Thanksgiving Day phishing emails with .doc attachments

There's a phishing scheme in the wild that invites the email recipient to click an attached Word document (.doc) file.

The subject line resembles one of these:

• Thanksgiving Day congratulation
• Thanksgiving Day Greeting Card

If you've been following this blog, it goes without saying that you should never (ever!) open unexpected attachments—even if the sender appears to be someone you know.

Always be skeptical of any message that contains hyperlinks or attachments, and be wary of unexpected messages or those that contain out-of-the-ordinary language.

It's the holidays. Be extra alert and remember this motto:

Stop. Think. Don't click!

Online holiday shopping: How to stay safe out there

A few nights ago I logged in to Amazon to order a couple of household items. A banner quickly caught my eye, enticing me to view the "early Black Friday deals." I did. And I spent $150. It was three weeks before Thanksgiving.

The holiday shopping season comes earlier every year. This season, we'll spend over $700 billion. With the rise in spending comes an increase in online scams. In 2017, holiday scams were up 20% over the previous year. Expect even more this year.

Cyber thieves are forever devising more clever schemes to get us to click. And they can be very convincing. You don't need to be a victim.

Instead, outsmart them by changing one online behavior: Stop clicking links in emails and text messages. Instead, navigate to the site you want to visit online by typing the URL in the address bar of your browser.

Until you learn to be skeptical of every single attachment and hyperlink that you receive in a digital message, you are more likely to fall prey to a phishing scam or fake web site.

If you absolutely must click a link, first hover over the text to view the real destination behind the link. Make doubly sure it points to a domain that is both legitimate and trustworthy. Blindly clicking on a link is like walking unarmed down an unlit urban alley alone late at night. You do not know what is lurking.

Next time you log in to do some shopping, repeat this mantra:

Stop. Think! Don't click.

Top 10 ways of keeping kids safe online

Sophos is a security company in the UK that offers up some great security awareness content. Below is a list of ten short and simple tips to share with your children. For more information, see https://nakedsecurity.sophos.com/2014/02/11/safer-internet-day-dont-be-an-online-sheep-our-top-10-tips-help-you-think-before-you-act/.

1. Limit your Facebook profile to your friends only.
2. Accept online friend requests only from people you already know, and like, and trust.
3. Only upload things you are happy for the whole world to see, including your parents, friends and even your enemies.
4. Never give out your address or agree to meet in person someone you’ve “met” online.
5. Set a password lock on your phone or any other device you use, and make sure it locks automatically when you aren’t using it.
6. Don’t click on suspicious-looking links.
7. Tell your friends in person if you receive unusual messages from them. (Someone could have stolen their passwords.)
8. Always log out – don’t leave any account open when you go away from your computer, phone or other device.
9. Don’t pick easy passwords – mix up letters, numbers and funny characters so other people can’t guess what you chose.
10. If you see something upsetting, or dangerous, or dishonest, speak up! Tell a parent or a teacher.

Use Facebook? Time to change your password

This week there was a Facebook breach that affected 50 million users. Three days later, on Friday September 28, 2018, all of those users were forced to change their Facebook passwords. Even if you were not required to change your password, it's a good idea to do it anyway. Do it this weekend.

A Forbes article about the breach also recommends that you log out of any other web sites where you authenticate using your Facebook credentials. To access this information in Facebook, click apps and web sites, then logged in using Facebook. Remove the apps that you've used your Facebook account to log in to.

Go to settings and click security and login. Select the single-click option to log out of Facebook and every app or site where you are logged in using Facebook.

If you haven't enabled two-factor authentication on Facebook, do it today. Employ the same protection for any site holding sensitive information about you. This should include your email account (if multi-factor authentication is offered by your email provider), your banking and insurance web sites, your retirement and investment sites/apps, etc.

And, finally, if you are not using a password manager to store and encrypt all of your app passwords, start doing that today. LastPass, 1Password and KeyPass are just a few password managers available. Most have a free option. Writing down passwords and re-using them across various web sites or apps is a huge risk that is easily avoided by using password manager software.

For more information about the vulnerability that was exploited,  see https://www.forbes.com/sites/kateoflahertyuk/2018/09/29/facebook-data-breach-what-to-do-next/#b7fe4852de35.

No excuse now: Credit card freezes are free!

The best way to protect your identity is to freeze your credit and then thaw it with the appropriate credit bureau when a credit check is needed.

If you haven't done this for yourself, your spouse and your dependents, consider doing this to protect your family from identity theft. Yup, this includes your children or any dependent who has a social security number.

Credit bureaus formerly charged minor fees for both freezing and thawing your credit. The 2017 Equifax breach led to much-needed change—a win for Americans. Note that freezing your credit also protects your credit score from those unsolicited credit inquiries.

According to Brian Krebs, this freedom from freeze fees was solidified in the Economic Growth, Regulatory Relief and Consumer Protection Act of 2018.

For more information, see the Krebs' article at https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/.

Have you disabled autofill in your browser?

I was, at one time, an autofill user. How convenient for me that my browser fills in the answers for me in various web form fields, like name, address, phone number, zip code, etc. It's possible to input credit card data this way as well, although I never enabled that feature.

More recently, I disabled the autofill capability in my preferred browser, which happens to be Google Chrome. I did this because the bad guys figured out a way to cull this information without the user's knowledge.

How they do this is quite simple. The user clicks a link in a targeted phishing email and is redirected to the attacker's web page. A form on the page shows some blank fields—such as first name and last name.

With autofill enabled in browser settings, and with a single click, the user chooses to automatically fill the name fields, unaware that there are hidden fields on the page that are automatically filled as well—only with more sensitive information than just a name.

Note that if you use a password manager program (such as LastPass), it may have an autofill feature enabled.

For more information, see https://www.social-engineer.com/disable-autofill-browsers/.

Facebook users: Beware Target gift card scam

If one of your Facebook friends claims that he/she sent a text and received a free Target gift card in exchange, it's a hoax. The simple lesson here is that if it looks too good to be true, it probably is.

According to an article on Goodhousekeeping.com, the Facebook post appears to come from someone you know, and it may look like this:

This is a phishing scam.

The rule of thumb to avoid being scammed is this: Don't click links or open attachments in unexpected or unusual messages. Always verify before clicking. Other red flags are messages urging you to act now, messages asking for money, and anything offering something for nothing.

Want to stay safe online? Be careful what you click. When in doubt, verify. It's as simple as that.

For more information, see https://www.goodhousekeeping.com/life/money/a20952055/target-gift-card-scam/.