The 7.0 earthquake Tuesday (Jan. 12) in Haiti caused massive destruction with widespread loss of life and property.

“Unfortunately, these events also bring out the con artists and scammers who are more interested in making money for themselves rather than contributing to the rescue and restoration efforts,” said Eugene H. Spafford, professor and executive director of CERIAS (Center for Education and Research in Information Assurance and Security) at Purdue University.

Researchers at CERIAS know that criminals will take advantage of the most tragic of circumstances and exploit the sense of urgency people have to “do something” in order to overcome their normal caution.

“Our past research showed that the same people who normally commit fraud with get-rich-quick e-mails adjust their scams – within a matter of hours – to act as victims of these tragedies,” said Howard Sypher, a professor with CERIAS and head of the Department of Communication. “Web sites are undoubtedly already constructed to impersonate major charities and thus trick the unwary.”

Spafford cautions that fraudulent calls for aid could come in many forms.

“Be alert for fraudulent but sincere-sounding appeals for aid from Haitian victims, from what appear to be charities, or from government or U.N. officials,” he advises. “These solicitations may be sent as e-mail to you or a group to which you belong, as postings or messages on a social newsgroup such as Facebook or Twitter, as a phone call from someone soliciting donations, or as a Web site to which you are directed or that pops up when visiting a site.”

Both professors emphasized that, based on their past experiences, some of these fraudulent appeals will sound convincing, and the associated Web pages will appear official and legitimate.

Here are some tips from the experts at CERIAS on how to avoid being scammed, now and at other times:

• Do not enter any information at a Web page that pops up unexpectedly when you visit some other site.
• Never click on a Web site address (URL) in e-mail sent to you; it may look official, but most will be pointers to fraud or attack sites.
• Don’t assume that every Web address returned by a search engine, such as Google or Bing, is a legitimate organization.
• Do not respond to e-mail requesting donations or making a special offer (such as asking you to hold their assets while Haiti rebuilds).
• Do not reveal any personal or financial information during a phone call you did not dial yourself.
• If a friend forwards a URL, phone number or e-mail, don’t trust it until you check its validity. Your friend may have been scammed first.

Find Legitimate Charities

Check the Web sites of charities to which you already contribute or already know are legitimate for information on what kind of donations are being accepted and how to go about contributing. The United Way of Metropolitan Chicago has a blog post with information on how to donate to their Worldwide Disaster Relief fund which will benefit the rescue and recovery efforts in Haiti.

If you do not already have a relationship with a charitable organization, you can check CNN’s list of real charities: http://www.cnn.com/2010/LIVING/01/13/haiti.earthquake.how.to.help/index.html

“Use your phone book to find the information of a nearby chapter of the American Red Cross or the Salvation Army,” Spafford said. “Call or visit them and ask how you can contribute to Haitian disaster relief. Even small donations help and will be gratefully received – by real charities, not crooks.”

In Related News:

• Boilermakers, Purdue Athletics to raise funds for Haiti
• Purdue student groups raise more than $3,400 for Haiti
• Purdue student groups continue raising money for Haiti
• Downtown Lafayette restaurants work together for Haiti benefit
• Purdue students raise $1k+ for Haiti in first night of fundraising

News via Lafayette Indiana Online

Scammers see Haitian earthquake as opportunity to profit

In May and June alone, taxpayers reported almost 700 separate phishing incidents to the IRS. In 2008 so far, taxpayers have reported about 1,600 phishing incidents to the IRS.

“Taxpayers should take steps to keep their personal information out of the hands of identity thieves,” said IRS Commissioner Doug Shulman. “That includes not falling for any of the phony e-mails or faxes now in circulation pretending to come from the IRS.”

The most common scams involve tax refunds and, this year, economic stimulus payments.

Although most of these scams consist of e-mails requesting detailed personal information, the IRS generally does not send e-mails to taxpayers, does not discuss tax account matters with taxpayers in e-mails, and does not request security-related personal information, such as PIN numbers, from taxpayers.

Refund e-Mail Scam

There are several variations of the refund scam, in which an e-mail claiming to come from the IRS falsely informs the recipient that he or she is eligible for a tax refund for a specific amount. The bogus e-mail instructs the recipient to click on a link to access a refund claim form. The form requests personal information that the scammers can use to access the e-mail recipient’s bank or credit card account.

This notification is phony. The IRS does not send unsolicited e-mail about tax account matters to taxpayers.

Filing a tax return is the only way to apply for a tax refund; there is no separate application form. Taxpayers who wish to find out if they are due a refund from their last annual tax return filing may use the “Where’s My Refund?” interactive application on the IRS Web site at IRS.gov, the only official IRS Web site.

Economic Stimulus Payments Scam

In this scam, a taxpayer receives an e-mail pretending to come from the IRS which tells the recipient he or she is eligible for an economic stimulus payment. The message recommends direct deposit into the taxpayer’s checking or savings account. To receive the payment, recipients must click on a link to complete and submit an online form by a certain date; otherwise, the e-mail warns, payment may be delayed. The form requests personal and financial data, including checking or savings account numbers that the scammers can use to gain access to the accounts.

In reality, the way members of the public receive their economic stimulus payment is to file a tax return with the IRS, not a special form. Additionally, the IRS does not request personal or financial information via e-mail.

Information on how to obtain an economic stimulus payment may be found in the Economic Stimulus Payment Information Center on the IRS Web site (www.irs.gov). For more information on stimulus-related scams, see IR-2008-11.

Substitute Form 1040 Fax Scam

This scam consists of a cover letter and form that are faxed, rather than e-mailed. The cover letter is addressed “Dear Valued Tax Payer (sic)” and appears to be signed by an IRS employee. The letter says that the IRS is updating its files and that recipients who supply the requested information will receive a nominal tax refund. It also states that those who fail to immediately return the completed form risk additional tax and withholding. The attached form is labeled a substitute Form 1040 and is titled “Certificate of Current Status of Beneficial Owner For United States Tax Recertification & Withholding.” It requests a large amount of detailed personal and financial information, such as mother’s maiden name (often used in security screening), bank account numbers, estimated assets and more. It asks the recipient to sign and fax back the completed form, as well as a copy of the recipient’s driver’s license and passport.

The letter, signature and form are all fraudulent. Moreover, the IRS does not send unsolicited faxes to taxpayers and does not request such detailed personal and financial information.

This is a variant of earlier scams. For more information, see news releases IR-2004-104 and IR-2004-75.

Company Report Scam

This e-mail appears to come from an IRS.gov e-mail address, addresses recipients by name and references the company the recipient works for. These personalized details may convince the recipient that the e-mail is legitimate. The e-mail says that the IRS has a report on the company and asks the recipient to review a copy by clicking on a link to download the report. However, when the link is clicked, malware is downloaded to the recipient’s computer.

There are various types of malware, which can hijack a victim’s computer hard drive to give someone remote access to the computer, search for passwords and other information and send them to the scammer, or cause other types of identity theft or damage.

The IRS does not compile reports on companies or send e-mails to company staff asking them to review a report. Generally, the IRS does not send unsolicited e-mails to taxpayers.

Tax Court Scam

In this scam, an e-mail that appears to come from the U.S. Tax Court contains a petition involving a court case between the IRS and the recipient. The document instructs the recipient to download other files. The downloads transfer malware, or malicious code, to the recipient’s computer.

There are various types of malware, which, for example, can hijack a victim’s computer hard drive to give someone remote access to the computer, or can search for passwords and other information and send them to the scammer.

The truth is that the Tax Court is not e-mailing notices to anyone who currently has a case before the court. Visit the court’s Web site at http://www.ustaxcourt.gov/ for more information. Recipients are advised to avoid clicking on any links in the e-mail and to delete the e-mail.

How Scams Work

To lure their victims, phishing scams use the name of a known institution, such as the IRS, to either offer a reward for taking a simple action, such as providing information, or threaten or imply an unpleasant consequence, such as losing a refund, for failing to take the requested action.

The goal of the scams is to trick people into revealing personal and financial information, such as Social Security, bank account or credit card numbers, which the scammers can use to commit identity theft.

Typically, identity thieves use a victim’s personal and financial data to empty the victim’s financial accounts, run up charges on the victim’s existing credit cards, apply for new loans, credit cards, services or benefits in the victim’s name, file fraudulent tax returns or even commit crimes. Most of these fraudulent activities can be committed electronically from a remote location, including overseas. Committing these activities in cyberspace allows scammers to act quickly and cover their tracks before the victim becomes aware of the theft.

People whose identities have been stolen can spend months or years — and their hard-earned money — cleaning up the mess thieves have made of their reputations and credit records. In the meantime, victims may lose job opportunities or may be refused loans, education, housing or cars.

What to Do

Anyone wishing to access the IRS Web site should type www.irs.gov into their Internet address window, rather than clicking on a link in an e-mail or opening an attachment, either of which may download malicious code or send the recipient to a phony Web site.

Those who have received a questionable e-mail claiming to come from the IRS may forward it to the following address: phishing@irs.gov. Use the instructions contained in an article on IRS.gov titled “How to Protect Yourself from Suspicious E-Mails or Phishing Schemes.” Following the instructions will help the IRS track the suspicious e-mail to its origins and shut down the scam. Find the article by visiting IRS.gov and entering the words “suspicious e-mails” into the search box in the upper right corner of the front page.

Those who have received a questionable telephone call that claims to come from the IRS may also use the phishing@irs.gov mailbox to notify the IRS.

The IRS has issued previous warnings on scams that use the IRS name to lend the scam legitimacy. More information on identity theft, phishing and telephone scams using the IRS name, logo or spoofed (copied) Web site is available on the IRS Web site at IRS.gov. Enter the terms “phishing,” “identity theft” or “e-mail scams” into the search box in the upper right corner of the front page.

In Related News:

• Economic stimulus payments on the way; direct deposit payments begin today
• IRS offers help to financially distressed taxpayers
• IN Dept of Revenue reminds Hoosiers about tax changes, recommends I-file
• COBRA subsidy eligibility period extended thru Feb; 15-month subsidy available
• IRS Free File now available to almost all taxpayers

News via Lafayette Indiana Online

Scammers use email, fax to pose as IRS

The e-mails appear to come from various Purdue administrative departments or units and ask users to confirm their e-mail address by responding with their password information. Additional variants of the scam e-mails ask users to navigate to a specific URL and then enter their Purdue user name and passwords. Many of these e-mails use Purdue terminology and appear highly authentic.

“In most variations, the e-mails state that if the user does not respond or take some required action, their e-mail account will be deactivated from the database,” said Scott Ksander, executive director of IT networks and security. “Users should immediately delete the e-mail and not take the action requested.”

These are targeted e-mail scams and phishing e-mails that attempt to fraudulently acquire sensitive information by masquerading as an authoritative entity such as the Purdue Webmail Team, Ksander said. He reminds campus computing users that IT units at Purdue should never ask users to divulge their passwords to university IT resources.

Ksander recommends those who have already responded to the e-mail immediately reset their passwords. Users can go to the password reset page located at http://www.purdue.edu/securepurdue. Click on the “Change Your Password” link.

In Related News:

• Scammers see Haitian earthquake as opportunity to profit
• Purdue police investigating computer thefts
• Purdue highlights cloud computing tools at supercomputing conference
• Purdue partnership for putting idle computers to work on research wins international award
• Purdue creates first virtual clean room for training pharmacists

News via Lafayette Indiana Online

Purdue community warned of e-mail scam