Cybercrime and Phishing Scams Sweeping China

A wave of cybercrime has swept across China this past week, triggering the Chinese government to mount a counter campaign. Whilst the criminals attempt to steal online banking details, the government has sought expert advice on how to combat the issue. One of the key results, is that phishing sites will now appear below those of legitimate banks in search results.

The personal details of over 45 million Chinese people (almost 10% of China’s online population) were stolen during wave of attacks. China’s Ministry of Industry and Information is investigating the crimes, and has said "The department believes the recent leak of user information is a serious infringement of the rights of internet users and threatens internet safety". The phishing scams work by impersonating a legitimate bank (or similar), and sending messages directing people to the fake sites. Once people visit the fake sites, their login details are taken, and then used by the criminals to steal money from the account.

The way in which the Chinese government fought back was to employ SEO (search engine optimisation) tactics; that is to say ensuring what results users get from searching particular terms online. The Chinese government has managed to get the 10 biggest search engines in China on board the anti-phishing campaign. Furthermore, some of the Chinese search engines are going to introduce an icon, confirming the legitimacy of a site. These two techniques combined should reduce the number of people being tricked and scammed.

Phishing scams are common globally, and are relatively easy to avoid if you follow these simple tips:

-        Beware email messages!!

Look out for emails that claim to be from companies asking you to click-through to update your details or rectify a problem with your account. If you’re unsure about the authenticity of an email, don’t open it and contact the company it claims to be from.

-        Keep an eye on your accounts

Be vigilant for any transactions you don’t recognise. Contact your bank or credit card provider to query a transaction if it looks unfamiliar. You should also contact your bank or credit card provider if your statements fail to arrive. They may have been redirected by a fraudster.

-        Avoid attachments!

Genuine banks will never send emails with attachments.

-        View an example

There is a good example of what a phishing email might look like, with annotations of things to look out for on the Lloyds TSB site.

Up to date information, tips and more can be found on online blogs such as http://fightbankfraud.blogspot.com/

No More Mr Nice Guy?

Security analysts believe the US should clarify the repercussions of cyberattacks following sustained hacks from China.  It is also believed that the Chinese attacks are carried out by as few as 12 groups directed, for the most part, by the Chinese government. During the cyberattacks, the Chinese groups have stolen billions of dollars' worth of intellectual property and information from US companies and government agencies, according to online security experts.

Thanks to advances in technologies and increasing knowledge amongst experts, more cybercriminals are being identified by their ‘digital fingerprint’. The distinguishing characteristics of each attack is monitored by US experts enabling them to link individuals to particular groups of hackers, and sometimes where they are, or who they are. These techniques have, according to US security experts, shown an intensifying pattern. This escalating issue has sparked the recent concern amongst industry experts. As James Cartwright, a retired Marine general and former vice chairman of the Joint Chiefs of Staff puts it, "If you want to attack me you can do it all you want, because I can't do anything about it. It's risk free, and you're willing to take almost any risk to come after me."

The problems the US has in confronting the issue are the same as any other country has: firstly it is very hard to prove exactly who carried out the attack, and secondly both countries must have mutual agreements on such a situation. Mr Cartwright went on to say that the US "needs to say, 'if you come after me, I'm going to find you, I'm going to do something about it.' It will be proportional, but I'm going to do something ... and if you're hiding in a third country, I'm going to tell that country you're there, if they don't stop you from doing it, I'm going to come and get you."

The question is, how should the US proceed? Due to the nature of what is being stolen, the response is pretty much unanimous from  US government campaigners: a clear and firm message must be sent to those breaking the law. Online security specialist, Tero Pollanen, agrees Cartwright that "the US needs a clear policy on dealing with cyber attacks, and the countries through which the attacks are routed. This way, when an attck is apparent, the US can request the country to stop the attack. If the request is refused, the US then has the right to stop the computer server from sending the attack. "

The problem is, he goes on, "there is no international police force. Enforcing laws in another territory is always going to be tricky to manage."

This article is by Tero Pollanen; an online security and fraud prevention specialist. For the latest online security and financial news, tips and more, check out his blog: http://tero-pollanen.blogspot.com/

How to avoid identity fraud

Research published to coincide with the launch of National Identity Fraud Prevention Week (NIFPW) found that while 95% of the public are aware of the threat posed by ID theft, cases continue to rise because people are still being careless with their personal information.

Around 7% of the UK population – over four million people – have fallen victim to identity fraud to date, losing between £1,190 and £9,000 each. Over 80,000 cases of ID theft were reported in the UK in the first nine months of this year alone, according to a study commissioned for the launch of the 2011 NIFPW campaign.

If your identity is stolen by a fraudster, it can take months to get your credit report back in order and deal with the repercussions of the crime. Although any monetary loss will usually be repaid to you, damage to your credit score as a result of ID theft can result in credit rejections, and could even bring debt collectors to your door.

Although there is little you can do about criminals accessing your personal information from the servers of large companies as happened in a number of cases earlier this year, the most high-profile of which being the Sony PlayStation debacle, there are a number of steps you can take to protect your identity from fraudsters both off and online.

Speaking at the launch of this year’s NIFPW campaign, Andrea Davis, a spokesperson from campaign partner Fellowes, said, “No-one can afford to be complacent about ID fraud, everyone is at risk, whether young or old. It is important to ensure that you are not delivering your information straight into the hands of fraudsters.

“The risk is very real – both off and online – and we should all be taking steps to protect our identities. It is worrying that one in four people may be literally throwing their identities away and a huge number of people are sharing sensitive information on line.”

So what can you do to protect your identity?

1. Buy a shredder or burn your mail

One of most popular and low-tech ways for fraudsters to get hold of your personal information is by going through your rubbish. Throwing out letters and bank statements that contain sensitive information can provide criminals with all they need to apply for financial products, identification documents and state benefits in your name. Fraudsters can even use the information they find to take control of your accounts and have your correspondence redirected.

2. Verify the identity of anybody asking for your personal information

If you receive an unsolicited phone call from a bank or utilities firm asking you to confirm personal details, call the company back on an officially-published phone number. You should also never give out personal information to cold callers on the doorstep. Again, contact the business any caller claims to represent on a published number.

3. Inform companies when you move

Receiving your unopened mail will feel like Christmas for a fraudster who’s moved into your old home. Ask Royal Mail to forward any post for at least six months after you move to make sure you don’t miss anything.

4. Protect and alternate your PINs and passwords

Avoid using birthdates and relatives’ names and never write anything down. Try to use different passwords for different accounts and change them regularly.

5. Make sure your anti-virus software is up-to-date and your firewall is turned on

Keep viruses at bay by keeping your anti-virus software up to date and turning on your firewall whenever you use the internet. This will protect your computer from malware that logs your personal information and sends it back to fraudsters.

6. Be wary of phishing scams

Look out for emails that purport to be from companies asking you to click-through to update your details or rectify a problem with your account. If you’re unsure about the authenticity of an email, don’t open it and contact the company it claims to be from.

7. Don’t post detailed personal information on social media profiles

Always make sure your privacy settings are set to protect your personal details and avoid adding information like your date of birth and address. These could be used to apply for credit in your name.

8. Keep an eye on your bank statements

Be vigilant for any transactions you don’t recognise. Contact your bank or credit card provider to query a transaction if it looks unfamiliar. You should also contact your bank or credit card provider if your statements fail to arrive. They may have been redirected by a fraudster.

9. Check your credit file regularly

Contact the three major credit bureaus (Callcredit, Equifax and Experian) to request a copy of your report at least twice a year. Look for any financial products or accounts you have not applied for. If there are any entries you don’t recognise, contact the credit agency concerned immediately.

10.  Avoid carrying letters or other documentation with your bank cards

If these are stolen, a fraudster will have all that’s needed to apply for credit or identity documents in your name. You should also make sure your smartphone, tablet computer, and laptop are password-protected in the event of loss or theft.

If you think you’ve been the victim of identity theft, the Association of Chief Police Officers and the Home Office recommend that you contact all of your creditors (banks, credit and store card providers, and phone and utility companies…) to ask them to monitor your accounts, even if they have not been affected by the fraud. You should then contact your local police station and the credit bureaus.

You can ask CIFAS, the national fraud prevention organisation, to place a “Protective registration” on your credit file if you suspect your identity has been stolen. This will alert all lenders to carry out further checks if they receive an application for a financial product in your name.