Identity Theft and Phone Scams

Technology has changed greatly in the past ten years, and has enabled us to do things now we may not have even thought possible just mere decades ago. We’ve shrunken computers down to fit nicely in one hand, and use them for everything from sending messages to loved ones, to making bank deposits, to online shopping. But this is not news to you — more than likely as you’re reading this on a cell phone, as 88% of Canadian households use a mobile device.¹ With mobile phones being so popular and used for so many important tasks, this often exposes both individuals and companies, making us vulnerable to hackers seeking out our confidential data. While it’s often easy to dismiss these issues as older adults that may have more of a learning curve with smartphones, it’s actually more common amongst the “Millennial” crowd.² They are more comfortable with technology, and with that comfort can come a naivety or lax attitude regarding security or best practices in guarding their data and keeping it safe. Apparently, hacking is not as hard to do as one would think — in 2017, CBC/Radio-Canada ran an investigation using an ethical hacker to gain access to politician Matthew Dubé’s cell phone, using a weakness in Signalling System No. 7 (SS7) which can allow everything from location tracking, to accessing voicemails that would remain unregistered to the intended recipient.³ This doesn’t just provide issues for individual users, but can also be a major issue for companies that lease phones out to their employees, or unknowingly permit their employees to use poor security practices while conducting business on personal cell phones. Bring Your Own Device (BYOD) is so common, it’s almost expected in this day and age, even across multiple industries.⁴ Companies can try to mitigate damage by having a plan in place, in the event of a breach of confidential or sensitive company data.⁵ TeckPath can help with a security assessment – contact us for a consultation today! Here are just some of the security breaches to look out for. Knowing what to expect may help you prepare a response later, if you do fall victim.

Caller ID Spoofing

What is it?Caller ID Spoofing is when the Caller ID information that appears on your phone has been altered from the source that is placing the call. ⁶ Most of us have seen this, as there are legitimate reasons for Caller ID Spoofing. For example, call centers that make calls on behalf of multiple clients, such as retail customer support, may display information reflecting the client they are representing. ⁶ However, this becomes illegal if a telemarketer, for example, falsifies their identity with the intention of misleading you.⁶ This can be done in a variety of ways, all with jargon that can be confusing for everyday mobile consumers ⁶:

• “Neighbouring” which is when they match the first 6 digits of your cell phone to make it look as if someone nearby is calling you from a number you partially recognize
• “Mirroring” which is when your own number appears on the Caller ID
• Displaying an ID of a recognizable company or brand, common in your region

Red Flags to Consider if you think you may be a victim:Caller ID Spoofing is a bit easier to avoid than other fraudulent attempts. While an illegitimate business or user may be calling you, they generally cannot get information from your phone, however, you must be wary of volunteering information. How to protect yourself:Do not volunteer valuable or confidential information over the phone if you are unsure or do not feel comfortable. These recorded messages or telemarketers may ask you for credit card or bank account information, but the best response is to hang up if you feel suspicious. Also, you can take further action by registering your number on the National Do Not Call List, file an official complaint, or report the issue to your local police or Canadian Anti-Fraud Centre. For this and more information on Caller ID Spoofing, you can visit the Canadian Radio-television and Communications Commission website.

Port Out Scams & SIM Swapping

What is it?Port Out Scams are described as an “unauthorized mobile phone number porting, where a fraudster uses your stolen cellular account information to transfer (or “port”) your phone number and account to another carrier in order to take control of your phone while also shutting down your account”.⁷ This can be done using very basic information of yours, including (but not limited to) your Name, Address, Mobile Number and last four digits of your social security number. No proof of identification is necessary, and someone can do this by claiming your phone is “lost or stolen”.⁷ SIM Swapping is similar, in that someone can request a new SIM card as you, use that SIM card, and render your phone (and thus, “old card”) disabled. Red Flags to Consider if you think you may be a victim:Your phone may stop working, or only allow Emergency Calls How to protect yourself:Hide any identifying information on social media accounts, and be wary of how much information you display on public forums or online marketplaces.⁷ Also, shred any sensitive information displayed on mail before discarding.⁷

Phishing

What is it?Phishing has been around for a while, and happens when you are sent a fraudulent email, which often looks legitimate, but prompts you to click on a link, or enter information. By doing so, you can accidentally install something on your phone that sends confidential information to the hacker, without you knowing about it.⁸ Red Flags to Consider if you think you may be a victim:If it feels odd to be clicking on a link within an email, or a pop up appears on your phone that seems to not match in branding, or there are a lot of misspelled words, back out of the email/screen on your smartphone. How to protect yourself:Consider why you would be directed to a link within an email, instead of the email stating the information clearly in the body. Also, consider that most alerts and pop-ups stating that you’ve won a great vacation or asking you to “enter to win” are fraudulent.

Vishing & Smishing

What is it?Vishing is just like Phishing, but instead of email, you’ll receive a phone call, and Smishing is done over text message. Red Flags to Consider if you think you may be a victim:Is the caller asking you to “confirm details” or is it a recording telling you to visit a site to retrieve a gift?⁸ Or is this a text message demanding an immediate reaction from you to call a number or visit a website due to an account or credit card cancellation?⁸ How to protect yourself:If it’s vishing, don’t be afraid to end your call, and if it’s smishing, do not respond to the text message, especially if they’re asking for sensitive information. If you worry it was a legitimate business, or have concerns about your accounts/credit cards, look up the legitimate number to the bank or company (not any numbers provided to you by the person who contacted you) and speak to a customer service representative.

Malware

What is it?Malware is a program that often goes undetected and can enter your device through certain websites or by downloading corrupted or fraudulent files.⁸ Red Flags to Consider if you think you may be a victim:Pop-ups that seem odd, slowness in navigation that seems sudden, or an app on your phone that’s running in the background that you don’t remember downloading are some of the possible signs of malware. How to protect yourself:Don’t click on suspicious links or visit suspicious websites, and do research on apps before downloading to your phone.⁸ Also, keep your phone in sync with the latest security updates provided by your phone manufacturer.

Missed Call Scam

What is it?You may receive a phone call where the user hangs up after one ring, prompting you to call them back. You then may have to pay a high price for returning the call.⁸ Red Flags to Consider if you think you may be a victim:A quick call or hangup from a number you do not have stored in your phone or do not recognize is a clear indicator. How to protect yourself:If you do not recognize the number, do not call back. If the call is official business, they will usually leave a message or call back, letting it ring more than once. With all of these scams floating about, one can feel rather helpless against the dark side of technology and fraudulent businesses or hackers. Along with the steps listed above, there are other general steps you can take to better defend your phone and protect yourself or your company from identity thieves.

• Two-Step Verification is becoming more common and is a good step in helping to protect your device. Two-Step Verification is used when you combine parts like “something you know” (such as a password or PIN) and “something you possess” (such as your actual phone).⁹ This helps to thwart remote hackers and is easy enough for any user to implement.
• Two-Factor Authentication is a bit better than Two-Step Verification, in that a one-time use code can be sent to the user, and when combined with another very unique identifier (such as a fingerprint), can provide a more secure layer of protection.⁹ This works even better when combined with a strong password. Which leads us to the next point.
• A strong password for both your phone and any applications or websites you use is crucial, along with making those passwords unique for each site. According to a recent survey, more than 80% of “millennials” reuse the same passwords across multiple sites. Hackers know this and if they have one password, will try to use it across any other sites you may have visited.⁹ Using a combination of alpha-numeric characters, as well as special characters and capitalization, is a simple first step to protect yourself and your identity.

The good news is, you don’t have to navigate through this alone. TeckPath is here to help! Reach out for a consultation and learn more about our strategic services and how we can aid in protecting your company. References: ¹ Communications Monitoring Report 2018 – Communications Services in Canadian Households: Subscriptions and Expenditures 2012-2016 ²Millennials Are Scammed Twice As Often As Seniors. Here’s Why. ³Hackers only needed a phone number to track this MP’s cellphone ⁴Employees Working On Their Personal Devices? Here’s How You Can Protect Your Business Data. ⁵Is a Bring Your Own Device (BYOD) Program the Right Choice for Your Organization? ⁶ Caller ID Spoofing ⁷ Port-Out Scams and SIM Hijacking: How to Protect Yourself ⁸ How to protect yourself from fraud : Mobile phone scams, SIM swap and porting fraud ⁹ Two-factor authentication vs. Two-step verification, you’ve probably missed this tiny difference