FBI Reports Fraudulent Activity on Internet Related to Hurricane Katrina

On September 1st, the FBI issued a warning after noting a lot of sites soliciting for charitable donations for the victims of Hurricane Katrina. It is expected that we will see a lot of SPAM e-mails regarding this subject popping up in our inboxes also.

Some of the websites and SPAM could lead to phishing and pharming activity related to identity theft. Of course, they might also lead to charity fraud, or even a combination of both activities.

Here are their recommendations:

• Do not respond to any unsolicited (SPAM) incoming e-mails.
• To ensure contributions to U.S. based non-profit organizations are used for intended purposes, go directly to recognized charities and aid organization’s websites, as opposed to following a link to another site.
• Attempt to verify the legitimacy of non-profit organizations by utilizing various Internet-based resources which may assist in confirming the existence of the organization, as well as its non-profit status.
• Be leery of e-mails claiming to show pictures of the disaster areas in attached files, as the files may contain viruses. Only open attachments from known senders.

If you note any of this activity, please report it at www.IC3.gov.

The victims of Katrina deserve and need our help. It's unfortunate that this disaster has brought out the bad in many people. It is up to all of us to ensure that every dollar donated helps the poor souls, who have suffered a terrible disaster in their lives.

Here is another FBI Alert on the London Bombings. As was done after the Tsumani disaster, the Advance Fee (419) scammers were soliciting for people to claim money for a person who perished in the bombings.

Here is a link to the alert:

http://www.ifccfbi.gov/strategy/wn050822.asp.

Unfortunately, if they haven't started already, I'm sure the Advance Fee (419) scammers will develop a scam for Katrina also.

To view the FBI Alert on Katrina, click on the title of this post.

Ensuring the Katrina Victims Receive Your Money

If Katrina is like other disasters, there will be people trying to take advantage of the situation (commit fraud). One method they use is to solicit donations for phony charities. The people there need your help. I am posting this in the hope that we can get as much to them as quickly as possible without any of our hard earned money lining the pockets of unscrupulous fiends.

The FTC has already addressed this issue and has some helpful tips. Here they are:

"Donate to recognized charities you have given to before. Watch out for charities that have sprung up overnight. They may be well-meaning, but lack the infrastructure to provide assistance. And be wary of charities with names that sound like familiar, or nationally known organizations. Some phony charities use names that sound or look like those of respected, legitimate organizations.

Give directly to the charity, not the solicitors for the charity. Solicitors take a portion of the proceeds to cover their costs, which leaves less for victim assistance.

Do not provide personal or financial information, including your Social Security number or credit card and bank account numbers to anyone who solicits from you. Scam artists use this information to commit fraud against you.

Check out any charities before you donate. Contact the Better Business Bureaus Wise Giving Alliance at www.give.org.

Do not give or send cash. For security and tax record purposes, contribute by check or credit card. Write the official name of the charity on your check. You can contribute safely online through national charities like www.redcross.org/donate."

Ask for identification if you are approached in person. Many states require paid fundraisers to identify themselves as such and to name the charity for which they are soliciting.

Should you suspect fraud, report it to the authorities. You can file a report directly with the FTC at http://www.ftc.gov/.

The people on the Gulf Coast need and deserve every penny they can get. By contributing wisely, we can ensure they do!

For the FTC Alert on this, click on the title of this post.

Robbers Posing as FEMA Personnel

Like everyone else, I have been dismayed at the problems created in the wake of Katrina. Disasters bring out the best and the worst in people. Unfortunately, in this case, we have seen far too much of the worst.

On Saturday, the Federal Emergency Management Agency, or FEMA disclosed that their uniforms, letterhead and badges have been stolen in New Orleans and robbers are using them to commit their foul deeds.

Reports indicate that these robbers are identifying themselves as procurement officers to commit their misdeeds (robberies) and are sometimes armed. Note that real FEMA personnel are never armed.

To verify FEMA personnel, or report suspicious activity, please call their offices in Baton Rouge at 225-296-3421, or 225-296-3335.

For the FEMA website, click on the title of this post.

Addressing Qchex Fraud

One subject, I've received a lot of comments on is Qchex. Qchex allows people to receive checks through the internet. Their site warns the prospective consumer that they accept no liability and will not investigate anything regarding the checks they send out.

They seem to have become a fraudster's best friend.

Criminals across the world quickly took advantage of the service Qchex offers in Nigerian Letter, Lottery and Auction (Advance Fee) scams. In these scams, an unsuspecting person is promised a large amount of money from a lottery winning, or for helping foreign royalty etc. They are then sent a Qchex item, allegedly to cover a tax or tariff and are told to cash it and wire the money (normally overseas). In auction variety of this scam, Qchex are used to purchase high ticket items, which are normally shipped overseas, or they are sent an amount over the purchase price and asked to kindly wire the excess money. In the end, the check returns and they are held financially and in some cases, criminally responsible.

The banks do not always detect the fraud and more victims are created when their accounts are drained through the use of Qchex. In these instances, since the money is normally reimbursed, if the bank can't return it to someone, they themselves become the victim.

Please note that many other financial instruments are used in these scams, primarily counterfeit items. With QChex, it made the process easier since it takes skill and resources to produce quality counterfeit items.

The good news is that the FDIC and the Privacy Rights Clearinghouse have officially complained. Qchex is claiming that they have now come up with a solution that will verify that the right person is using the account in question. According to Qchex, their new controls are reducing the number of complaints.

Quite frankly, due to Qchex's initial lack of response to the problem, I'm going to wait and see if they have truly taken a bite out of the criminal activity their service supports. I checked their security disclosure at http://qchex.com/security.asp today. It still has the disclosure of what I term as (no accountability), along with some ludicrous examples of how they enhance your security by doing business with them. The most amusing was "Registering your bank accounts with Qchex ensures no one else can setup or access your account numbers on the Qchex system." I guess that means if you do business with them, they will catch on if the criminals try to use your account at Qchex?

I would ask anyone, who is aware of any recent fraud with Qchex to click on the title of this post, which will take you to a site where you can complain to the FDIC.

You can also make the Privacy Rights Clearinghouse aware of any recent activity by visiting their site at:

http://www.privacyrights.org/index.htm

In many of the replies, I've received about Qchex, people were so angry they suggested suing them. There are attorneys out there that deal in fraud litigation. Here is a link to a simple search listing some of them on Yahoo.

http://myweb2.search.yahoo.com/search?fr=sbc-web&tab=&p=Fraud+Victim+Attorneys&btn=Search

I'm not an attorney, but after dealing with some of the victims on this, it is clear that they have been damaged financially.

More Arrests in Zotob Case

E Week is reporting that 16 more fraudsters have been arrested in Turkey as a result of the recent Zotob case. Allegedly these 16 individuals are tied into a credit card and identity theft ring. There is more information forthcoming, but these individuals are said to run botnets.

Botnets are frequently used to steal information and spread SPAM. There are reports that the owners of these networks rent them out to organized crime. Organized gangs use botnets to install spyware, or a Trojan horse to gather financial, or personal information, which are used in fraud schemes. This is normally done through the use of keyloggers. Keyloggers log keystrokes and place them in a file, normally encrypted, that can be extracted remotely.

Please note that so-called legitimate marketing firms use spyware, normally downloaded from freeware, or peer to peer programs) that gather information on people. A lot of this technology is legal and can easily be purchased over the internet, often being touted for reasons such as spying on your employees, or spouse.

According to Wikipedia, "Botnet" is a jargon term for a collection of software robots, or bots, which run autonomously. A botnet's originator can control the group remotely, usually through a means such as IRC, and usually for nefarious purposes.

A botnet can comprise a collection of cracked machines running programs (usually referred to as worms, Trojan horses, or backdoors) under a common command and control infrastructure. Individual programs manifest as IRC "bots". Often the command and control takes place via an IRC server or a specific channel on a public IRC network. A bot typically runs hidden, and complies with the RFC 1459 standard. Generally, the perpetrator of the botnet has compromised a series of systems using various tools (exploits, buffer overflows, as well as others; see also RPC). Newer bots can automatically scan their environment and propagate themselves using vulnerabilities and weak passwords. Generally, the more vulnerabilities a bot can scan and propagate through, the more valuable it becomes to a botnet owner community.

Microsoft's Internet Security Team is being given credit for developing a lot of the intelligence, which the FBI and international authorities used to resolve these cases.

For more information on the original arrests of Farid Essebar from Morocco and Attilla Ecici from Turkey go to:

http://fraudwar.blogspot.com/2005/08/zotob-hackers-caught.html

For the original article from EWeek, click on the title of this post.