After much debate, it turns out abbreviating 2020 is not dangerous after all. When something gets posted online, there is a good chance that it can take on a life of its own. That seems to be what happened to an interesting tidbit of advice, posted by a Twitter user at the start of the new year. The advice said that you should not abbreviate the year (writing “20” instead of “2020”) due to fraud and forgery concerns because someone could add additional digits to the end of your “20” and change the year on your document.

From there, the advice about abbreviating 2020 not only went viral but it also somehow grew in magnitude and severity. The information has now been shared by police departments and other experts in different parts of the country. Some reports even said that authorities have issued a warning.

Fortunately, this seems to be a very small cause for concern. Someone could add their own two digits to the end of the date if you simply wrote “20,” changing the date to “2007,” for example. However, you have to ask yourself how that would benefit someone and what harm could it actually do to you.

Luckily, a well-thought-out explanation of the risks and worries of abbreviating 2020 can be found here. The only documents that could really be negatively impacted by abbreviating 2020 would already have the type-written date beside the signed date. Other documents, like some tax return forms, already have the precise number of blanks for you to write the date. However, your checks, for example, are not really in danger; after all, how does it benefit a thief to change the year on a check?

There are some really important reminders that come from this story, and they are relevant no matter what year it is.

  • Some viral posts are nothing more than a hoax, and others like this one start out as a gentle warning. That does not make them dire or dangerous
  • People tend to share posts that seem to be great advice on the surface—such as the infamous “Facebook is going to start using your photos unless you copy and paste this onto your wall right now!” hoax—but those posts can sound scarier as they make the internet and social media rounds
  • Good habits should not be ignored

The good habits you develop to protect yourself can actually help you in different ways. It does not hurt anything to write out “2020” instead of just the last two digits. And if writing out the year makes you more aware of your privacy and the need to protect yourself, then, by all means, write it out.

Other good habits to focus on this year include avoiding phishing scams, not sharing social media posts that are not fact-checked, maintaining strong password security and hygiene and monitoring all of your accounts for any signs of suspicious activity. If any of those habits are not clear, check out the information at the Identity Theft Resource Center’s helpful website to learn more about how to protect yourself this year. Be sure to follow the ITRC on Facebook and Twitter for up-to-date information as well.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

You might also like…

A PayPal vulnerability in the login system was recently discovered by a white-hat hacker, allowing the company to create a patch for the problem. When we picture highly-skilled hackers at work, we might think of darkened rooms and faces peering out of black hoodies, lit by the glow of several computer monitors. At least, that is how Hollywood portrays these criminal masterminds who can break into a secure network from anywhere in the world and cause harm.

Fortunately, that is not often the reality. In fact, a number of hackers—the so-called “white-hat hackers”—like to sift around in a major company’s security defenses just to see what they can find. The company might pay them handsomely as a reward.

That was the case with a recently patched login vulnerability at PayPal. A hacker discovered that the Java script in the login page could potentially allow unauthorized outsiders to access accounts. Alex Birsan then reported the issue to PayPal and publicly disclosed it, for which he received over $15,000 from the company.

The method involved in accessing an account without authorization is so roundabout that PayPal has no reason to think anyone actually accomplished it. According to the company, an unsuspecting user would have had to go to PayPal by first clicking a button on a malicious website and entering their credentials to take advantage of the PayPal vulnerability. Then a hacker would have had to access the Google CAPTCHA that verifies the users’ identities on certain accounts. Still, there is no reason to leave a vulnerability unchecked, and PayPal created a patch for the PayPal vulnerability.

While PayPal users do not have to do anything to install this patch—since the issue was with PayPal’s own site, not downloaded user software—this is a good reminder that any time a vulnerability is discovered and a patch is issued, that patch will not be useful unless it is implemented. If the PayPal vulnerability had involved user software or apps, you would not be protected if you had not installed the latest update.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

You might also like…

Unbeknownst to many consumers, the country’s most advanced consumer privacy act just went into effect on January 1, 2020. The California Consumer Privacy Act (CCPA) outlines some of the strongest protections for individual consumers and the companies they choose to do business with. However, some early reporting shows that a lot of people are still not aware of the new legislation.

CCPA provides new protections in the event of a data breach, new tools for consumers to find out exactly what information a company has collected and sold or shared and more. Under the CCPA, consumers also have the right to delete some personal information and opt-in for children. In the CCPA personal information is defined as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information under the CCPA does not include publicly available information.

 Companies doing business in California — whether they are located there or not, or simply have customers or users who reside in the state — must provide more than just the proof of information they have collected. If an individual consumer does not want their information sold to third parties, the CCPA states they have the right to opt-out and the companies must comply. Failure to comply could result in significant fines, penalties and damage awards of up to $7,500 per consumer.

Image of business with notice of CCPA

That has been a sticking point for a number of businesses, though.

There are questions about how businesses will comply with the do not sell requirements. Some companies are claiming that if they “share” their users’ data with an outside company, they are in compliance. The supporters of the CCPA have said selling or sharing is the same thing, though companies like Facebook, CVS, Indeed and others argue their methods of providing users’ information to outsiders does not violate the CCPA.

Image of Conde Nast disclosure of CCPA

Some of the other responsibilities of businesses include a child opt-in requirement, a website notice requirement, a duty to educate, vendor agreements, third-party transfers and cybersecurity protections to prevent a data breach. In the event of a data breach, consumers can now sue to recover up to $750 in costs per data breach. For more information about consumer rights in the event of a data breach or other CCPA rights, click here.

Image of business disclosure of CCPA

Though the California Consumer Privacy Act went into effect on January 1, businesses have until July 1 to comply before enforcement—and presumably, punitive action—begins. It will be interesting to see both how this plays out for businesses that make a lot of money by selling their customers’ information, and how many other states follow suit with legislation of their own.

Sign Up For Identity Theft and Data Breach News

Sign up for the TMI Weekly to stay in the know about potential threats to your identity/privacy and tips to keep you safe. Our monthly breach alert keeps you posted on the latest trends and activity in the world of breaches.

Free Identity Theft Assistance

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

This news is currently evolving and we will update as announcements are made available.  

You might also like…

The Epilepsy Foundation and law enforcement are on the hunt for hackers responsible for a recent Epilepsy Foundation Cyberattack. Data breaches and account takeovers tend to be fairly straightforward. Hackers break into a network, steal useful information and then use or sell that data to someone else. Sometimes, though, cybercrimes have a far more malicious goal in mind. It might be revenge, intentional damage to a reputation or brand or some other similar focus.

In one particularly brutal cyberattack, experts initially worried that hackers broke into the Twitter account for the Epilepsy Foundation and used that access to send out dangerous tweets. Further investigations showed that they did not actually violate any accounts or even terms of use. Instead, they tweeted at those who were following the Foundation’s account and any hashtags they deployed. The tweets contained flashing, strobe-like images that were specifically intended to induce seizures in people who have photosensitivity issues. Users who rely on information from the Foundation’s Twitter feed were put at risk of a seizure due to the Epilepsy Foundation cyberattack, and the organization is taking the account hack very seriously.

The timing of the Epilepsy Foundation cyberattack appears to be no coincidence, as it occurred during National Epilepsy Awareness Month. That is a time with higher traffic because more people are looking for information and shared posts from the organization. For its part, the Epilepsy Foundation has now filed criminal complaints against the hackers and intends to assist law enforcement in discovering the culprit of the Epilepsy Foundation cyberattack and bringing the charges against them.

Social media has long had to deal with disinformation campaigns where public health is concerned, but coordinated, planned attacks of this kind are not very common. Unfortunately, as revenge-style attacks and stunts increase, hackers may attempt even more boundary-pushing tactics. This kind of weaponization is particularly alarming for a few reasons. First, it may be hard to show that the attackers actually violated any laws or even rules for using Twitter. Second, and more importantly, it demonstrates how easy it is to entice large numbers of followers to click a malicious link or download and spread harmful software.

You might also like…

Concerns Arise Around Possible LinkedIn Password Exposure

Super Bowl Means Super Scams

New York Special Olympics Email List Suffers Hack 

A business ransomware attack continues to be one of the most damaging, costly forms of cyberattacks against both businesses and consumers alike. Simply put, it is easy to pull off and it often works, all with little risk of discovery to the perpetrator.

Most ransomware attacks involve a little bit of malicious software—either designed by the criminal or purchased from another source—and some social engineering. Typically, phishing attacks work as an avenue for infecting a computer or network with harmful software. By getting even one low-level employee to click a link or open an attachment, criminals can infect the network, lock up the system and demand a ransom payment in exchange for the key to open it.

Unfortunately, the only responses to a business ransomware attack are to pay the ransom or ignore it and buy a new computer. Experts do not recommend paying the attackers because there is no guarantee they will release your network or your files. Unfortunately, getting your system back online can prove to be difficult.

One telemarketing firm, The Heritage Company, suffered a crippling business ransomware attack before Christmas. Employees were not made aware of the attack and only learned of it when all 300-plus were laid off. The company was unable to recover from the attack, despite paying the attackers to regain access via the unencryption key. In a letter to employees and a subsequent outgoing voice mail message, the company urged employees to look for other jobs.

This kind of incident is not rare, and small businesses are just as likely to be victimized as larger ones. Certain industries, like healthcare and education, are also more likely to be targeted due to the higher risks associated with being breached.

When it comes to ransomware, the best offense is a good defense. Prevention is the most important step, and it comes down to things like employee training on avoiding phishing attacks, ensuring the network has strong, up-to-date anti-malware protection and backing up all data on external storage devices every day. That way, should the other steps fail, the worst outcome is having to purchase new hardware and load the backed-up data into it.

You may also like…

Concerns Arise Around Possible LinkedIn Password Exposure

Super Bowl Means Super Scams

New York Special Olympics Email List Suffers Hack 

A Landry’s data breach has exposed thousands of people’s information after they had their software compromised. The more things change, the more they stay the same. At least, that is how it appears in the world of cybercrime, data breaches and identity theft. As hackers come up with new tools and tactics to steal information electronically, old methods of gaining financial or identifying information are still just as much of a problem as ever.

A recently announced data breach of Houston-based restaurant and hotel company Landry’s, Inc., proves this point. More than 600 locations in the company’s sixty brands were impacted by unauthorized access to the software that controls their card readers. Patrons who visited these locations between March 13 and October 17 of 2019 are advised to look through their card statements for signs of any unusual activity due to malware that was installed on the company’s servers.

However, Landry’s data breach has a slightly different twist. According to a statement from the company, the issue arose when servers inadvertently swiped payment cards in the wrong type of card reader at a few locations. Some card readers in the locations are used to send food and drink orders directly to the bar or kitchen, and the affected cards appear to have been used in those card readers. The list of brands under the Landry’s, Inc. umbrella can be found here.

All consumers who rely on payment cards for any kind of transaction have to be proactive about their accounts, specifically in watching out for signs that their cards may have been compromised. Enabling security tools from your financial institutions is also helpful, as these tools can alert you to unauthorized transactions the moment they occur.

Landry’s has not mentioned the offer of credit monitoring for affected customers yet, but the company recommends reporting any fraudulent charges from Landry’s data breach to the Federal Trade Commission and to your financial institution.

You might also like…

Concerns Arise Around Possible LinkedIn Password Exposure

Super Bowl Means Super Scams

New York Special Olympics Email List Suffers Hack 

It takes a bad criminal to attack donors to a beloved non-profit organization, but that is exactly what happened with the New York Special Olympics organization.

Who Is It Targeting: Donors to the New York Special Olympics organization

What Is It: Phishing attempt from a hijacked email list

What Are They After: Many donors to the New York Special Olympics program received a phishing attack in their email inboxes last month. Disguised as a receipt for a very high-dollar donation to the organization, recipients were prompted to click the link if there was an issue with their donation. (This is a very common phishing tactic, as your first instinct may be to dispute the erroneous charge.) The link redirected to the criminals’ own servers and was intended to steal identities or financial information.

How Can You Avoid It:

If you think you may be a victim of identity theft, contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. Find more information about current scams and alerts here. For full details of this scam check out this article from Tripwire.

The U.S. Army is the latest branch of the armed services to issue an order against using TikTok.

Who Is It Targeting: Video app users

What Is It: Data theft, “leaky” app

What Are They After: The U.S. Army just became the second branch of the military to warn its members that they are not to download, install or use the app TikTok on their government-issued phones. The Chinese app, popular with young users, lets you create brief video clips that you then share on your social media channels. A number of security worries have cropped up concerning stolen information through the TikTok app, and the Army is not taking any chances.

How Can You Avoid It:

  • Make sure you understand all the privacy permissions you are granting when you open a new account
  • Do not be in a hurry to download the latest app
  • If you cannot tell what data the app uses or shares with others, then it is best to avoid it

If you think you may be a victim of identity theft, contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. Find more information about current scams and alerts here. For full details of this scam check out this article from Fox 5 San Diego.

With the Super Bowl quickly approaching, it is time to start looking out for people trying to trick you with a Super Bowl scam. Fans are eagerly awaiting the results of the playoffs to see who will go head-to-head next month. Whether your team makes the final game or not, it is an exciting time for football fans. Unfortunately, it is also an exciting time for scammers.

From bogus tickets and fake travel deals to illegal online gambling, there is no limit to the different ways that criminals can attempt to pick your virtual pockets with a Super Bowl scam. One nearly unbelievable Super Bowl scam involved a beloved community member and well-known businessman who stole more than $750,000 from his own friends and associates. That included $36,000 from his own mother.

It is important to learn how to protect yourself from a Super Bowl scam now so that all you have to worry about come game day is having enough snacks on hand to celebrate.

Tickets

Part of the trouble with spotting fake tickets from real ones is the fact that real ticket resale websites actually do exist. As long as the terms and conditions are met, buying someone’s unwanted tickets is legal. Sadly, it is rather easy to create a fake website that offers bogus tickets. Make sure you are only using verified ticket sources.

Hotel and Travel Packages

Just because you saw photos of a great suite close to the stadium or clicked on an ad for a $99 roundtrip flight, that does not mean your reservation is real. It is probably a Super Bowl scam. Only use legitimate travel sites to book your accommodations, and if possible, use a payment method that offers some kind of buyer protection. Avoid the urge to click on flashy last-minute deals, too.

Phishing Attempts

The easiest way to steal identifying information and funds is to never bother making fake tickets or fake travel packages. Instead, scammers send out a mass email or text message offers, or create viral social media posts. Unsuspecting fans click on the links in the message, hoping to get a great deal. Instead, either malware is installed on their device or the users submit their information and payment method to be stolen. The reality of scams and hoaxes is that these tactics are not limited to just Super Bowl scams. Criminals recycle their tools, mostly because they work, at any time of the year and whenever a major event is taking place. Be on the lookout for too good to be true opportunities and remember to safeguard your information at all times.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at 888.400.5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

You might also like…

Concerns Arise Around Possible Linkedin Password Exposure

Ring Doorbell Data Leak Exposes Over 3,000 Accounts 

Data Privacy Day 2020 – The Year of Privacy