News

Multiple media reports this week warned Americans to be on guard against a new phishing scam that arrives in a text message informing recipients they are not yet registered to vote. A bit of digging reveals the missives were sent by a California political consulting firm as part of a well-meaning but potentially counterproductive get-out-the-vote effort that had all the hallmarks of a phishing campaign.

On Aug. 27, the local Channel 4 affiliate WDIV in Detroit warned about a new SMS message wave that they said could prevent registered voters from casting their ballot. The story didn’t explain how or why the scam could block eligible voters from casting ballots, but it did show one of the related text messages, which linked to the site all-vote.com.

“We have you in our records as not registered to vote,” the unbidden SMS advised. “Check your registration status & register in 2 minutes.”

Similar warnings came from an ABC station in Arizona, and from an NBC affiliate in Pennsylvania, where election officials just issued an alert to be on the lookout for scam messages coming from all-vote.com. Some people interviewed who received the messages said they figured it was a scam because they knew for a fact they were registered to vote in their state. WDIV even interviewed a seventh-grader from Canada who said he also got the SMS saying he wasn’t registered to vote.

Someone trying to determine whether all-vote.com was legitimate might visit the main URL first (as opposed to just clicking the link in the SMS) to find out more about the organization. But visiting all-vote.com directly presents one with a login page to an online service called bl.ink. DomainTools.com finds all-vote.com was registered on July 10, 2024. Red flag #1.

Another version of this SMS campaign told recipients to check their voter status at a site called votewin.org, which DomainTools says was registered July 9, 2024. There is little information about who runs votewin.org on its website, and the contact page leads to generic contact form. Red Flag #2.

What’s more, Votewin.org asks visitors to supply their name, address, email address, date of birth, mobile phone number, while pre-checking options to sign the visitor up for more notifications. Big Red Flag #3.

Votewin.org’s Terms of Service referenced a California-based voter engagement platform called VoteAmerica LLC. The same voter registration query form advertised in the SMS messages is available if one clicks the “check your registration status” link on voteamerica.org.

VoteAmerica founder Debra Cleaver told KrebsOnSecurity the entity responsible for the SMS campaigns telling people they weren’t registered is Movement Labs, a political consulting firm in San Francisco.

Cleaver said her office had received several inquiries about the messages, which violate a key tenet of election outreach: Never tell the recipient what their voter status may be.

“That’s one of the worst practices,” Cleaver said. “You never tell someone what the voter file says because voter files are not reliable, and are often out of date.”

Reached via email, Movement Labs founder Yoni Landau said the SMS campaigns targeted “underrepresented groups in the electorate, young people, folks who are moving, low income households and the like, who are unregistered in our databases, with the intent to help them register to vote.”

Landau said filling out the form on Votewin.org merely checks to see if the visitor is registered to vote in their state, and then attempts to help them register if not.

“We understand that many people are jarred by the messages – we tested hundreds of variations of messages and found that these had the largest impact on someone’s likelihood to register,” he said. “I’m deeply sorry for anyone that may have gotten the message in error, who is registered to vote, and we’re looking into our content now to see if there are any variations that might be less certain but still as effective in generating new legal registrations.”

Cleaver said Movement Labs’ SMS campaign may have been incompetent, but it wasn’t malicious.

“When you work in voter mobilization, it’s not enough to want to do good, you actually need to be good,” she said. “At the end of the day the end result of incompetence and maliciousness is the same: increased chaos, reduced voter turnout, and long-term harm to our democracy.”

To register to vote or to update your voter registration, visit vote.gov and select your state or region.

The flaw in Microsoft 365 Copilot allowed data theft using ASCII smuggling and prompt injection

The Texas Dow Employees Credit Union told the Maine Attorney General the MOVEit data breach compromised information of over 500,000 members

A US Justice Department watchdog has found “significant weaknesses” in the FBI’s physical and online media storage and disposal processes

The Port of Seattle revealed system outages at the city’s airport may have been caused by a cyber-attack, affecting early Labor Day travel

The Dutch data protection regulator has imposed a €290m GDPR fine on Uber for storing driver data in the US without adequate safeguards

AppOmni report claims number of companies suffering SaaS-related data breaches has jumped five percentage points over past year

An EDR killer Sophos X-Ops has tracked for three years continues to bedevil organizations targeted by ransomware gangs.

Ars Technica has a good article on what’s happening in the world of television surveillance. More than even I realized.

Reports filed with the U.S. Federal Trade Commission (FTC) put the risks in perspective — scammers squarely target older adults. In 2023, adults aged 60 and up filed over one-third of all fraud reports. Their reported losses? Close to $2 billion.

While scammers target all age groups, older adults offer them a particular advantage. Technology and everyday internet use came along later in their lives. They didn’t grow up with it like the rest of us did, making them less familiar with technology and more susceptible to attack. Moreover, their lifetime savings, home ownership, and retirement accounts make them attractive targets.

That’s much the case with our grandparents today. It’s little wonder hackers, scammers, and thieves go after them.

Figures courtesy of the FTC

However, your grandparents have a big advantage working in their favor. You.

A chat with your grandparents can keep them safer online

Your knowledge, your expertise, and your overall comfort level with technology and the internet can help them steer clear of fraud. Have a chat about staying safe online. Or have a few chats over time. The advice you pass up can make all the difference.

Here are a few ways you can start:

1. Talk about the latest online scams.  

As the year rolls on, so do the scams. Every scam has its season, from tax scams early in the year to shopping scams during the holidays. Current events play in too. In the wake of natural disasters, phony relief scams make the rounds on the internet. Encourage your grandparents to keep an eye on the news for the latest online scams so they have a better chance of recognizing fraudulent activity. Or better yet, give them a call when you get word of a new data breach or scam.

2. Show them how to think like a cybercriminal. 

The secret to beating cybercriminals at their own game is to think like one. Encourage your grandparents to consider what can make them targets. Perhaps they have large retirement funds. Maybe their online bank account is secured with a password that they use for multiple online accounts. Have them think about how they’ve made it easier for a crook to take advantage of them. From there, they can tighten up their security as needed. A tool like our Protection Score can do this for them. It stops weak points and offers solutions for shoring them up.

3. Strengthen their passwords. 

Each account should get its own strong, unique password. Which is a lot of work, given all the accounts we keep. A password manager can help. It creates and securely stores strong, unique passwords for every account. (No more sticky notes with passwords on the monitor.)

Also, help them set up two-factor authentication on their accounts that offer it. It provides an extra layer of security, as it requires multiple forms of verification, such as a fingerprint scan or facial recognition. This, with strong, unique passwords, makes accounts terrifically tough to crack.

4. Show them how to spot phishing scams.

Hackers, scammers, and thieves all use phishing attacks to rope in victims. And today, they look increasingly convincing thanks to AI tools. And as we’ve covered here on our blocks, scammers can easily clone voices  —  even faces—on calls and video chats. Plenty more phishing attacks come by text, email, and phone calls. This is where your grandparents need to get savvy.

If they receive an email that appears to be from a business or even a family member, but they are asking them for their Social Security Number, passwords, or money, stop and think. Don’t click on anything or take any direct action from the message. Instead, go straight to the organization’s website and verify that the message is legitimate with customer service. If the message claims to be from a family member asking for financial help, contact them directly to ensure it’s not a scammer in disguise. In all, make sure they show great caution any time a seemingly “urgent” email, message, or call comes their way. Urgency is often a sign of a scam.

5. Set them up with comprehensive online protection.

Today’s online protection goes far beyond antivirus. It protects people. Their devices, their identity, and their privacy.

Comprehensive online protection like our McAfee+ plans keep them safe from hackers, scammers, and thieves in several ways. Consider this short list of what comprehensive online protection like ours can do for your grandparents:

Scam Protection

Is that email, text, or message packing a scam link? Our scam protection lets your grandparents know before they click that link. It uses AI to sniff out bad links. And if they click or tap on one, no worries. It blocks links to malicious sites.

Web protection

Like scam protection, our web protection sniffs out sketchy links while they browse. So say they stumble across a great-looking offer in a bed of search results. If it’s a link to a scam site, they’ll spot it. Also like scam protection, it blocks the site if they accidentally hit the link.

Transaction Monitoring

This helps them nip fraud in the bud. Based on the settings they provide, transaction monitoring keeps an eye out for unusual activity on credit and debit cards. That same monitoring can extend to retirement, investment, and loan accounts as well. It can further notify them if someone tries to change the contact info on their bank accounts or take out a short-term loan in their name.

Credit Monitoring

This is an important thing to do in today’s password- and digital-driven world. Credit monitoring uncovers any inconsistencies or outright instances of fraud in credit reports. Then it helps put your grandparents on the path to setting them straight. It further keeps an eye on their credit reports overall by providing you with notifications if anything changes in their history or score.

Personal Data Cleanup

This provides your grandparents with another powerful tool for protecting their privacy. Personal Data Cleanup removes their personal info from some of the sketchiest data broker sites out there. And they’ll sell those lines and lines of info about them to anyone. Hackers and spammers included. Personal Data Cleanup scans data broker sites and shows which ones are selling their personal info. From there, it provides guidance for removing your data from those sites. Further, when part of our McAfee+ Advanced and Ultimate, it sends requests to remove their data automatically.

Identity Theft Coverage & Restoration

Say the unfortunate happens to your grandparents and they fall victim to identity theft. Our coverage and restoration plan provides up to $2 million in lawyer fees and reimbursement for lawyer fees and stolen funds. Further, a licensed expert can help them repair their identity and credit. In all, this saves them money and their time if theft happens.

The post How to Talk to Your Grandparents About Staying Safe Online appeared first on McAfee Blog.