FTC Alert, April 27th, 2020, "Don't click links in unsolicited text messages"

Don’t click links in unsolicited text messages

Share this page

 

• Facebook
 
• Twitter
 
• Linked-In

April 27, 2020

by 

Rosario Méndez

Attorney, Division of Consumer and Business Education, FTC

You might be seeing text messages promising money – maybe the economic impact payments, loans for small businesses, or an offer for money you can get. In fact, I recently saw a WhatsApp text message in Spanish that advertised money for people quarantined at home. If you’ve spotted messages like this, I hope you’ve also deleted them. These text messages going around could lead you to a scam or a hacker, but not to anything helpful.

 

It’s important to remember that scammers will go to any length to make their message seem real. This particular text had the logo of the Executive Office of the President of the U.S. – a typical scammer tactic to make a message look affiliated with the government. It also had a list of people who could supposedly apply for the government grant – basically anyone – and had misspellings and cut off sentences. Now, not all scammers have bad grammar or spelling – but it’s a good tip-off to a scam when you see them. Also, when it comes to economic impact payments and other pandemic recovery help, the government is not reaching out via text, phone, email, or messages to your social media. If you spot one: pretty likely it’s a scam.

 

So, if you get text messages claiming to be related to the government’s help for people affected by the Coronavirus:

• Do not click on any links.Clicking could expose you to scams, download malware, or get your phone number added to lists that are then sold to other bad actors. 
• Delete those text messages immediately.
• If you have questions about the federal government’s economic impact payment, go to irs.gov/coronavirus. 

Report any suspicious text message to the FTC at ftc.gov/complaint. Your report matters. It helps stop scams and alert people about them. 

 

MI Governor Whitmer Executive order update 2020 -59 (COVID -19) April 24th, 2020

Governor Whitmer announced an update to the Executive Order # 2020-59, COVID -19

Click the link below for details:

MI Governor Whitmers Executive Order #2020-59

MI Attorney General Dana Nessel: Stimulus Payment Scams , April 21, 2020

URGENT

Michigan Attorney General's Message to Consumers:

• 
  
• Scammers are using the news that the federal government will send one-time payments to millions of people across the country as part of the federal economic relief response to COVID-19 to steal personal information. 
• The Michigan Department of Attorney General has already received reports that residents are getting emails from websites appearing to be official demanding that they provide PayPal, bank account or other financial information to receive the $1200 federal stimulus payment immediately. 
• If you receive a text, email or phone call from someone claiming to be from the government with a check for you—DO NOT FALL FOR IT. 
• These fake phishing scams will likely ask you for your bank account information and insist $1,000 or more will be deposited directly into your bank account.    

Click the link below for the video message on avoiding the scams: 

MI Attorney Generals: Stimulus Payment Scams

CPAM Members, information from the Michigan Townships Association:

Click the link to access their website:
Michigan Townships Association

Michigan Townships

1,240 local units of government that govern more than 96% of Michigan's land area, in which over 58% of Michigan's property values are located. Townships provide essential services to more than 51% of Michigan's citizens, and deliver the best value for local services.

Michigan Municipal League - Resources addressing COVID-19

CPAM members, here is a great resource, the Michigan Municipal League. 

Here is information from their website and a link for more resources to 

address the COVID-19 crisis.

Michigan Municipal League

Resources For Communities

Cities and villages are on the front lines of responding to the outbreak of coronavirus disease (COVID-19) in their community. Local elected leaders have the primary responsibility for ensuring the health and safety of their residents. Michigan local governments have longstanding emergency protocols for public health emergencies and community members rely on them to provide them with timely, accurate information about their local preparedness and response.

The Michigan Municipal League is committed to providing local leaders with the necessary tools and resources to ensure communities are well equipped to navigate the current outbreak of coronavirus disease (COVID-19).

Questions on the Coronavirus?

The League can help!

Due to the volume of questions Governor Whitmer’s Administration is receiving on the coronavirus (COVID-19), the Michigan Municipal League has partnered with the Governor’s office to help answer and address the questions our members have.

ASK YOUR QUESTIONS HERE

VIEW ANSWERS TO QUESTIONSMichigan Municipal League 

FBI Warns of Emerging Health Care Fraud Schemes Related to COVID-19 Pandemic

April 13th, 2020

FBI  Alert:  FBI warns of Emerging Health Care Scams related to COVID-19.

Click the link below for details:

FBI Warns of Emerging Health Care Fraud Schemes Related to COVID-19 Pandemic

FBI Expects a Rise in Scams Involving Cryptocurrency Related to the COVID-19 Pandemic

April 13th, 2020

The FBI has published an alert on the rise of scams involving "Cryptocurrency" . Click the link below to access the press release:

FBI Expects a Rise in Scams Involving Cryptocurrency Related to the COVID-19 Pandemic

Zoombomming: Federal Crime,US Attorney's Office Eastern District of MI April 3rd, 2020

U.S. Attorneys » Eastern District of Michigan » News

SHARE

Department of Justice

U.S. Attorney’s Office

Eastern District of Michigan

---

FOR IMMEDIATE RELEASE

Friday, April 3, 2020

Federal, State, and Local Law Enforcement Warn Against Teleconferencing Hacking During Coronavirus Pandemic

As our country finds new ways of communicating during the COVID-19 pandemic, Michigan residents have turned to video-teleconferencing (VTC) platforms, such as Zoom, to stay connected.  Unfortunately, as the FBI reported this week, there has been a rise in the number of so-called “Zoom-bombing,” or video hacking across the United States.  The State of Michigan has seen several instances of such hacking just this week.  Hackers are disrupting conferences and online classrooms with pornographic and/or hate images and threatening language.

Michigan’s chief federal, state, and local law enforcement officials are joining together to warn anyone who hacks into a teleconference can be charged with state or federal crimes.  Charges may include – to name just a few – disrupting a public meeting, computer intrusion, using a computer to commit a crime, hate crimes, fraud, or transmitting threatening communications.  All of these charges are punishable by fines and imprisonment. 

“You think Zoom bombing is funny?  Let’s see how funny it is after you get arrested,” stated Matthew Schneider, United States Attorney for Eastern Michigan.  “If you interfere with a teleconference or public meeting in Michigan, you could have federal, state, or local law enforcement knocking at your door.”

Western District of Michigan U.S. Attorney Andrew Birge advised video conference users: “Whether you run a business, a law enforcement meeting, a classroom or you just want to video chat with family, you need to be aware that your video conference may not be secure and information you share may be compromised.  Be careful.  If you do get hacked, call us.”

 “It is a shame that during a pandemic which is causing fear and anxiety across the globe that there are wrongdoers seeking to disrupt virtual environments which have become essential to communication, teleworking and online learning,” said Special Agent in Charge Steven M. D’Antuono. “While Michiganders are sheltering in place, it is important to practice good cyber hygiene. We encourage our communities to visit fbi.gov or ic3.gov to learn more about tips they can take to keep their devices secure.”

“We were alerted to this problem by a Michigan reporter who participated in a Zoom conference that was hijacked,” stated Michigan Attorney General Dana Nessel.  “Since then we have learned of other incidents around the country.  There are steps people can take to protect their cybersecurity and we encourage all users to follow the proper procedures to ensure their teleconferences are secure.”

Robert Stevenson, Michigan Association of Chiefs of Police stated, “While the state is practicing social distancing, our law enforcement partners are coming together to help keep the people of Michigan safe during this crisis.  Please report any incidents of hacking or any other type of fraud to your local, state or federal law enforcement agency.”

As individuals continue the transition to online lessons and meetings, law enforcement recommends exercising due diligence and caution in your cybersecurity efforts.  The following steps can be taken to mitigate teleconferencing threats:

• Do not make the meetings or classroom public.  In Zoom, there are two options to make a meeting private: require a meeting password or use the waiting room feature and control the admittance of guest.
• Do not share a link to a teleconference or classroom on an unrestricted publicly available social media post.  Provide the link directly to specific people.
• Manage screensharing options in Zoom, change screensharing to “Host Only.”
• Ensure users are using the updated version of remote access/meeting applications. In January, 2020, Zoom updated their software.  In their security update, the teleconference software provider added passwords by default for meetings and disabled the ability to randomly scan for meetings to join.
• Lastly, ensure that your organization’s telework policy or guide addresses requirements for physical and information security.
•  

If you were a victim of a teleconference hijacking, or any cyber-crime for that matter, report it to the FBI’s Internet Crime Complaint Center at https://www.ic3.gov/default.aspx.  Click here for more information regarding teleconference hijacking:  https://www.ic3.gov/media/2020/200401.aspx.

Additionally, if you receive a specific threat during a teleconference, please report it to the FBI at https://tips.fbi.gov/  or call the FBI Detroit Division at (313) 965-2323.

 Eastern District of MI (Dept. of Justice)

FTC Scam Alert: Avoid scams while finding help during the quarantine

Avoid scams while finding help during the quarantine

Share this page

 

• Facebook
 
• Twitter
 
• Linked-In

April 7, 2020

by 

Lois Greisman, FTC, Elder Justice Coordinator

Michael Herndon, CFPB, Acting Assistant Director, Office for Older Americans

Older adults may be hard hit by the coronavirus – and scammers prey on that. If you or someone you know must stay at home and needs help with errands, you’ll want to know about this latest scam.

Scammers are offering help with errands, and running off with your money

If you’re an older adult or a caregiver for one, you may need help picking up groceries, prescriptions, and other necessary supplies. If someone you don’t know offers to help, be wary. Some scammers offer to buy supplies but never come back with the goods or your money. It’s usually safer to find a trusted friend or neighbor or arrange a delivery with a well-known company.

If you’re ordering supplies online, know who you’re buying from. Online sellers may claim to have in-demand products, like cleaning, household, and medical supplies when, in fact, they don’t. Use an established delivery service, or order directly from the store. Many grocery stores and pharmacies are offering contactless delivery. If you need additional help for yourself or a loved one, the Eldercare Locator, a public service of the U.S. Administration on Aging, can connect you to services for older adults and their families. You can also call 1-800-677-1116.

Are you also helping to manage someone’s money?

If you’re helping with basics, you might also be managing money for someone and can’t be with them because of social distancing and quarantines. If so, here are some ideas:

• Check in by phone or video chat. Stay in touch to know how they’re handling things – and so they know you’re thinking about them.
• Ask questions. If your loved one mentions concerns about money or spotted unusual activity in their accounts, ask for details. Older adults and their family members can learn about common types of scams, as well as how to avoid and report them by checking out the Pass it On and Money Smart for Older Adults programs.
• Financial caregivers: learn more about your responsibilities. The CFPB’s Managing Someone Else’s Money guides can help you understand your role as a fiduciary. Each guide explains your responsibilities, and how to spot financial exploitation and avoid scams.

Help keep everyone safe from scams

Help spread the word and keep those you care about from falling for a scam, regardless of their age or health status. If you spot a scam, report it to the FTC at ftc.gov/complaint.

FTC Scam alert: Avoid scams during the quarantine

FTC Scam Alert; COVID-19 checks: flattening the scam curve

Coronavirus checks: flattening the scam curve

Share this page

 

• Facebook
 
• Twitter
 
• Linked-In

April 8, 2020

by 

Karen Hobbs

Assistant Director, Division of Consumer and Business Education, FTC

There’s a lot to worry about when it comes to the Coronavirus crisis, including the new ways scammers are using the economic impact payments (so-called “stimulus checks”) to trick people. To keep ahead of scammers who are trying to cash in on those payments, read on.

Scammers have no shame, and nothing – not even a global health crisis – is off limits. They’re pitching fake Coronavirus vaccines, unproven cures, and bogus at-home testing kits. So, it’s not surprising that scammers are exploiting confusion about economic impact payments too. But it’s still shameful.

Most people who qualify for a check will automatically get it direct deposited by the IRS within weeks. But as details emerge about how and when payments will arrive, some scammers may start using official-looking fake checks to steal money and confuse people into turning over personal information. Here’s some information to help avoid fake check scams that might be arriving soon.

• The check’s not in the mail – yet. Reports say that paper checks – for people without direct deposit – will start arriving in May at the earliest. So, if you get an economic impact payment, stimulus, or relief check before then, or you get a check when you’re expecting a direct deposit, it’s a scam.
• The IRS will not send you an overpayment and make you send the money back in cash, gift cards, or through a money transfer. If you get an official-looking check for more than what you were expecting – say, for $3,000 – the next call you’re likely to get is from a scammer. They’ll tell you to keep your $1,200 payment, and return the rest by sending cash, gift cards, or money transfers. It’s a scam that will leave you owing money to your bank.
• That’s not the IRS calling, texting, or emailing. Scammers are sending official-looking messages – including postcards with a password to be used online to “access” or “verify” your payment or direct deposit information. The IRS will not contact you to collect your personal information or bank account. It’s a scam.

For trusted information and updates about IRS payments – including eligibility, how to sign up for direct deposit, or where to file a short tax form – always start with irs.gov/coronavirus. Learn how to avoid scams by subscribing to the FTC’s consumer alerts, and report scams to the FTC at ftc.gov/complaint.

FTC Scam Alert: Stimulus checks

FTC Alert: MI Small Businesses: Where to go for financial relief and not fall prey to a scam

Small businesses: Where to go for financial relief information

Share this page

 

• Facebook
 
• Twitter
 
• Linked-In

April 2, 2020

by 

Lesley Fair

Attorney, FTC Bureau of Consumer Protection

If you own a small business or work for one, you’ve seen the headlines about financial relief that may be available to some companies through the Small Business Administration (SBA). But you’ve also heard about scammers who extract a grain of truth from the news and distort it in an effort to cheat small businesses. Now more than ever it’s critical for small businesses to go straight to the source for accurate information about what’s happening at the SBA. And that source, of course, is the Small Business Administration’s dedicated page, sba.gov/coronavirus.

The SBA’s Coronavirus Small Business Guidance & Loan Resources page offers the latest information about the Paycheck Protection Program, Economic Injury Disaster Loans and Loan Advances, SBA Debt Relief, and SBA Express Bridge Loans. Yes, there are legitimate business groups and financial institutions sharing information, too. But given the number of fraudsters out to make a quick buck with bogus websites and phony email, your safest bet it to go straight to the SBA by carefully typing the URL sba.gov/coronavirus into the address bar at the top of your browser.

Here are more tips to help you avoid scams targeting small businesses.

• Scammers often mimic the look and feel of legitimate email. You’ve heard warnings for years about email phishing attempts. Fraudsters have upped their game in response. They’ve been known to copy logos of financial institutions and government agencies, including the SBA, and use wording that sounds familiar. They also manipulate email addresses so that a message looks to be from a legitimate source – but isn’t. That’s why it’s dangerous to respond to those emails. Instead go directly to the SBA site.
• Don’t click on links. Say you get an email that says it’s from your bank or a government agency. Don’t click on any links. It could load malware onto your computer. If you think you may need to respond, pick up the phone and call the office directly, but don’t use a number listed in the email. That could be fake, too. Instead, search online for a genuine telephone number or call your banker using the number you’ve always used. Yes, now is a good time to keep in close contact with your financial institution, but employ the same established lines of communication you used before COVID-19 became a concern.
• Be suspicious of unsolicited phone calls. Some scammers may try the personal approach by calling you and impersonating someone from a financial institution or government agency. Don’t engage in conversation. If you think you may need to respond, call using a number you know is legit.
• Watch out for application scams. Some small businesses report they’ve received unsolicited calls or email from people claiming to have an inside track to expedite financial relief. The people contacting them may charge upfront fees or ask for sensitive financial information – account numbers, tax IDs, Social Security numbers, and the like. Don’t take the bait. It’s a scam. Applying for a loan was a step-by-step process before the Coronavirus crisis and it’s a step-by-step process now. That’s why the SBA’s sba.gov/coronavirus site is the safest place for you to start.
• Alert others to Coronavirus relief check scams. Most people have read the news about Coronavirus relief checks that many Americans may receive. The FTC Consumer Blog has advice about spotting relief check scams. Share the tips with your co-workers, family, and social networks.

If you spot a potential Coronavirus-related scam, report it to the FTC at ftc.gov/complaint.

FTC - Small Businesses: Don't fall prey to a scam

FTC Scam Alert: Socially distancing from COVID-19 robocall scam

Socially distancing from COVID-19 robocall scams

Share this page

 

• Facebook
 
• Twitter
 
• Linked-In

March 27, 2020

by 

Karen Hobbs

Assistant Director, Division of Consumer and Business Education, FTC

Scammers – and scammy companies – are using illegal robocalls to profit from Coronavirus-related fears. Listen to some of the latest scammy robocall pitches, so you can be on the lookout and know how to respond. (Here’s a hint: hang up!)

Illegal robocalls are universally hated, so why do scammers still use them? Because they need only a few people to take the bait for them to make money. They might do that by getting your bank account number, tricking you into handing over gift card PIN codes, or stealing valuable personal information like your Social Security number.

Times of crisis bring out the best in people, and the worst in scammers – as you can hear in these sample calls from Coronavirus scammers pretending to be from the Social Security Administration, offering fake Coronavirus tests to Medicare recipients, and scaring small businesses into buying bogus online listing services.

• Social Security Administration scam
• Fake tests for Medicare recipients
• Small business listing scam

To hear more examples of illegal robocalls exploiting concerns about the Coronavirus, and to stay up to date on the latest FTC information, visit ftc.gov/coronavirus. The FTC is taking the fight against illegal Coronavirus robocalls to companies that help scammy telemarketers. That includes companies that transmit or carry these kinds of calls for telemarketers, or that give the phone numbers that scammers use for people to call them back. Today, the FTC sent letters to nine VoIP providers and companies that license phone numbers, warning them about the penalties for helping telemarketers that use these kinds of illegal robocalls.

Now that you know what Coronavirus robocall scams sound like, make sure others do too – share, link, or like this post, and encourage them to subscribe to the FTC’s consumer alerts. And, if you get scam calls like these, don’t believe them. Instead:

• Hang up. Don’t press any numbers. The recording might say that pressing a number will let you speak to a live operator or remove you from their call list, but it might lead to more robocalls, instead.
• Consider using a call blocking app or device. You also can ask your phone provider if it has call-blocking tools. To learn more, go to ftc.gov/calls.
• Report the call. Report robocalls at ftc.gov/complaint. The more we hear from you, the more we can help fight scams.

Federal Trade Commission: COVID-19 Robo call scam

Michigan Govner's Executive Order 2020-42, COVID-19

 MI Governor Whitmer's executive order 2020-, COVID -19

Click the link below for details:

MI Governor's Executive order update April 10th, 2020

ZOOM Alert - March 20th, 2020, "How to Keep Uninvited Guests Out of Your Zoom Event"

For residents, businesses, schools, faith communities that are using the ZOOM video platform here is a link to the article posted by ZOOM to help keep your meetings safe. 

Please check the website and updates on security on this system.

ZOOM - Security tips on using their program

FBI Alert- Virtual Environments, April 1st, 2020, " Cyber Actors take advantage of COVID-19 pandemic to exploit increased use in Virtual Environment"

April 01, 2020 

Alert Number

I-040120-PSA

Questions regarding this PSA should be directed to your local FBI Field Office.
Local Field Office Locations: www.fbi.gov/contact-us/field

CYBER ACTORS TAKE ADVANTAGE OF COVID-19 PANDEMIC TO EXPLOIT INCREASED USE OF VIRTUAL ENVIRONMENTS

The FBI anticipates cyber actors will exploit increased use of virtual environments by government agencies, the private sector, private organizations, and individuals as a result of the COVID-19 pandemic. Computer systems and virtual environments provide essential communication services for telework and education, in addition to conducting regular business. Cyber actors exploit vulnerabilities in these systems to steal sensitive information, target individuals and businesses performing financial transactions, and engage in extortion.
As of March 30 2020, the FBI's Internet Crime Complaint Center (IC3) has received and reviewed more than 1,200 complaints related to COVID-19 scams. In recent weeks, cyber actors have engaged in phishing campaigns against first responders, launched DDoS attacks against government agencies, deployed ransomware at medical facilities, and created fake COVID-19 websites that quietly download malware to victim devices. Based on recent trends, the FBI assesses these same groups will target businesses and individuals working from home via telework software vulnerabilities, education technology platforms, and new Business Email Compromise schemes.

Telework Vulnerabilities

The FBI advises you to carefully consider the applications you or your organization uses for telework applications, including video conferencing software and voice over Internet Protocol (VOIP) conference call systems. Telework software comprises a variety of tools that enable users to remotely access organizational applications, resources, and shared files. The COVID-19 pandemic has led to a spike in businesses teleworking to communicate and share information over the internet. With this knowledge, malicious cyber actors are looking for ways to exploit telework software vulnerabilities in order to obtain sensitive information, eavesdrop on conference calls or virtual meetings, or conduct other malicious activities. While telework software provides individuals, businesses, and academic institutions with a mechanism to work remotely, users should consider the risks associated with them and apply cyber best practices to protect critical information, safeguard user privacy, and prevent eavesdropping. Cyber actors may use any of the below means to exploit telework applications.

Software from Untrusted Sources

• Malicious cyber actors may use legitimate-looking telework software—which may be offered for free or at a reduced price—to gain access to sensitive data or eavesdrop on conversations.
• Cyber actors may also use phishing links or malicious mobile applications that appear to come from legitimate telework software vendors.

Communication Tools

• Malicious cyber actors may target communication tools (VOIP phones, video conferencing equipment, and cloud-based communications systems) to overload services and take them offline, or eavesdrop on conference calls.
• Cyber actors have also used video-teleconferencing (VTC) hijacking to disrupt conferences by inserting pornographic images, hate images, or threatening language.

Remote Desktop Access

• Some telework software allows for remote desktop sharing, which is beneficial for collaboration and presentations; however, malicious cyber actors historically have compromised remote desktop applications and can use compromised systems to move into other shared applications.

Supply Chain

• As organizations seek to obtain equipment, such as laptops, to enable teleworking, some have turned to laptop rentals from foreign sources. Previously used, improperly sanitized equipment potentially carries preinstalled malware.

Education Technology Services and Platforms

Today's rapid incorporation of education technology (edtech) and online learning could have privacy and safety implications if students' online activity is not closely monitored. For example, in late 2017, cyber actors exploited school information technology (IT) systems by hacking into multiple school district servers across the United States. They accessed student contact information, education plans, homework assignments, medical records, and counselor reports, and then used that information to contact, extort, and threaten students with physical violence and release of their personal information. The actors sent text messages to parents and local law enforcement, publicized students' private information, posted student personally identifiable information on social media, and stated how the release of such information could help child predators identify new targets.
Additionally, parents and caretakers should be aware of new technology issued to children who do not already have a foundation for online safety. Children may not recognize the dangers of visiting unknown websites or communicating with strangers online.

Business Email Compromise (BEC)

BEC is a scam that targets both individuals and businesses who have the ability to send wire transfers, checks, and automated clearing house (ACH) transfers. In a typical BEC scheme, the victim receives an email purported to be from a company the victim normally conducts business with; however, the email requests money be sent to a new account, or for standard payment practices be altered. For example, during this pandemic, BEC fraudsters have impersonated vendors and asked for payment outside the normal course of business due to COVID-19. The FBI advises the public to be on the lookout for the following:

• The use of urgency and last-minute changes in wire instructions or recipient account information;
• Last-minute changes in established communication platforms or email account addresses;
• Communications only in email and refusal to communicate via telephone;
• Requests for advanced payment of services when not previously required; and
• Requests from employees to change direct deposit information.

TIPS TO PROTECT YOU AND YOUR ORGANIZATION

Teleworking Tips:

Do:

• Select trusted and reputable telework software vendors; conduct additional due diligence when selecting foreign-sourced vendors.
• Restrict access to remote meetings, conference calls, or virtual classrooms, including the use of passwords if possible.
• Beware of social engineering tactics aimed at revealing sensitive information. Make use of tools that block suspected phishing emails or allow users to report and quarantine them.
• Beware of advertisements or emails purporting to be from telework software vendors.
• Always verify the web address of legitimate websites or manually type it into the browser.

Don't:

• Share links to remote meetings, conference calls, or virtual classrooms on open websites or open social media profiles.
• Open attachments or click links within emails from senders you do not recognize.
• Enable remote desktop access functions like Remote Desktop Protocol (RDP) or Virtual Network Computing (VNC) unless absolutely needed.¹

Education Technology Tips:

School districts across the United States are working to address a dynamically changing learning environment. The FBI acknowledges everyone is adjusting to these demands, but the FBI encourages parents and families to:
Do:

• Closely monitor children's use of edtech and online services.
• Research edtech service user agreements about data breach notifications, marketing, and/or selling of user data, data retention practices, and whether users and/or parents can elect to have student data deleted by request.
• Conduct regular internet searches of children's information to monitor the exposure and spread of their information on the internet.
• Consider credit or identity theft monitoring to check for any fraudulent use of their child's identity.
• Research parent coalition and information-sharing organizations available online for those looking for support and additional resources.
• Research school-related, edtech, and other related vendor cyber breaches, which can further inform families of student data and security vulnerabilities.

Don't:

• Provide exact information on children when creating user profiles (e.g., use initials instead of full names, avoid using exact dates of birth, avoid including photos, etc.)

BEC Tips:

Do:

• Check for last-minute changes in wiring instructions or recipient account information.
• Verify vendor information via the recipient's contact information on file—do not contact the vendor through the number provided in the email.
• Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's email address appears to match who it is coming from.
• If you discover you are the victim of a fraudulent incident, immediately contact your financial institution to request a recall of funds, and contact your employer to report irregularities with payroll deposits. As soon as possible, file a complaint with the FBI's Internet Crime Complaint Center at www.ic3.gov or, for BEC and/or email account compromise (EAC) victims, BEC.IC3.gov.

Cyber Crime Vulnerability Tips:

The following tips can help protect individuals and businesses from being victimized by cyber actors:
Do:

• Verify the web address of legitimate websites and manually type them into your browser.
• Change passwords for routers and smart devices from default setting to unique passwords.
• Check for misspelled domain names within a link (for example, confirm that addresses for government websites end in .gov).
• Report suspicious activity on work computers to your employer.
• Use multi-factor authentication (MFA) when accessing organizational sites, resources, and files.
• Practice good cyber security when accessing Wi-Fi networks, including use of strong passwords and Wi-Fi Protected Access (WPA) or WPA2 protocols.
• Ensure desktops, laptops, and mobile devices have anti-virus software installed and routine security updates are applied; this includes regularly updating web browsers, browser plugins, and document readers.

Don't:

• Open attachments or click links within emails received from senders you do not recognize.
• Provide usernames, passwords, birth dates, social security numbers, financial data, or other personal information in response to an email or phone call.
• Use public or non-secure Wi-Fi access points to access sensitive information.
• Use the same password for multiple accounts.

If private sector partners have additional questions, you can reach out to local FBI Field Office Private Sector Coordinators. If you have evidence your child's data may have been compromised, if you are the victim of an internet scam or cyber crime, or if you want to report suspicious activity, please visit the FBI's Internet Crime Complaint Center at www.ic3.gov.

---

^{1. National Institute of Standards and Technology | Special Publication 800-46, Revision 2 | "Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security" | July 2016 | https://dx.doi.org/10.6028/NIST.SP.800-46r2 ↩}