Tips and Tricks from CyberWyoming, Oct. 10, 2022

Brief 10/10/2022
McAfee Invoice Scam Email:  If you receive an email with the subject line of “#%PAYMENT DETAIL INVOICE:-#MC24/KA59/PZ73$#” from Kyro Robert at a Gmail address, delete it and block the sender.  This email, reported by a Sheridan citizen, is well branded with a pleasing design, but it impersonates the well-known McAfee antivirus software.
Geek Squad Impersonation:  A Sheridan citizen reported an email impersonating Geek Squad for a 3 year $499.99 Geek Squad Personal Home Membership renewal.  The email greeted this citizen as “HELLO USER” in all caps and the subject line was “@#orderAlert!!!” from Milo Robert at a Gmail address.
Sometimes Real Sites Get Credential Hacked:  A Laramie citizen reported a Google Workspace alert telling him that faith@grantwatch.com was flagged as a phishing message and recalled from recipients’ inboxes.  While GrantWatch.com is a real site, it appears that Faith’s user ID and password have been compromised.
Geek Squad and McAfee Impersonation Scam:  Whenever an email starts with “We are about to lose our membership in you.” it may be a clue that it is fake.  A Big Horn citizen reported an email from Jason Smith at a Gmail address with this beginning sentence saying that Geek Squad was notifying her that her McAfee Total Protection will be renewed for $254.33.  The subject line was “Thank you for your order- 4840026719”. Don’t call the number in the email, just block and delete.
Norton not Nortton:  If you receive an email from a Jonson Fum at a Gmail address, just block it.  Jonson is trying to scam you for Nortton VPN Security Online, but note that he misspelled the popular antivirus software as it is supposed to be Norton with one ‘t’.  The subject line of this fake email is “thank you for your online payment.  Reported by a Big Horn citizen.
Not Norton: Internet security firm Norton warns about fake emails pretending to come from them and warning recipients their account is about to expire or there's another security issue. Victims are asked to call a number where they're supposed to provide their sign-on details. Often the messages use bad spelling and threats. If you get one of these messages, go directly to your account at www.norton.com and check there. Brought to you by scambusters.org.
AARP False Charities Alert:  The AARP Fraud Watch Network wants to remind you that phone calls, emails, direct mail and door to door solicitations asking you for money for victims of natural disasters, like hurricane Ian, could be fake.  Scam charities proliferate when big crises hit the news.  Before you give, research the charity on www.charitywatch.org or www.charitynavigator.org.
Dark pattern worries: The US Federal Trade Commission (FTC) has sounded an alarm about the increasing use of so-called "dark pattern" tricks used by online companies to trick consumers into buying stuff they don't want or into giving away confidential information about themselves. Tactics include making ads look like non-advertising independent posts, making it tough to cancel subscriptions or charges, and hiding key terms and conditions or junk fees. "These traps will not be tolerated," says Samuel Levine, the Commission's Director of the Bureau of Consumer Protection. We covered dark patterns in issue #977: https://scambusters.org/darkpattern.html.  Brought to you by scambusters.org.
Crypto scam returns: A fake ad promoting a supposed virtual currency to be launched by Amazon has reappeared online. It was first spotted in 2021, claiming investors could get in early on a deal by buying into a "pre-sale." As of this writing, Amazon has never said it plans to launch a crypto currency, let alone have a pre-sale. Brought to you by scambusters.org.
Stargazer warning: If you're one of the millions of people in awe of the images being returned by the new James Web Telescope (JWT), keep your eyes peeled for a phishing attempt that uses copies of JWT images embedded with malware. It comes with what seems to be a Microsoft Word attachment that contains a download link for the picture. Once downloaded, it installs malware that enables a hacker to access your computer. If you want to see genuine images, NASA has posted them on a Flickr social media photo site: https://www.flickr.com/photos/nasawebbtelescope/albumsBrought to you by scambusters.org.
MS-ISAC and CISA Patch Now Alert: The Multi-State Information Sharing and Analysis Center (MS-ISAC) or the Cybersecurity & Infrastructure Security Agency (CISA) has published a patch now (update your software) alert for Microsoft Exchange Server, Cisco, Drupal, Mozilla’s Thunderbird email product, and Google’s Android operating system products.  If you use these products, make sure the software (or firmware) is updated.   
Please report scams you may experience to phishing@cyberwyoming.org to alert your friends and neighbors.
Other ways to report a scam:
● Better Business Bureau Scam Tracker: www.bbb.org/scamtracker/us/reportscam
● Wyoming Attorney General’s Office, Consumer Protection 307-777-6397, 800-438-5799 orag.consumer@wyo.gov
● File a complaint with the Federal Trade Commission at https://reportfraud.ftc.gov/#/
● Report your scam to the FBI at https://www.ic3.gov/Home/FileComplaint
● Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at https://www.donotcall.gov/report.html or call 1-888-382-1222, option 3
● Office of the Inspector General:  https://oig.ssa.gov/
● AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
● IRS: report email scams impersonating the IRS to phishing@irs.gov
● Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit www.aarp.org/fraudsupport to learn more about the free program and register.