News

It’s Diwali, a time of light, a time of togetherness, and, of course, a time of celebration. Along with Diwali comes the traditional acts of dana and seva, as well as gift-giving to the friends and family members they honor and love. However, it’s also a time when thieves get busy—where they hop online and take advantage of all that goodwill with all manner of scams. 

It’s unfortunate yet true. Thieves flock to where the money is, and plenty of money gets exchanged online during Diwali. As you shop online for that thoughtful gift or to donate online to a cause you care about, keep an eye out for the scams that these thieves set. Because they’re out there.  

Yet you have several ways you can spot their scams, along with several ways you can protect yourself further from them. The thing is, online thieves tend to use the same old tricks, which means a sharp eye and a little prevention on your part can keep you far safer during Diwali.  

For starters, let’s look at some of the most common scams out there. 

Top online shopping scams to avoid during Diwali 

1) The bogus website scam  

A classic scammer move is to “typosquat” phony email addresses and URLs that look awfully close to legitimate addresses of legitimate companies and retailers. So close that you may overlook them. They often appear in phishing emails and instead of leading you to a great deal, these can in fact link you to scam sites that can then lift your login credentials, payment info, or even funds should you try to place an order through them.  

You can avoid these sites by going to the retailer’s site directly. Be skeptical of any links you receive by email, text, or direct message—it’s best to go to the site yourself by manually typing in the legitimate address yourself and looking for the deal there.  

2) The hot deal scam  

In some cases, thieves will set up shopping websites that offer a popular or hard-to-find item at a great price. Yet if the pricing, availability, or delivery time all look too good to be true for the item in question, it may be a scam designed to harvest your personal info and accounts—because, surprise, they don’t have the item at all. The site will take your payment, yet you’ll never receive the item. What’s more, the scammers will have your payment info and address, which they can use to cause further harm. 

Use caution here before you click. If you’re unsure about a product or retailer, read reviews from trusted websites to help see if it’s legitimate. You can also use a service like Who.Is and see how recently the site was created. If the site was only put up very recently, it could be a sign of a scam. 

3) The fake charity scam 

In the spirit of dana, donating to charities makes for a popular Diwali gesture. Scammers know this too and will set up phony charities to cash in. Some indications that a phony charity has reached you include an urgent pitch that asks you to “act now.” A proper charity will certainly make their case for a donation, yet they won’t pressure you into it. Moreover, phony charities will outright ask for payment in the form of gift cards, wire transfers, money orders, or even cryptocurrency—because once those funds are sent, they’re nearly impossible to reclaim when you find out you’ve been scammed. 

There are plenty of ways to make donations to legitimate charities, and the NGO Darpan site offers resources that can help you make an informed choice.  

4) Prize and gift scams 

Whether they come to you by email, direct message, or text message, scammers will blast out phoney prize and gift notifications during Diwali. And of course, there’s a catch. To claim your “prize” or “gift,” the scammers require you to fill out a questionnaire. Once again, there’s no gift or prize in play here. Just a thief on the other end attempting to steal your personal information to commit other fraud down the road.  

Look out for these scams, as many have URLs that end in .cn (the Chinese domain). Both .xyz, and .top are popular URL domains for these scams. Several can look quite legitimate, yet if you haven’t entered in a legitimate contest, drawing, or lottery yourself, there’s a very good chance this is a scam. 

Avoid getting scammed during Diwali 

Aside from knowing how to spot scams, you can take several other preventative measures that can keep you safe as you shop, donate, or simply spend time online. 

Stick with known, legitimate retailers and charities online 

This is a great one to start with. Directly typing in the correct address for online stores and retailers is a prime way to avoid scammers online. As mentioned in the bogus website scam and the prize scams above, thieves will often create web addresses that look nearly identical to legitimate addresses of well-known companies hoping that you won’t look closely at them, then click or tap that bad link.  

If you get an offer sent to you via email, text, or any other message, don’t click the link. Visit the site directly and look for the offer there. 

Look for the lock icon in your browser when you shop 

Secure websites begin their address with “https,” not just “http.” That extra “s” in stands for “secure,” which means that it uses a secure protocol for transmitting sensitive info like passwords, credit card numbers, and the like over the internet. It often appears as a little padlock icon in the address bar of your browser, so double-check for that. If you don’t see that it’s secure, it’s best to avoid making purchases on that website.  

Use a VPN if you’re shopping on public Wi-Fi  

Public Wi-Fi in coffee shops and other public locations can expose your private surfing to prying eyes because those networks are open to all. Using a virtual private network (VPN) encrypts your browsing, shopping, and other internet traffic, thus making it secure from attempts at intercepting your data on public Wi-Fi, such as your passwords and credit card numbers.  

What’s more, a VPN masks your whereabouts and your IP address, plus uses encryption that helps keep your activities private. As a result, companies and data brokers can potentially learn far less about you, your shopping, your travels, your habits, and any other information that they could possibly collect and otherwise profit from. 

Use protection while you shop online 

A complete suite of online protection software like McAfee can offer layers of extra security while you shop. In addition to the VPN, identity, credit monitoring, and other features mentioned above, it includes web browser protection that can block malicious and suspicious links that could lead you down the road to malware or a phishing scam—along with a password manager that can create strong, unique passwords and store them securely as well. Taken together, McAfee offers all-in-one online protection for your identity, privacy, and security that can keep you far safer when you shop online—and as you spend your time online in general. 

A brighter, safer Diwali for you and your family online 

If celebrating Diwali takes you online in any way, keep an eye open for the scams that typically pop up this time of year. Sadly, they’re out there, because it’s such a prime time of year for online shopping, gift-giving, and donations.  

As you can see, thieves use several types of common scams that simply dress themselves up in different ways. Taking a moment to pause and consider what you’re seeing before you click or buy can help you spot those scams.  

Further, using online protection software can help you stay safer still with features that make your time online more private and secure while also preventing you from clicking on any of those malicious links or attachments that crop up during Diwali—and any time of year. 

The post Protect yourself from scams this Diwali appeared first on McAfee Blog.

Have you ever come across a website that just didn’t look quite right? Perhaps the company logo looked slightly misshapen, or the font seemed off-brand. Odds are, you landed on a phony version of a legitimate corporation’s website—a tried and true tactic relied on by many cybercriminals.  

Fake Login Pages Explained  

A fake login page is essentially a knock-off of a real login page used to trick people into entering their login credentials, which hackers can later use to break into online accounts. These websites mirror legitimate pages by using company logos, fonts, formatting, and overall templates. Depending on the attention to detail put in by the hackers behind the imposter website, it can be nearly impossible to distinguish from the real thing. Consequentially, fake login pages can be highly effective in their end goal: credential theft.  

How do these pages get in front of a consumer in the first place? Typically, scammers will target unsuspecting recipients with phishing emails spoofing a trusted brand. These emails may state that the user needs to reset their password or entice them with a deal that sounds too good to be true. If the consumer clicks on the link in the email, they will be directed to the fake login page and asked to enter their username and password. Once they submit their information, cybercriminals can use the consumer’s data to conduct credential stuffing attacks and hack their online profiles. This could lead to credit card fraud, data extraction, wire transfers, identity theft, and more. 

How Fake Login Pages Are Affecting Canadians 

Scammers have recently targeted Canadians with attacks leveraging fake login pages to harvest personal data. For example, criminals preyed on employees who were expecting COVID-19 relief grants in the form of the CERB (Canada Emergency Response Benefit). These funds were sent via an electronic transfer from Interac, a legitimate Canadian interbank network. However, a phishing campaign spoofing Interac’s e-transfer service circulated emails claiming that the Canada Revenue Agency (CRA) made a CERB deposit of $1,957.50 CAD.  

These emails directed recipients to a fake CRA login page, which then redirected to a phony Interac e-transfer site where users were asked to select their personal bank. From there, the recipient was asked to enter their username, card number, password, security questions and answers for their online banking profile, and other personally identifiable information—providing all the information a criminal would need to hack into the user’s bank account.  

Why Fake Login Pages are Effective  

If you Google “fake login pages,” you will quickly find countless guides on how to create fake websites in seconds. Ethical concerns aside, this demonstrates just how common vector spoofed websites are for cyberattacks. While it has been easier to distinguish between real and fake login pages in the past, criminals are constantly updating their techniques to be more sophisticated, therefore making it more difficult for consumers to recognize their fraudulent schemes.  

One reason why fake login pages are so effective is due to inattentional blindness, or failure to notice something that is completely visible because of a lack of attention. One of the most famous studies on inattentional blindness is the “invisible gorilla test.” In this study, participants watched a video of people dressed in black and white shirts passing basketballs. Participants were asked to count the number of times the team in white passed the ball: 

Because participants were intently focused on counting the number of times the players in white passed the ball, more than 50% failed to notice the person in the gorilla costume walking through the game. If this is the first time you’ve seen this video, it’s likely that you didn’t notice the gorilla, the curtain changing color from red to gold, or the player in black leaving the game. Similarly, if you come across a well-forged login page and aren’t actively looking for signs of fraud, you could inherently miss a cybercriminal’s “invisible gorilla.” That’s why it’s crucial for even those with phishing training to practice caution when they come across a website asking them to take action or enter personal details.  

How to Steer Clear of Fake Login Pages  

The most important defense against steering clear of fake login pages is knowing how to recognize them. Follow these tips to help you decipher between a legitimate and a fake website:  

1. Don’t fall for phishing  

Most fake login pages are circulated vis phishing messages. If you receive a suspicious message that asks for personal details, there are a few ways to determine if it was sent by a phisher aiming to steal your identity. Phishers often send messages with a tone of urgency, and they try to inspire extreme emotions such as excitement or fear. If an unsolicited email urges you to “act fast!” slow down and evaluate the situation. 

2. Look for misspellings or grammatical errors  

Oftentimes, hackers will use a URL for their spoofed website that is just one character off from the legitimate site, such as using “www.rbcr0yalbank.com” versus “www.rbcroyalbank.com.” Before clicking on any website from an email asking you to act, hover over the link with your cursor. This will allow you to preview the URL and identify any suspicious misspellings or grammatical errors before navigating to a potentially dangerous website. 

3. Ensure the website is secured with HTTPS 

HTTPS, or Hypertext Transfer Protocol Secure, is a protocol that encrypts your interaction with a website. Typically, websites that begin with HTTPS and feature a padlock in the top left corner are considered safer. However, cybercriminals have more recently developed malware toolkits that leverage HTTPS to hide malware from detection by various security defenses. If the website is secured with HTTPS, ensure that this isn’t the only way you’re analyzing the page for online safety.  

4. Enable multi-factor authentication  

Multi-factor authentication requires that users confirm a collection of things to verify their identity—usually something they have, and a factor unique to their physical being—such as a retina or fingerprint scan. This can prevent a cybercriminal from using credential-stuffing tactics (where they will use email and password combinations to hack into online profiles) to access your network or account if your login details were ever exposed during a data breach.  

5. Sign up for an identity theft alert service 

An identity theft alert service warns you about suspicious activity surrounding your personal information, allowing you to jump to action before irreparable damage is done. McAfee Total Protection not only keeps your devices safe from viruses but gives you the added peace of mind that your identity is secure, as well.  

The post How to Spot Fake Login Pages  appeared first on McAfee Blog.

The campaigns are set up to provide fake services to the citizens and steal their credentials

GUAC aims to bring together many different sources of software security metadata

JFrog scanned over eight million artifacts in the most common open-source software registries

Lindy Cameron argues that smart cities are becoming an attractive target for threat actors, including nation states

Tim Brown, CISO and VP of security at SolarWinds shared his experiences remediating a major cyber-attack during Mandiant’s mWISE event on October 18, 2022

Interpol study warns that many threats are expected to increase

Ransom demands soar to $17m, according to new report

Spanish police apprehend suspect in Tenerife