New phishing scam targets iPhone users
There is a new phishing expedition afoot, with scammers ready to reel in any Apple iPhone owner who takes the bait.
Phishing, as you may know, is a phunny way to spell phraud.
A combination of "phony" and "fishing," the term refers to an attempt to make a webpage or telephone number appear to be that of a company — in this case, Apple — when it isn't. (Actually, replacing the "f" with "ph" to make "phishing" is a tip-of-the-hat to the hackers of the 1970s who were known as "phone phreaks" — designers of the blue boxes that emitted dialing tones to fool the telephone system into making free long-distance and international calls.)
Sean Gallagher, a reporter for Ars Technica (www.arstechnica.com), first wrote about this scam, which begins as what appears to be an email from Apple. It advises the potential chump to go to what appears to be an Apple website. There, the bait is dangled in the form of a warning: The account is "locked due to detected illegal activity."
About that time, a dialog box pops up with a phone number to call — which looks like any other dialog box that offers to call a phone number when the user taps on a phone number when it is displayed.
There's one small difference: This box pops up without any action on the user. Not surprisingly, the number it will dial is in no way connected with Apple. It actually ends up somewhere in India.
"Scammers are following the money," Gallagher wrote. "As more people use mobile devices as their primary or sole way of connecting to the Internet, phishing attacks and other scams have increasingly targeted mobile users. And since so much of people's lives are tied to mobile devices, they're particularly attractive targets for scammers and fraudsters."
If the number is called, the scammers on the other end likely will make an attempt to get the user to sign up for a security service, at which point credit-card numbers or other financial information may come into play. Gallagher wrote that he couldn't be sure of the exact flimflam that was being run: "I attempted to bluff my way through a call to the 'support' number to collect intelligence on the scam. The person answering the call, who identified himself as 'Lance Roger from Apple Care,' became suspicious of me and hung up before I could get too far into the script."
A few tips to help prevent getting caught:
• Don't click on links or phone numbers in email if there is the slightest doubt of the email's origin. Type in the website; look up the company's phone number in question and dial it.
• Emails originating from companies with which you have a relationship will usually start with your name as a greeting, instead of "Dear Customer." The email may be legit, but the universal greeting raises a red flag.
• The devil is in the details. Look for the small things: bad spelling; poor grammar and punctuation. This scam is a bit more polished than most. Still, there are small clues.
• Know what type of website you're on. Secure websites have the URL designation of "https:" Sensitive information should be entered only on such pages. Regular websites use the "http:" address.
• Make use of firewalls and antivirus software. It's easy to find free ones using Google or other search engines.
Gallagher reported his findings to Apple's security team. But, as he noted in a previous column about phishing: "Taking down a scam like this is akin to a game of Whack-A-Mole."
One mole whacked. Perhaps.
Quick with the mallet! There are a dozen more.
Contact Lonnie Brown at ledgerdatabase@ aol.com.