Tax Season Scams

Everyone’s favorite time of the year is coming up soon, so to protect yourself from scammers and identity thieves, here are a few quick tips to remember:

  1. The IRS is never going to initiate contact via email. Ever. Even if you filed your taxes online. If there is a problem with your filing, they will contact you via telephone or postal mail.
  2. If the IRS does contact you, they are never going to ask you to “verify” personal information such as your Social Security number, account information, credit card numbers or anything else. They’re the IRS; they already know what they need to know about you.
  3. If you do get a phone call, don’t automatically trust what pops up on caller ID, since this information can be easily spoofed. If they’re asking to verify personal information, it’s probably someone trying to steal your identity.
  4. On a similar note, beware of phone calls at strange times. The IRS isn’t going to call at 1 AM or 11 PM.
  5. If you’re paying someone to prepare your tax return for you, make sure you’re dealing with someone you trust and who knows what they’re doing. It doesn’t matter who prepares your taxes, you are ultimately responsible for what gets filed.
  6. Also beware of tax preparers who make wild claims about how big of a tax return they can obtain for you.
  7. Finally, a lot of large, nationwide tax preparation companies advertise a “service” in which they write you a check before your taxes are even prepared or filed, based on an estimate of what you will receive. While this is not a “scam,” know that these advances are loans, which you will have to pay back with interest. If they give you more than you get back from the IRS, the excess will come out of your pocket.

Like I’ve said before, just about anything can be turned into a scam. The best defense is to be prepared by knowing what to watch out for.

Lastly, If you do get a suspicious email, forward it to phishing@irs.gov. Don’t open any attachments, and don’t click on any links contained in the message. These could infect your computer with spyware or other malicious software.

Fraudulent Facebook email contains malware attachment.

There’s a new fake email message making its way around the web the last few months. This time, it targets Facebook users.

The messages all have something to do with your Facebook password, using subject lines such as “Password Reset Confirmation Email.” They contain an attachment that is supposed to be your new password, but is actually a pretty nasty Trojan horse program that opens your computer up to a variety of attacks. One of these programs is known as Bredolab, and it’s just bad news all around. Below is the text of an example message from “The Facebook Team:”

Hey,
Because of the measures taken to provide safety to our clients your password has been changed. You can find your new password in attached document.

Thanks

The Facebook Team

There are other fake Facebook messages that try to lure victims with a “New Login System” message and contain a disguised link. In this case, it seems to be a pretty standard password-stealing attempt, but given the amount of malware that can be spread and the fraud that can be committed with a hacked Facebook account, it could lead to much worse problems than someone just messing with your Facebook page.

Facebook is never going to send you an email message with your password as an attachment. In fact, they’re never going to send you an attachment at all. If you get one of these messages, hold your cursor over the link (DO NOT CLICK) and you’ll see that the message actually takes you to a non-Facebook website (most likely hosted overseas).

Furthermore, Facebook isn’t going to “confirm” your request for a password reset unless you’ve actually requested it, and any links contained in these messages will be hosted at Facebook.com, not a website with just an IP address (numbers separated by periods, as in “123.45.678.90”), and not a website hosted overseas.

Once again, a new threat just goes to reinforce the old rules of thumb: never open an attachment in an email message you weren’t expecting, and never click on links in an unsolicited email message without verifying first that the message is legitimate.

What is the deal with Facebook and Twitter lately? It seems like they’ve both been targets of an awful lot of phishing, fraud and malware activity these past few months.

Both sites have astounding numbers of users—I recently heard that if Facebook was a country, it would be the fourth most populous in the world, just behind the U.S.—so I imagine it has to do with the sheer numbers involved. When you’ve got over 300 million potential victims, even a 0.1% success rate (1 in 1,000) is a pretty large number of people.

The Top Ten Scams of 2009

A couple days ago, the Connecticut BBB released its list of the top ten scams for the past year. I’ll summarize the list below, or you can read the full press release by following the above link.

  1. Acai Supplements and Other “Free” Trial Offers
  2. Stimulus/Government Grant Scams
  3. Robocalls
  4. Lottery/Sweepstakes Scam
  5. Job Hunter Scams
  6. Google Work from Home Scam
  7. Mortgage Foreclosure Rescue/Debt Assistance
  8. Mystery Shopping
  9. Over-Payment Scams
  10. Phishing e-mails/H1N1 spam

None of these come as any sort of surprise, really. I can’t help being a little proud of the fact that I’ve pretty much covered almost all of these, and I’m planning to cover the few that I haven’t touched on yet. The fact that so many people still fall for these schemes tells me that my work has just begun, though.

New phishing attempt: this one is just sort of pathetic.

I had two really sad phishing attempts in my inbox this morning, but just in case somebody out there isn’t sure, let me state this very clearly: these are fraudulent messages, and the only correct response is to delete them immediately.

Here is the full text of the first one:

From: Federal Credit Bureau
To: [not my email address]
Sent: Wednesday, December 23, 2009 10:00 AM
Subject: Your Credit Score has been decreased.

Your Credit Score has been decreased. You need to download your credit history file from Federal Credit Bureau website and carefully review it. Use your personal hyperlink.

==========================================
Federal Credit Bureau

And here’s attempt number two:

From: Federal Credit Bureau
To: [not my address again]
Sent: Wednesday, December 23, 2009 9:26 AM
Subject: You have some wrong items in your Credit Report.

You have some wrong items in your Credit Report. You need to download your credit history file from Federal Credit Bureau website and carefully review it. Use your personal hyperlink.

——————————————————————–
Federal Credit Bureau

In both cases, the word “hyperlink” contained a link to a website hosted at a “.co.uk” address.

The thing is, I know they’ll hook a few people with these messages, so let’s take a closer look.

For one thing, no federal entity is going to contact you via email, ever. Right away, you know this is a phishing attempt.

For another thing, federal entities (at least here in the U.S.) use a “.gov” domain. The “reply to” addresses for these were “information@fedcb.org” and files@fedcb.org.” That “.org” is a dead giveaway.

Finally, as stated above, the links contained in the messages took you to a “.co.uk” domain. For those of you who don’t know, that means a website hosted in the United Kingdom. The U.S. government doesn’t host its websites on overseas networks.

Of course, if you’re living in the U.K., this address might not immediately strike you as odd; but still, aren’t the British government’s websites hosted on “.gov.uk” domains, not commercial “.co.uk” sites?

As always, if you’ve received this message or anything similar, just delete it. That link takes you somewhere you do not want to visit, I guarantee it.

Probable Census Bureau job scams: a preemptive strike.

I heard an advertisement on the radio just yesterday, recruiting people who’d like to work part-time as census-takers for the 2010 Census. It gave a phone number and a website to contact them. Since it used a “.gov” domain, I know the ad was legitimate.

I also know that every single thing the government tries to do is almost immediately used by criminals to mount some sort of scam. See also: Social Security, USPS jobs, economic stimulus funding, tax returns and just about anything else you can think of.

So consider this a preemptive strike: somebody, very soon, is going to start running a “Census Bureau Jobs” scam.

If you get an email offering you a job as a census-taker, just delete it. It won’t be legitimate. Neither will any newspaper ads that direct you to someone who wants you to pay for information on these jobs (like the old Postal Service jobs scam).

There are only three ways to get the official information, and they all involve contacting the Bureau directly:

  • Online: visit http://2010.census.gov/2010censusjobs/. See that “.gov” at the end? That means it’s a legit US government website.
  • Call 1-866-861-2010
  • Contact your local Census Office. This information is available at the above website, so it’s sort of a repeat of #1.

I haven’t even heard anything about anyone using Census Bureau jobs as the basis for a scam yet, but I know it will happen.

So, now you know in advance. Now that’s vigilance!

Google files federal lawsuit against company for work-at-home scams.

You know those work-at-home scams that use Google’s name and logo?

It looks like Google is finally going after one of them. A federal lawsuit has been filed against a company called Pacific WebWorks, based in Salt Lake City, Utah.

The suit alleges that Pacific WebWorks has been using Google’s name and logo, without authorization, to sell a “work-at-home” scheme. Victims of this scam are charged repeated fees while receiving nearly nothing (or literally nothing) of value in return. Google is also demanding the company reveal an accounting of its profits.

The Better Business Bureau’s report (“F,” in case you didn’t already guess) for the company lists the following as websites operated by Pacific WebWorks:

www.pacificwebworks.com
www.profitcenterlearning.com
www.googlefastcash.com
www.gogglefastcash.com
www.homebizkit4u.com
www.moneyy.org
www.googlebizkit.com
www.profitstudiolearning.com
www.yourprofitgateway.com
www.esuccess2u.com
www.eauctionsuccess.com
www.yourwebsiterev.com

Do NOT visit any of the above sites!

But, take a moment to study the web addresses. You see words like “success” and “profit” and “cash” an awful lot in there. They even use a misspelling of “Google” (“gogglefastcash”). Why would a legitimate business need so many different websites, including some that use another company’s name?

Anybody else think this won’t just stop at a corporate suit? I see criminal charges looming for Pacific WebWorks. That’s good—it’s a criminal organization that needs to be shut down. I don’t mind jumping the legal gun and passing judgment here; this company has been running a scam, pure and simple.

“I’ll be judge, I’ll be jury,” said cunning old Fury:
“I’ll try the whole cause, and condemn you to death.”

—Lewis Carroll
Alice’s Adventures in Wonderland

How to avoid Craigslist scams.

You’ve probably heard of Craigslist. Basically, it’s an online classified ad site where you can sell or buy items, find jobs, dates or local events.

It’s an interesting site, for a variety of reasons:

  1. The design of the site is super-minimalist. It’s changed very little since 1996, so it’s an example of pure function over flash (and Flash, for that matter).
  2. The company genuinely seems more interested in creating value than raking in supermassive profits, which it could do if it would just fill the site up with paid advertising and skeevy JavaScript (their profits are pretty massive anyway, though).
  3. It’s only source of revenue is paid job listings in certain cities

There are more, but “Why Craigslist Is Neat” is not the title of today’s post.

When you’re selling something on Craigslist, it’s very likely you’re going to get some messages from people attempting to scam you. So how do you avoid them?

First and foremost, deal only with local people you can meet in person, and accept only cash as payment. With this one step, you will reduce your chances of running into a scam to nearly nothing.

When you do meet your buyer in person, only do so in a public place (never at your home), make sure you tell your friends or family where you are going, bring a cell phone, consider bringing a friend, and listen to any nagging doubts you might have when you’re meeting the buyer. These tips are directly from Craigslist’s page on the topic of personal safety.

Never give any personal information to anyone during the course of a Craigslist transaction. You’re buying or selling an object with cash. Nobody needs anybody’s account numbers (or full name, in my opinion).

Generally, nobody from Craigslist is going to contact you about your listing, as the company is not involved in the transaction at all. There are no “guarantees,” and anyone who talks of these things is up to no good.

You might get people who agree to buy an item, then send you a cashier’s check for ten times the amount, with instructions to cash it and wire the excess back to them.

Sound familiar? It should—it’s a variation on the old secret shopper scam, this time in the form of an overpayment scam.

However, if you’re following the number one rule (cash only, local in-person sales only), you eliminate the possibility of this scam entirely.

Craigslist has a page dedicated to avoiding scams, which contains some examples of different scams, as well as the following:

Most scams involve one or more of the following:

  • inquiry from someone far away, often in another country
  • Western Union, Money Gram, cashier’s check, money order, shipping, escrow service, or a “guarantee”
  • inability or refusal to meet face-to-face before consummating transaction

Finally, make sure you’re actually on Craigslist. The real web address is www.craigslist.org. Watch out for easy misspellings like “craiglist” or different domains (.com or .net).

It’s a great site if you use it wisely (and an interesting business model), but be aware of the dangers and stick to in-person sales using cash.

Avoid charity scams this holiday season.

The holiday season is a time when concept of “giving” seems to come up a lot.

Hey, I’m all for it, too. Every single one of us, without exception, has something we could use to help someone else in our community, our country, or our world (“We are all connected,” after all). If “giving” was my main topic today, I would probably mention that there are people in need all year round, not just during November and December, but since it’s not, I won’t.

Instead, I’m going to talk about charity scams.

You see, two forces collide during the holiday season:

  1. The fact that a lot of people are thinking about “giving” more than usual
  2. The fact that there are people in the world who will do literally anything to line their own pockets.

It’s sort of a perfect storm.

However, there are some incredibly easy steps you can take to make sure you’re donating dollars to people who are in actual need, instead of donating to some crook’s wallet.

First, you could just decide ahead of time which charity or charities you’re going to support, and contact them yourself. If other organizations ask for donations, simply explain that you’ve already given what you had budgeted for the year. Legitimate charities will understand. Anybody who won’t accept this explanation is not to be trusted.

Secondly, consider donating something other than money. Food banks (like this one) can almost always use someone to help out at their distribution centers for a few hours, and there’s always the classic “helping out at the Soup Kitchen” scenario. Call or email organizations in your area and find out what sort of in-kind donations they’re looking for.

These two methods of giving are pretty safe. Scammers are looking for the easy money—they’re not going to set up an entire working food bank in hopes of skimming a few hundred dollars. However, there always seem to be a lot of opportunities that spring up on the spur of the moment this time of year.

First off, be cautious of charities that contact you via email. Most legitimate charities aren’t going to seek new donors this way. However, if you’ve given to an organization before, they might use email, since it saves them money on postage. Still, never respond directly to an email soliciting donations—use the organization’s official website or phone number, which you should use a source other than the email message (phonebook, Internet search, etc.) to find.

Always ask what percentage of your donation goes to help whoever the charity is supposed to help. If they’re on the up-and-up, they won’t mind the question. An angry or otherwise negative answer is a warning sign.

Donating by check is recommended over cash, as it gives you a way to track your donation for tax deduction purposes. However, never make the check out to a person—always write it to the organization.

I would also suggest going one extra step and paying by cashier’s check, to keep your checking account number out of general circulation, but if it’s an organization you trust, you can make that call yourself.

Watch out for fake charities using names that sound similar to real ones. Sometimes the difference between “foundation” and “center” can mean the difference between your money being used for the greater good, or just ending up in some dirtbag’s pocket.

Check out any charity with the Better Business Bureau before you donate, and I would also suggest doing a general Internet search. Sometimes you’ll find “Scrooge Lists” that call out charities who only pass on a tiny portion of their proceeds to the people they’re supposed to be helping. Be especially wary of any organization that claims to be raising money for disabled or retired police officers or firefighters or their families. A lot of these so-called charities are scams, plain and simple. What would you call a charity that keeps over 98% of its proceeds? 

Finally, as a general rule, never respond to an unsolicited charity request without doing some homework first, no matter who the person contacting you claims to be. Know who you’re donating to before you send a single dime.

Once you’ve verified that you’re dealing with a legitimate charity, however, have at it—give as generously as your conscience dictates.

Publisher’s Clearing House scam: Don’t hold your breath waiting for the Prize Patrol.

This was a new one on me.

The other day, a REGIONAL member called the credit union because he had received an interesting phone call.

The caller claimed to represent Publisher’s Clearing House and informed the member that he had won something like three million dollars, and that the Prize Patrol would be stopping by his house that day.

However, in order to claim his prize, he had to pay some sort of fee up front—$3,500, to be paid via wire transfer immediately or the prize would be forfeit.

Well, our member didn’t take the bait at all. It was yet another version of the same old advance fee fraud.

I wondered if this was a local job, since Publisher’s Clearing House was kind of a goofy choice. Well-organized fraud rings are usually a little sneakier than that (they’re just as easy to see through, though, if you’re paying attention).

No matter, though—the takeaway here is that in a legitimate sweepstakes, you never send money first in order to claim your winnings.

What is a Nigerian 419 scam?

In the world of fraud prevention, you’ll see the term “Nigerian 419 Scam” come up quite a lot. But what is it?

Simply put, a Nigerian 419 scam (or just “Nigerian scam”) is a type of advance fee fraud; the victim sends or wires money to the scammer in hopes of receiving a large payout. Naturally, this payout never comes.

In the early days of the scheme (1980s), crooks used postal mail and fax to try and hook people, but email is the preferred medium today—you can send millions of messages at the same time, for free.

Here’s the hook: the con artist claims to be a relative of a deposed dictator, an African prince living in exile, a government employee, banker, or similar. In every case, they claim to know of a large sum of money, either their own or someone else’s, but need your assistance in obtaining it. In return for your help, they will give you a percentage of the fortune, usually to the tune of several million dollars.

The victim will be asked to help by sending money, either to bribe a bank official or to set up a bank account (they are given the impression that they must keep a certain amount of money in a Nigerian bank in order to get a piece of the fortune). Once the victim starts sending money, the con artists will claim to experience various delays and the need for more cash, in hopes of further stealing from the victim.

At some point, the victim either realizes they’ve been had, or the crooks move on to new victims. There have been cases of victims being kidnapped, robbed and murdered, as well.

It sounds so obvious when you deconstruct it, but the simple fact is that an awful lot of people still fall for this scheme. Crooks don’t keep hammering away at scams that don’t work.

There are a thousand different signs to watch out for, like messages sent from free web-based email addresses or persons asking you to wire money via Western Union or Moneygram, but I think we can narrow it down to just this one point: never send money in an attempt to get money (or gold, diamonds, or anything else).

For one thing, how many Nigerian princes do you think there are in the world? How did this prince, banker, government official or whatever, just happen to pick you, out of over six billion other people on Earth? How do you know you’re dealing with a real person at all?

More to the point, why in the world would you even attempt to get your hands on a pile of stolen or embezzled cash? Think about that—stealing is stealing, no matter what country it originated in. Even if it all turned out to be true, how do you think you’re going to explain $2,500,000 to the IRS? They’re going to ask. You know they will.

Of course, that won’t happen, because it never turns out to be true. Stop asking yourself, “But what if it is?” right now. It’s not. In the history of the entire universe, there has never been a single case of this deal being legitimate.

By the way, why is it called a “Nigerian 419 scam” in the first place?

Well, these things originated in Nigeria in the 1980s, when their economy was circling the drain in a major way (they’ve never really recovered). Many of these scams still come from Nigeria, and there may be actual Nigerian government officials involved in some of these schemes, which can be run by single people acting alone, or by powerful organized crime syndicates. “419” is an article of the Nigerian Criminal Code that deals with fraud.

 HPHKR5STV262