Pop-up screens can be phishing scams.
It could happen to anyone. You’re innocently browsing news headlines, checking the latest sports scores or searching for the perfect pair of shoes when out of nowhere you get a pop-up warning that a virus was detected on your computer and you need to contact Microsoft immediately. Conveniently enough, the pop-up also provides you with the Microsoft support number. It says Microsoft and seems legitimate. What could go wrong?
Someone – we’ll call him Wilson – recently received a warning like this on his personal laptop. Wilson tried closing the pop-up, but it wouldn’t close. He tried rebooting his computer, but the pop-up just came back (warning sign #1), so he figured it must be legitimate. He called the phone number provided in the warning. A nice person identifying himself as “Microsoft Support” answered, gained access to the computer and quickly began to assist in removing the virus from Wilson’s computer.
The representative claiming to be from Microsoft said he needed a credit card number (warning sign #2) to work on eliminating the problem. Reluctantly, Wilson gave the representative the information because he wanted to restore his laptop. The rep gave Wilson the option to pay $249.99 to eliminate the virus and receive three years of protection against getting a virus in the future, which Wilson declined. The representative identified the virus as Zeus Trojan and indicated that this type of software problem wasn’t covered under any warranty.
Wilson received an email from a payment service company asking if he approved $249.99 charges for services rendered and if the services provided were satisfactory before they processed the charge. His immediate response was that he had not authorized any charges and would challenge any charges. Needless to say, the charges went through anyway.
Wilson teamed up with a professional tech service but still took months to recover from the incident. To avoid being phished in the first place, Wilson could have called his own tech support service to confirm the message on the pop-up warning. He could have sought Microsoft support himself through independent channels, not through the phone number on the pop-up.
So what do you do after your information is compromised?
- Change your passwords – Hackers are trying to get your accounts and account details. It is very common for user names and passwords to be shared and used to compromise other accounts. It is best to change passwords for all your online accounts, including financial institutions, email and social media. When changing your passwords, make the new one more challenging by using a combination of upper and lowercase letters, numbers and special characters. Don’t use dates, kid or pet names or repeated characters.
- Check your machine – Scan your computer for any viruses, spyware and malware. These can be used to steal account information and track your keystrokes or Internet traffic. Don’t be too proud to solicit assistance from professionals to clean up your machine and make sure it is protected in the future.
- Verify and protect your accounts – You’ll want to verify that none of your accounts have fraudulent charges or provide authorization to third-party programs. If any accounts have shipping information, make sure it is still accurate. Close any accounts that were accessed and report any fraudulent charges to the financial institution. It is also a good idea to place a fraud alert on your credit reports.
- Let other contacts know – If your email or social media accounts were hacked, or if you clicked on a link on a malicious website or in a malicious email, emails may be sent or posts may be made on your behalf that could potentially spread spam and malware.
Make sure your computer’s anti-virus software is up to date, and schedule a scan regularly. Make yourself familiar with the various types of phishing scams, viruses and malware. In addition to placing pop-ups on websites, some scammers are placing phone calls, claiming to be from Microsoft or other legitimate services. Here is a good source from OnguardOnline.gov about the various types of threats and how to protect your computer. Remember, the more you know about cybersecurity and how it affects you, the easier it is to protect your computer and private information.
This loss control information is advisory only. The author assumes no responsibility for management or control of loss control activities. Not all exposures are identified in this article.