There are several situations in which identity theft can affect the processing of a tax return. Most involve someone misusing someone’s Social Security number (SSN), which the IRS uses to make sure the filing is accurate and complete and that they get any refund they are due.

It could be a sign of identity theft if a taxpayer receives an IRS notice that:taxes

  • More than one tax return was filed for one tax year, or
  • IRS records indicate a taxpayer received wages from an employer they don’t know.

If someone uses a taxpayer’s SSN to file for a tax refund before the taxpayer does, the IRS may believe the taxpayer has already filed and received their refund. The taxpayer might not know this until they get a letter from the IRS indicating that more than one return was filed for them.

If someone has used a taxpayer’s SSN to get a job, the employer may report that person’s income to the IRS using the taxpayer’s SSN, making it appear to the IRS as if the taxpayer did not report all of their income on their tax return. In that situation, the IRS might send the taxpayer a notice that they appear to have received wages from an employer they don’t know.

If You Suspect Identity Theft – Contact the IRS

If you get a notice from the IRS, respond immediately to the name and number printed on the notice. If you think you have tax issues related to identity theft, let the IRS know as soon as possible, even if you don’t have any evidence that it’s affected your tax return. Contact the IRS Identity Protection Specialized Unit (IPSU) at 1-800-908-4490. The IPSU’s hours are 8:00 am to 8:00 pm (your local time).

Specialists will work with you to get your tax return filed, get you any refund you are due, and protect your account from identity thieves in the future. You can document the identity theft by submitting a police report or the IRS ID Theft Affidavit (Form 14039).

You’ll have to prove your identity with a copy of a valid government-issued identification, like your Social Security card, driver’s license or passport.

We welcome you to post/reprint the above article, as written, giving credit to and linking back to ITRC Blog.

Imagine these scenarios:

You are on vacation and you open your laptop in your hotel room. You log into the public wifi network, and quickly agree to the Terms and Conditions (without reading them of course), and start to do your normal Internet activities. For just a second, you have a fleeting thought: “Is my computer at risk?” And then you begin your normal Internet activities and quickly forget all about it.

You are waiting to catch your flight in an airport and, after grabbing a cup of coffee and opening your laptop, you see that there’s a “Free Public Wifi” network available. You login to your banking account to transfer funds. You have a vague sense that you might not be doing something safe, but you figure that you’re only going to be online for fifteen minutes, so you’re probably okay, right?

How Safe Are Wifi Hotspots?

Many of us assume that using a wifi network at a hotel or airport is the same as logging into our network at home or at the office. But the risks of using wifi networks at a hotel or airport are exponentially greater than those experienced at home or in an enterprise setting.

For example, while sharing folders, printers, desktops, and other services can be useful at home or in the office, doing so is inappropriate on a public network, where competitors or hackers can access this information.

Most private networks use firewalls to defend users against Internet-based attacks. This is not necessarily true in public wireless networks, where security practices vary widely. You may assume you are safe from outside attacks, but you really have no idea whether any firewall lies between your laptop data and the Internet.

Business travelers willing to connect to any network that offers free Internet access are especially vulnerable to such attacks. It is literally impossible to tell the safe networks from the bad ones. Wireless eavesdropping is possible everywhere. Only a small percentage of public networks prevent wireless eavesdropping, and many networks leave wifi users completely responsible for their laptop security, with extensive or complete file and service exposure.

So What Should I Be Worried About?

Okay, so now you are probably aware that using a public wifi network while on the road exposes you to a lot of security risks. But what risks are we talking about exactly?

The following is a list of different types of hacks that can occur in public wifi hotspots:

Sniffers: Software sniffers allow eavesdroppers to passively intercept data sent between your web browser and web servers on the Internet. This is the easiest and most basic kind of attack. Any email, web search or file you transfer between computers or open from network locations on an unsecured network can be captured by hackers. Sniffing software is readily available for free on the web and there are 184 videos on YouTube to show budding hackers how to use them. The only way to protect yourself against wifi sniffing in most public wifi hotspots is to use a VPN, such as PRIVATE WiFiTM.

Sidejacking: Sidejacking is a method where an attacker uses packet sniffing to steal a session cookie from a website you just visited. These cookies often contain usernames and passwords, and are generally sent back to you unencrypted, even if the original log-in was protected via HTTPS. Anyone listening can steal this log-in information and then use it to break into your Facebook or gmail account. This made news in late 2010 because a programmer released a program called Firesheep that allows intruders sitting near you on a public wifi network to take over your Facebook session, gain access to all of your sensitive data and send viral messages and wall posts to all of your friends.

Evil Twin/Honeypot Attack: This is a rogue wifi access point that appears to be a legitimate one, but actually has been set up by a hacker to eavesdrop on wireless communications. An evil twin is the wireless version of the “phishing” scam: an attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider. When a victim connects, the hacker can launch man-in-the-middle attacks, listening in on all Internet traffic, or just ask for credit card information in the standard pay-for-access deal. Tools for setting this up are easily available (e.g., Karma and Hotspotter). One recent study found that over 56% of laptops were broadcasting the name of their trusted wifi networks, and that 34% of them were willing to connect to highly insecure wifi networks.

ARP Spoofing: Address Resolution Protocol (ARP) spoofing, also known as ARP flooding, ARP poisoning or ARP Poison Routing (APR), is a technique used to attack a wireless network. ARP spoofing allows an attacker to sniff traffic on a LAN and modify or stop the traffic altogether. This attack can only occur on networks that make use of ARP and not another method of address resolution. ARP spoofing sends fake, or “spoofed”, ARP messages to a LAN which associates the attacker’s MAC address with the IP address of the victim. Any traffic meant for the victim’s IP address is mistakenly sent to the attacker instead. The attacker could then forward the traffic to the actual default gateway (passive sniffing) or modify the data before forwarding it (man-in-the-middle attack). The attacker could also launch a denial-of-service attack against a victim by associating a nonexistent MAC address to the IP address of the victim. A successful APR attempt is invisible to the user.

“Free Public Wifi” Rogue Networks: “Free Public Wifi” networks are ad-hoc networks advertising “free” Internet connectivity. Once you connect to a viral network, all of your shared folders are accessible to every other laptop connected to the networks. A hacker can then easily access confidential data on your hard drive. These viral networks can be used as bait by an Evil Twin. “Free Public Wifi” networks turn up in many airports. Don’t connect to these networks and you won’t infect your laptop. If you find this kind of network on your laptop, delete it and reconfigure your adapter to avoid auto-connecting to any wireless network.

Man-in-the-middle Attacks: Any device that lies between you and a server can execute man-in-the-middle attacks, which intercept and modify data exchanged between two systems. To you, the man-in-the-middle appears to be a legitimate server, and to the server, the man-in-the-middle appears to be a legitimate client. In a wireless LAN, these attacks can be launched by an Evil Twin.

You Should Know What You Are Agreeing To

Remember those Terms and Conditions that you agreed to and didn’t read? Well, we’ve actually read them, and here is what some of them say:

  • Starbucks: It is the Customer’s responsibility to ensure the security of its network and the machines that connect to and use IP Service(s).
  • Boingo Wireless: There are security, privacy and confidentiality risks inherent in wireless communications and technology and Boingo does not make any assurances or warranties relating to such risks. If you have concerns you should not use the Boingo software or service. We cannot guarantee that your use of the wireless services through Boingo, including the content or communications to or from you, will not be viewed by unauthorized third parties.
  • JetBlue: Wireless internet connections such as that provided through the Service are not secure. Communications may be intercepted by others and your equipment may be subject to surveillance and/or damage. Since the wireless connection providing you with access uses radio signals, you should have no expectation of privacy whatsoever when using the service. Accordingly, in providing this service, JetBlue cannot and does not promise any privacy protection when you use the service. It is your sole responsibility to install and deploy technological tools to protect your communications and equipment that may be compromised by use of a wireless network.”

So How Can I Protect My Laptop?

Okay, so now you know how dangerous wireless networks can be, and the various kinds of attacks you may face when using them. So what specifically can you do to protect yourself and your data?

Below are some proactive steps you can take to protect yourself when using such networks, and services you can use that provide laptop security.

Disable or block file sharing

  • Enable a Windows Firewall or install a third party personal firewall
  • Use file encryption
  • Most importantly, use a VPN

The one thing that they all have in common is that it is your responsibility to protect yourself. The best way to protect your sensitive information is to use a Virtual Private Network, or VPN, which encrypts the data moving to and from your laptop. The encryption protects all your Internet communication from being intercepted by others in wifi hotspots. In addition, VPNs can prevent hackers from connecting to your laptop and stealing your data files.

The above article was posted on Friday, July 1st, 2011 by Jared Howe for Private WiFi. Private WiFi is a personal VPN software that encrypts your data in public wireless hotspots. Using our easy software prevents identity thieves from hacking into your emails, online banking, social media accounts, and other personal information. You can check them out at www.privatewifi.com.

After any kind of data breach or hacking event, there are a handful of possibilities for what criminals will do with your stolen information. The outcome typically depends on what types of data they were able to steal, but possibilities include holding it for ransom to prove to a company that they were hacked, using it themselves for identity theft and fraud, or selling your records on the Dark Web to others who would use it.

Considering the heavy emotional and financial toll that identity theft can have on its victims, it’s shocking how little a consumer’s record can sell for on this internet black market. Recent studies have shown just how much money your life is worth to a scammer.

1. Credit card or debit card information – Hackers used to actively seek out credit and debit card numbers, as well as any PIN numbers or security codes associated with those cards. Due to better fraud detection and things like “card not present” transaction alerts from financial institutions, it’s easier than ever to spot criminal use of someone’s card and cancel that account. That could be why card account logins only fetch a few dollars. According to McAfee’s recent findings, a card number with the CVV2 code from the back is worth between $5-$8 dollars, but if it also comes with the bank’s ID number, it could go for $15 online. If the stolen credentials included something called “fullz,” that is, the card owner’s complete information, that would be worth around $30.

2. Online Payment Service Account Information – Whether it’s your own bank account that you can access and use online or a payment service like PayPal, there’s an interesting finding of the value of these stolen logins: the higher your available balance, the more money the criminal pays to purchase it from the original thief. For example, McAfee’s “The Hidden Data Economy” found:

$400-$1000 Balance is worth $20-$50
$1000-$2500 Balance is worth $50-$120
$2500-$5000 Balance is worth $120-$200
$5000-$8000 Balance is worth $200-$300

3. Medical Identities – When people think of identity theft, they tend to overlook their medical identities. This is the information contained in your medical records, such as your name, address, Social Security number, health insurance ID number, prescription medications, or other necessary information. A study by NPR found that a group of ten Medicare numbers will fetch about $4700 online; it’s important to remember that Medicare numbers—unlike most health insurance numbers now—are still currently the member’s Social Security number, which can make the stolen profiles doubly valuable.

But what about a typical case of stolen identities where the victim’s name, address, phone number, birth date, Social Security number, and other details are just thrown onto the black market for someone to steal? They go for about twenty dollars each at the current market prices.

Interestingly, selling a stolen set of “fullz” online isn’t a one-and-done proposition. Once a thief has accessed someone’s complete identity, he can sell the same records to multiple customers. That means the work of recovering from the crime can feel insurmountable; you resolve one issue with a credit card someone opened up in Minnesota only to turn around and get a bill for a medical procedure in Florida. That’s why it’s important to start your recovery process with an identity theft report, and then by reaching out to agencies that can give you clear instructions on what to do next.


If you think you may be a victim of identity theft, contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App.

Last month, State Attorney General Kamala Harris announced the creation of a new law enforcement unit to address the growing problems associated with identity theft and cybercrime. According to the F.T.C., California has the most identity theft complaints of any state (over a million complaints annually), and the third highest number per-capita. Known as the California e-Crime Unit, this new law enforcement group will include a group of 20 investigators and prosecutors whose sole responsibility will be to prosecute cybercrime.

 

While Florida, Texas, and Louisiana already have similar units in place, California’s promises to be the largest such unit yet created, with a broader mandate. Criminal activity such as identity theft, internet scamming, and hacking will be the units’ primary focus. The problem with catching cybercriminals is not the ability to track their activity, or to find sufficient evidence of their crimes. So then why is it decidedly more difficult to actually bring a cybercriminal or identity thief to justice? The primary reason is the relatively new unique challenges cybercrime presents.

Primary amongst these is the fact that a significant amount of cybercrime transcends traditional jurisdictional boundaries. Often it is beyond the scope of an individual local police force or district attorney to effectively build a case against and prosecute criminals who may commit their crimes in multiple counties, states, or even countries. Additionally such complication makes it confusing for the consumer to know just how to most effectively get help for their identity theft issues. These are exactly the issues Harris and this new task force are hoping to address. By developing a unit completely focused on cybercrime, with the mobility to help individual local and county jurisdictions seamlessly could potentially be a game changer in the battle on identity theft and cyber crime that has to this point, been a losing one. This is one of the strongest and most encouraging indicators yet that the severity of this problem is finally starting to hit home in the minds of legislators and law enforcement officials.

“Identity Theft and Cyber Crime Blues: California’s New eCrime Unit Gets Tough on Cyber Criminals” was written by Matt Davis. Matt is a Victim Advisor at the Identity Theft Resource Center.

When it comes to web browsers, you have options. The ultimate goal of any web browser is to provide people with a better Internet experience. Regardless of your preference, ask yourself what makes for a better Internet experience?

browser security

According to Firefox, they provide an “open community” where the key features are “openness, innovation, and opportunity.” It gives the users the ability to “shape their own online lives.” In terms of privacy and security, Firefox offers the add-on Flagfox 4.1.11 – said to provide several tools like site safety checks, malware checks, Whois (domain search – who owns the website), page code validation, and display of a flag to tell the user the location of the current website’s server, amongst others. This is supposed to add an extra layer of awareness to the user’s browsing experience, and the user has the ability the select these features or customize their own actions. Firefox’s goal is to be “unobtrusive” – thus, Flagfox does not actually track anything, nor does it send the information anywhere.

Google Chrome on the other hand, is dedicated to “help protect you and your computer from malicious websites as you browse the web.” This web search engine features safe browsing, sandboxing, and automatic updates. For Google Chrome’s safe browsing, users are informed with a warning message if the site they are visiting poses a malware or phishing threat – “Warning: Visiting this site may harm your computer!” Like Firefox, which also offers updates, Google Chrome offers automatics updates. These updates check for the latest security features, and require no action on behalf of the user. According to Google, their feature Sandbox adds an extra layer of protection by “protecting against malicious web pages that try to leave programs on your computer, monitor your web activities, or steal private information from your hard drive.” It prevents the self-installation of malware to your computer. Software Engineer, Nicholas Sylvain, notes that Sandbox was meant to be generic; therefore, it is not just limited to Google – which means that it can be used by others if they share Google’s “multi-process architecture.”

Whether your preferred web browser is Firefox or Google Chrome, both seem to place an emphasis on browser security – of course, through different approaches. Yet, nonetheless, they both express a deep concern for their users’ interests – an interest that lies in the power of the internet.

“Google Chrome vs Firefox: Which is safer?” was written by Gabby Beltran. Gabby is the Public Information Officer and a Bilingual Victim Advisor at the Identity Theft Resource Center.

What is a Social Networking Site?

Social networking websites are a place for internet users to come together, often in groups sharing common interests in hobbies, religion or politics. These websites may require a minimum amount of personal information in order to join. Profile pages, telling other users about yourself, are another standard. Once you are granted access to a social networking website you can begin to socialize. This socialization may include reading the profile pages of other members and possibly even contacting them.

 

What is Identity Theft?

Identity theft occurs when an imposter gains access to personal identifying information (PII) and uses it for personal gain and exploitation.

HOW IDENTITY THEFT MIGHT HAPPEN THROUGH SOCIAL NETWORKING SITES
Because you must divulge some level of personal information in order to use and fully benefit from social networking sites, the risk of identity theft exists for people who use them. Below are some of the ways that you might put yourself at risk of identity theft:

  • Using low privacy or no privacy settings
  • Accepting invitations to connect from unfamiliar persons or contacts
  • Downloading free applications for use on your profile
  • Giving your password or other account details to people you know
  • Participating in quizzes (e.g. How well do you know me?) which may require you to divulge a lot of personal information
  • Clicking on links that lead you to other websites, even if the link was sent to you by a friend or posted on your friend’s profile
  • Falling for email scams (phishing) that ask you to update your social networking profiles
  • Using no or out-of-date security software to prevent malicious software from being loaded onto your computer and stealing personal information

Here are some examples of how people may become victims of identity theft through social networking sites:

Example 1: A man receives a message from one of his friends which has a link to a funny video, so he clicks on it. The link does not bring up a video. The friend’s profile had been hacked, and now a form of malicious software is being downloaded onto the man’s computer as a result of him clicking the link. This software is designed to open a way for an identity thief to take personal information from the man’s system. It additionally sends a similar email to everybody he is connected with on his profile, asking them to “view the video”. Downloading free applications and software can be sources of this type of malicious software, too.
Example 2: Someone has hacked a woman’s social networking profile to harass her and sabotage her online reputation. They are posting embarrassing photos and rude comments on her profile. These photos and comments appear to be from her and are directed to her network of contacts, when in fact they are not. Although she has used the highest level of privacy settings, she has shared too much information online with others. Someone used her posted information to fraudulently access her profile. Always remember, that even though your profile may be set to “private”, treat everything you post online as public.
Example 3: Cybercriminals sometimes will create a page that looks just like the introductory page to a favorite social networking site. This page will ask you to re-enter your password. These criminals will get you to this page from a link in an email or private message or public post with a link to a fraudulent site. If you are already logged in to a networking site and then asked to log in again, be aware that it is a red flag and it is probably a scam designed to make you divulge a lot of personal information to someone with bad intentions.

HOW TO PROTECT YOURSELF:

  • Use the least amount of information necessary to register for and use the site. Use a nick-name or handle (although this is not possible with certain sites),
  • Create a strong password and change it often. Use a mix of upper and lower case letters, numbers, and characters that are not connected to your personal information (such as birthdates, addresses, last names, etc.).
  • Use the highest level privacy settings that the site allows. Do not accept default settings.
  • Be wise about what you post. Do not announce when you will be leaving town. Other things you should never post publicly: your address, phone number, driver’s license number, social security number (SSN), student ID number and even your home town. Thieves can figure out your social security number by what town you were born in and what year. It’s ok to post what year or how old you are, but with this information combined with where you were born, they can figure out your SSN.
  • Only connect to people you already know and trust. Don’t put too much out there – even those you know could use your information in a way you didn’t intend.
  • Read privacy and security policies closely – know what you’re getting into. Some major social networking sites actually say they will use or sell information about you (not individual data necessarily, but aggregate information based on your personal information and that of others using their site) in order to display advertising or other information they believe might be useful to you.
  • Verify emails and links in emails you supposedly get from your social networking site (e.g. the recent Facebook scam emails that asked customers to re-set their passwords). These are often designed to gain access to your user name, password, and ultimately your personal information.
  • Unclick the privacy settings that display the time stamps of your posts.
  • Install a firewall, reputable anti-spam and anti-virus software to protect your information– and keep it updated!

Be certain of BOTH the source AND content of each file you download! Don’t download an executable program just to “check it out.” If it’s malicious software, the first time you run it, you’re system is already infected! In other words, you need to be sure that you trust not only the person or file server that gave you the file, but also the contents of the file itself.

Beware of hidden file extensions! Windows by default hides the last name extension of a file, so that an innocuous-looking picture file, such as “susie.jpg”, might really be “susie.jpg.exe”, an executable Trojan or other malicious software! To avoid being tricked, unhide those pesky extensions, so you can see them.

Use common sense. When in doubt, don’t open it, download it, add it, or give information you may have doubts about sharing.

There are various types of identity theft, for example, financial, governmental, medical, and criminal. Child identity theft usually involves one or more of these types. Therefore, child identity theft is not a standalone category.

ID theft trends It is important to keep in mind that each case involving a child’s identity requires multiple steps of correction. Furthermore, since the elapsed time between the crime and the moment of discovery may be extended over a period of years, child identity theft cases may be more serious and complex. The age of the victim is often times a factor considered in the mitigation steps, and what actions will be required.

As child identity theft becomes a growing concern for parents, many question why thieves target children’s identities. There are several factors why a child’s identity may be the perfect target. One of those factors is that parents would never think of checking a child’s credit history. Children should not have established credit histories because they are not 18-years-old; therefore, they are not of legal age to enter into a contract. One would never suspect any fraudulent activity. This gives the thieves the perfect cover-up, and certainly the necessary time to commit the crime and exploit the identity. A second factor is the wide open possibilities that the child’s identity represents. It provides a clean and fresh start – in any and every way you look at it. For instance, the Credit Reporting Agencies have no way of verifying whether a Social Security number (SSN) belongs to a minor. Therefore, a credit report is established and associated with the first pieces of personal identifying information received. A child’s identity may also be used for other purposes such as – employment, to receive medical services, or evade law enforcement violations, amongst others.

There is no one way to pinpoint how a child’s identity is stolen. Often times, it may be as a result of thieves creating a “fake” 9-digit number and the number happens to be a legitimate SSN assigned to a child. Another instance may be that thieves figured out the way SSNs were generated before it was even assigned by the Social Security Administration. Furthermore, it may be as a result of a stolen document containing the child’s SSN. Unfortunately, in some cases, the child’s identity may have been stolen by a child’s family member or relative.

Over the past year, child identity theft has been a widely covered topic in the media. With this exposure, the issue has become a growing concern for parents, government entities, credit reporting agencies and legislators alike. A child’s identity represents an opportunity that is surrounded by a combination of circumstances – often favorable to the thief.

2011 turned out to be a very big year for Twitter. The masses seemed to discover that this platform made it (seemingly) possible to contact their favorite celebrities, news outlets and politicians directly. However, while it will take some time for the dust to settle and see if Twitter will remain the connection powerhouse it became in 2011, one thing is for sure… Today’s Tweeps should think Twice before believing their Tweets.

twitter

By far, the largest Twitter account to be taken over was that of Lady Gaga. Just like everything Ms. Gaga does, her Twitter account hack turned out to be large and dramatic. With more than 7 million followers on the social networking platform, Gaga has an unprecedented public outreach capability. And this December, when her followers (or as she calls them her “little monsters”) were offered free iPads it actually did not seem too good to be true. Alas, her followers learned soon after the hack that the scam was just another phishing attack and that their heroine was not as generous as they had hoped.

Pop stars and screen sirens were not the only target of Twitter account takeovers. Politicians got their fair share of abuse as well. If we learned one thing in 2011 it was to not to transmit scandalous pictures via tweet and/or direct message as was evidenced by the media circus known as “Weinergate”. This event taught us that even if nothing is sent out to our followers publicly, the information within our Twitter accounts can harm us, as was evidenced by a hacker finding and spreading some NSFW images from the congressman’s Direct Message outbox.

Perhaps the most sought after hacks were those of news outlets. Fox News, NBC and USA Today had their streams taken over. A group which called themselves ‘The Script Kiddies’ claimed that they were responsible for the takeover of all three accounts. The damage was minimal, but the hackers did have the opportunity to tweet from NBC’s account, a false report of a high-jacked airliner that had crashed into Ground Zero. Perhaps though the damage was not done by what the hackers posted, but by the possibilities of what they could have posted.

And so in 2012 we are left with trepidation of what hackers have in store for us. The mayhem that could be, should our celebrities, politicians or news outlets become controlled not by popular culture or corporate responsibility, but by a bunch of teenagers lurking behind keyboards. It should be an interesting year.

‘Twitter Takeovers of 2011’ was written by Nikki Junker. She is Social Media Coordinator and Victim Advisor at the Identity Theft Resource Center.

There is so much you can do on a mobile phone these days! Many tasks you would do on a computer can now be done while on the go with a Smartphone. However, with all of that accessibility comes a price. That price may be diminished safety and privacy. Mobile Applications help users do everything from order a pizza to deposit checks. The dark side of this convenience is the risk users may have when the security of the mobile applications are taken for granted.

Risks associated with Mobile Applications

There are many risks associated with the usage of mobile applications. Some of the more prominent ones are:

  • Malware: Malware is software that is intended to do a malicious act. It could damage or disable computers and computer systems, but is often used nowadays to retrieve information from an infected system. A Smartphone is much like a mini-computer so it makes sense that the risk of malware to computers is present on Smartphones as well. Malware can take many forms including Trojans, viruses, worms and others. This software may install things such as key logging software, spyware, botnets and other nasty things. These programs are often used to obtain personal information which can then be used for the financial gain of the criminals who have installed them, sometimes with a significant cost to the person affected.
  • Metadata: Metadata is data that describes a data file. For instance, when a digital picture is taken with a digital camera or Smartphone, there is the information contained in the picture file that recreates the image for others to view. However, in the same image file there is also information about that image, such as where the picture was taken (GPS location), when it was taken and information on the device which took it. Criminals can use this information to track consumers.
  • Application (App) Scams: There seems to be an application that will do just about any task these days. However, some of these apps are developed by criminals who are hoping users will download and install the application, which will then allow them access to the Smartphone’s system, as well as possible user information, such as a credit card number or social security number, or account numbers and passwords stored on the Smartphone.
  • Insecure Applications (Apps): Recent studies show that even legitimate applications can allow sensitive information to be exposed to criminals looking for such information. Some of these applications include banking institutions and major retailers.

Protecting Yourself from the Risks of Mobile Applications

While it may seem like a scary world out there for those who want the convenience of mobile apps, there are ways to protect yourself. Knowing that you have taken preventative measures should ease a bit of the concern. Some things you can do to protect yourself from the risks of mobile apps are:

  • Install an anti-virus software program that protects against spyware and malware as well. Make sure this software is reputable and is kept current through frequent updates.
  • Enroll in a backup program which also provides the capability for your phone to be wiped. This will help protect the information on your phone should it become infected by malware.
  • Research apps to determine if they are safe before downloading them. Look at who developed the app. For most large companies the company should be the developer themselves. If the app is new, or not well known, do a quick Google search to see if there are any reviews of the app. A Google search for “app name – problems” may be rewarding.
  • Review what information you are allowing the application access to when you accept the terms and permissions. Make sure that the amount of information you are allowing the app to have access to is only the information it will need to perform its intended function. If it requires access to lots of personal information, you will have to weigh the need for the app versus the exposure of that information to others.
  • Turn geolocation and GPS off when it is not immediately needed. This can easily be done through the privacy settings on your Smartphone. Droids usually have an icon to turn on or off the GPS function. This will keep your location from being broadcasted unintentionally through picture uploads, tweets, etc.
  • Do not root or jailbreak your phone. This makes it much more susceptible to malware. For more information on jailbreaking and rooting see ITRC Fact Sheet 145 – Smartphone Threats.

Signs that your Smartphone may have been Compromised

One of the problems when a device is infected with malware (or has otherwise been compromised) is it will be difficult for the user to tell. Unless an anti-virus has been installed and alerts users to the presence of malware, there is no notification that a Smartphone has been compromised. However, there are a few indications that may mean that malware is present:

  • Decreased Performance: Just as your PC will slow down when infected with malware a Smartphone will do the same. Problems with slow operation and decreased functionability can mean that malware is present on a phone’s operation system.
  • Random action: If it seems as though your phone has a mind of its own it may mean it is being controlled by an outsider. If applications open on their own, the phone powers on or off by itself or items are downloaded without permission it may mean that software allowing outside access has been installed.
  • In known emails or phone calls: If a Smartphone’s call log shows calls that the you never made or emails have been sent to addresses you don’t recognize, this could be a sign of a Smartphone nabbing infected and compromised.

Steps to Take if You Become a Victim

Protection is key to remaining safe from malware on Smartphone’s.

  • If you have an anti-virus installed on the phone, the detection and removal of any malware should be simple and the anti-virus software will perform the task for you.
  • If you are unable to remove the malware then a backup program with wiping capability will be incredibly helpful. All information should be wiped from the phone and the backup information can be downloaded to a new phone.
  • If you believe that sensitive personal information has been compromised, then you should take appropriate action to protect yourself from identity theft. Please refer to ITRC Fact sheet 120 for information on how to do this.

Definitions

  • Key Logging: The use of a computer program to record every keystroke made by a computer or Smartphone user. The “key-logger” will then send the information to an outside server. This is often used in order to gain fraudulent access to passwords and other confidential information.
  • Spyware: Software that self-installs on a computer, enabling information to be gathered covertly about a person’s Internet use, passwords, etc.
  • Botnets: A network of private computers infected with malicious software and controlled as a group without the owners’ knowledge, e.g., to send spam.
  • Trojan: A Trojan horse, or Trojan, is malware that appears to perform a desirable function for the user prior to run or install but instead facilitates unauthorized access of the user’s computer system.
  • Virus: A Virus is a software program capable of reproducing itself and usually capable of causing great harm to files or other programs on the same computer; they often have methods of infecting other computers.
  • Worms: A computer worm is a self-replicating malware computer program.
  • Geolocation: Geolocation is the identification of the real-world geographic location of an object, such as a cell phone or an Internet-connected computer terminal. For example, a picture taken with a Smartphone may record the location within the picture file. When the file is posted on a social network site, any viewer may be able to determine the location from the data saved on the picture file. This could tell someone exactly where your home is located.