Fraud Information Center

There have been a few new words and phrases being thrown around lately in terms of fraud. Without knowing what these terms mean, it can be more confusing than it needs to be. Let us help explain a few of terms we've been learning about here at Home State Bank.

Social Engineering is the art of manipulating, influencing, or deceiving you in order to gain control over your computer system. The hacker might use the phone, email, snail mail or direct contact to gain illegal access. Phishing and spear phishing, are examples.

Phishing (pronounced fishing) is a hacking technique that is the digital equivalent of “casting a net.” Phishing campaigns don’t target victims individually—they’re sent to hundreds, sometimes thousands, of people. Emails claiming to be from popular social web sites, banks, auction sites, or IT administrators are commonly used to lure the unsuspecting public.

Spear Phishing is highly targeted and targets a single individual. Hackers do this by pretending to know you. It’s personal.

Smishing is a form of phishing that uses mobile phones as the attack platform. This form of attack has become increasingly popular due to the fact that people are more likely to trust a message that comes in through a messaging app on their phone than from a message delivered via email.

Vishing is short for "voice phishing," which involves defrauding people over the phone, enticing them to divulge sensitive information.

Phishbait is an email crafted to attract prospective phishing victims to open an email and follow a malicious link.

Multi-Factor Authentication (MFA) is used to ensure that digital users are who they say they are by requiring that they provide at least two pieces of evidence to prove their identity. When you sign into an account for the first time on a new device or application (like a web browser) you need more than just the username and password. You need a second thing - what we call a second "factor" - to prove who you are.

Juice Jacking refers to the threat of malicious access gained to your phone or other USB devices when plugged into a public charging kiosk - such as at an airport or sporting event.

Malware is software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system.

Scareware is malicious computer programs designed to trick a user into buying and downloading unnecessary and potentially dangerous software, such as fake antivirus protection.

Whaling is a cyberattack that involves impersonating a high-ranking executive to steal money or sensitive information from an organization. It is also known as "whale phishing"

Passkey is a digital credential, tied to a user account and a website or application.  Passkeys allow users to authenticate without having to enter a username or password, or provide any additional authentication factor.

Doxing is the action or process of searching for and publishing private or identifying information about a particular individual on the internet, typically with malicious intent.

Scam Alert: QR Code on an Unexpected Package

An unexpected package from an unknown sender arrives in your name. You open it and find a note that says it’s a gift, but it doesn't say who sent it. The note also says to scan a QR code to find out who sent it — or to get instructions on how to return it. Did someone really send you a gift? Or is it an attempt to steal your personal information?

If you know it’s really a gift, you can keep it. But know that the unexpected package could be a new twist on a brushing scam that could steal your personal information. If you scan the QR code, it could take you to a phishing website that steals your personal information, like credit card numbers or usernames and passwords. It could also download malware onto your phone and give hackers access to your device. If you scanned the QR code and entered your credentials, like your username and password, into a website, change your password right away. Create a strong password that is hard to guess, and turn on two-factor authentication. If you’re concerned someone has your personal information, get your free credit report at AnnualCreditReport.com. Look for signs that someone is using your information, like accounts in your name you don’t recognize.

Also review your credit card bills and bank account statements and look for transactions you didn’t make. And consider taking other steps to protect your identity, like freezing your credit or putting a fraud alert on your credit report. If you think someone stole your identity, report it, and get a personal recovery plan at IdentityTheft.gov.

Think that text message is from USPS?  It could be a scam

Have you ever gotten a text message about a package coming via the United States Postal Service? Maybe it confirmed your order, said a package is out for delivery, or said there's a problem like unpaid postage, a missed delivery, or you need to update your shipping preferences. That text message will say to click a link to learn more or fix the problem. But there's a good chance that text message that says it's from USPS (or FedEX...or DHL...) is really from a scammer.

Scammers want you to click the link in their message. What happens next is the scam: the click takes you to a look-alike of a real website where they'll tell you to enter personal or financial information. It will go straight to the scammer if you pay that money, along with your credit card number, name, address, and anything else you entered.

To Avoid This Scam:

• Verify delivery information independently. If you think a text is about a real delivery, don't give information or click on any links in the message. Instead, go to the online retail site or account from which you ordered your item to look up your package's shipping and tracking information.

• Use filters. See what options your mobile phone has to filter and block texts from unknown senders.

• Report unwanted text messages and scams on the messaging app you use. See if your phone has an option to report junk or spam. If not, forward the message to 7726.

Give to a charity, not a scam

There’s no shortage of good causes to donate to. But before you give somewhere new, make sure you’re not donating to a scam.

Scammers are pros at tricking people into donating. They’ll often even use names that sound a lot like other charities you’ve heard of to get your money. Here’s how to make sure your money is going to support the cause you care about:

--Information from KnowBe4 CyberHeist Newsletter & Blog

If you have been the victim of identify theft, here are some steps to help you get your life back on track: