Phishermen Using "Stop Fraud Now" Hook

Phishermen use all kinds of "lures." In this latest ploy (reported by Websense), they are even invoking the name of the FBI and the National White Collar Crime Center in their phishing scheme.

The problem is that anyone, who chooses to use their "free service," will become another "identity theft" statistic.

Here is the alert from Websense:

Websense® Security Labs™ has received reports of a new phishing attack that targets customers of Bank of America and various other banks. Users receive a spoofed email message, which claims that a new security program called SFN (Stop Fraud Now) has been launched. The program claims to provide protection against cloning of credit cards and asks users to provide details, such as Social Security Number, card number, and ATM Personal Identification Number (PIN). The message provides a link to a phishing website that requests users enter their personal information and account details.

The phishing site is hosted in Canada and was up at the time of this alert.

Phishing email:

Bank of America' in collaboration with ALL the banks around the world which offers services of transactions through the internet and not only and several institutions against frauds launched a revolutionary program called SFN (Stop Fraud Now)'.

By registering on SFN your card is protected 99.99%. You probably wonder why we say that the chances of suffering a loss are 0. The moment you register you will receive a code which contains an international unique code (IUC). This code arrives to the bank which your card was released from. This way your card can't be cloned without knowing this code. Only the issuer bank can reproduce your card in case you loose it or has been stolen. Also you have many options from your account. On-line assistance through chat or virtual phoning (skype) non-stop and also the possibility of blocking your account through the push of a button anytime you find anything suspicious about it. You can unblock it as easy after solving the issues. Another helpful option you can find it in the internet Online section. There you have two buttons On-line and Off-line which allows y! ou to keep your card off-line for transactions and to active it only when you wish to shop or make a transaction. We guarantee it's a 100% efficient and secure program and monitored 24 hours a day, 365 days a year.

Click here <> to see the list of banks which support SFN program

Click here <> to visit our website for more informations!

JOIN NOW FOR MORE PROTECTION!Your card no longer can be cloned! Your card is monitored non-stop for a period of 356 days preventing suspicious transactions on the internet but also from the bancomat!

You have free assistance from our team anytime you're unclear about our services! Once you created your account you can set your card to on-line or off-line for internet transactions! This option offers you 100% ASSURANCE that ONLY YOU are able to use the card for online transactions!

The chances of being a victim of a material loss is 0.01% and in the case supposing our system didn't work at the efficiency we promised, we guarantee 100% that your money will be recovered!This service is offered by Bank of America in association with European Central Bank and National Australian Bank The project is of federal nature and is protected by the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C). It is 100% FREE !

For more information about this program visit our website

Bank of America
Electronic Banking Services
CA4-701-02-75
P.O. Box 37000
San Francisco, CA 94137

For the full Websense alert, link here.

My fantasy is that the FBI reaches across the border to the RCMP (Royal Canadian Mounted Police) and takes this one down!

This isn't the first time, the cybercriminals have used the name of the FBI:

The FBI Doesn't Notify People They Investigate

Phishermen Luring Victims with Google

Phishermen try to lure their victims with whatever is popular and there is no doubt "Google" is popular. Because of this, the phishermen are trying to tarnish Google's good name!

In November, Websense issued this alert:

Websense® Security Labs™ has received reports of a new phishing attack that targets users of Google's search engine. Users are redirected to a spoofed copy of Google's front page with a large message claiming "You WON $400.00 !!!". Users are presented with instructions for collecting their prize money. These instructions direct users to enter their credit card number and shipping address. Once the information has been collected, users are directed to Google's legitimate website.

This phishing site is hosted in the United States and was up at the time of this alert.

For the November version with screenshots, link here.

And today Websense released another version of this scam:

Users are shown a spoofed copy of the Gmail login page with a message claiming, "You WON $500.00!" The message states that this prize money will be delivered to an e-Gold, PayPal, StormPay, or MoneyBookers account of their choice. If users select an account, they are informed that this prize money is only available to "premium members" of "Gmail Games." The page states that "Gmail Games" membership requires an $8.60 registration fee, and then asks users to pay the registration fee or forfeit the $500 prize money. Users are directed to an actual payment site to deliver the registration fee.

This phishing site is hosted in the United States and was up at the time of this alert.

Sample Email Lure:*

*You won $500! Gmail congratulates you!* *CONGRATULATIONS!YOU WON $500!*Gmail gives members random cash prizes. Today, your account is randomly selected as the one of 12 top winners accounts who will get cash prizes from us. Please click the link below and follow instructions on our web site. Your money will be paid directly to your e-gold, PayPal, StormPay or MoneyBookers account.

Click here to get your prize:

Sincerely,

The Gmail.com staff

Gmail.com

For the alert with screenshots, link here.

The Phishermen will always try to use "trusted" names to further their misdeeds. Education is the best defense against Internet scams and sharing knowledge is something all of us can do!

Is it Fair to Blame Nigeria for the World's Fraud Woes?

I recently read an article, where many Nigerians were upset about a series of stories done by CNN. The reason they were upset was because they felt that the story depicted that all Nigerians were corrupt. This made me reflect that there are many of out there - who when a fraud is discovered - seem to automatically classify it as being of "Nigerian" origin.

This evening, I came across a story from the Online Journal: "New version of Nigerian phishing e-mail scam promises jobs, riches, poker and great lunches" - which is essentially calling "phishing" a Nigerian scam. After reading it, I started to understand why Nigerians might find some of this offensive. To read the article: Click Here.

This inspired me to do a little digging.

Since I've done a little research on phishing, I decided to refer to the Anti Phishing Working Group and their most recent report (May), which coincidentally reported a "all-time" record of recorded "phishing attempts."

Nigeria isn't even listed in their "top-ten."

According to the APWG:

"In May, Websense Security Labs saw a continuation of the top three countries hosing phishing websites. The United States remains the on the top of the list with 34.1%. The rest of the top 10 breakdown is as follows: China 15%, Republic of Korea 8.17%, France 3.94%, Germany 3.38%, Japan 2.65%, Malaysia 2.59%, Canada 2.37%, Italy 2.02%, and Brazil 1.7%."

If the APWG is correct - then how could phishing be called a Nigerian scam?

Advance fee - which is also referred to as 419 - has taken on many forms and is a worldwide problem. A lot of it originates in Europe, Canada and even the United States. Lottery scams - which are one form - seem to be coming from Canada, or Great Britain and Romance scams from Eastern Europe are a huge issue.

Recently one of the bogus tools, used in advance fee scams have been counterfeit, or altered money orders. People are tricked into cashing these items and wiring the money back to a "fraudster." According to the U.S. Postal Inspection Service - they are being produced (the counterfeit items) in Eastern Europe and West Africa. So far as the altered items - they seem to be produced in the U.S. Prison System and are used primarily in Romance Scams.

I did mention West Africa - but only as one source - and Nigeria is only one of the countries in West Africa. So far as the "other sources," we can look to points of origin that aren't even anywhere near Nigeria, including the United States.

Interestingly enough, what many term as "Nigerian Fraud," wasn't invented in Nigeria and can be traced back to 1588 AD - what what is known as the "Spanish Prisoner Letter."

Another fact - which many of us - fail to "recognize" is that Nigeria is doing something about their problems with fraud. In fact, some might argue that they are pursuing it more "aggresively" than in many of the other countries mentioned in this post.

In recent years, Nigeria has led a very public campaign against corruption within Nigeria. President Olusegun Obasanjo formed the Economic & Financial Crimes Commission (EFCC), which has been extremely aggressive in fighting fraud in Nigeria. Recently, they were taken off a money laundering "blacklist" and for a list of stories - where they have made an impact - link, here.

There is little doubt that Nigeria realizes it has a fraud problem and that there are "good guys" over there fighting the "good fight."

They key to winning the war is for the "good guys" to work together and go after those who are bad.

So far as the rest of us - the next time we run across a scam on the Internet - perhaps we should take a deeper look at it's point of origin. Not only is it unfair to blame the world's fraud problem on Nigeria, but it confuses efforts to bring forth resolution.

If Someone Promises to Fix Your Credit - Proceed with Caution!

Whether it be on a telephone pole, classified advertisement, or a spam e-mail, we all see "advertising lures" that promise to repair people's bad credit. Many of them are bogus - and the sad fact is - they target people, who are already "needy" and take more of their money.

If it's too good to be true, it probably isn't.

Recently, the FTC (Federal Trade Commission) and the Postal Inspection Service went after some of these "services." Here is a quote from a recent FTC press release:

“Credit repair schemes are a big problem for consumers,” said Eileen Harrington, Deputy Director of the FTC’s Bureau of Consumer Protection. “Credit repair promoters generally charge hundreds of dollars, but don’t deliver on their claims. The fact is, they can’t. No one can legally remove accurate and timely information from your credit report.”

Here are some recommendations from the FTC on how to avoid these schemes:

• Avoid any company that wants you to pay for credit repair services before they provide any services. It is against the law.
  
• Avoid any credit repair company that will not tell you your legal rights and what you can do, yourself, for free.
  
• Avoid any credit repair company that tells you not to contact a credit reporting company directly.
  
• Avoid any credit repair company that advises you to dispute all of the information in your credit report.
  
• Avoid any company that suggests creating a “new” credit identity – and then, a new credit report – by applying for an Employer Identification Number to use instead of your Social Security number. That is against the law. If you follow illegal advice and commit fraud, you also may be subject to prosecution.

To sum up the FTC's intent in the recent efforts to stop this:

“We have two goals with this announcement,” Harrington said. “One is very specific. It is to stop Bad Credit B Gone’s deceptive practices, and force them to return their ill-gotten gains to consumers. The other is broad. It is to put other credit repair firms on notice that we are on the beat, and it is to alert consumers that there is absolutely no reason to pay for credit repair – ever. Despite their claims, there is nothing that any credit repair firm can do for you for a fee that you cannot do for yourself at little or no cost.”

If someone was trying to repair their finances "at little, or not cost," the FTC has a page with all the details - including people's legal rights.

Link, here.

If you think someone has - or is trying to scam you - file a complaint, here.