As with any public crisis, the spread of thehas created a — targeting people who are awaiting their , who are and who are just trying to stay healthy. Add in and you need to be on guard against all kind of scams and misinformation found online, in your email inbox and even in your .
A recent release from the FBI’s Internet Crime Complain Center offers some solid advice on what to watch out for.
“Scammers are leveraging the COVID-19 pandemic to steal your money, your personal information, or both. Don’t let them,” the FBI said. “Protect yourself and do your research before clicking on links purporting to provide information on the virus; donating to a charity online or through social media; contributing to a crowdfunding campaign; purchasing products online; or giving up your personal information in order to receive money or other benefits.”
New research from Next Caller found that about 32% of 1,000 surveyed Americans believe they’ve already been targeted by fraud or scams related to COVID-19. Next Caller also found that fraud concern is increasingly on consumers’ minds, with 52% of Americans saying they’re more worried about being victimized by fraud than normal. 44% of respondents said they’ve noticed an increase in phone calls and texts from unknown numbers, and emails from unknown sources.
Meanwhile, researchers at Trustwave found that ransomware attacks amounted to 18% of overall breach incidents observed in 2019, up from 4% in 2018. Researchers also found the amount of malware in traditional spam email declined to 0.2% from 6% the previous year, as attackers look for more effective infection vehicles. The biggest rise was in social engineering attacks, like phishing. In 2018, Trustwave analysts found 33% of all data breach incidents were the result of phishing or social engineering attacks. In 2019, that number rose to half.
Here are three coronavirus-related online scams to avoid.
Here phishy, phishy
Unsolicited emails that prompt you to click on an attachment should always raise a red flag when you’re checking your inbox. But these classic email phishing scams still lure unsuspecting users into downloading malicious items and giving up their login information every day.
With the news that the government is going to issue payments of up to $1,200 into US taxpayers in the coming month, the to be on alert for attackers masquerading as the agency and asking for personal information supposedly in order to receive your check. “While talk of economic stimulus checks has been in the news cycle, government agencies are not sending unsolicited emails seeking your private information in order to send you money,” the warning said.
Among other steps to create a safer inbox, the US Cybersecurity and Infrastructure Security Agency recommends turning off your email client’s option to automatically download attachments. Not all email clients offer this and each client is different, but some do. Because social engineering attacks — scams designed to persuade you to hand over your sensitive information by targeting specific information about you — have become increasingly common in times of crisis, it’s also a good idea to read up on how to identify these security risks.
And remember, never reveal personal or financial information in an email, or respond to requests for it.
If you’re looking to track COVID-19 news with an app, it’s a good idea to keep an eye out for malware traps. Earlier in March, a malicious Android app called CovidLock claimed to help users chart the spread of the virus. Instead, it led to a slew of Android phones being locked and held for ransom by hackers.
Researchers at Check Point discovered 16 malicious apps posing as legitimate coronavirus-related apps in a bid to steal users’ sensitive data or generate fraudulent revenues from freemium services. Among them, a notorious strain of banking trojan known as Cerberus, which can log all of your keystrokes and let someone command your device remotely.
Meanwhile, Reason Labs recently discovered hackers were using coronavirus-tracking map sites to inject malware into people’s browsers. As reported by MarketWatch, coronavirus-related website name registrations are 50% more likely to be from malicious actors.
As Android Authority points out, setting a password on your phone can help protect you from a lock-out attack if you’re using Android Nougat. It’s also a good idea to stick to the Google Play store for any coronavirus-related apps to better your odds of installing benign software. None of the 16 malicious apps spotted by Check Point were found on an official app store, but were offered on new coronavirus-related websites which the researchers believe were specifically set up to lure new users.
How common are these new coronavirus-related domains? Check Point said it tallied more than 30,103 new coronavirus-related site registrations. 131 of those were considered malicious and 2,777 were “suspicious and under investigation.”
During a disease outbreak or natural disaster, the better angels of our nature compel us to open our wallets to the less fortunate through charitable giving and donation. Before we follow that impulse, we need to take an extra few moments to make sure the charity isn’t a funnel into the bank account of a predatory impersonator.
Taking a few moments to review the Federal Trade Commission’s Charity Scams page could save you the heartbreak of an emptied checking account. You can also improve your odds by searching sites such as guidestar.org and give.org for the name of your charity before donating.
Random Facebook groups offering supposed home cures for COVID-19, long Twitter threads from self-appointed health experts and cleverly designed websites — there are dozens of ways misinformation can lure unsuspecting victims into a position of vulnerability. While it can be hard to sort the solid information from the scam-baiting, here are a couple of ways:
- By clicking the “about” section of a Facebook group, you can see whether that group has changed its name multiple times to reflect new national crises — a sure sign that the group is trawling for an audience rather than promoting reliable news.
- Keep an eye on official sources on Twitter, including the accounts of trusted news sites and their news reporters, and avoiding political operatives where possible.
- If a site claims to be an official government publication, check the URL to see if it ends in .gov.
For more tips on avoiding internet scams during the novel coronavirus pandemic, check out CISA’s official tip sheet.