Posts

The coronavirus is making a lasting impact on the United States in many different ways. More than 175,000 people have died from the coronavirus, and 57+ million Americans have filed for unemployment. Another noticeable impact is the dramatic increase in scams and identity theft. There have been more than 92,000 COVID-19 fraud reports and $118+ million lost from fraud, according to the Federal Trade Commission. A story published by the Washington Post reports that no event over the last decade has spawned as many schemes or lasted this long.

Since COVID-19 began seriously affecting the U.S. in March, fraudsters and scammers have been trying to take advantage of the situation to steal or misuse people’s personally identifiable information (PII) in any way possible to commit identity theft. Recently, scammers have been taking advantage of the medical space to commit financial identity theft from COVID-19, using many different methods.

Medicare and Medicaid Scams

There is some good news when it comes to COVID-19 scams. COVID-related phishing scams appear to be on the decline. According to CheckPoint, July saw a 50 percent decrease in COVID-19 scams compared to June. However, CheckPoint reported that COVID-19 medical and vaccine-related scams are still in high demand as the race is on to find a vaccine. The U.S. Department of Health and Human Services Office of the Inspector General (HHS-OIG) echoes a similar message. The HHS-OIG says scammers are offering tests to Medicare beneficiaries in exchange for PII, like Medicare and Medicaid information to commit financial identity theft.

The AMAC Foundation is so concerned about the current issue that they and Medicare.gov are sending a notice warning recipients of the scams. The HHS-OIG believes fraudsters are targeting recipients with telemarketing calls, text messages, social media messages and door-to-door visits in their effort to steal PII. PII can be used to bill Federal health care and commit financial identity theft fraudulently.

Insurance Scams

Insurance scams are another financial identity theft concern from COVID-19 with telemedicine being so widely available, as mentioned by the Coalition Against Insurance Fraud. The Coalition warns that costly insurance scams can exploit the burgeoning arms-length telemedicine. Tele-schemes can steal patients’ identities and defraud their insurance policies.

Medical Identity Theft Threat

While fraudsters are using the medical space to commit financial identity theft from COVID-19, there is also a risk of medical identity theft. According to a story published by CBS Dallas, hackers know more people are using the healthcare system, and they know they can take advantage of the situation.

If hackers get their hands on medical records, it could leave a lasting impact. The Senior Director of Threat Hunting and Intelligence at Binary Defense says someone who steals a victim’s identity can go as far as getting an expensive medical procedure done and charge it to the victim’s insurance account. The story suggests consumers give out the bare minimum amount of PII at medical appointments, ensure the provider’s online portals are secure, and ask providers to delete all of their medical records from the database once they are no longer a patient to help reduce their risk of falling victim to identity theft.

What You Can Do

Scammers are using Medicare and Medicaid scams, insurance scams, and a rise in people using the healthcare system to commit identity theft – particularly financial identity theft from COVID-19. However, there are still actions you can take to reduce your risk of falling victim to a COVID-19 scam or financial identity theft.

  • Medicare and Medicaid beneficiaries should be cautious of any unsolicited requests for Medicare or Medicaid numbers
  • Keep an eye out for unexpected calls or messages that ask for PII. If someone receives a message with a link or an attachment, do not click or open anything. (NOTE: A physician or trusted health care provider will approve any COVID-19 tests or treatments.)
  • Anyone suspicious of COVID-19 healthcare fraud should report it online to the U.S. Department of Health and Human Services Office of Inspector General or call 800.HHS.TIPS

If you are the victim of financial identity theft from COVID-19, or a COVID-19 scam, you can call the Identity Theft Resource Center toll-free at 888.400.5530. You can also live-chat on our website to speak with an expert advisor.


Read more of our latest news below

Being Able to Identify a Phishing Attack is More Important Now Than Ever

Netflix Email Phishing Scam Could Steal Credit Card Information

Hacked Dating Apps are a Popular Target for Social Engineering Scams

Phishing attacks are nothing new. However, with scammers increasingly using sophisticated and new methods of harming recipients that experts are not as familiar with, being able to identify a phishing attack has never been more important. They can arrive as emails, texts, social media messages, phone calls or links to websites which appear to come from someone the victim knows or a legitimate business. It might look like a boss or co-worker, someone in an email contact list, a bank or a consumer’s favorite retailer.

Trusted brands are used to provide an air of credibility for scammers, who capitalize on the good reputation and relationships these brands have built. Some brands that have been used in phishing attacks to target consumers include Wells Fargo, Zoom, American Express, Apple and Microsoft. The companies being used are not involved in these scams; in many ways, they are victims of the scammer as much as the targeted consumer.

Every phishing attack has a different goal, depending on what kind of ruse they are using. Some use links or attachments to insert malicious code on the user’s device so they can collect more information. Others attempt to steal people’s personal and business usernames or passwords,  and others still try to get someone to click on a well-disguised link so they can divert them to a place where the user enters even more information that the fraudster will use to his or her benefit. While phishing attacks have different objectives, the attackers’ primary goal is to steal the information needed to scam individuals and businesses.

Fortunately, the age-old advice about avoiding a phishing attack still holds true. These are some things people should keep in mind when trying to identify a phishing attack.

Check the email address and URL to make sure it is not fake

Check unexpected inbound messages very carefully, paying special attention to the sender’s email or website address included in the message; they might notice something strange. If it says “Amaz0n.com,” for example, it is fake. If the website link is Citibank.card.shop.com (as an example), instead of the company’s actual web address, again, it is probably fake. Always go back to the source of the email (or in this case, the company that is being represented) and check for alerts about potential scams of which they are already aware. Many times, the company is aware and has posted information about the scam.

Never click on an unknown link or open an unexpected attachment

Received an unexpected email, text, social media message or phone call with a link or an attachment?  Consumers should reach out directly to the purported “source” of the communication to verify the validity of the message before clicking on a link or opening an attachment (as mentioned above). Clicking on a malicious link or opening a bogus attachment could lead to someone’s personal information being stolen or infect the device with malware.

Check the message for grammatical errors and awkward phrasing

Read unexpected messages carefully and with a critical eye. Grammatical errors and awkward language are two quick indicators that the email isn’t sent by the company indicated. In trying to identify a phishing attack, customers should remember that companies do not send out emails or other messages with glaring errors – in most cases, large, reputable companies have teams checking their communications for just those types of issues. Smaller businesses may have a looser communication style, but loyal customers will know if something is “off.”  If someone sees any strange mistakes, that is probably a sign it is a fake. In fact, sometimes spelling mistakes are intentional so that only more gullible recipients will interact.

Never trust the caller ID

Do not go by what the caller ID may say. It is easy for a scammer to change the phone number or screen name to say anything, like “IRS” or “County Sheriff’s Department.” If someone calls with an attempt to verify identity information or demands for some kind of payment, consumers should hang up immediately and initiate contact with the company directly using a verified phone number from a trusted source. Here’s a tip: people should put numbers in their contact list for companies that are used regularly – but name them something only they would identify. For example, list the bank as “Bank on 4th & Main St.” instead of by the bank’s name. That way, if there’s an inbound call from the number, the person receiving the call will know they can trust it.

Remember that in many cases, fraudsters are using websites that look like the companies they are pretending to be. A web search could also bring someone to a potential fraudulent site. People should always treat the search results with the same critical eye as they would these other steps.

Phishing attacks can be confusing because of how close to real they can look or sound. Scam websites, emails, phone calls and text messages that mimic trusted brands will continue. However, by implementing these tips to identify a phishing attack, it will help reduce the risk of falling for a phishing attack.

Anyone with additional questions about phishing attacks, or believes they have been a victim of one, can call the Identity Theft Resource Center toll-free at 888.400.5530 to speak with an expert advisor. They can also use the live-chat feature on the website to get the help they need.


You might also like…