Today's STOP, DROP and ROLL to avoid being the victim of banking fraud

Thursday, October 29th 2009 @ 6:31 AM (1 ratings)    post viewed 2805 times

---

When I read the article on the threatpost.com website that said "FBI: SMBs Lost $40 Million in Bank Trojan Attacks" , I was tempted to say, "Nothing new here, folks. Move along." But the truth is, it's far too easy for people in the security field to see the constant flow of stories about Identity Theft, Fraud and Espionage and become desensitized to it all. Instead, this time - and as often as I can think of it - I'm going to give you a new mantra to chant to yourself while shaving, primping, waiting in the swineline, etc. - "IGNORE Spam, SEPARATE on-line banking and WATCH your bank balances daily". That is "IGNORE, SEPARATE and WATCH" - every day. Here's why...

The story I mentioned above (click HERE) shows that scammers have stolen $40 Million so far, from unsuspecting Small and Medium-sized Businesses' bank accounts, and that they now have a system for attacking anyone's bank accounts.  I expect that system to evolve to become much more elaborate. But it all starts by getting some malware on a computer that you use for banking.

1. IGNORE Spam

The first step they use is to send you Spam. We all know what Spam is, by now, right? But people keep clicking on it. In the old days, Spam was pretty easy to spot, due to the terrible grammar and outrageous claims in the subject line. But now, they are getting very creative. They mimic valid account notices from services that most people use. I

n business, Spam impersonates services like "FedEx" or "UPS", or even your own IT Helpdesk; and for home users, Spam often purports to be from "Paypal", "Microsoft" or "Adobe". If they can get you to open the message and click on a link within it, there's a good chance they can infect your computer, EVEN IF YOU HAVE THE BEST ANTIVIRUS SOLUTION AVAILABLE TODAY.

So, that's why I say, "IGNORE Spam". I even want you to try to avoid clicking on links in web pages or online forums or blogs that aren't from people or companies you know you can trust. These days, any site can be infected - for a while, at least - with links to malicious websites. But for now, let's just focus on things that are easy to distinguish. If it's not from somebody you trust, don't click on it.

2. SEPARATE Online Banking From Other Activities

Next, you have to avoid doing online banking at the same time, or even on the same account or computer as you do email and browse for other sites. I know this sounds difficult, but you should really try to find a way to do this, for maximum protection from fraud. There are several ways you can separate your activities: separate computers; separate "Non-Privileged" accounts (so the malware has a harder time crossing over); or even "Virtualized systems" (where you can run another operating system on top of your main one).

If activities can be contained within one Virtual Machine, any malware you may have picked up in will have a harder time tracking your banking activities on another.

So, step two is "SEPARATE" your online activities like email and browsing from banking. If you can't use separate computers for "email", "browsing" and "banking", you may have to get help to come up with a strategy for separating these activities, logically.

3. WATCH Bank Balances

Lastly, WATCH your banking accounts every day. Of course, you'll have to do this from that separate computer, user account or virtual machine we covered above. Watch for transactions you did not authorize, not only in your checking accounts, but in your savings and even Lines of Credit. People often have a lot more capacity for having money stolen from Lines of Credit than from checking accounts.

You can usually check your bank balance by phone for most institutions. This is also a good way to separate activities, if possible. Call your bank immediately, if you suspect something out of the ordinary has happened. The sooner you report the incident, the more likely it is that the thieves will be caught, and that you'll be able to recover the lost funds.

Now, All Together...

So, let's review the steps

1. IGNORE Spam - don't open messages or click on links or attachments from people or sites you don't trust or deal with normally.
2. SEPARATE Online Banking - use a different computer, or at least different Non-Privileged accounts or Virtual Machines to separate daily Internet activities from Online Banking activities. 
3. WATCH Bank Balances Daily - Keep an eye out for unusual transactions in ALL your accounts, and report anything unusual to your bank.
   

IGNORE, SEPARATE and WATCH. Repeat this phrase 3 times right now, and you will be on your way to safer online activities. Almost like the rule, "STOP, DROP and ROLL" for getting out of a burning building, this should be engrained in your memory.

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn't mean you can't have an economical way to address human security risks. Please call or email me at the coordinates below... Scott Wright The Streetwise Security Coach Join the Streetwise Security Zone at: http://www.streetwise-security-zone.com/join.html Phone: 1-613-693-0997 Email: scott@streetwise-security-zone.com Twitter ID: http://www.twitter.com/streetsec To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

rate this post: