I've Been Mugged

April 20 Is 'Secure Your ID Day'

April 20, 2013 is "Secure Your ID Day." To learn more about how you can protect yourself and your sensitive personal information, visit the Better Business Bureau website. The site lists participating BBB groups in various states.

If you can't attend a local event, then browse these tips and suggestions from the BBB to keep your sensitive personal information secure. Other resources that consumers may find helpful:

• Identity Theft Resource Center
• Consumer Financial Protection Bureau (CFPB)
• Onguard Online (FTC)
• The Resources page in this blog

Data Breach At Schnucks Supermarkets Affects Customers And Their Banks

St. Louis-based KSDK television reported a data breach at Schuncks supermarkets. The supermarket chain isn't yet sure exactly where (e.g., which stores) and how the breach occurred (e.g., in the store or with a debit/credit card processor). The breach occurred about a week ago.

Schnucks operates stores in Missouri, Illinos, Iowa, and Indiana. Customers have already seen unauthorized charges on their debit/credit cards. A representative from Montgomery Bank reported that about 600 of their accountholders have already filed fraud claims. Some customers wonder why the store has not posted alerts in its stores, so shoppers can use cash instead:

“They’re just letting people use their cards and not saying anything.”

Reportedly, the retailer has hired a forensics technology firm to assist it with a breach investigation. It sounds to me like the company' was caught unprepared and its post-breach response needs improvement. Customers need to be notified prompty to take appropriate action to avoid or minimize identity theft and fraud.

Fraudsters Target Police Chief With Check Scam

Wicked Local warned consumers about a check scam that targeted the Police Chief at Hingham, Massachusetts. Like many other check scams, the a package arrived snail mail -- in this case, UPS. The package included a letter and bogus $3,000.00 check which appeared to be from a legitimate business. The letter includes instructions to wire money, about $250, to cover supposed taxes and fees.

Police Chief Michael Peraino was suspicious and called the business first to verify the check. The receptionist at the business verified that the check was a fake, as the business had already received many phone calls from consumers.

Fraudsters attempt check scams like this because they receive real money wired to them from each victim long before the victim realizes that the bogus check they deposited in their bank account has bounced. Each victim is out the $250 they wired, the amount of the bogus check, and any bounced-check fees from their bank.

Check scams like this are a reminder for consumers to verify first any check you receive from an unknown organization or person.The Identity Theft Resource Center (ITRC) advises consumers to follow these steps to verify a suspected scam:

1. Contact the company involved directly, using a customer service number you find in the phone book or that you have used in the past.
2. If you were solicited online, contact the Internet Crime Complaint Center, a partnership between the FBI and the National White Collar Crime Center. Or, contact your local State Attorney General's office.
3. Contact the Federal Trade Commission via phone (877-FTC HELP) or e-mail
4. Avoid scams that appear to use expensive out-of-country telephone numbers. If you are unsure about a telephone number's location, look the number or Area Code using this free decoder.

If you are unsure who the attorney general is in the state where you live, then browse this list. Readers of this blog are familiar with a similar check scam that targeted Craig's List website users.

California AG Issues Safety Tips For Consumers For Shopping During The Holidays

The California Attorney General (AG) issued these safety tips for consumers to securely shop online:

"1. Shop on secure websites. One clue about which websites are safe and which are not is to look for a yellow padlock in the browser bar or ‘https’ in the web address (the ‘s’ stands for ‘secure’).

2. Don’t make purchases over a free Wi-Fi hotspot like at a coffee shop, which can be scanned by those looking to capture your passwords and other information.

3. Never send personal or financial information through e-mail. Legitimate companies will not ask you to do so because it is not a secure way to transfer sensitive information.

4. If you are receiving text messages on your cell phone saying you have won a prize or gift card, do not click on the link in the message – it is most likely a scam and may install a virus on your phone.

5. To get the full value of a gift card, use it right away. Gift cards that are lost or stolen are not always replaceable. Retailer or restaurant gift cards do not have expiration dates, but bank cards, like Visa or MasterCard gift cards, or cards issued by a mall that can be used at different stores, may sometimes have expiration dates.

6. Know the return policies of the retailers you shop with before you leave the store or conclude an online transaction. Many retailers will give you a refund if you have a receipt and your return is prompt, but some may only give store credit. Ask a clerk if the policy is not posted at the register."

This list is good advice year-round, not just during the holidays. To this list, I would add:

• Treat your smart phone like the handheld computer that it is and install the appropriate anti-virus app
• Know the differences between the three types of plastic in your wallet or purse
• If you are a consumer without a bank account, get all of the facts before moving your money to a prepaid card (or payroll card). Even better: consider a new bank account at a credit union
• Read both the privacy and terms and conditions policies before installing any new apps on your smart phone or tablet. Don't install apps that lack these policies
• If you are a parent giving a smart phone or tablet as a Christmas gift, learn about and teach your children safe mobile device usage and shopping habits

Legit Email Or Scam? Legit Text Message Or Scam? What To Do Next

Recently, I received the following email message from a relative:

Sent: Thursday, November 01, 2012 11:30 AM
To: undisclosed recipients:
Subject: Manila, Philippines : (Sad News) : Shirley XXXXXXXXXX

Hello,
Just hoping this message reaches you... Well, I'm sorry for this emergency and for not informing you about my urgent trip to Manila, Philippines but I just have to let you know my present predicament... Everything was fine until I was attacked on my way back to the hotel, i wasn't hurt but I lost my money, bank cards, mobile phone and my bag in the course of this attack.. I immediately contacted my bank in order to block my cards and also made a report at the nearest police station. I've been to the embassy and they are helping me with my documentation so i can fly out but I'm urgently in need of some help from you to pay up my hotel bills and my flight ticket back home... My return flight back home is scheduled to leave in few hours from now... Please i need your help..."

The bottom of the email had the person's standard, valid signature with her office contact information. Legit email or scam?

To me, it read like a scam. My relative uses much better punctuation and grammar. Plus, I didn't think she was traveling abroad. So, the simple next step was to call her via a land-line phone or other separate method to confirm things.

I called her, left a voice mail message, and she replied via email a day later. She confirmed that she was not traveling abroad, and that heer email account had been hacked.

Identity thieves and scam artists are creative and persistent. There are a variety of "phishing" (e.g., email) scams and "smishing" (text message) scams. Learn to recognize them. Remember, you can always call the company directly and confirm whether or not they sent the suspect text message (or email).

So, a word to the wise. When you receive a suspect communication, confirm it with the person (or company) first via an alternate method. If you receive a suspect text message, call or email the person. If you receive a suspect email, call the person. Even better, talk with them in person.

While waiting for the person to reply, you can always check one of the hoax websites, like Snopes. Your telephone company's website probably lists the types of phone and text scams that have been reported. Your Internet service provider's website probably lists the types of email scams that have been reported.

If you use Facebook, then the Facecrooks site is a good source to verify suspect messages and apps that abuse your privacy.

National Protect Your Identity Week 2012

Not sure what you can do to protect your sensitive personal information? October 20 - 27, 2012 is "National Protect Your Identity Week" (NPYIW).

The ProtectYourIDNow site contains a wealth of information for consumers, plus local events by state. I visited the website to see what's available this year. There are some interesting statistics about how consumers don't protect themselves nor their sensitive personal information:

"68 percent of people with public social media profiles shared their birthday information (with 45 percent sharing month, date and year); 63 percent shared their high school name; 18 percent shared their phone number; and 12 percent shared their pet's name-all are prime examples of personal information a company would use to verify your identity."

While it may feel nice to receive birthday congratulations from your "friends" on social networking websites, the fact is that your birth date is a sensitive and critical piece of personal information that data brokers (and identity thieves) use to distinguish between multiple people with the same name. Experts warn consumers to stop doing these seven things on Facebook and other social networking websites. Some other interesting statistics:

"Seven percent of Smartphone owners were victims of identity fraud... 32 percent of Smartphone owners do not update to a new operating system when it becomes available; 62 percent do not use a password on their home screen... 32 percent save login information on their mobile device... Young adults, aged 18-24, took the longest to detect identity theft - 132 days on average... the average cost ($1,156) was roughly five times more than the amount lost by other age groups... Children may be 51 times more likely than adults to have their identity stolen..."

The NPYIW website includes tips to protect yourself, informative videos, advice about what to do if you are a victim of identity theft and fraud, and an online quiz to test your knowledge about identity theft and fraud. Sponsors of NPYIW include the National Foundation for Credit Counseling, the National Sheriffs Association, the National Association of Triads, the Consumer Federation of America, the Council Of Better Business Bureaus, the U.S. Federal Trade Commission (FTC), the Identity Theft Resource Center, the National Crime Prevention Council, the Credit Union National Association, and many others.

Did you attend a NPYIW event? If so, share your experience below.

You've Been 'Mugged' In An Auto Accident Insurance Scam. What To Do Next?

Recently, an I've Been Mugged reader wrote asking what to do. She had been the innocent victim in an auto insurance scam:

"Two days ago, I was surprised to find myself in a situation that I believe is a clever scam. It involves auto insurance and a trumped up claim. Although the situation is still unfolding, and my carrier may not pay once they investigate, I am shaken at being on the business end of such a scheme. I'm afraid to drive. I feel unsafe because this person has my address and who knows what else such a person might do."

While I had heard about these scams, I have never been involved in an auto accident insurance scam. And, I had not thought about an insurance claim scam as also being a potential identity theft risk, too. It stands to reason that if some criminals are willing to stage a bogus accident, intentionally cause a collision, and/or submit bogus medical claims after an accident, then they are also willing to abuse the other driver's personal data.

So, what should a consumer do to protect yourself? What can a consumer do to protect yourself after a staged accident?

First, I did some online research to learn about the types of auto insurance scams. My thinking is that by understanding them, it would be easier to recognize them and not get tricked. The Allstate Insurance page lists the types of auto insurance scams and fraud schemes:

• Swoop & Squat
• Sideswipe
• Shady Helpers

I am not going to repeat the scam descriptions here. You can visit the site and read them for yourself. Some are intentional collisions. Sadly, criminals will stage bogus accidents or cause intentional collisions. In 2010, Florida led the nation in the number of complaints about insurance fraud related to staged accidents.

Second, I found that auto insurance company websites often provide advice for their policyholders about how to protect yourself, and what to do if you suspect fraud. The State Farm site lists the types of auto insurance frauds and provides instructions for its policyholders:

"To report suspected insurance fraud, call State Farm or the National Insurance Crime Bureau (NICB) hotline: 1-800-TEL-NICB / 1-800-835-6422"

So, if you suspect fraud, you should inform both your auto insurance company and the NICB. I visited the NICB website to learn more.

The NICB, based in Des Plaines, Illinois, is a non-profit organization dedicated to preventing, detecting, and defeating insurance fraud and vehicle theft. The NICB works with more than 1,100 property and casualty insurance companies. The NICB offers an Apple iPhone app for consumers to report suspected insurance fraud.

According to the NICB, staged accidents occur in every state in the nation. In 2010, the top five cities with the most staged accidents and related auto insurance fraud schemes were:

1. New York, New York
2. Tampa, Florida
3. Miami, Florida
4. Orlando, Florida
5. Houston, Texas

And, the top five states were:

1. Florida
2. New York
3. California
4. Texas
5. Illinois

The NICB also describes the types auto insurance scams:

• Swoop & Squat
• Sideswipe
• Panic Stop
• Drive Down

While at the site, I downloaded the NICB Staged Automobile Accident Fraud brochure (Adobe PDF) to learn more. It sounded to me like the I've Been Mugged reader had experienced a "Drive Down" scam.

The NICB also offers a really good flyer for consumers about what to do after an auto accident. Download the Accident Checklist (Adobe PDF). The NICB advises consumers to:

• Tend to the injured. Call emergency and/or ambulance personnel if needed
• Keep a disposable camera in your auto. Take photos of the entire accident scene, and damage to your car, the other car(s), and any buildings affected. Take photos of all cars' license plates and Vehicle Identification Numbers.
• Notify the police immediately, and call them to the scene
• Get the information (e.g., name, address, phone, insurance certificates) of all other drivers involved, and of any witnesses. Either write down the informaton, or take photos of any documents, especially if the driver is not the registered owner of the other car
• Notify your insurance company immediately
• Don't disclose your Social Security Number or bank account information

If you suspect that others involved in the (staged) accident have abused your personal information or committed identity fraud, file a report with local police and get a copy of that police report. I have used the Identity Theft Resource Center (ITRC) website before, and highly recommend it. The site provides plenty of information and advice for a variety of identity theft and fraud situations. If you suspect other drivers in the (staged) accident are abusing your personal information, then Fact Sheet 110 seems to apply. It makes sens to file fraud complaints with your insurance company and with the U.S. Federal Trade Commission (FTC).

If you are feeling particularly vulnerable, you might arrange a consultation with an attorney to get advice about what to do next. Get an attorney referral from somebody you trust and know. I also visited the websites for several states' Attorney General offices, as these websites often contain advice and resources for consumers.  For example, the New York State Attorney General website provides advice for consumers about how to fight auto insurance fraud.

I am sure that some I've Been Mugged readers have opinions or experience with auto insurance claim scams. If you were a victim in a staged auto accident auto insurance scam, what did you do to protect yourself? What resources did you find most helpful?

Will A Credit Card Or a Debit Card Protect You From Fraud Better?

[Editor's note: today's guest post is by Odysseas Papadimitriou, a personal finance industry expert and CEO of the credit card comparison website Card Hub as well as the new personal finance social network Wallet Hub. I have written previously about CardHub.com, and hope to see the site develop more tools and information to help consumers make informed decisions about financial products. Consumers often ask whether debit cards or credit cards are better. Today, Mr. Papadimitriou answers that question regarding fraud prevention.]

By Odysseas Papadimitriou

We all work hard, pay obscene amounts in taxes, have seemingly endless bills to pay, and certainly don’t want to be handing out money to strangers or serving as the financial backing for common criminals. That’s why I regularly hear from consumers who are terrified of falling victim to fraud and are wondering about the best ways to safeguard their finances, especially whether a credit card or debit card will better protect them.

Spoiler Alert: The combination of federal laws and policies instituted by the major networks limit liability for unauthorized purchases made with either a credit card or a debit card, often to $0.

In other words, even if someone does get ahold of your card or account information, you probably won’t ultimately be out any money. That, combined with the fact that fraud only affects about 0.005% of all credit and debit card transactions, means it isn’t as big of a concern as many people think.

Credit vs. Debit

With the above being said, there are differences between credit cards and debit cards when it comes to fraud. First of all, you won’t be liable for any fraudulent credit card transactions, whereas you may or may not be liable for debit card transactions, depending on how quickly you report the fraud and whether or not the transactions in question were completed with a signature or your account’s PIN.

In addition, the decision between a credit card and a debit card will affect how difficult fraud is to deal with from a logistical standpoint. The reason has to do with the fundamental differences between these products.

When you make a purchase with a debit card, funds are automatically removed from your account. On the other hand, the bank initially foots the bill when you pay with credit, and you aren’t required to spend any of your own money for days.

Therefore, you can usually sort out credit card fraud before it affects the rest of your life or requires you to retrieve any money. The same cannot be said for debit card fraud, as you might not notice the fraudulent activity before you are required to cut checks for other monthly obligations; if they bounce, you’ll have even more to sort out.

Other Anti-Fraud Tips

While using a credit card can help simplify fraud fallout, there are a number free and easy ways that you can proactively safeguard your finances.

• Check your credit reports: Everyone is entitled to a copy of each of their three major credit reports (i.e. Experian, Equifax, and TransUnion) once every 12 months, and reviewing them is a good way to ensure that no one has opened any financial accounts under your name.
• Lock your mailbox & shred documents: Thieves have been known to raid people’s mailboxes (especially when they’re out of town) and trash in search of direct mail credit card offers, replacement cards, and financial information they can use to open accounts in other people’s names.
• Choose secure passwords: You don’t want someone to be able to hack into your e-mail or online banking account just because they know your child or pet’s name. You should ideally use a combination of letters, numbers, and selective capitalization and update your passwords every couple of months.
• Be wary of giving out financial information: The best policy is to only give sensitive financial information to people you contact, rather than the other way around. This allows you to ensure you know who you’re dealing with and drastically reduces your chances of falling for a scam.

Final Thoughts

You should ultimately take three things from this article: 1) Fraud isn’t as problematic as the local news makes it out to be; 2) Credit cards protect you from fraud better than debit cards; and 3) There are a number of easy ways that you can protect yourself on a daily basis. In other words, you should be vigilant in protecting your money but not let the fear of fraud consume you.

What should be of greater concern is choosing the right financial products and managing them responsibly. Consumers are on pace to incur $50 billion in credit card debt for the second straight year, and not only is budgeting therefore in order, but there are also a number of excellent credit card offers out there that can help lower the financial burden.

The Risks Of Buying Drugs Online

Everyone loves a good deal. And the Internet provides several sources of deals and discounts. If you seek deals on prescription drugs, there are several things you should know so you don't get "mugged" by a rogue online pharmacy website.

Earlier this year, the National Association of Boards of Pharmacy (NABP), which accredits online drugstores, released the results of a study where it reviewed more than 9,600 online pharmacies. Key results:

• Most are rogues sites: 96.6% (or 9.349 of 9,677 online pharmacies reviewed) operated out of compliance with existing laws and standards
• Only 2.7% (259 online pharmacies) to be legitimate websites, and 0.7% (69 sites) were accredited through an NABP verification program
• Of these 9,349 online pharmacies, 8,122 don't require a valid physician's prescription
• 4,648 offer foreign or drugs not approved the U.S. FDA
• 3,363 have internet servers outside the USA
• 1,523 don't have secure web sites

The problem is intensified by drugs that are in short supply. Fraudsters know this and try to take advantage of the situation:

"The most critical shortages involve cancer, antibiotic, nutrition, and electrolyte-imbalance medicines, according to the FDA. For many community pharmacies, health-system pharmacies, and patients the lack of availability of needed -- and often life-saving -- medications through official, authorized supply channels means resorting to unconventional and more dangerous means of obtaining the medications, sometimes turning to unknown sellers online. The unfulfilled demand for these medications has created a lucrative market for counterfeiters..."

The results: several risks to consumers. One risk is that you may not get what you paid for:

"... health care facilities and patients have no assurance that the substances they receive are what they are purported to be. Many of the replacement drugs purchased online are unregulated, meaning there are no safeguards in place to ensure their identity, safety, efficacy, where and under what conditions they were made, or how they were handled."

A second risk is to your health. Counterfeit drugs can fail to address your medical conditions, make you sicker, or kill you:

"... two-thirds of the online drug sellers discovered in this study are represented on the NABP list of Not Recommended sites. These illegal online drug sellers pose serious risks to patient health. The risk is especially high with vaccines..."

A third risk is identity theft or fraud at those online pharmacies that operate unsecured sites.

Earlier this year, the U.S. Congress House Committee on Oversight and Government Reform investigated "gray market" companies, that operate outside of authorized drug distribution networks to provide short-supply drugs at hugely inflated prices. In July 2012, the committee released its report (Adobe PDF), which found:

"... a growing number of prescription drugs sold in the United States have experienced supply shortages. Because these shortages have been most severe among a group of injectable drugs used to treat patients with cancer and other serious illnesses, they have had a particularly serious impact on hospitals... During drug shortages, hospitals are sometimes unable to buy drugs from their normal trading partners, usually one of the three large national “primary” distributors... some short-supply injectable drugs do not reach health care providers through the manufacturer-wholesaler distributor-dispenser chain that policymakers and industry stakeholders present as the typical model for drug distribution. Instead, these drugs “leak” into longer gray market distribution networks, in which a number of different companies – some doing business as pharmacies and some as distributors – buy and resell the drugs to each other before one of them finally sells the drugs to a hospital or other health care facility. In more than two-thirds (69%) of the 300 drug distribution chains reviewed in this investigation, prescription drugs leaked into the gray market through pharmacies. Instead of dispensing the drugs in accordance with their professional duties, state laws, and the expectations of their trading partners, these pharmacies re-sold the drugs to gray market wholesalers..."

The investigation also found:

"... a number of businesses holding pharmacy licenses that do not dispense drugs, but instead appear to operate for the sole purpose of acquiring short-supply drugs that can be sold into the gray market.... Some gray market wholesalers gain access to shortage drugs by recruiting pharmacies to act as their purchasing agents..."

The impact is far higher drug prices than otherwise for health care facilities, hospitals, and consumers.

The NABP operates several online pharmacy accreditation programs, including the Verified Internet Pharmacy Practice Sites (VIPPS), the Veterinary-Verified Internet Pharmacy Practices Sites (Vet-VIPPS), and the e-Advertiser Approval Program. The NABP has appllied to the Internet Corporation For Assigned Names and Numbers (ICANN) for a specific domain-name to help consumers recognize accredited online pharmacies.

To protect yourself online, experts advise consumers to:

1. Buy drugs online from reputable stores you already know
2. Look for NABP VIPPS and Vet-VIPPS symbols when shopping
3. Visit AwareRX.org, which maintains lists of both NABP-recommended and not-recommended online pharmacy websites
4. Visit SafeMedicines.org operated by the Center for Safe Internet Pharmacies (CSIP), which contains a tool for patients to check if doctors in their state purchased counterfeit cancer medications
5. Watch this public service announcement produced by the CISP:

Download the full NABP report: "Internet Drug Outlet Identification Program Progress Report for State and Federal Regulators: April 2012" (Adobe PDF).

FTC Sues Wyndham Worldwide For Misrepresenting Its Data Security

Late last month, the U.S. Federal Trade Commission (FTC) filed a lawsuit against Wyndham Worldwide Corporation, the Parsippany, New Jersey-based international hotel conglomerate, for alleged data security failures that resulted in three data breaches at Wyndham hotels in less than two years. The suit (Adobe PDF) alleged that:

"Defendants’ failure to maintain reasonable security allowed intruders to obtain unauthorized access to the computer networks of Wyndham Hotels and Resorts, LLC, and several hotels franchised and managed by Defendants on three separate occasions in less than two years. Defendants’ security failures led to fraudulent charges on consumers’ accounts, more than $10.6 million in fraud loss, and the export of hundreds of thousands of consumers’ payment card account information to a domain registered in Russia. In all three security breaches, hackers accessed sensitive consumer data by compromising Defendants’ Phoenix, Arizona data center."

Specifically, the suit alleged that Wyndham's website privacy policy misrepresented the data security measures the company used to protect consumers' sensitive personal and payment information. The suit alleged that the hotel's data security:

"... failed to use readily available security measures to limit access between and among the Wyndham-branded hotels’ property management systems, the Hotels and Resorts’ corporate network, and the Internet, such as by employing firewalls... allowed software at the Wyndham-branded hotels to be configured inappropriately, resulting in the storage of payment card information in clear readable text... failed to remedy known security vulnerabilities on Wyndham branded hotels’ servers that were connected to Hotels and Resorts’ computer network, thereby putting personal information held by Defendants and the other Wyndham branded hotels at risk. For example, Defendants permitted Wyndham-branded hotels to connect insecure servers to the Hotels and Resorts’ network, including servers using outdated operating systems that could not receive security updates or patches... allowed servers to connect to Hotels and Resorts’ network, despite the fact that well-known default user IDs and passwords were enabled on the servers, which were easily available to hackers through simple Internet searches... failed to employ commonly-used methods to require user IDs and passwords that are difficult for hackers to guess. Defendants did not require the use of complex passwords for access to the Wyndham-branded hotels’ property management systems..."

This is pretty damning, since sensitive information that should have been encrypted wasn't, passwords were too easy to guess, and obsolete web server software prevented data security updates. The suit, filed in U.S. District Court in Arizona, named as defendants both Wyndham Worldwide and three of its subsidiaries:

• Wyndham Hotel Group, LLC
• Wyndham Hotels & Resorts, LLC
• Wyndham Hotel Management, Inc.

It is good to see the FTC take these types of actions, especially because consumers have no way to verify that companies comply with the promises in their data security and privacy policies.

Why Cyber Criminals Attack: For The Money

Last week, the Ponemon Institute and Check Point Software Technologies released the results of a joint survey, "The Impact of Cybercrime on Business" (Adobe PDF), conducted to better understand the nature of online attacks which businesses of all sizes face. The survey included executives from companies in several countries. Key survey findings:

• Companies experience an average of 66 cyber attacks per year
• Mobile devices (e.g., smart phones and tablets) present an increased breach risk
• Cyber crime is expensive, costing companies on average
• Criminals attack for the money

Almost all survey participants said:

"... the primary goal for cybercriminals is financial fraud and/or access to the company’s financial records. In the U.S. and UK, financial gain is followed by theft of customer data. Approximately five percent of security attacks are motivated by political or ideological agendas."

So, identity thieves and cyber criminals attack employers to steal money: the employer's and/or yours. And, the criminals will attempt to use your mobile devices to gain access to employer's networks:

"... Hong Kong and Brazil report on average the highest percentage of mobile devices infected an act of cyber crime... the lowest average of infected mobile devices and machines connected to the network at 11 percent in the U.S. and nine percent in Germany."

The Ponemon/Check Point survey included more than 2,600 experienced business leaders and IT security practitioners from commpanies located in the United States, United Kingdom, Germany, Hong Kong and Brazil.A similar study by Symantec found that 50% of cyber attacks focused on businesses with fewer than 2,500 employees, and targeted mobile device and social networking users.

The Ponemon Institute helps both public sector and privbate sectors by performing independent research on privacy, data security, and information protection. Check Point Software Technologies provides organizations with a veriety of solutions to secure online networks and data.

FTC Seeks Information From The Public About How Identity Theft Impacts Elders

The U.S. Federal Trade Commission (FTC) seeks information from the public about how identity theft and fraud impact senior citizens. According to the Bureau of Justice statistics, 11.7 million people, about 5 percent of the population ages 16 or older, were victims of identity theft between 2006 and 2008. The FTC is concerned that:

"... seniors may be particularly susceptible to identity theft. They are often targeted for phishing scams; some seniors have granted powers of attorney giving wide access to their personal information; and most seniors' Medicare cards list their Social Security numbers. In addition, the personal information of senior citizens may be vulnerable in hospitals, nursing homes, and other care facilities."

To learn about the problem, the FTC seeks:

• Original research about the scope of identity theft and elders,
• The types of scams (e.g., phishing, tax, power of attorney, door-to-door) targeting elders,
• Obstacles to fighting or preventing this identity theft,
• Solutions by both the public and private sectors, and
• Any related issues

The FTC focuses upon enforcing laws, sharing its identity-theft complaint data with local law enforcement, and educates both consumers and businesses about data security. The FTC has brought actions against 35 companies for failing to adequately safeguard the sensitvie consumer data stored. In the summer of 2011, the FTC held a forum on the impacts upon children of identity theft. In September 2011, the FTC testified before Congress (Adobe PDF) about the problem and the actions it was taking.

Comments and submissions must be received by July 15, 2012. Information can be submitted in electronic or paper formats. Submissions should be mailed or delivered to:

Federal Trade Commission
Office of the Secretary
Room H-112 (Annex L)
600 Pennsylvania Avenue, N.W.
Washington, DC 20580

Submissions received will be made public on the FTC website.

The FTC helps consumers to prevent fraudulent, deceptive, and unfair business practices. It also provides information to help consumers spot, stop, and avoid them. If you have been a victim of identity theft and fraud, you can file a complaint in English or Spanish at the FTC Complaint Assistant website, or call 1-877-FTC-HELP (1-877-382-4357). The FTC compiles complaints it receives into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad.

Slamming And Your Home Energy Bills

Recently, an I've Been Mugged reader wrote asking me about what to do with their home energy bill. The reader was concerned that they had been "slammed" -- their energy supplier had been switched without their approval. When thinking about situations like this, it is important for consumers to understand your rights first.

Each state in the USA has a Public Utility Commission (PUC) or state agency to govern and regulate which companies are licensed to sell energy (e.g., electricity, natural gas). So, to understand your rights a good first step is the PUC website for the state where you live.

I'll use the state where I live as an example. In Massachusetts, some private companies are licensed to sell only electricity, some only gas, and some both. The Executive Office of Energy and Environmental Affairs (EEA) provides the lists of licensed energy sellers in Massachusetts. Obviously, this is a list consumers would use to verify any private company selling energy in the state, especially door-to-door sales people.

The same EEA website describes consumers' various rights about energy services. For example, the "Cooling Off Period" describes the length of time consumers can change their mind after switching to a new energy service provider:

"Your choice of a competitive power supplier will not take effect for at least three business days. Should you change your mind during that three day period, you will not incur any charges."

The site also describes consumers' rights about slamming:

"A competitive power supplier may not switch you to its service without your consent. Your consent must take the form of either: 1) a written letter of authorization signed by you; or 2) your oral statement to an independent third party, such as a separate verification company. If you are switched without your authorization, you may file a complaint with the Massachusetts Department of Telecommunications and Energy by calling 1-800-392-6066."

Historically, slamming happened a lot with phone services, but lately it can happen with energy services, too. In 2011, the Georgia Public Service Commission (PSC) fined gas marketer Energy America with a $400,000 penalty for customers it "slammed." While some companies approach consumers at home, others perform phone solicitations.

Before accusing a company of slamming your energy service, I would first check with other members in the home, or a landlord, to see if somebody else signed an order to switch service. Then, I would contact the new energy supplier to get the sales person's name and a copy of that new-service order.

If slamming is still a concern, other steps I might perform in order:

1. Check the website of my existing energy supplier to see what they advise about slamming
2. Check my state's PUC website to understand my rights and what they advise about slamming
3. File a complaint with the PUC in the state where I live
4. File a police report with local law enforcement, since it is fraud to forge another person's signature
5. File a complaint with the Federal Trade Commission
6. Consult with an attorney to see what other options there may be for consumers

Having difficulty finding the website for your state's PUC? This list may help.

Security Report Describes Multiple Threats Targeting Apple And Android Mobile Devices

Your Apple brand mobile device may not be as secure as you think it is. Trend Micro released a report last week about mobile device security. Key findings from the report:

• During the first three months of 2012, Apple led all major technology vendors with 91 reported vulnerabilities (http://cve.mitre.org/); followed by Oracle (78), Google (73), Microsoft (43), IBM (42), Cisco (36), Mozilla (30), MySQL (28), Adobe (27), and  Apache (24).
• During the same period, Android-based smartphone suffered from the most cyber criminal attacks. Trend Micro identified about 5,000 new malicious apps that target Android devices

The report described a variety of scams and threats targeting mobile device users worldwide. The “one-click billing fraud” scam is particularly nasty. In this scam, thieves target video sharing websites. When a person clicks on a link to view a video, the link redirects to a website that downloads a software virus to their device. The virus locks up the person’s device and demands payment to unlock the device. This scam now targets Android-based smartphones.

Some scams used email hoaxes about new products to spread malware:

“Free “iPad 3” giveaway promos stirred up interest in the product even before its launch and infected systems with malware. Twitter spam touting free McDonald’s gift cards redirected users to adult dating sites..."

Some scams used new social networking sites to spread computer viruses:

“New social networking site, Pinterest, gained not just popularity but also notoriety. Site users were drawn into “re-pinning” a Starbucks logo to get supposed gift cards but instead got Malware.”

The report describes another type of scams, often referred to as “ransomeware” which:

“Refers to a class of malware that holds systems and/or files “hostage” unless victims pay up...”

Ransomeware may also encrypt files on the hard drives of victims’ infected devices, and demand payment to release the encrypted files. Trend Micro reported that this scam previously operated in Russia, but has now spread to several countries in Europe. A variation of this scam includes the use of police department logos on a landing page which demands that victims with infected computers pay a bogus fine for accessing Internet port and materials with violent content.

Before installing apps on your smartphone, the report’s authors advice consumers to:

1. Be ready to give out some personal information.
2. Know that a third-party will gain access to your personal information.
3. Know the app developer’s reputation

Download the “Security In the Age of Mobility” report (Adobe PDF, 2.1 MBytes).

Hackers Target Facebook Users With New Malware Tool To Steal Credit Card Information

In case you haven't heard, scammers and identity thieves have targeted social networking users. Trusteer reported a new scam by identity theives using a new version of the "Ice IX" malware.

After a Facebook member (within an infected computer) has logged into their Facebook account, the "Ice IX" malware spawns a new browser with a fake Facebook page which prompts users to enter credit card information for supposed additional data security protection. Of course, no security protection is provided, and the malware steals both the consumer's credit card information and other sensitive personal data stored on your computer.

This is another fine example of the creativity and persistence of scammers and identity thieves. Visit the Trusteer website to view screen images of the fake Facebook page. To learn more about how to protect yourself when using Facebook.com and its mobile apps, see the links in the "Using Facebook Safely" module in the near-right column.

The Bright Side of Identity Theft And Fraud For Consumers

In a New York Times article titled, "The Bright Side Of Being Hacked," reporter Somini Sengupta described several benefits for corporations of a data breach via hacking. The article concluded:

"Rather, what Anonymous has done, experts said at the big RSA computer security conference here last week, is raise the alarm about the unguarded state of corporate computer systems."

Yes, raised awareness is a good thing, as was recently discussed about unsecured corporate video conferencing systems. Sengupta's articles reminded me of a blog post I wrote in 2010 which listed six benefits for consumers of being an identity theft victim:

"1. Awareness: After an identity thief has stolen your personal data, account credentials, and/or money consumers seem to have a new awareness of of the value of their sensitive personal data.
2. Acceptance and curiosity: after having their identity information and/or money stolen, there is an acceptance that identity theft is a problem. There is a curiosity to learn about other ways identity thieves and criminals might harm them, so they can avoid this painful experience in the future.
3. Willingness to change behaviors: Not knowing how to protect yourself is terrifying to most people. The pain from this terror seems to be sufficient incentive for consumers to change their habits (e.g., practice safe online shopping habits, check their credit reports for accuracy, use strong passwords at online sites, maintain anti-virus software on their home computer, etc.). Of the people I have talked with, after being an identity-theft victim, none want to return to their old ways.
4. Stronger consumer interest: along with this awareness about identity theft is an interest in products, services, processes, and/or laws that address and protect the needs and assets of consumers. Getting good customer service seems to become more important, too.
5. Gratitude and appreciation: before becoming a victim of identity theft and fraud, many consumers perceive warnings by consumer and privacy advocates to be unnecessary and overly cautious. Some have called me paranoid. After experiencing the pain of the theft and fraud, a different attitude emerges which includes a sincere appreciation for identity theft protection advice to help them fix their fraud problem, and a context for listening to future warnings.
6. Participation in our democracy: when the perception is that local or federal laws haven't kept up with business practices, some been motivated to write to their Congressional reps to demand action."

While, identity theft and fraud are painful experiences for consumers, these events can be a huge wake-up call for consumers to change their habits and practice better data security habits at home, at work, at ATM machines, at their doctor's office, at social networking websites, and with their mobile devices.

Former MLB Player Jailed On Fraud And Identity Theft Charges

This story caught my attention for reasons you might find surprising. It did not catch my attention because it involves a celebrity. It caught my attention because it shows how employees and independent contractors can become identity theft and fraud victims via an employer.

The Sports Illustrated article, "How Lenny Dykstra Got Nailed" explains how former Major League Baseball player Lenny Dykstra was jailed on identity theft and fraud charges. To fund a lavish lifestyle, Dykstra allegedly asked his employees to use their credit cards, never repaid them for the purchases, and used without authorization their sensitive personal information (e.g., Social Security Number) to apply for loans.

This story also highlights the importance of filing identity-theft and fraud complaints with both local law enforcement, the FTC, and the CFPB. Filed complaints allow law enforcement to discover patterns they might not discover otherwise.

Wilberto Hernandez, a personal credit repair consultant in Los Angeles had phoned local police after he received a notice from a credit agency that his Social Security number had been presented for credit checks at two car dealerships. Hernandez had helped one of Dykstra's business associates with credit repair services. Local police quickly saw a pattern among police reports filed:

"By Christmas 2010, [the police detective] had spoken with 17 people—personal assistants, drivers, private jet pilots and housekeepers—who claimed that Dykstra did not pay them for services, used their credit cards or got hold of their Social Security numbers and opened credit cards in their names."

One victim's situation was particularly instructive:

"Christopher Gavanis, then 30, had just moved to Los Angeles from Pennsylvania. Gavanis... couldn't afford a car to help him find work—but he did have a sterling credit rating. According to an interview police conducted with Gavanis on April 14, 2011, Dykstra promised him the car he desperately needed in return for the use of his credit... Dykstra also promised Gavanis a job with Home Free Systems once clients started rolling in..."

High Value Targets

CFPB Reports List Of Consumer Complaints About Financial Products

In its annual report, the new Consumer Financial Protection Bureau (CFPB), a federal agency designed to ensure that financial products and services for consumers are beneficial for consumers, listed the leading complaints submitted by consumers. The CFPB accepts complaints about credit cards and mortgages.

The CFPB began operation on July 21, 2011. In its annual report (Adobe PDF) to the U.S. Congress, the CFPB reported that by December 31, 2011, it had received 13,210 complaints from consumers, including 9,307 credit card complaints and 2,326 mortgage complaints. 44% of all complaints were submitted through the CFPB website, and about 15% via telephone calls. The leading types of credit-card complaints received:

Leading Credit Card Complaints Reported By Consumers to CFPB. July 21 - Dec. 31, 2011	Number	Percent
1. Billing Disputes	1,278	13.7%
2. Identity Theft / Fraud / Embezzlement	1,014	10.9%
3. APR or Interest rate	950	10.2%
4. Other	854	9.2%
5. Closing / Cancelling Account	478	5.1%
6. Credit reporting	437	4.7%
7. Credit Card Payment / Debt Protection	383	4.1%
8. Collection Practices	378	4.1%
9. Late Fee	364	3.9%
10. Other Fee	334	3.6%
Total for Top 10 complaint types	6,470	65.9%

The types of mortgage complaints received:

Mortgage Complaints Reported By Consumers to CFPB. July 21 - Dec. 31, 2011	Number	Percent
1. Problems when you are unable to pay (Loan modification, collection, foreclosure)	889	38.2%
2. Other	540	23.2%
3. Making payments (Loan servicing, payments, escrow accounts)	501	21.5%
4. Applying for the loan (Application, originator, mortgage broker)	235	10.1%
5. Signing the agreement (Settlement process and costs)	96	4.1%
6. Receiving a credit offer (Credit decision/Underwriting)	65	2.8%
Total Mortgage Complaints	2,326	100.0%

The FTC advises consumers who experience identity theft or fraud with financial products to both submit a complaint to the CFPB and submit a complaint to the FTC.

I like the CFPB's mission and its website. The agency's consumer response mechanisms are still new and in their infancy. They will become more beneficial as the agency identifies and resolves problems. What is your opinion of the CFPB?

10 Tips To Recognize And Avoid Scams That Target Elders

In it's Winter issue of Consumer News, the FDIC provided several tips for consumers to recognize and avoid scams, identity theft, and fraud that target elders:

1. Choose an advisor carefully: perform research of any new broker, attorney, accountant, or other professional you are considering to hire. Meet with the professional and ask questions before making a hiring decisions. Also, check with the local consumer protection agency in your state.
2. Use the powers-of-attorney legal document carefully: FDIC experts want that this document can easily be abused by the appointed person. Review and discuss the document with a lawyer before signing.
3. Protect your personal financial information: Don't disclose bank account numbers, Social Security numbers, PINs (personal identification numbers), passwords or other sensitive information without first verifying the identity of the person requesting the information. Don't give out this information over the phone to unsolicited callers. Don't give out this information to door-to-door sales people.
4. Files at home: store your checkbook, account statements, and other sensitive information in a safe place. Shred paper documents containing sensitive information (e.g., Social Security numbers, bank account numbers, health care plan numbers, etc.) that is no longer needed.
5. Monitor financial accounts activity: closely review monthly credit card and bank account statements when you receive them. Look for unauthorized or suspicious transactions, and report them to your bank immediately.
6. Don't rush major financial or investment decisions: take your time to fully understand the offer. Ask questions if you don’t. If you need it, ask a lawyer or financial advisor to help you review any documents. Reject immediately anyone saying that you must make a decision immediately.
7. Be aware of reverse-mortgage scams: reverse mortgages allow homeowners ages 62 or older to borrow money from the equity in their homes. However, these arrangements have several risks and costs. The U.S. Department of Housing and Urban Development’s Federal Housing Administration (HUD or call 1-800-569-4287) provides guidance about how to use reverse mortgages and locate approved lenders or counselors.
8. Telemarketing calls: beware of unsolicited callers asking for money or personal information. Consider the national Do Not Call Registry (call 1-888-382-1222) to register to opt out of telemarketing calls.
9. Sending money: don’t comply with requests from strangers to wire money to a foreign location or to deposit a check into your account (perhaps as part of an online sale). the checks are usually bogus.
10. Social networking site use: if you use social networking websites, don't post the names of relatives, home addresses, and birth dates. Scam artists troll social networking sites looking for personal information to pretend to be a friend or family member.

To learn more about common frauds targeting seniors, visit the FBI Common Fraud Schemes site, the FDIC Consumer News site, or MyMoney.gov.

After reading this list of tips, I must say that it is good advice for consumers of any age.