Instructor: Fraud and Scams.
In this lesson we're going to talk about some fraud and scams
because these are types of social engineering.
Now, the first thing I want to talk about is fraud.
What exactly is a fraud?
Well, when you're dealing with a fraud,
you're dealing with the wrongful or criminal deception
intended to result in financial or personal gain.
So if I'm trying to commit fraud against you,
I'm trying to essentially steal from you in some way.
But I'm not really stealing like picking your pocket,
you're actually giving it to me,
because I'm going to trick you into doing it.
And that's why this is part of social engineering.
Now, one of the most common frauds that we deal with
inside of cybersecurity is identity fraud.
Identity fraud is the use by one person
of another person's personal information,
without their authorization, to commit a crime or to deceive
or defraud that other person or some other third party.
Really what this sounds like is identity theft, right?
We hear that term a lot these days.
When we talk about somebody who stole
your social security number, or your date of birth,
or your personal information, or where you were born.
All of that information can be used to steal your identity.
Now when somebody commits identity theft,
they're actually stealing another person's identity
and using it as their own.
So they're going to actually become you.
They want to take your social security number,
and they're going to apply for new credit as if they're you.
They're taking over your identity.
That's the idea with identity theft.
Now, often we hear identity fraud
and identity theft being used interchangeably.
Now there's really a misconception here
because there is a difference between identity fraud
and identity theft.
With identity fraud
I might just take your credit card number
and then go make charges as if I'm you.
That's not technically identity theft,
that's just identity fraud.
But these days, most people will use both terms
interchangeably and more commonly you'll hear identity theft
as the term.
For the exam though, they prefer the term identity fraud.
Now, the next thing I want to talk about is scams.
What exactly is a scam?
Well, a scam is a fraudulent or deceptive act or operation.
That's it. It's really simple.
Essentially it's somebody trying to deceive you
into doing something.
Now I can do that in a lot of different ways,
but the one that we are most worried about
as cybersecurity professionals is what's known
as an invoice scam.
This is because it is commonly used
against small businesses,
medium-sized businesses and large businesses.
When we talk about an invoice scam,
this is a scam in which a person is tricked into paying
for a fake invoice for a product or service
that they did not actually order.
Now there's many different variations of this invoice scam,
but the typical one is something like this.
You get a phone call,
and as you answer the phone call
as the receptionist for your office,
they ask you a couple of basic questions.
They might ask you questions
about the type of printer you have,
or to verify an order that you've placed
for a certain type of toner.
So they'll say, "Oh, do you have an HP LaserJet XYZ model?"
And you'll say, "Oh no, we have the YAZ model."
They go, "Oh okay, I'll make sure
I get that fixed on the order."
And then a couple of days later
on your doorstep is some toner.
And you're like, okay, that tracks, I had the call.
I ordered the toner.
I verified the model and now the toner showed up.
But when you look at that bill,
you're going to get this invoice
and it's going to be exceptionally large for what you got.
And when you look at it, you may find that you paid
two or five or 10 times the cost of what that toner is
if you just went to Amazon or Office Depot to buy it.
And that's why this is called an invoice scam.
Now, once you get that bill, you're really surprised, right?
And then your boss starts looking at it
and they start saying
"Hey, why is our toner budget all blown up?
Why are we way over budget here?"
And it's usually because somebody has fallen
for one of these invoice scams.
Now it's not just toner,
although it's one of the more common ones,
I've seen it done with printer paper,
toner, office supplies, trash bags,
janitorial services, all sorts of different things.
And so you want to make sure you're on the lookout
for these types of things inside your organization.
Now, when we talk about identity fraud and invoice scams,
these are rather low-tech social engineering techniques.
For example with identity fraud,
I might call you up on the phone
and get you to give me information,
like your date of birth or your mother's maiden name
or things like that.
And then use that to steal pieces of your identity.
But it doesn't have to be low-tech.
It can be very technical as well.
For example, there's a thing called prepending.
And this is a very technical method that's used
in social engineering to trick users
into entering their usernames and passwords
and other sensitive information
by adding what's considered essentially an invisible string
before the web link when they go to click
on something in an email.
So if we go and look at pretending,
what we're going to see is that there's this prepended string
that's called data:text.
And anything beyond that is going to be some form of data
that's now being converted.
So in this case, I have data:text/html.
What type of data is it?
Well it's text or HTML data.
Then there's a comma and everything
beyond that is going to be what is treated as data.
And so if you look here
and I clicked on a link and I see https,
accounts.google.com/ServiceLogin:service=mail.
That looks normal.
That's what you would get
if you were trying to log in using your Gmail account.
But what you're not seeing is everything else
beyond that, as it goes past the scroll bar
of that browser and all the rest of that could have things
like small files that are inline of these documents.
And so when you're going to that,
instead of being brought to Google,
you're actually being brought
to a page that looks like Google.
And when you enter that data
it's now going to go into my system
and I'm going to be able to steal your identity,
perform an invoice scam,
or other things by using this prepending technique.