This week’s Intego Mac podcast features a special report on the top 10 internet scams that everyone should know about, to protect the security of their data, their money, and their privacy.
If you like the Intego Mac Podcast, be sure to follow it on Apple Podcasts, Overcast, Spotify, or Amazon.
Intego Mac Premium Bundle X9 is the ultimate protection and utility suite for your Mac. Download a free trial now at intego.com, and use this link for a special discount when you’re ready to buy.
Get Apple security news delivered straight to your inbox, for free. Intego’s twice-monthly newsletter will keep you informed about Apple-related privacy and security, along with tips and tricks for getting the most out of your Mac or iPhone. Subscribe for free—no strings attached.
Voice Over 0:00
This is the Intego Mac Podcast—the voice of Mac security—for Thursday, June 6, 2024. This week’s Intego Mac Podcast features a special report on the top 10 internet scams that everyone should know, to protect the security of their data, money and privacy. Now, here are the hosts of the Intego Mac Podcast: veteran Mac journalist Kirk McElhearn, and Intego’s Chief Security Analyst, Josh Long.
Kirk McElhearn 0:33
Good morning, Josh, how are you today?
Josh Long 0:35
I’m doing well. How are you, Kirk?
Kirk McElhearn 0:37
I’m doing just fine. In today’s episode, we’re going to talk about the top 10 common online scams that people may encounter. And I wonder how many of them you have encountered in your experience on the internet, which is quite long, like like mine, but we’ll get to in a minute, we do have a little bit of news we want to talk about. We’re talking over Zoom. And we use Zoom every week. And we record vocally and it’s edited and all this. But Zoom is like our interface. Right? Zoom Workplace. It used to be just Zoom. Now it’s Zoom Workplace. Zoom recently added post quantum end to end encryption to video meetings. What does this mean Josh? “Post quantum.”
Josh Long 1:12
Yeah, post quantum sounds like oh, my gosh…like, quantum gets thrown around a lot. And so what exactly does post quantum mean? Well, so we’ve talked before about quantum computing. In fact, Kirk wrote an article about quantum computing a while back on the blog, October 2020, you wrote this article, we’re inching closer gradually to this idea that we will have quantum computers, which is a major breakthrough in processing technology, to the point where a lot of today’s encryption could potentially become weaker. And so that’s what Zoom is really talking about here, when they say post quantum, what they really mean is quantum resistant encryption. So meaning that once we do get these specialized processors that are potentially able to break today’s some of today’s encryption, that Zoom will already be using technology that is more difficult to break using quantum computers. That’s all that really means.
Kirk McElhearn 2:15
Okay, we talked a few weeks ago about whether TikTok is safe, and for a number of reasons for how it collects data, figures out your location, the kind of information, shares, et cetera. We just want to briefly mention that another country has warned people not to use TikTok and this time, it’s Canada, the head of Canada’s intelligence agency, is warning Canadians not to use TikTok. There’s not much to say about it. It’s just the moral panic around TikTok, but it’s worth pointing out that these are intelligence agencies that are coming out and saying this, of course, they could be told to say this by the politician.
Josh Long 2:48
Yeah, great point. Just a quick quote from the director of the Canadian Security Intelligence Service: “They’re using big data analytics. They have amazing computer farms crunching the data. They are developing artificial intelligence based on using this data.”
Kirk McElhearn 3:05
Yeah, so does Facebook. (Yeah, exactly.) Okay. One quick news story, US sanctions operators have a free VPN that routed crime traffic through user PCs. So basically, you had this free VPN that was free, but what you were doing was allowing criminals to put traffic through your computer that could make you an accessory before, during and after the fact, couldn’t it?
Josh Long 3:24
Yeah. And so what’s actually interesting about this is the allegation here, and the reason for the sanctions is because supposedly what was happening is that this software was getting onto people’s computers through an infection, meaning they had no idea that their computer was being used as an endpoint for other people, potentially bad guys to get out onto the internet. And so that’s where the problem lies. You might remember that we talked last year about something called Night Owl, it was a free app available for Mac and the developers sold it to another company. And that developer added a framework to it called Pawns, P-A-W-N-S just like the chess piece. And the whole idea behind this Pawns network is that it makes it possible for other people to get out onto the internet using any computer that has this Pawns Framework installed on it. So it’s kind of the same thing as these free VPNs are doing. Because again, in that case of NightOwl, the Pawns framework was being put on your computer without really explicitly getting your consent. It wasn’t really clearly explaining, this is going to happen if you start using, or if you continue to use the software or start using the software after the new developers taken over. And so this is another example of that kind of software. This particular proxy service was known as “911 S5.” Apparently a couple of so-called free VPNs were using this, and using their so-called “free VPN” as sort of a Trojan horse to get this software on people’s computers. So be careful. You know, free software can sometimes be just fine. But sometimes it’s owned by companies that do nefarious things. And so you do need to be a little bit careful about using free software. Now, something like a VPN, it’s kind of expensive to run a VPN service. So my recommendation is never ever use a free VPN service because you have to wonder what they’re doing to monetize that service. And probably they’re either using your data, or in this case, they’re using your internet connection to give bad guys access to the internet from someplace else.
Kirk McElhearn 5:42
Okay, so we want to look at the top 10 scams that you have to be aware of on the internet. And if you listen to this podcast regularly, you’ve heard us talk about most of these, there might be one or two that we haven’t really gone into in detail, but we have an article on the integral Mac security blog. And it’s kind of good to refresh your memory about all these things. You know, I’m thinking back to the early days of the Internet all back in the old days, right back in the 90s, when I was first using the internet, and we didn’t think about anything like this, we didn’t have secure connections, encrypted websites, we didn’t have any of this. But we didn’t worry too much because the criminals hadn’t caught up yet. Right? We were too busy just being awed by everything that was on the internet. Probably one of the first type of scams that came out was fishing. So fishing with a P pH is ing is when you get an email and it says, update your account, get free iCloud storage, you know, sign into this, because Phenix is holding onto your package. All of these are trying to get your credentials, your username and your password, first of all to get into that account. But second of all, assuming that you use the same username and password everywhere that if they can get into your FedEx account, they can get into your Apple ID account and to your bank account and all that now I hope most people listen to this podcast or using a password manager. And don’t reuse passwords like this. But phishing is the one thing. I get phishing emails every single day. There’s not a day goes by that I get phishing emails in my spam folder.
Josh Long 7:12
Wow, that’s a lot of phishing emails. I don’t think I get nearly that many. But it’s something that I used to get a lot of in fact, when I first started getting into computer security, that was one of the things that I investigated a lot spammers, and phishing scam campaigns and trying to figure out who was behind these things and trying to get them shut down. Because typically, they would register a domain, a lookalike domain very often. So it would be you know, Facebook dot, you know, us or something like that, something that was kind of plausible, kind of similar a little bit. So I would try to get these providers or the domain registrar’s to shut down those sites. But these days, it’s like Whack a Mole. And in fact, you imagine like a giant Whack a Mole table, that’s the size of like a football field and you’ve got one paddle I, you know, good luck, you might do a little bit of good, you might whack one mole. But now there’s 10,000 Other moles all around you. And so you’re probably not doing that much good.
Kirk McElhearn 8:12
So one of the most common scams we’ve seen is fake invoice scams, you get an email saying that here’s an invoice for this product, or this service. Now this started last year, it started rolling out with what was it the Geek Squad from BestBuy, and they were billing you for, I guess, like an extended warranty type thing. Some of these invoices are sent via legitimate platforms like PayPal, and QuickBooks and others. We have in this in the article on the intercom, security bug, we linked to other articles about specific topics like this. And we did a bit of research about this. In fact, Josh called up one of the phone numbers on one of these fake invoices to see what would happen because they’re billing you. And here’s the customer service number. If you have any questions, they don’t tell you to log into an account or send an email, they want a phone number, so they can eventually get you to install software, take over your computer, etc.
Josh Long 9:03
Exactly. The whole idea is to walk you through this process that’s going to you know, make you trust them to the point where they’re going to help you to not get charged this fake charge that they sent you in this fake invoice. And what the reality is, is that they’re they’re going to use this for some kind of malicious purpose. They’re either going to wait until you walk away from the computer and you don’t realize that they’re still connected even though you’re not on the phone call with them anymore. And in the meantime, now that you’ve walked away, they you’re still logged into your bank account and they can send money to themselves. Or maybe they’ll install malware on your computer or whatever it is that their their goal is. But the whole point is they’re going to steal from you and all of this under the guise that they’re going to save you money by reversing some charge that you didn’t authorize.
Kirk McElhearn 9:55
Okay, another email scam that’s become pretty common is the porn blackmail email. And basically these emails say, I’ve hacked your computer, and I’ve gotten your camera to record you doing things that you don’t want people to know about. And if you don’t give me some money, I will send this to all your contacts, your friends, your family, your employer, etc. And of course, they want money by Bitcoin because it’s anonymous, and they’re bogus. They’re all bogus. And now while technically, it’s possible for certain malware to access the camera on your computer, it’s extremely rare. And Apple’s really good about the way that they prevent apps from accessing the camera without giving them permission. But these emails are always bogus. No one has hacked all your devices with Pegasus, which is one of the more recent emails that we saw. And we’ll have a link to an article where we discuss this and we look at the email in detail and explain why it’s bogus.
Josh Long 10:46
Next up, we’ve got scareware. This is something that we’re seeing maybe a little bit less often than past couple of years, but has been a pretty prevalent thing in the past where, for example, a website that you visit, maybe you click on a link in a Google search result. And now you’re suddenly redirected to a page that pops up all kinds of warnings, claiming that your computer is infected with viruses, or something else that to scare you and try to get you to take some action. Sometimes they’re popups, or other kinds of messages or JavaScript alerts that will pop up on your on your computer. And by the way, these are things that don’t necessarily just show up on a Mac, you can also get these kinds of messages on an iPhone or iPad as well, or really any computer any computing device that can access the internet. But the whole idea is that it’s trying to trick you and again scare you so that you take action, and give your credit card number to supposedly clean something or whatever it might be that they’re trying to get out of you or get you to download some malware that is supposedly an antivirus that will clean your computer. So you do need to be careful about these things, even though they’re a little bit less common today than they were a couple of years ago.
Kirk McElhearn 11:56
What we used to see a few years ago was overt saying that you needed to update Flash Player unfortunately flashes did I’ll link to an article on the Intego Mac security blog talking about that, we’re gonna take a break and come back with some more scams that you need to watch out for online.
Voice Over 12:13
Protecting your online security and privacy has never been more important than it is today. Intego has been proudly protecting Mac users for over 25 years. And our latest Mac protection suite includes the tools you need to stay protected. Intego’s Mac Premium Bundle X9 includes Virus Barrier, the world’s best Mac anti-malware protection, Net Barrier, powerful inbound and outbound firewall security, Personal Backup to keep your important files safe from ransomware. And much more to help protect, secure and organize your Mac. Best of all, it’s compatible with macOS Sonoma, and the latest Apple Silicon Macs. Download the free trial of Mac Premium Bundle X9 from intego.com today. When you’re ready to buy, Intego Mac Podcast listeners can get a special discount by using the link in this episode’s show notes at podcast.intego.com. That’s podcast.intego.com and click on this episode to find the special discount link exclusively for Intego Mac Podcast listeners. Intego. World class protection and utility software for Mac users made by the Mac security experts.
Kirk McElhearn 13:28
So we just talked about scareware. And we mentioned that sometimes these come through poisonous Google searches and malicious Google ads are becoming a serious problem. Sometimes they’ll take you to a malicious site, which looks like a real site. Sometimes they’ll sometimes they’ll lead you to download malware. But malvertising, which is what this is called is becoming increasingly common. I don’t know that Google. Well, Google probably wants to stop this. But how can they stop it? It’s really difficult. I think what happens is a company will take out an ad, and it’s going to a specific website. And then after the ad goes alive, they’ll change that website to redirect to something else, right.
Josh Long 14:04
That’s one way that this can happen. Certainly, yeah. Remember, when you own a website, or you’re operating a website, you can change the code to that website at any time. So as soon as the ad gets approved, they can immediately go in and change the website so that it behaves differently than what it appeared to the Google reviewer. Right. So that’s where this problem lies. Now, one thing that Google could potentially do to help stop this would be to have some kind of a mechanism to where if the code changed on the site, that maybe Google could say, oh, that looks like it’s different from what we’ve analyzed. And we need to review it again, before we can allow this particular site to continue to be used for ads. That’s something that Google could do and could do in an automated fashion. But unfortunately, Google has not done anything like that yet.
Kirk McElhearn 14:56
So for users, what can we suggest just don’t click on On Google ads?
Josh Long 15:00
Well, the tricky thing here is that you need to be aware of how Google Ads work. So you will get an indicator that a result is sponsored. But you have to be looking for it. It’s not super obvious. They don’t make it a bright, you know, background to make it stand out or anything like that, because Google wants you to click on those ads, because that’s how they make money. And so they make it look just similar enough to regular Google search results that most people don’t even realize they’re clicking on an ad. And so that’s the whole thing is like, there’s kind of an incentive for Google to make it not look like an ad.
Kirk McElhearn 15:40
Yet ads used to look different a few years ago, very different.
Josh Long 15:43
And I’ll just quickly mention, this is not exclusive to Google, this can also happen on Bing or other search engines, too. It’s just that, you know, we’re mentioning Google, because most people use Google when they you know, you Google it, nobody really says, oh, make sure you bring that or DuckDuckGo it or whatever. It’s just you know, most people are using Google. And therefore most of the bad guys are probably buying Google ads. But you can potentially see these things on Bing and other search engines as well, because they also have ads.
Kirk McElhearn 16:13
Okay, here’s one that comes and go. It’s a Tech Support Scam, where you get a phone call, and it’s a noisy call center. In fact, it sounds like most call centers, right? The call quality is not very good. There’s a lot of people talking in the background, and you get someone who claims to be from windows where I’m calling from Microsoft, your Windows computer is infected. I think the best one that I got a couple of years ago was someone says, Hello, I am calling from Bitcoin support, as if there is such a thing as Bitcoin support. And what they’ll do is they’ll try and convince you that they’ve detected that there’s malware on your computer, and they can help you. If you download some software that they tell you to download, they can help you get rid of the malware. Now we saw just above when we were talking about the scareware. It’s the same kind of thing, except here, you’ve got someone on the phone, who’s using social engineering to convince you and for older people, and people don’t know a lot about computers, sure someone from Microsoft is going to call them up if they have a PC. Now, if you’re on a Mac, and it’s Microsoft calls, you know, it’s obviously bogus. But this sort of thing, if it works, and you’d be much more efficient, because you’ve got someone talking you through the process.
Josh Long 17:19
Right, you’ll notice there’s a lot of overlap between some of these types of scams and others. So this is also very similar to the fake invoice scams, which gives you a phone number, and then you call that number. So in other cases, like we’re talking about here, you’ll receive a phone call, or maybe you’ll receive a text message inviting you to call the claims that you’re infected or claims something or other to try to get you to call a call center. But one way or another, whether it’s an inbound call, or something where they’re encouraging you to make a call, it’s still a problem. Once they find out that you do have a Mac, they have a separate script that they’ll just go off of instead, they’ll be like, Oh, yes, no, that’s what I meant to say. And then they’ll pull out.
Kirk McElhearn 18:06
Okay, an increasingly common scam, and it’s only in the past couple of years, is scammers put fake profiles of well known celebrities on Facebook and Instagram. And then they contact users saying they want to chat with them. Now, I used I don’t use Instagram much I use Facebook a bit. And I manage a few Facebook groups. And every few times a month I see profiles come in that are like the name of the celebrity that the group is about wanting to join the group. And of course, I know to ban them immediately. And I’ve seen among I follow a lot of musicians on Facebook, and I’ve seen a number of them. I put a screenshot in the article here on the Intego Max security blog from Paul Weller, who says there are a number of scam accounts around at the moment, we’d like to remind you that Paul does not use any social media personally. So we’ll not message anyone directly. But this is becoming increasingly common, I can think of a half a dozen accounts that I follow that have mentioned this in the past six or eight months. There’s a really interesting story. And we link in our article, a woman who thought that Bob Dylan had fallen in love with her. And then he asked her for $5,000. So, you know, your favorite celebrity is not going to want to chat with you online on Facebook or Instagram or WhatsApp or anything else.
Josh Long 19:18
Good point. And they probably are not going to be asking you for money either that, that seems like a kind of a leap to go from, hey, I’m a celebrity. And by the way, I saw your profile. And I think you’re really cool. And oh, by the way, can you loan me some money? Like that seems really weird, but I guess there are enough people who might fall for something like that.
Kirk McElhearn 19:37
But think of the social engineering. It’s like I don’t control my account and I don’t easily have access to money. I mean, if you think about Britney Spears, right that she was in conservatorship or whatever. You could think that other celebrities that are accountants do this and I only get money at the end of the month and I want to buy you a gift or whatever. So eBay scams. Josh you don’t buy and sell things on eBay, do you?
Josh Long 19:59
I don’t frequently sell things. But I do occasionally buy things on eBay.
Kirk McElhearn 20:04
Okay, I sell stuff on eBay. And I’ve mentioned it before that, like, when I buy a new Mac, I sell the old one on eBay, I don’t put it in the closet, like some people I know. Sometimes I’ll trade things into Apple, but they don’t always pay enough. And it’s easier to sell on eBay. If you have something like an iPhone or an iPad or iMac on eBay, you’re likely to get a message relatively quickly from someone who says, Oh, I really want this now, even if you put it up for auction, right, I usually put things up for auction for seven days. And the person will say, I really want this now. And if you contact me offline, I can pay you cash, and you’ll save the fees and all of that. And here’s what happens if you do that. And they pay me the money, you send the item, they reverse the charge, or they claimed that it was broken, or they never got it. And since you didn’t make the sale through eBay, use eBay seller protection. So basically, you’re screwed. Anytime I list anything good, I can tell from the emails right away that want to do that, that it’s going to be a scam. It’s like, I need this for my daughter and University. And I can do as soon as possible. Nope, ain’t gonna happen. One other thing I’ll suggest I’ve sold some items like Macs and stuff like that. And I just want sold the camera was pretty expensive. I put it for collection only, so the person had to come to me to pick it up. That way, you know that the person has it, I even took a photo of him holding the camera to make sure not that I thought he was going to scam because I once I met him, I realized he was serious. But it’s the only way if you have something expensive that you can be sure that nothing’s gonna go wrong. If you do have something expensive, take a photo of it when it’s in the box before you send it, just to prove that it was in good condition before you sent it. It was actually someone from Apple who told me to do that when I called a couple years ago about trading in an iPad or an iPhone, said, Hey, I’m gonna give you a word of advice, take a picture of it before you send it in because they use third party companies to manage these trade ins. And the lady said, We’ve had problems with this company. And sometimes they claim it’s broken. So it’s a good idea to take photos. Don’t sell anything on eBay, that’s not going through eBay. And don’t buy anything on eBay, it’s not going through eBay, it’s the same thing. If you buy something that someone asked you to pay off eBay, then you don’t get Buyer Protection either.
Josh Long 22:17
Also, just another tip from the buyer perspective, you do need to be careful about listings that seem a little too good to be true. If someone is offering something for a much better price than every other listing for that same product on eBay, that’s something you might want to be a little suspicious about. Most of the time, when you see these things, also, they will have very little positive feedback, or maybe the most recent positive feedback they got was like years ago, meaning possibly that somebody has now hacked somebody’s account, maybe through these password reuse campaigns. And so now they’ve gotten a hold of some existing eBay account that has positive feedback. And they’re going to use that to try to scam other people. So be very careful about buying things on eBay as well, especially if it seems a little too good to be true.
Kirk McElhearn 23:06
Yeah, because when you’re selling something on eBay, you can search for the item and you can search for sold items and see what it’s sold for. So you know what you can get right when you’re selling something on eBay.
Josh Long 23:18
Also make sure that they have an actual photo of the item. That’s another thing that can help in distinguishing between something that’s a real listing and something where somebody stole somebody else’s photo, you can actually search by photo on Google image search. So you can try to identify whether that photo has been uploaded somewhere else before. And of course, if somebody’s just using a generic photo, then you have no such way to really prove that they actually have the item in hand.
Kirk McElhearn 23:46
Okay, online dating and romance scams. These are so prevalent that the US Federal Trade Commission has a page with advice about them about what to look for and what to avoid. It’s so easy to make a fake profile. Now, in researching this article, I found that most online dating apps now have you take a live selfie to prove that you are the same face in the photos that you’re putting in your profile. But even this probably could be defeated. Or someone gets into someone’s profile and changes the photos and does things so basically, people are looking for connections and they find what they think is a genuine connection. And it could be someone who’s trying to scam them like the Bob Dylan guy who scammed the woman out of 5000 That wasn’t even a dating or romance scam. At least it didn’t start like that. But you’ve got to be careful and all of the dating apps, they all have extensive information on what to do, what to look for, how to report profiles if you’re if you have any worries, etc. The last one we look at is an interesting one. It’s the grandchild friend scam now, years ago, I want to say 10 or 15 years ago, I remember a spate of emails in about a year from three different people saying that I’ve lost my passport and In my money, my wallet was stolen. I’m in the airport here. And this isn’t my email account, I’m using someone else’s. And I need money. All of these were people who had my name and their email contacts, but weren’t people I knew very well, who wouldn’t address me asking me for this sort of thing. But when this gets serious is when someone figures out that, okay, this person has grandparents, because grandparents are good, right? They’re not computer savvy, and they’re easy to fall. So we find the grandparents, we send them an email saying that I’m the grandson and I’m in trouble and I need money. Another version of this is that someone will get on the phone and say that they’re with the police and can’t talk and pass the phone to someone else, who then goes on to try and scam the victim. Now, using AI tools, voices can be faked very easily. So anyone who talks on the internet like you or me, Josh, right, we’re talking on the internet, you know, hundreds of hours every year, it’s easy to find these voices.
Josh Long 25:54
It’s not just emails, either these can also come in as Facebook Messenger messages as well. In fact, that’s probably one of the most common ways that these messages propagate, from what I’ve seen in my own observations is that, you know, people make connections with other people on Facebook, and then they can see who you’re connected with. And they can see that you have, you know, relatives, people with the same last name, or people that you’ve commented about in the past that you Oh, good job, you know, I’m so proud of your grandma, or whatever, that kind of thing. And the thing is, if people can see those kinds of messages that you’re posting, or see other kinds of data about you on Facebook, they can get a pretty good profile of you and your relationship to other people and then make this determination of Haha, I know how to scam them. Another really common impossibly related thing is that a lot of times people will create a fake profile that looks almost identical to somebody else that you’re already friends with. And they’ll send you this friend request. And you’ll be like, Oh, that’s weird. I thought I was already connected with that person. But you know the name and you know, the face. And so you just hit Accept, a lot of people would do that. And then you don’t realize that you’re already connected with that person. And what really happened is the new person is not just that person recreating their profile, or maybe accidentally, you got disconnected from them and you’re reconnecting what often is the case is that this new person that you’re connecting with, is actually a scammer. And you’re giving them by making them your friend on Facebook, you’re giving them access to see more parts of your profile, they might be able to see your phone number if you’ve shared it, and all kinds of other things like that. And they can use that information for one of these grandchild slash friend overseas in need type scams. So be very, very careful about that as well.
Kirk McElhearn 27:51
One more variant I want to mention, I got an email two weeks ago from a musician I’d been in touch with. And it said, Hi, let me know if you get this the subject line was checking in. I immediately knew this was a scam, right? Someone had hacked his email account. So I emailed the person who runs the record label. He’s on who I know. And I said, Look, this person’s email account was hacked. This is what I got. And he said, Yeah, I got the same email, I’ll talk to him. So if you see that kind of thing, this is someone I was in touch with six years ago, and they’ve never been in touch with since so if you see that sort of thing, I mean, someone’s gotten into their account and has sent this kind of email to every contact in the account. Many of them are going to reply, oh, hi, we haven’t talked in years, etc. Anyway, article on the Intego Max security blog. This is the 10 most common online scams and there are a lot more but now that you have this knowledge about the scams and what to look for, you’ll be able to detect other scams that sort of combined the some of the methods that we’ve talked about here. Until next week, Josh, stay secure.
Josh Long 28:48
All right, stay secure.
Voice Over 28:51
Thanks for listening to the Intego Mac Podcast, the voice of Mac security with your hosts, Kirk McElhearn and Josh Long. To get every weekly episode, be sure to follow us on Apple Podcasts, or subscribe in your favorite podcast app. And, if you can, leave a rating, a like or review. Links to topics and information mentioned in the podcast can be found in the show notes for the episode at podcast.intego.com. The Intego website is also where to find details on the full line of Intego security and utility software: intego.com.
