deposit for payroll, can you get it done on your end?”
Depending on the email address the scammer used to send it from, especially if they got
into your real email address, that would be really convincing.
So I guess really the only way you can defend against this firstly is make sure you keep
your email account secure with a unique, strong
password, and ideally use two factor authentication.
Then always keep tabs on your bank account to make sure payment deposits arrive when
they should.
Alright the final scam is a new, trickier variation on classic bank phone scams.
And it may even be used to circumvent two factor authentication methods.
What happens is the scammer will call you up pretending to be your bank’s fraud department,
asking if you made some purchase, which you obviously didn’t, and then they offer to
block the transaction.
They then ask for a piece of information that by itself you might not think can be used
to scam you, such as your bank member ID, user ID, email address, or something you use
to login, but not your password.
Then they’ll go on the bank’s website and use the lost password function, along
with whatever info you gave them.
With some banks, this will trigger a confirmation text message with a code to be sent to your
phone, but it might not say anything about a forgotten password in this text.
So the scammers then ask for that code from your phone, and use it to log in to your account
themselves.
Depending on your bank they may already have enough to steal money from you, or they may
keep digging for more info, even asking for your bank card PIN.
Obviously everyone knows you should never give your PIN number to anyone claiming to
be the bank, unless you specifically called them, but again the trick here is you don’t
realize you gave them other info they can use to take over your account.
So the way to defend against this scam is nothing new.
If you ever receive a call from someone claiming to be your bank, never give them any info
unless you actually call them, and use the official bank phone number on the bank card.
And be aware that scammers might be able to use seemingly innocuous info to scam you,
so be extra careful.
If you want to know about even more scams, I’d recommend this other video I made this
year talking about other new online scams to watch out for.
You can just check that out by clicking the thumbnail right here.
So thanks so much for watching guys, and have a good one.