Android malware relays near field communication (NFC) traffic to steal cash

Attackers are using a novel attack scenario. They clone NFC data from physical payment cards and then emulate the cloned cards to withdraw money from victims' accounts through ATMs.

To protect yourself from this type of attack:

• Check the website’s URL to make sure the website isn’t a fake version of a genuine one.
• Only download apps from the Google Play and Apples stores.
• Keep payment card PIN codes secret. 
• Use security apps on mobile devices that can stop unwanted software and malware from being downloaded and installed. 
• Turn off the NFC function on devices when it’s not needed.
• Use RFID-protected wallets. 
• Use digital versions of physical cards on smartphones. 

Want to learn more?

How to delete everything from your Google searches

Want to learn more?

Mistakes to avoid if you just have to use public WiFi

Public WiFi hotspots are inherently risky, even if they appear secure. So much so, even security professionals can be tricked into using a scam hotspot which often mimic legitimate networks. To stay safe: avoid WiFi networks that ask for payment information; check for a lock symbol next to the hotspot name indicating a password is needed to connect, and look for a terms and conditions page before you connect. Additionally, users should be wary of misspellings in URLs and hotspot names, which could indicate a fake site designed to steal data.

For those who must use public WiFi, especially while travelling, use a secure VPN service to protect your data from potential threats.

Want to learn more?

7 password rules to live by in 2024, according to security experts

• having passwords that are 12 characters or longer that don't contain dictionary words but do contain a random mix of uppercase and lowercase letters as well as numbers and special characters.
• using a password manager.
• never reusing passwords.
• avoiding password hints.
• changing default passwords.
• using MFA.
• only changing passwords when you have to.

Want to learn more?

Hello, is it me you’re looking for? How scammers get your phone number

Scammers obtain phone numbers through data brokers, public sources, stolen accounts, autodialers and physical mail. Data brokers collect personal information from publicly available sources, commercial partners and online activities, then sell this information. Public sources like social media or online job markets can also expose phone numbers if privacy settings are not properly configured. Stolen accounts, often compromised due to weak passwords or data breaches, provide another source. Autodialers call random numbers to confirm active lines and physical mail sometimes displays phone numbers that can be accessed if deliveries are stolen or recycling is rummaged through.

To protect yourself, be cautious about sharing your phone number online and use privacy settings to limit its visibility on social media and other platforms. Enable two-factor authentication on accounts, preferably using apps or biometrics rather than SMS. Consider using a pre-paid SIM card or VoIP service for online purchases instead of your regular number. Employ mobile security solutions with call filtering and block third-party cookies in your web browser. Always stay vigilant about phishing attempts and avoid responding to unsolicited messages or calls. Finally, ask your service provider about additional security measures like SIM card locks to protect against SIM swapping.

Want to learn more?

5 critical steps to shield your teens from sextortion

• Keep yourself informed about the types of scams that are out there.
• Educate your teens about this type of attack early on.
• Create an evironment which feels safe and encourages your teen to talk to you.
• If an attack occurs, contact the police.
• If an attack occurs, avoid victim-blaming. Contact an expert to get help taking down images.

Want to learn more?

Buying a VPN? Here’s what to know and look for

• stop others from tracking your browsing habits.
• allow you to use public wi-fi safely.
• let you connect to your corporate network securely.
• allow you to share sensitive files safely.

• What type of encryption do they use?
• Is the service paid or free?
• How many servers do they have and where are they located?
• What protocol do they use?
• Do they provide support?
• Do they log your activity?

Want to learn more?

7 essential cybersecurity tips for summer travel:

1. restart your phone daily or use Lockdown mode.
2. say no to public wifi, use your phone as a hotspot or a VPN.
3. before you leave home update and backup your devices.
4. turn on the "Find My" feature on your devices.
5. turn off location services.
6. use Apple pay.
7. guard your online presence by being careful of what you post.

Want to learn more?

The murky world of password leaks – and how to check if you’ve been hit

Read the whole article.

Want to learn more?

How to keep your browsing history private

Want to learn more?

The NSA advises you to turn your phone off and on once a week - here's why

Want to learn more?

Microsoft says you should always ask this one security question to avoid scams

Scammers try to make you panic so you will blindly follow their instructions. Calls about your child being in jail, notifications that your PC has been hacked and your bank account has been frozen are some examples of their techniques. By simply contacting another person and asking them if you should follow the scammer's instructions, you can avoid being a victim. Getting a sober second opinion works for all scam scenarios.

Want to learn more?

True or false: if you get a pop-up message, you should pull the plug on your computer immediately

Want to learn more?

May 2 was World Password Day. Here are some password tips.

Want to learn more?

Beyond fun and games: Exploring privacy risks in children’s apps

Child-targeted apps can be dangerous, collecting data without their permission or knowledge. Almost half of Android apps studied collected more than one piece of personal data. More than half of these apps won't let you delete the collected data. While there are some laws that protect children's data, watch out for the following:

• in-app purchases
• advertising
• excessive data collection
• oversharing
• limited parental controls
• inappropriate content
• security risks

Want to learn more?

How to safely scan a QR code using your smartphone

How can you stay safe when using a QR code? 

Want to learn more?

Your smart TV is snooping on you. Here's how to limit the personal data it gathers

Smart TVs collect personal data even without you signing into a particular service. They use Automatic Content Recognition (ACR) to watch and listen to every show you watch regardless of whether it is a streaming service, Blu-ray, DVD or a video server. This tool constantly pattern-matches video frames and audio snippets against an audio and visual database.They also use Advertisement Identification (AdID) which identifies every commercial that you watch. TV manufacturers are selling this information. 

If you have an Amazon Fire TV, Google TV, LG, Roku, Samsung or Vizio, you can limit the data collection. Read the whole article for details.
 

Want to learn more?

The 7 signs you’ve been hacked
 

1. Slow device
2. Random or constant shut downs
3. Strange pop-ups
4. People are receiving messages from you that you didn't send
5. New applications have been installed on your computer without your knowledge
6. Sudden changes to your login credentials or account information
7. The browser redirects you to a web page you didn't ask to go to

Want to learn more?

Borrower beware: Common loan scams and how to avoid them

Cyber criminals are using loan fraud to take advantage of people struggling to make ends meet.

Top loan fraud threats

• Upfront fee for a no-strings attached loan
• Student loans repayment help
• Phishing emails with fake loan applications
• Malicious loan apps
• Payday loan scams
• Fake requests for loan repayment
• Identity theft

Stay safe from loan fraud

Look for the following red flags like guaranteed approval, request for upfront payment, unsolicited contact, pressure tactics and lack of fine print. To protect yourself research the company offering the loan, never pay an upfront fee without seeing the terms, use anti-malware, enable multi-factor authentication, don't reply to unsolicited emails, don't overshare online. When using loan apps, only download apps from official Google/Apple app stores, read reviews and avoid those that ask for excessive permissions.

Want to learn more?

Your loved one is calling and they need help: how do you know it is really them and not a deep fake?

Want to learn more?

How to share sensitive files securely online

• File transfer protocol or FTP, as files aren't encrypted
• Peer-to-peer or P2P, which can work for some files but has shortfalls
• Email, as it isn't always encrypted end-to-end

• Choose a provider that focuses on security
• Password protect files and enable multi-factor authentication
• Set a time limit on download links
• Use security software and a virtual private network on public wifi

Want to learn more?

What to Do When Your Phone Number Is Being Spoofed

How to stop scammers from spoofing your phone number:

• Let your mobile carrier know
• Block calls from anyone not in your address book
• Put a password on your voicemail
• Update your voicemail message to explain you have been spoofed
• Check your phone bill for unusual activity
• Wait for the scammers to move on to another number. If they don't, get a new phone number.

How to stop receiving spoofed calls:

• Let unknown numbers go to voicemail
• Block robocalls
• Block unknown numbers
• Use a phone filter app

Want to learn more?

5 Google Drive tips to help you prevent disasters

1. Use a strong password and enable two-step verification to secure your account.
2. Create your documents in Google Drive, rather than an app. This makes them easier to locate.
3. Use the version history to reverse document changes.
4. Back up your files in another folder in case you accidentally delete them.
5. Lock your files to keep them from being edited.

Want to learn more?

10 things to avoid posting on social media – and why

Oversharing on social media can put you at risk of identity fraud, password compromise and theft.

Things you should keep to yourself:

1. Personally identifiable information (PII) can be used to open accounts, apply for credit, crack passwords and hijack your accounts.
2. Travel plans let people know no one is at home. Wait until you return from your trip to post.
3. Location data lets criminals know your home is unattended or where you could be intercepted and robbed.
4. Expensive purchases make you a target for mugging or burglary.
5. Photos of kids can be scrapped from your site for unsavoury purposes. If you want to post photos, get permission first. 
6. Work-related grievances should not be shared online. Griping online could get you disciplined or fired.
7. Financial details should not be posted online. Even blurry images of payment cards exposes you to fraud risk.
8. PII of family/friends needs to be treated as carefully as you treat your own.
9. Social media giveaways are often used to collect PII. If it seems too good to be true, it probably is.
10. Private conversations can cause strife and stress for yourself and others. If it isn't your news to share, don't share it.

To avoid oversharing, consider:

• being mindful of what and when you post.
• reviewing your friends list regularly.
• restricting who can view your friends list, photos and posts.
• enabling MFA and having a strong, unique password.

Want to learn more?

How to protect yourself from the Google Voice scam

Google Voice is a free service that lets you send and recieve texts and phone calls online. It uses verification codes to set up an account. Scammers are taking advantage of this service to impersonate you. They are using dating apps, Facebook Marketplace and Craig's List to find their victims.

How the scam works

1. The scammer contacts you via text, email or phone for a valid reason, like wanting to purchase something you have posted on Facebook Marketplace.
2. The scammer asks to verity your identify using a code to ensure you can be trusted.
3. Without your knowledge, they use your phone number to set up a new Google Voice account and a verification code is sent to you.
4. They ask you for the code.
5. The scammer uses your Google Voice number to pretend to be you or someone else. They now have access to everything that Google Voice does including your personal information, contacts, messages and voicemail.

How to protect yourself

• Never share verification codes. They do not prove your identity.
• Do your research. Google the person, look for fraud alerts and ask for references.
• If it seems too good to be true, it probably is. Walk away from anything that feels off.

Want to learn more?

How to stop V-day scams before they break your heart and your bank account 

• quickly try to create a strong connection or say they love you.
• always have an excuse for not video chatting or meeting in person.
• urgently asks for money, gift cards or favors.
• sends you email with links or attachments loaded with malware 
• are inconsistent or vague details about themselves, their work or their location.

• online greeting cards that appear to come from family and friends may be loaded with malware. Check with the sender to confirm the card came from them.
• new dating websites can be malicious, collecting your personal information to use against you later. Check for reviews and make sure the site is legitimate.
• sharing intimate photos with others can lead to sextortion. Be careful what you share and be aware some threats are just bluffs.

• Go slow and let the relationship develop over time.
• Trust your instinct. You have the right to end the relationship even if you don't have evidence that they aren't being truthful. Don't do anything that is unsafe or feels wrong.
• Give yourself permission to end the relationship without a final conversation especially if you are worried they will manipulate you into continuing contact. Feel free to block them from contacting you further. 

Want to learn more?

Beware of malicious files in your Shared with me folder

Scammers are using the ease of Google Drive file sharing to dump documents in your Shared with me folder. To put a file in your Shared me me folder, all they need is your email address.

Google scans all shared documents so opening the scammer's document is not dangerous. Clicking on any links in the document is.

Read the whole article.

Want to learn more?

10 tips for protecting personal information from the Office of the Privacy Commissioner of Canada

1. Think twice before you give out your personal data. Ask yourself, why it is needed, how it will be used and who will see it.
2. Ask questions. How will your data will be used and protected. The company should respond.
3. Speak up about any concerns around the use of your data.
4. Just say no. Sign up for the Do Not Call list and the Do Not Mail list.
5. Safeguard your SIN. It should only be used for income reporting purposes.
6. Password protect your devices.
7. Protect your passwords. Make them long and unique.
8. Adjust your privacy settings. Never rely on default settings.
9. Properly clean old devices before you discard them.
10. Know your rights to privacy.

Want to learn more?