Scam tactics - Information Security Office

Criminals are constantly coming up with new schemes designed to compromise devices, steal passwords, trick you into revealing personal, financial, and other valuable information, or con you out of money. Scams can lead to identity theft, regular theft, access to your accounts and personal information, and compromised devices. And a compromised device can put all of your information and passwords at risk.

Social engineering

Sometimes called “human hacking,” social engineering is a form of manipulation to get someone to act in a certain way. Many types of people use social engineering, be it a salesperson trying to get you to purchase extra add-ons you don’t really need or a threat actor trying to get your bank account information in a phishing email.

Criminals use social engineering because it works. It’s human nature to act whether it’s out of a tendency to trust, fear of something bad happening, curiosity, or simply wanting to help another person. For social engineers, it’s far easier to get someone to share their username and password by taking advantage of these traits than it is to break into a system by force.

Social engineering attacks can be broken down into four steps:

Information gathering

A successful social engineering attack requires a lot of preparation, so social engineers start by gathering information on their target. They often use social media like Facebook, Instagram, and LinkedIn, as well as general searches on engines like Google or Bing. Dedicated attackers may also go dumpster diving, looking for work documents, bank statements, medical prescriptions, or anything else that could provide more information on your work, interests, and lifestyle — all to help them better target you. When their larger goal is to breach a company’s security, they’ll also do extensive research on the organization.
Pretexting

Pretexting is the practice of presenting oneself as someone else to obtain private information. Here, social engineers use the information they’ve gathered to gain their target’s trust — they may feign shared interests to create rapport and use collected knowledge of the targeted company to impersonate someone trustworthy, such as a help desk or HR employee.
Elicitation

Once social engineers establish some sort of relationship, they elicit information from the target. This can take many forms, such as direct or indirect questions or a link in a phishing email.
Manipulation

Finally, social engineers move to manipulation or, rather, influencing their target to take actions that may not be in their best interest. Some common manipulation techniques include:

Fear-relief: They say something to scare the target then immediately follow up with an offer for relief. (e.g., “Your computer has been infected with malware, but if you give me your password, I can remote in and remove it.”)
Guilt: They may do the target a favor to gain leverage over that person.
Foot in the door: They ask the target for something small to get their foot in the door, and if the target responds, they’ll follow up with a larger request. (You’ll also see this manipulation technique commonly used by salespeople.)

Key indicators of a scam

Scams commonly use email, the internet, or the telephone to trick people into sharing sensitive information or doing something against policy. Criminals often use recent events, such as the COVID-19 pandemic or an earthquake, to prey on people, hoping to catch them off guard.

Key indicators of a scam:

Requests for personal or private information, such as your password, financial account information, Social Security number, or money
Unexpected/unsolicited emails with links or attachments
Sense of urgency and call to action (e.g., “contact us immediately,” “log in now”)
Scare tactics or threats stressing that, if you don't act quickly, something bad will happen (e.g., “your computer may be infected”)
Promises of something too good to be true, including bargains and “great offers” or links to claim an award or reward
Requests that you forward emails, attachments, links, etc., to your friends, co-workers, or family

Phishing

Phishing is a scam designed to steal information or passwords, compromise devices, or trick you out of money. While we often think of phishing as being limited to emails, it can also take the form of deceptive text messages, posts on social media, pop-ups, or phone calls.

Phishers may ask for your name, account information, date of birth, Social Security number, address, etc. They may also try to get you to open a link or file. Hover or tab over any links to review specifically where you are being directed. If it's not legit, don't open it.

Types of phishing and phishing “hooks”

Phishing is a way criminals use social engineering to trick you into sharing private and confidential data, such as bank account numbers or login information. Criminals employ many methods, such as:

Phishing
- Generic, everyday phishing is not targeted and tends to be easier to spot.
Spear phishing
- Spear phishing is one of the most dangerous forms of phishing. The phisher targets a specific individual and studies them to be able to write a more convincing, legitimate-looking message to trick them into letting down their guard and share sensitive information.
Whaling
- Also known as CEO fraud, whaling specifically targets CEOs and senior leadership.
Shared document phishing
- You might receive an email that appears to come from file-sharing sites like UBox, Dropbox, Google Drive, or OneDrive alerting you that a document has been shared with you. The link provided in these emails will take you to a fake login page that mimics the real login page and will steal your account credentials.

Indicators that an email isn’t legitimate:

The sender isn’t specified, isn’t someone you know, or doesn’t match the “from” address
Unfamiliar, unusual, or generic greetings; it’s not addressed to you, specifically, by name
- [No greeting]
- Dear member
- Hello friend
Spelling and grammar errors
Suspicious links
- A link that doesn’t match the URL of the webpage stated in the email
- A link to pictures or videos from people you don’t personally know
- A link or attachment to view an unexpected e-card or track an unknown package
Attachments
- Incorrect or suspicious file names
- Suspicious file extensions (e.g., *.bin, *.com, *.exe, *.html, *.pif, *.vbs, *.zip, *.zzx)
Low-resolution images

Reputable organizations like the University of Utah will never email you for your password, Social Security number, or any confidential or personal information. Visit our Phish Tank to learn more about various phishing schemes and how to avoid them.

If you cannot tell whether an email is legitimate, please report it using the Phish Alert button, forward it as an attachment to phish@utah.edu, or contact your respective help desk.

Campus IT Help Desk
801-581-4000
helpdesk@utah.edu

University of Utah Health ITS Service Desk
801-587-6000
ServiceDesk@hsc.utah.edu

Employment scams

Employment scams occur when criminals create fake job listings or reach out to people directly to deceive them into believing that they are being offered a (potential) job and persuade them to provide personal information. Often, these job offers are enticing and offer a lot of money for little work.

Be skeptical and never provide personal information, such as your driver license information or Social Security number, over email or the phone without determining the employer's legitimacy. If it sounds too good to be true, it's most likely a scam.

Follow these tips to avoid employment scams:

Never provide your Social Security number, driver license information, bank information, or other personal information over the phone or email.
Be skeptical of jobs that offer a lot of money for little work.
Never apply to a job that has been sent to you out of the blue.
Never send or wire money to the “employer.” A legitimate employer will never ask you to do that.
Don't agree to background checks with an employer you've never met in person.
If you're still uncertain, determine the legitimacy of the job offer/listing by researching the employer. Contact the business/ organization to verify whether it’s hiring and whether the person who contacted you works there.
Attackers will pretend they're someone real or even someone you know. If you receive a job offer from someone who seems legitimate, contact them through a known, trusted communication channel to verify whether it's really them.
Never accept cashier's checks or money orders as payment. Your bank can hold you accountable for fake checks.

*An example of an employment scam in which the sender offers the recipient a lot of money for little work. For a larger version, please select the image.*

Romance scams

Beware of online romance scams that lure victims into an online relationship to get money. Reports by the FTC show that people lost about $304 million in romance scams in 2020. Romance scammers create fake profiles on social media and dating sites, and seek out victims by conversations, gifts, and declarations of love without meeting in person. Knowing that they have the victim's trust, they begin asking for money to pay for medical expenses, plane tickets, debts, etc. Often the scammers will ask their victims to pay them by wiring money or gift cards so they can receive the money quickly and anonymously, with these transactions being impossible to reverse.

Romance scams can be upsetting and embarrassing because an emotional attachment has been created with someone who doesn't exist. To protect yourself and your assets, look for red flags, and never send money or gifts to someone you haven't met in person.

Warning signs of a romance scam:

The person professes their love quickly and lures you off the dating site to communicate with you through email or messaging apps, which allows them to communicate with multiple victims simultaneously.
They can't meet in person or live video chat. Sometimes these scammers will send prerecorded videos, which are actually stolen.
They ask for private information, such as financial information or even intimate photos, that they can later use as blackmail.
They always have emergencies and ask you for money to help them financially. If they ask you for money, you should immediately be suspicious. Assume you'll never get your money back even if they promise to pay you back.

Steps to protect yourself and avoid being scammed:

Take it slow and take time getting to know someone. A clear sign of a scammer is that they try to move the online romance as fast as possible.
If you're suspicious at any time while communicating with someone online, trust your gut and end all contact.
Never transfer money to an online love interest. If you think you have sent money to a scammer, contact your bank right away.

*Scammers may target you though phone calls and text messages.*

Other examples of scams

Criminals are unfortunately all too creative in finding new ways to scam us. While it’s impossible to make a comprehensive list of all the scams out there, here are some of the more common ones you may encounter.

Financial scams

Many scams are financially motivated, and scammers will often ask for money via irreversible transaction types, such as money orders, gift cards, or cryptocurrency transfers. Some finance-based scams include:

Fake charities/disaster fraud: Scammers will create a fake charity looking for donations for good causes or to provide relief to survivors of high-profile natural disasters or tragedies.
IRS/tax fraud: Someone pretending to be from the IRS contacts you regarding your taxes. They may say you owe late fees or that they need to recalculate your tax refund. They may ask you for money and/or confidential information, such as your Social Security, bank account, or driver license numbers, etc.
- If you suspect you’ve received a fake IRS email or phone call, or that you have been a victim of tax fraud, visit IRS Report Phishing and Online Scams for next steps.
Nigerian prince scams: Also called 419 scams, a scammer pretends to be someone needing help moving money out of the country. They promise you money in return for your help but need you to cover some transaction fees in advance.

Health care scams

Scammers know how expensive health insurance can be and have learned how easy it is to prey on our anxiety for affordable health care. They claim to offer major savings on health insurance while trying to get their hands on our current health insurance information, Social Security numbers, and financial information.

Identity theft

Identity theft, a classic scam, is where a hacker uses private information, such as your Social Security number or bank account information to obtain money, credit, or other resources. Signs of identity theft include bills for products or services you didn’t purchase, unauthorized withdrawals from your bank account, and an unexpectedly low credit score. Report suspicious activity as soon as possible to limit the damage caused by a potential theft of your identity.

Impersonation

Attackers pose as someone in authority, or an IT representative, to obtain information or direct access to systems. Impersonation is often used in social engineering attacks. Attackers may research their target to know enough to persuade you to trust them. Examples include:

An IRS scam that targets students.
The “Microsoft computer support” scam. Someone supposedly from the Microsoft or Windows Support Center calls to tell you there's a problem with your computer or that someone's trying to hack in. These scammers usually have you run some simple commands then ask you to install something that will allow them to “fix the problem.” They also might send you an attachment or a link or read you a URL. Following the instructions will give them full access to your computer.

Ransomware

Scams that lock your device and demand you pay money to unlock it. Examples include:

A pop-up that tells you there is a problem with your device. The pop-up offers free or cheap antivirus software to fix the problem. Once you install the fake antivirus program, it locks your device and you must pay the scammer to unlock it.
A pop-up that prompts you to sign in with your Windows account or email for “Windows” to fix the problem. After you sign in, the program locks your browser. To unlock it, you must buy antivirus software for $200 or $300. This is a double-whammy because you also give the attacker your credit card information.

Don’t be fooled by scams!