If the IRS calls, hang up!

Listening to the local news a few days ago, I cringed as another innocent victim fell prey to the well-known IRS scam whereby an "agent" calls you to report you are delinquent on your taxes and owe penalties in the form of heavy fines. See the story: Local couple loses money to IRS scam.

If you receive a message of this nature on your voice mail, do not return the call. If you pick up the phone and someone claims to be from the IRS, hang up the phone without saying anything.

Know this: The IRS will not call you to collect back taxes. They use the postal service for notifications of this nature.

Victims of this scam are typically immigrants and the elderly. But any of us can become a victim of fraud or any social engineering scam if we aren't on our toes. Stay alert and reject any such phone calls. If you do return such a call or engage these guys on the phone, then you've validated your phone number, and they will keep trying.

Just hang up!

If you do receive such a call, you can report it to the U.S. Treasury Inspector General for tax administration at 800.366.4484. If you receive an email that appears to be an IRS scam, forward it to phishing@IRS.gov, and then delete the message or send it to your spam or junk email folder. Do not reply to any such email.

How do we fight back? Sharing this message with anyone and everyone you know is the best way to put a stop to this threat. Spread the word. Information is our most effective weapon.

For more information:

• IRS: Report Phishing and Online Scams
• Phone Scams Continue to be Serious Threat, Remain on IRS “Dirty Dozen” List of Tax Scams for the 2015 Filing Season (still true in 2016)
• IRS Warns of Pervasive Telephone Scam (first posted in 2013)
• Five Easy Ways to Spot a Spam Phone Call

A few online holiday shopping reminders

For those last-minute shoppers, I hope you've ordered your online gifts by now because it looks like deliveries might be delayed this year due to the big couriers like UPS and FedEx being overwhelmed with deliveries. (Note that Amazon.com has said they're going to buy their own fleet of long-haul trucks; that'll take care of the recurring holiday shipping delays in the future.)

But for those of you still shopping, here are three tips for safe shopping on the web, from Bob Sullivan's blog:

1. Update your software first. Make sure all the latest patches are installed before you start spending online.


2. Use two-factor authentication on e-commerce and banking sites that offer it. Amazon just recently started using this extra step that makes it really hard for your account to get hacked.


3. Use only one credit card online. This is how I do it. I have a card that I carry with me, and another that I've memorized and use for all my online shopping and other online payments. No sites have my checking account number, and I'll never provide it.


4. Stick with known shopping sites; if not, do your research before using a "small business" or other site that you're not familiar with, for that extra special, custom gift.


5. Enable text alerts on banking transactions. I haven't done this one yet, but it's a good idea. I'm going to do it today. Going forward, I'll receive a text any time my credit card is used.

Keeping the Holidays Free From Fraud: Tips for Your Business

If you are a small business owner, read on.

This morning a friend of mine who owns a small business shared a BizAhead article with me, written by Laura Buck. Here is a bullet list of the tips she offers for keeping your small business safe from fraudsters this holiday season:

• Encrypt payment information with end-to-end encryption
• Be on the lookout for suspicious sales, such as unusually large orders without any contact from the customer or rush orders for pricey goods
• Watch and educate your employees - train them in not clicking that link, and then test them, re-test them, and test them again
• Be observant - keep an eye out for credit card skimmers
• Be sure to shred sensitive information - don't take short-cuts because it's the holiday season
• Keep your wallet and credit cards close by - the other day while I was shopping, a woman left her purse in the top of her grocery cart and walked away just long for someone to grab it; no one did, but it would have been sooooo easy
• Be vigilant about security and safety
• Protect your passwords, pass phrases and PINs

For the full article, see Keeping the Holidays Free From Fraud: Tips for Your Business. The holiday season is prime fraud and scam time. Stay alert and question anything out of the ordinary or unexpected.

Safe and secure online holiday shopping

To remind you in staying safe online and prevent becoming a victim of a 'no-delivery' scam, listen to this 1-minute podcast from the FBI:

Online Holiday Shopping

Never click links in pop-up ads. Ever!

Are you using two-factor authentication to secure your banking credentials?

What is "2FA" in geek speak? It stands for two-factor authentication, which is a fancy way of saying that your successful login to a computer system is dependent upon two separate things from any of these categories:

• Something you know, like a password.
• Something you have, like a cell phone.
• Something you are, like a fingerprint or heart beat.

If your login credentials require only user name and password, that's called single factor authentication because there is generally only one unknown in that combination: your password. User names are rarely hard to guess.

But passwords are made to be broken. If you're not using a very strong or really long password, your credentials can be easily cracked and your bank account wiped out. (See earlier posting How do I create a strong password?)

The best protection you can get is to use multiple authentication methods to gain access to your sensitive web-based accounts. If your web site provider offers 2FA, turn it on. It's something you'll have to enable on the site, but figuring out how to do that is easy thanks to Turn it On: The Ultimate Guide to 2FA, which provides instructions for many (but not all) sites that offer 2FA. 

Try it out. Navigate to Turn it On, then type "Google" in the search box and press the Enter key on your keyboard. If the Turn it On web page doesn't have instructions for the site you're looking for, just check with your web site provider. 

Go to your banking web site today and turn on 2FA. Don't wait!

For more information, see

How to turn on two-factor authentication on Over 100 popular online services.

How Not To Be Hacked: The Definitive Guide for Regular People

Earlier this week, my boss told me of a special speaker coming to our office soon: consultant, author and fellow Atlanta resident James J. Deluccia, IV. My boss then handed me a signed copy of James' newly released book, called How Not to be Hacked: The Definitive Guide for Regular People.

The book is a quick and easy read. James shares the most essential tips for keeping your data and your family safe and secure online.

On pp. 141-144 of the book is a nicely summarized list of all the tips that James has to offer to regular folk who are not security experts or don't do this stuff for a living.

One of those tips is about using two-factor authentication for every online account you access that involves your money. This includes banking web sites, credit card account logins, retirement account web sites (frequently accessed through your employer benefits portal), bill payers, online retailers who have your credit card number, homeowners association (HOA) sites where you pay your dues, online brokerage firms, your pet insurance seller, or any web-based site where you are moving money. And that is exactly the topic of my next posting.

James' book already has a unanimous 5-star rating on Amazon and is available for just $12.99. This is a great gift for anyone and everyone you know who has a computer, tablet or mobile phone. 

A perfect Christmas gift for someone you love! If you read the book, please post your comments here. I'd love to hear from you.

Are you cyber aware?

October was cyber security awareness month, but every month is security awareness month at (SANS) Securing the Human.

Stay on top of what's happening in cyber and how to protect yourself and your family online with free SANS.org resources. Here are three popular resources to bookmark or download:

• Securing Your Kids Presentation & Handout - http://ow.ly/SWH6X
• Three Steps to Transform Your Security Awareness Program - http://ow.ly/TTGbv 
• Security Awareness Event Calendar - http://ow.ly/TTGjE

Remember to visit Securing the Human year-round to access dozens of tools, videos, and articles all related to security awareness. You don't have to be part of an organization or corporation to take advantage - these resources are for everyone!