Threats Without Borders - Issue 173
Threats Without Borders - Issue 173
Cybercrime Investigation Newsletter, Week ending March 10, 2024
The Internet Crime Complaint Center (IC3) released its Internet Crime report for 2023, and as expected, the numbers aren’t good. All of the fraud-fighter talking heads are utterly aghast at the numbers! Of course, they are. The worst ones are those who use the extreme victimization to pimp their cybersecurity and fraud prevention services. “If people only use our products, so much of this could be prevented.” Right. Your products are being used now…maybe they aren’t as effective as you think.
The point that’s rarely made, and the most important, is that the numbers provided by the IC3 are incorrect. In fact, they aren’t even close. The Center itself acknowledges this fact in the Introduction to the report. The majority of victims never report their losses, not to law enforcement and certainly not to the IC3. Many victims will report the loss to their financial institutions, but how many banks and credit unions have a policy to report their customer’s victimization to the IC3? If you listen real close, you can hear all of the lawyers gasping; You can’t do that, Matt; do you know nothing about privacy?
I have read that only 1/3 of the victimization gets counted by the IC3. I can’t source that, but it seems about right—maybe closer to half, but certainly no more.
So when you read the IC3 report, finish every number with “to the third,” and you’ll be a lot closer to the truth.
https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
Calling out Facebook isn’t the answer…
I certainly hope these 41 Attorney Generals' are just political grandstanding, and they don’t actually believe that account takeovers are caused by Meta’s (Facebook and Instagram) security failures. These social media platforms are secure…if users put in the effort to protect themselves. Account takeovers happen because of weak passwords, password reuse, and social engineering attacks, not because Facebook and Instagram are insecure. Attorney General Henry, if you are serious about consumer protection, let’s start a program in Pennsylvania to educate social media users about creating secure passwords, using multi-factor authentication, and defeating social engineering attacks! I’m sure someone in your agency knows how to get in touch with me. https://www.attorneygeneral.gov/taking-action/ag-henry-in-letter-to-meta-investigate-causes-of-spike-in-account-takeovers-increase-protection-for-consumers/
Mail Call
“Matt, thanks for bringing attention to the problem with scam “balance checking” websites. My wife recently fell victim to this and lost the balance of an Olive Garden card. How desperate are these jerks that they even steal a man’s endless salad bar? P.S. Keep up the great work. The newsletter is how I start every Tuesday”. Thanks, Craig. Sorry about your gift card balance. Breadsticks are on me if we ever meet!
Some News
Trellix looks at the adoption of AI to facilitate cybercrime. https://www.trellix.com/blogs/research/the-dark-side-of-innovation-cybercriminals-and-their-adoption-of-genai/
Cleafy does a deep dive into ODF; On-Device Fraud. https://www.cleafy.com/cleafy-labs/on-device-fraud-on-the-rise-exposing-a-recent-copybara-fraud-campaign
The Federal Trade Commission has extended telemarketing fraud protections to businesses through a new final rule. This rule also updates the record-keeping requirements to keep them in line with technological advances and market changes. The Commission has also proposed a new rule to equip the agency with powerful tools to combat tech support scams. https://www.ftc.gov/news-events/news/press-releases/2024/03/ftc-implements-new-protections-businesses-against-telemarketing-fraud-affirms-protections-against-ai
Are electronic “pull-tab” games being used to launder money? https://www.inforum.com/news/north-dakota/north-dakota-gaming-director-raises-alarm-over-possible-money-laundering-with-e-tab-machines
Cybersecurity professionals are turning to cybercrime because working in cybersecurity is a stressful and thankless job and well, crime does indeed pay. https://www.darkreading.com/cybersecurity-operations/broke-cyber-pros-cybercrime-side-hustles
You have until the 19th to get your bracket submitted for the next Stonk Madness! https://www.stonkmadness.com/
Cool Job
Deputy BSA Officer - Finwise. https://www.paycomonline.net/v4/ats/web.php/jobs/ViewJobDetails?job=23040&clientkey=6897E5BB605A9248CCAC55282BE01379&jpt=f97b1fd3bb3c0361ffae5c8497ff4ee2
Cool Tool
I’ll probably write more about this, but I wanted to get this tool out there ASAP. Once you install a browser extension and provide it with permissions, it has those permissions until you alter or deactivate the service. So, what happens when someone buys an extension? What if the new developer has malicious intent? Know when the ownership of your browser extension changes. https://github.com/classvsoftware/under-new-management
Irrelevant
The pendulum swings. https://www.politico.com/news/2024/03/07/liberal-cities-crime-policies-00145532
This is where you can find a penguin.
Happy “Spring Forward” to those who celebrate daylight saving time! Thank you for making time for this week’s issue."I have been working on some additional content that may not be included in the regular newsletter. So, if you receive an unexpected email, it's likely to be one of those. I'm not sure if receiving more of my writing would be beneficial or detrimental to the newsletter's success. However, it does mean more emails for Yahoo to block and more opportunities for lawyers to become offended.
Have a great week.
Matt
“HE WHO LIVES IN HARMONY WITH HIMSELF LIVES IN HARMONY WITH THE UNIVERSE” - I wonder who’s wrong, the Universe or me?
Published every Tuesday, Threats Without Borders offers original commentary and educational pieces related to cybercrime investigations and information security topics. We also summarize and comment on news articles concerning active threat intelligence for the financial industry. The newsletter interests everyone tasked with cybersecurity or involved in preventing or investigating technology-enabled fraud, theft, or money laundering.
Legal: I am not compensated by any entity for writing this newsletter. Obviously, anything written in this space is my own nonsensical opinions and doesn’t represent the official viewpoint of my employer or any associated organization. Blame me, not them.