Facebook Scam

[JiveTurkey]

I just nearly got scammed to death on Facebook. I'm still having palpitations.

One of my friends popped up in a chat window, telling me he was mugged last night at gunpoint. I was horrified. He said the assailant took all his money and credit cards. And that he needed me to wire him some money. Thankfully, my mother was standing next to me, advising to call his s.o. and confirm that it was really him. Turns out, someone hacked his account. I almost sent nearly every dime I had to some lying punk. I totally would have done it.

So, I deleted my FB account.

Just be careful.

[KatherineA]

I just nearly got scammed to death on Facebook. I'm still having palpitations.

One of my friends popped up in a chat window, telling me he was mugged last night at gunpoint. I was horrified. He said the assailant took all his money and credit cards. And that he needed me to wire him some money. Thankfully, my mother was standing next to me, advising to call his s.o. and confirm that it was really him. Turns out, someone hacked his account. I almost sent nearly every dime I had to some lying punk. I totally would have done it.

So, I deleted my FB account.

Just be careful.

I've heard of that scam - totally creeps me out because I would likely fall for it, particularly depending on the friend or relative whose account is hacked.

[lar]

The other day my daughter's teacher's account got hacked by someone and they sent out a prescription advertisment to everyone is her address book. I was wondering why a teacher was sending me something about Viagra, etc. I just responded interesting. Then she texted back what happened.

[caroline]

The other day my daughter's teacher's account got hacked by someone and they sent out a prescription advertisment to everyone is her address book. I was wondering why a teacher was sending me something about Viagra, etc. I just responded interesting. Then she texted back what happened.

This happened to my yahoo email account and everyone in my address book got sent a viagra sales add from canada too!

[Nanuk]

I just nearly got scammed to death on Facebook. I'm still having palpitations.

One of my friends popped up in a chat window, telling me he was mugged last night at gunpoint. I was horrified. He said the assailant took all his money and credit cards. And that he needed me to wire him some money.


My friends know to call in person when asking for favors like that. I'd never respond to an e-mail or IM about such things with anything other than: "call me."

Of course most of my friends are the sort that if they were mugged at gunpoint, there'd be a story in the next day's news about a dead mugger.

[Tony]

I think deleting your FB account is an overreaction. If it happens next that you get texted, are you going to destroy your phone? If they show up at your house will you sell and move?

I'd be kind of ashamed to admit I believed a story like that even for a second. I mean, if you were mugged (happens all the time) and your money and credit cards were stolen, would you message someone and ask them to wire you money? What sense would that make? If you didn't have enough ID to make a withdrawal at the bank, you wouldn't have enough to pick up a money transfer.

[LFE]

And yet another hazard of public social networks... warn people about them all the time.
- Glad you hear your mom was there to tell you to stop!

[JiveTurkey]

I think deleting your FB account is an overreaction. If it happens next that you get texted, are you going to destroy your phone? If they show up at your house will you sell and move?

I'd be kind of ashamed to admit I believed a story like that even for a second. I mean, if you were mugged (happens all the time) and your money and credit cards were stolen, would you message someone and ask them to wire you money? What sense would that make? If you didn't have enough ID to make a withdrawal at the bank, you wouldn't have enough to pick up a money transfer.

First of all, if somebody like that showed up at my door, they would be looking down a barrel. I deleted my FB account, because obviously his was hacked, and I didn't want to take any chances with mine. NO, I wouldn't destroy my phone. There you go being yourself, again.

I am not ashamed to admit I believed it for a second. I am not a cynical old fart and I do not intend to become one.

[LFE]

http://www.youtube.com/watch?v=QMpcgW3ah4A&feature=related

[JiveTurkey]

http://www.youtube.com/watch?v=QMpcgW3ah4A&feature=related
I love it when you do that. :)

[JiveTurkey]

Besides, if RC tells me it's okay to restore my account, I will. But not until I talk to him about it.

[Tony]

In fact, scams like this are often under-reported because the victims are ashamed to admit to being taken in. This one was relatively innocent (being so crude), but every day another local senior citizen is scammed out of thousands of dollars, even their entire life savings. Not online, but in person. You certainly did the right thing by reminding us about these scumbags.

http://www.fbi.gov/cyberinvest/escams.htm

[d56r]

Since Facebook changed their "privacy" rules, more of this will happen. You have LESS privacy than before. I had deactivated FB since then and have not had a need to waste my time on that site.

[Starbuck]

JiveTurkey, come back to FB! :D

I always leave chat offline, which cuts down on this type of thing.

And for everyone, just some unsolicited friendly infosec advice -- Change passwords, don't use the same password for email/fb/s&b/etc, and don't use words or slang found in any dictionary (including Klingon!).

I have a good friend who sent me an email about a great deal on HPs the other day, so I texted her asking her what was going on with her email account. As she hasn't been on in weeks, I advised her to change her password.

[d56r]

A report came out today from the FBI saying that internet crime in 2009 was up 20%. Make sure your computer is well protected to prevent someone from being able to hack into it. Plus as Starbuck suggests:

Change passwords, don't use the same password for email/fb/s&b/etc

[JiveTurkey]

Will changing your password really do much to protect you against hackers?

[LazerFlash]

Scams like this take advantage of the good nature of 99.999% of the human race. They prey upon people's compassion and the fact that even though many of us know scams like them exist, we (1) don't believe that we will fall for them and (2) in the heat of the moment, we really and truly want to help our friends and family in their time of need. Consider that con men have been around for as long as there have been "Haves" and "Have nots". The scam may change with time and technology, but the psychology behind them rarely does.

As several have pointed out, there are less drastic methods than throwing your phone away. Had we all done that, we wouldn't have phones today... Many of you are probably old enough to remember some of the long distance scams of the 1980's and early 90's. Even deleting FB or other accounts isn't really necessary. Simply using just good password security will keep your accounts safe. (Anyone interested in REALLY good password ideas can PM me.)

Using your head if this kind of thing happens to you is the BEST way to keep from being a victim... Like Tony said, what are the odds of someone losing their money and their phone and still being able to chat you up on FB? It takes just a second or two to pick up the phone and call the person supposedly in trouble. Also, thank you, JT, for reminding us that any of us could get hit. Although we've wasted more time on this thread than we probably would like, it's a good waste of time, IMO.

[LazerFlash]

Will changing your password really do much to protect you against hackers?Depends... If you use good password security, yes. If you use things easily guessed from your profile, no.

Those hackers who have devised software tools to assist them in cracking Facebook, MySpace, etc. rely on the information you yourself post online. If you take that away from them, it makes their job that much more difficult. OTOH, with the right hacking tools, no password is truly 100% secure. But, if you make it difficult, they'll move one.

[Tony]

I know the last time my Yahoo account was hacked the first thing they did was change the password, so I was locked out and couldn't change it!

[d56r]

If you have more than one email account or a cell phone, you can go into your account settings and set up your other email address as an alternate email for password reset. If not, then I think you can set up a mobile number to send it to you as a text message. That way you can get the new temporary password, go in and change it to something else (unless they have gone into your account and changes the alternate methods!).

[LazerFlash]

Depends... If you use good password security, yes. If you use things easily guessed from your profile, no. Those hackers who have devised software tools to assist them in cracking Facebook, MySpace, etc. rely on the information you yourself post online. If you take that away from them, it makes their job that much more difficult. OTOH, with the right hacking tools, no password is truly 100% secure. But, if you make it difficult, they'll move one. Back in the day, when I worked for a major health insurance company in DC, I used to bet people lunch that I could walk into their cubicle - or a cubicle of a co-worker - and within a relatively short period of time, log in as them (or their mark). You know what, I was treated to FAR more lunches than I ever paid out. :) Even when you factor out the idiots who used the word 'password' or taped their passwords to their monitor (or on the pull-out writing slider next to their desk), a few quick looks around a cubicle was often more than enough... If you make it easy, you're a great target. If you make it hard, you're a poor target.

At a minimum, I would highly recommend using passwords that are no less than 10 characters long (the longer the password, the more a 'hashing' application has to work), are a mix of numbers and letters (mixing upper & lower case), and includes one or more of the non-alpha/non-numeric characters.

[LFE]

Besides, if RC tells me it's okay to restore my account, I will. But not until I talk to him about it.

Naaaaa, they only prey of people that freshly deleted there accounts! OK.... never mind. Kidding.
Darn, meant to quote the password update...

[JiveTurkey]

Naaaaa, they only prey of people that freshly deleted there accounts! OK.... never mind. Kidding.
Darn, meant to quote the password update...

The least you could do is post another Dead video.

[Kensey]

Will changing your password really do much to protect you against hackers?

It depends. If they're trying to guess your password, it will. If they have your computer infected with a keylogger or they're actually hacking Facebook, not so much, but those are much less likely. People say "my account got hacked" a lot when what they mean is "I got fooled into giving my login and password to a phishing site" or "I used a password that was easy to guess".

When I was at UVa, they taught us a pretty good method for creating strong, easy-to-remember passwords:

* Take two words that are easy for you to remember, but not any of the obvious no-nos like birth month, wife's name, etc. For example, if I were Paul Ashbaugh, I might use "fascists" and "parquet".
* Remove all the consonants, or all the vowels, or every third letter, or any subtraction (or addition) that's easy for you to remember. Now I might have "fscsts" and "aue".
* Stick the words together with some punctuation, capitalize one or more letters, add a number, etc. So Ashbaugh's hypothetical password might end up as "5fscstS#aue&".

That's a pretty strong password -- it's just about impossible to guess and it's resistant to most dictionary attacks, so even if a site really is hacked, it still may not be discovered by the attacker.

As a general idea of what constitutes a "good" password, the current required minimum length for federal government computer accounts is 12 characters. Many government agencies also enforce complexity requirements, such as requiring 2 ore 3 out of the following 4 types of characters: uppercase letters, lowercase letters, numbers, and other characters.

[JiveTurkey]

Kensey rocks.

[LazerFlash]

* Stick the words together with some punctuation, capitalize one or more letters, add a number, etc. So Ashbaugh's hypothetical password might end up as "5fscstS#aue&".My only real problem with passwords like that is that while strong, they are all but impossible for the average user to keep mental track of.

Another approach for most of us NG types is to pick two words - one being a name (person, place, animal, etc.) and an unrelated word. (I have a tendency to use things from the current novel I'm reading, which adds another level to the guessing.) Pick a number at random and prefix the first word with it. Then, connect the two words with a non-alpha/non-numeric character (any of these: # @ _ * = + < > | ). Then, randomly convert one or two lower case characters to upper case and/or exchange letters with similar numbers/characters ("1" for "l" or "i", "@" for "a" "$" for "s", etc.) If wanted, you could lastly suffix the whole thing with another number chosen at random.

For example, a password that *I* might choose today could be 7dW@yne*de$sert Some what easier to remember and just as secure against guessing, profile spoofing and dictionary attacks.

Oh, one other thing that I've done: If you want an invisible password: Use any of the truly 'special' ASCII characters from 235-255; they don't usually display anything but a blank space or a dot.

[JiveTurkey]

If I may hijack my own thread...
I posted this here, because some of us are friends with this person on FB. Not for soliliqui.

[LFE]

You should have posted with "friend of the devil" :-)


If I may hijack my own thread...
I posted this here, because some of us are friends with this person on FB. Not for soliliqui.

[JiveTurkey]

Ok, you. Let's see if you are paying attention. ;)


http://www.youtube.com/watch?v=Gu0Q7lLYssQ

[LazerFlash]

I posted this here, because some of us are friends with this person on FB. Not for soliliqui.Huh?......:scratchchin:

[JiveTurkey]

I have done worse than make up my own words.

[LFE]

Ok, you. Let's see if you are paying attention. ;)

http://www.youtube.com/watch?v=Gu0Q7lLYssQ

Is it just me or is Bobby starting to look like Jerry...

[KatherineA]

My only real problem with passwords like that is that while strong, they are all but impossible for the average user to keep mental track of.




Yes, and when you must change them to a new complicated password every few months it gets really hard to remember. Then when you also need 2 more complicated passwords and a randomly generated key number code to get into your work computer it really stinks. But hey - it's secure.

[Tony]

Nobody can remember good passwords, that's what password managers are for - you only need to remember a single password (and it may not need to be complicated). I use and recommend Roboform (http://www.roboform.com/). But there are several other good ones like Lastpass (https://lastpass.com/) and Keepass (http://keepass.info/).

[Wormdoc]

I hadn't heard of those programs before....I went to the Roboform link and it's on sale until 15 or 17 March for 29.95. Seems like a good idea.

[Tony]

In fact, I just recently took advantage of the sale to buy a second license for my laptop for $10. I also have a third license for Roboform Portable that I keep on a flash drive in my pocket. But I dunno; they're introducing Roboform Online which confuses me as it seems it may be free.

[Nanuk]

Yes, and when you must change them to a new complicated password every few months it gets really hard to remember. Then when you also need 2 more complicated passwords and a randomly generated key number code to get into your work computer it really stinks. But hey - it's secure.

Nah, the most fun is when you have to plug your accountable ID card into a slot on the computer AND punch in a six-digit code just to get the computer to turn on, and then you have to use the twelve-character code with upper and lower case, letters, numbers and special symbols that changes every three months.

It's getting ridiculous. Waiting for the optical scanner or the new device that takes a DNA sample from you before allowing the computer to boot up.

[LazerFlash]

Waiting for the optical scanner or the new device that takes a DNA sample from you before allowing the computer to boot up.Biometrics... hottest thing in security right now, and not just for computers. I was talking with a vendor at a home/builders show recently. He had a brochure on a residential deadbolt 'system' that combined a fingerprint scanner with a retina scanner, all for around $1500.

[Kensey]

It's getting ridiculous. Waiting for the optical scanner or the new device that takes a DNA sample from you before allowing the computer to boot up.

There are already federal programs that require their users' laptops to be purchased with built-in fingerprint readers.

[Kensey]

My only real problem with passwords like that is that while strong, they are all but impossible for the average user to keep mental track of.

That's why you start off with words that are easy for you to remember. The rest is easy to remember if you pick the right words to begin with.

[LFE]

Using 0's for a's and o's, and 1's for i's and L's along with the number 4 can also be helpful...

t1me4spr1ng comes to mind if your L00k1ng41n0w :-)


That's why you start off with words that are easy for you to remember. The rest is easy to remember if you pick the right words to begin with.

[LazerFlash]

Using 0's for a's and o's, and 1's for i's and L's along with the number 4 can also be helpful...
t1me4spr1ng comes to mind if your L00k1ng41n0w :-)Although not as secure as some of the methods discussed already, I've recommended to several of those who are big texters that they can use 'text slang' instead of real words. If used properly, it deters dictionary attacks and casual guessing. And for those who text a LOT, they're just as fluent in it as they are in English (maybe more).

[Chutney Daftcraft]

I think deleting your FB account is an overreaction. If it happens next that you get texted, are you going to destroy your phone? If they show up at your house will you sell and move?

:rotfl: :rotfl:

[Chutney Daftcraft]

Will changing your password really do much to protect you against hackers?

It all depends. If you use the same password on facebook that you use for other sites, it makes hacking your account much easier. Not too long ago, someone hacked a Christian Group site. They couldn't do much with the info, but what they did do was cross-reference the info, and linked to the Christian Site's member's facebook pages, which many had the same facebook password... Long story short, the hacker(s) popped onto people's individual facebook pages, and the madness began...

http://img198.imageshack.us/i/yeul3.jpg/

http://media.ebaumsworld.com/mediaFiles/picture/366483/80733469.jpg

http://media.ebaumsworld.com/mediaFiles/picture/437517/80867992.jpg

[JiveTurkey]

:rotfl: :rotfl:
Um, yeah. Hardy har har. If you would have received a chat msg from me that day asking you to do something for me--that I was in trouble--oh, nevermind.

[Chutney Daftcraft]

That was funny primarily because it came from Tony...

[derricksonb]

Given the climate of the world today wouldn't we all assume that situations like this are a scam? Most of the people I know who would ask me for help aren't going to hit me up on FACEBOOK Chat, but are going to call me or know where I live.

Is this another version of the Nigerian scam? Probably but if my friend did ask me to route them money to their account instead of showing up at my house I would at least verify the routing number of the bank to which the money was being wired.

www.routingnumber (http://www.%3Cb%3Eroutingnumber%3C/b%3E)s.org/

Bob: I am in troubles and am needing you to be sending me $1,000.00 US.
Me: You need me to wire $1,000.00? OK, to which routing number do I wire the money?
Bob: You are to be wiring the monies to 112233221 00011223344332211.
Me: [after looking up the routing number] Bob, why are you using the Bank of Nigeria? You're ATM charges must be off the charts. BTW- why are you typing like an autistic Jihadist?

[JiveTurkey]

Given the climate of the world today wouldn't we all assume that situations like this are a scam? Most of the people I know who would ask me for help aren't going to hit me up on FACEBOOK Chat, but are going to call me or know where I live.

Yes, you are one of many people that has posted that. However, in this particular situation, it didn't strike me as odd.

Once I was finally on to him, I did mention that I had a Western Union account in my um...bunghole. If all you guys are looking for is a laugh, there you go.

[Zig]

I did mention that I had a Western Union account in my um...bunghole. If all you guys are looking for is a laugh, there you go. Just warn me before you make a deposit!

[derricksonb]

Yes, you are one of many people that has posted that. However, in this particular situation, it didn't strike me as odd.

I understand and I was merely adding my $.02. Speaking of $.02 can you wire...... :D


Once I was finally on to him, I did mention that I had a Western Union account in my um...bunghole. If all you guys are looking for is a laugh, there you go.

I have so many banking related double entendres bouncing around in my brain right now that I may explode, but for the sake of my sanity I will take the high road.

[longleaf]

http://img198.imageshack.us/i/yeul3.jpg/



http://media.ebaumsworld.com/mediaFiles/picture/366483/80733469.jpg

http://media.ebaumsworld.com/mediaFiles/picture/437517/80867992.jpgThese made me LOL!!

[Tony]

Interesting article from the LA Times this morning. http://www.washingtonpost.com/wp-dyn/content/article/2010/03/14/AR2010031403246.html

We haven't even touched on what's quickly becoming the biggest online scam: online purchases.


Consumers can take precautions to avoid being victimized, Pavelites said. They should install up-to-date computer firewalls, use only reputable payment centers to make purchases online, and not respond to unsolicited e-mails or pop-up adsI'm not sure why this guy mentions firewalls in 2010, as they have been included and turned on in every computer for about the last 10-15 years.

[kemeigen]

speaking of biometrics... our time clocks at work are biometric and passworded. no cheating on your time here.