How To Protect Yourself From Identity Theft During COVID-19

The ongoing spread of the coronavirus continues to create new crops of hackers, targeting people who are working from home, still awaiting stimulus or benefit checks, or just trying to stay healthy at home or on a socially distanced vacation. Scammers are even pretending to be government officials, so it’s important to be on guard against online misinformation in your inbox and in your text messages.

A March release from the FBI’s Internet Crime Complaint Center offers some solid advice on what to watch out for.

“Scammers are leveraging the COVID-19 pandemic to steal your money, your personal information, or both. Don’t let them,” the FBI said. “Protect yourself and do your research before clicking on links purporting to provide information on the virus; donating to a charity online or through social media; contributing to a crowdfunding campaign; purchasing products online; or giving up your personal information in order to receive money or other benefits.” 

An April report from Next Caller found that about 32% of 1,000 surveyed Americans believe they had already been targeted by fraud or scams related to COVID-19. Next Caller also found that fraud concern is increasingly on consumers’ minds, with 52% of Americans saying they’re more worried about being victimized by fraud than normal. 44% of respondents said they’ve noticed an increase in phone calls and texts from unknown numbers, and emails from unknown sources.

Meanwhile, researchers at Trustwave found that ransomware attacks amounted to 18% of overall breach incidents observed in 2019, up from 4% in 2018. Researchers also found the amount of malware in traditional spam email declined to 0.2% from 6% the previous year, as attackers look for more effective infection vehicles. The biggest rise was in social engineering attacks, like phishing. In 2018, Trustwave analysts found 33% of all data breach incidents were the result of phishing or social engineering attacks. In 2019, that number rose to half. 

Here are three coronavirus-related online scams to avoid.

Read more: FBI has stopped hundreds of coronavirus-related online scams

Here phishy, phishy

Unsolicited emails that prompt you to click on an attachment should always raise a red flag when you’re checking your inbox. But these classic email phishing scams still lure unsuspecting people into downloading malicious items and giving up their login information every day.

When news first broke back in March that the government would issue payments of up to $1,200 in coronavirus relief to US taxpayers, the FBI issued a warning to be on alert for attackers masquerading as the agency and asking for personal information supposedly in order to receive your check. “While talk of economic stimulus checks has been in the news cycle, government agencies are not sending unsolicited emails seeking your private information in order to send you money,” the Bureau said. 

As the nation waits to see if Congress will approve a second stimulus payment this month, the US Federal Trade Commission warned consumers about scammers pretending to be government officials in order to get victims’ bank account information. If people share that information, the scammers claim in an email, they’ll get money from a COVID-19 “Global Empowerment Fund.”

Calling it a scam, the FTC warned that there’s no money or fund. The agency urged recipients not to respond to messages like these, and to instead report them to the FTC at ftc.gov/complaint.

Among other steps to create a safer inbox, the US Cybersecurity and Infrastructure Security Agency recommends turning off your email client’s option to automatically download attachments. Not all email clients offer this and each client is different, but some do. Because social engineering attacks — scams designed to persuade you to hand over your sensitive information by targeting specific information about you — have become increasingly common in times of crisis, it’s also a good idea to read up on how to identify these security risks.

And remember, never reveal personal or financial information in an email, or respond to requests for it. 

Now playing: Watch this: Here’s how scammers are using the coronavirus to cash…

4:23

Mobile malware

If you’re looking to track COVID-19 news with an app, it’s a good idea to keep an eye out for malware traps. In March, a malicious Android app called CovidLock claimed to help users chart the spread of the virus. Instead, it led to a slew of Android phones being locked and held for ransom by hackers.

Researchers at Check Point discovered 16 malicious apps posing as legitimate coronavirus-related apps in a bid to steal users’ sensitive data or generate fraudulent revenues from freemium services. Among them, a notorious strain of banking trojan known as Cerberus, which can log all of your keystrokes and let someone command your device remotely. 

Meanwhile, Reason Labs recently discovered hackers were using coronavirus-tracking map sites to inject malware into people’s browsers. As reported by MarketWatch, coronavirus-related website name registrations are 50% more likely to be from malicious actors.

As Android Authority points out, setting a password on your phone can help protect you from a lock-out attack if you’re using Android Nougat. It’s also a good idea to stick to the Google Play store for any coronavirus-related apps to better your odds of installing benign software. None of the 16 malicious apps spotted by Check Point were found on an official app store, but were offered on new coronavirus-related websites which the researchers believe were specifically set up to lure new users. 

How common are these new coronavirus-related domains? Check Point said it tallied more than 30,103 new coronavirus-related site registrations. Some 131 of those were considered malicious and 2,777 were “suspicious and under investigation.” 

Charity checkout

During a disease outbreak or natural disaster, the better angels of our nature compel us to open our wallets to the less fortunate through charitable giving and donation. Before we follow that impulse, we need to take an extra few moments to make sure the charity isn’t a funnel into the bank account of a predatory impersonator. 

Taking a few moments to review the FTC’s Charity Scams page could save you the heartbreak of an emptied checking account. You can also improve your odds by searching sites such as guidestar.org and give.org for the name of your charity before donating. 

Legit sources

Random Facebook groups offering supposed home cures for COVID-19, long Twitter threads from self-appointed health experts and cleverly designed websites — there are dozens of ways misinformation can lure unsuspecting victims into a position of vulnerability. While it can be hard to sort the solid information from the scam-baiting, here are a couple of ways:

• By clicking the “about” section of a Facebook group, you can see whether that group has changed its name multiple times to reflect new national crises — a sure sign that the group is trawling for an audience rather than promoting reliable news. 
• Keep an eye on official sources on Twitter, including the accounts of trusted news sites and their news reporters, and avoiding political operatives where possible. 
• If a site claims to be an official government publication, check the URL to see if it ends in .gov. 

For more tips on avoiding internet scams during the novel coronavirus pandemic, check out CISA’s official tip sheet.

READ MORE HERE