By Susan Thompson | Lake Panorama Times
Curt Thornberry
He is a 20-year employee at Panora Fiber. As the director of technology development, Thornberry develops and deploys new internet and consumer technologies, plus leads a team that provides tech support to small and medium size businesses throughout Guthrie County and surrounding areas. He previously served on the Panora City Council and currently is the town’s mayor.
In this month’s Q&A, Thornberry talks about the dangers that exist because of our growing reliance on advanced technology in a digital world.
Q. There seems to be an increase in the ways scammers target online users. What are things we should do while on our computers to protect ourselves from scammers?
A. Online scams have been happening in our community for years. Most people are afraid to talk about and often are embarrassed they were scammed. Consequently, by not saying anything, the scammers continue to attack unsuspecting internet users. If we could get people to talk about and share their experiences, we could reduce the impact of these scams.
When it comes to online safety, there are a lot of things people can do to reduce the risk of being compromised. I think it is important for people to first think about what they are trying to protect. Do you have personally identifiable information, banking data, documents from work, genealogical records or personal photos you need to secure? Users often don’t think about what they could lose, until they have already lost it.
One of the easiest things a user can do is make sure devices are up to date. If you keep getting prompted to apply an update to your computer or smartphone, don’t avoid it. Security updates commonly are created to plug a security hole. Use security software on your computer and smartphones to protect against possible hacking or virus infection.
Make sure your computer or smartphone has a secure password to access. On a computer, I recommend at least a 10- to 12-character password comprised of numbers, letters and symbols. On smartphones, I recommend using biometric logins, such as a fingerprint or facial scan. One thing you can do is use a password manager to store all of your passwords. This way you only need to remember one password for your password manager. An added benefit with a password manager, such as Bitwarden, is it can be installed on your computer and smartphone so you always have access to all of your passwords on all your devices.
Make sure your devices are backed up. Users can back up their information to the Cloud or copy it to an external drive. Without a backup, your risk of losing data in a compromise is almost guaranteed. Automatically backup photos from your smartphone or computer to the Cloud so these are always protected.
Multifactor authentication is a common practice today for many programs and websites. This adds another layer of security when logging in. When users have an opportunity to use two factor authentication, I highly recommend it. You see it commonly on banking, healthcare, and finance websites. In these scenarios, users login to a website or computer program, then are sent a text or email with a secondary code to authenticate the user before gaining access.
Not only is it important to think about what you are trying to protect, but it’s important to think about what you are doing when you are online. Watch out for phishing emails that try and get you to click on a link or enter your password credentials into a website. Sometimes people become distracted when they are online and click before realizing they shouldn’t. If you receive an email from someone you don’t know asking you for something, be wary. I tell people if they have any question on whether an email is legitimate to either immediately delete it or, if you are unsure, verify the accuracy of the email by another means, such as a phone call.
Q. Let’s talk about the use of social media, specifically Facebook. What are the dangers, and ways users can protect themselves from those dangers?
A. The amount of data collection and targeting on Facebook is beyond what people comprehend. By filling out forms or taking quizzes on Facebook, users are sharing much more information than they realize. Facebook collects data both from what you explicitly share, such as your responses, and from indirect sources, such as your behavior on the site and interactions with ads.
When you provide details like your location, interests or job title, Facebook can use this to target you with information. Even if you don’t provide specific details, Facebook can infer things based on your activity. For example, if you indicate an interest in a certain type of music or political issue, it can deduce your preferences and demographics. Facebook also tracks how long you spend on certain types of content, which pages you visit, and even pauses in typing, using this to create a detailed profile. This behavioral data can be sold to third parties.
Facebook also partners with third parties and may augment your profile with additional information they gather, including purchase history, location data, or other browsing behavior if you’ve logged into third-party sites with your Facebook account. If you’ve shared location information on a form, it could allow for location-based tracking.
Third-party logins allow users to use their Facebook, Twitter, Apple or Google accounts as logins for other websites or apps. If you use your accounts to login to a malicious app, these will now have your login information and data. These permissions often lead to data sharing, security vulnerabilities and dependency on the underlying third-party provider. My recommendation is to not use your accounts for authenticating on third-party sites where you don’t understand the underlying company. If you do choose to use this method of authenticating, only grant the minimum permissions necessary to complete the authentication.
To safeguard a Facebook account, it’s essential to enable two-factor authentication, avoid reusing passwords, be cautious with third-party logins, and stay vigilant for phishing schemes. By enabling two-factor authentication, you are essentially locking down an account so even if a hacker has the password, that person won’t have access to your phone, which is used as a verifying factor sent in a text.
Finally, be on the lookout for fake Facebook profiles. Often hackers will create Facebook profiles that mimic your friends and family, using scraped data from the internet. This is a social engineering tactic designed to gain your trust. These profiles use publicly available information from social media or other online sources to craft a realistic looking profile that resembles someone you know. If you receive a friend request from someone you are already friends with, don’t accept it. You can review the fake profile’s activity to see what has happened on their timeline. If there is no history, minimal posts and only recent photos, then chances are the account is fake and is trying create a scam. You can report the account, if you like. You should also contact your friend offline to alert them to the suspicious account. By being friends with fake or hacked Facebook profiles, scammers have access to the same amount of information about you as your actual friends. This information can be targeted against you or other unsuspecting friends.
Q. Do phone calls still represent a danger when it comes to scammers?
A. Scams related to phone calls or “vishing” are much more prevalent than people realize. In these scenarios, there are a range of scams. There are several that I see making the rounds locally, including impersonation scams, tech support scams and family emergency scams.
Impersonation scams involve scammers pretending to be a trusted organization, such as a bank or a tech company. Tech support scams are insidious and are common in our area. These scams involve fraudsters pretending to be technical support from Microsoft or Apple. They tell the victim they noticed their computer is infected with malware. They try to get you to grant them remote access to your computer. If you grant them access, they will install malware and hijack your computer, steal information and charge for unnecessary repairs. Don’t give them access to your computer. If you don’t know who they are, hang up and call a trusted resource such as a family member or Panora Fiber for assistance.
The family emergency scam, also referred to as grandparents scam, play on people’s emotions and fears. This involves scammers impersonating a loved one, typically a grandchild or child, claiming to be in urgent trouble and needing immediate help. The scam often involves fabricated scenarios designed to create a sense of urgency, making victims act impulsively without verifying the story. This scam has impacted many people in our community, at times resulting in the loss of thousands of dollars.
Q. Both my husband and I have had times when clicking on a link we think will take us to something specific sets off a glaring message on our computer screen. It warns we’ve been hacked and need to call or click for help. Explain what that’s about and how to respond.
A. What you are describing is called scareware. This goes along with the tech support scams I detailed earlier. In these scenarios, scareware is a type of malicious software that tricks users into thinking their device is infected with a virus or has critical errors, often creating a sense of urgency or fear. Scareware usually pops up as fake security alerts, error messages, or “system scans” designed to look legitimate, with the goal of convincing users to purchase or download unnecessary and often harmful software.
When users encounter scareware, they should close their browser application and then relaunch it. Typically, the scareware will be removed from the cache and as long as the user doesn’t return to that page, the issue will be resolved. If you are concerned your computer may have been compromised, scan it with antivirus software or take it to a professional to have it checked out. We see this issue a lot with users who reach out to us at Panora Fiber. It happens more than people realize.
Q. What about identity theft? What are the most common ways this happens, and how can the impacted person respond?
A. With so much user data online, identity theft has become a more regular occurrence. The most common methods used for identity theft are through data breaches and phishing scams. If you feel you are a victim of identity theft, you need to act quickly and deliberately.
First, review your bank and credit card accounts, as well as your credit report. Next, report and lock your accounts. If you are a victim of a data breech, one of the remedies is to place a fraud alert with one of the major credit bureaus on your credit file. Victims also can submit a report to the FTC at identitytheft.gov. This generates an identity theft report and a recovery plan to assist in the process.
Scams and identity theft create lots of confusion and stress for the victim. It is important you act quickly. Don’t think that by avoiding the problem it will go away. Plan ahead and know what to do if you think you have been scammed. Reach out to trusted individuals or businesses for help. There is no shame in being a victim of a scam.
By addressing the online basics such as strong passwords, data backups, reliable security software, and being aware of what you are doing online, you can reduce your online risks and limit the amount of damage that occurs if you are scammed.