In this lesson,
we're going to talk about some fraud and scams.
Frauds and scams
are considered to be a form of social engineering.
First, we have fraud.
Fraud is a wrongful or criminal deception
that is intended to result in financial or personal gain
for the attacker.
Basically, when an attacker attempts
to commit fraud against you,
they are trying to essentially steal from you in some way.
The difference between fraud and regular theft though
is that with fraud,
you're going to be tricked into handing over your valuables
such as your information or your money
instead of the attacker breaking into your account
and stealing it directly from you.
This is why it is considered
to be part of social engineering.
One of the most common types of fraud
that you will see online
is known as identity fraud or identity theft.
Identity fraud or identity theft
involves the use by one person
of another person's personal information
without their authorization to commit a crime or deceive
or defraud that other person or some other third party.
These days, we commonly hear the terms identity fraud
or identity theft.
Criminals are routinely trying to steal
your social security number, your date of birth,
where you're born and other sensitive personal information
that could be used to steal your identity.
Now, when somebody commits identity theft,
they're actually stealing another person's identity
and using it as their own.
Their goal is to impersonate their victim
so that they can take their social security number
and apply for a new credit card
as if they were the victimized person.
Often, you will hear the terms identity fraud
and identity theft being used interchangeably
even though there is a slight difference between them.
With identity fraud,
the attacker might just take the victim's credit card
and then go make charges as if they were the victim.
Technically, this is considered identity fraud
and not identity theft.
For it to be identity theft,
the attacker will try to fully assume
the identity of the victim.
For example, if a person from outside of the United States
stole your name, address, social security number
and birthdate from you
and then started a new job in the United States
using your social security number and your identity,
that would technically be identity theft
and not identity fraud but these days,
more people will use both terms interchangeably
and more commonly, you'll hear identity theft used
as the preferred combined term
even though CompTIA prefers to use the term identity fraud
to describe both of these types of attacks.
Scams on the other hand are simply a fraudulent
or deceptive act or operation.
It is a really short definition
for a really large and broad concept.
Essentially, a scam occurs
whenever someone tries to deceive their victim
into doing something.
Now, there are many different ways
that scams can be conducted
but for our purposes, let's just consider a common scam
that is used against businesses all the time.
This common scam is called the invoice scam.
When we talk about an invoice scam, this is a scam
in which a person is tricked into paying for a fake invoice
for a product or service that they did not actually order.
Now, there's many different variations of this invoice scam
but typical one goes something like this.
An employee at your company gets a phone call
and when they answer the phone call,
they are asked a few basic questions by the attacker.
This attacker might ask you a few questions
about type of printer you have
or verify an order that you've placed
for a certain type of toner.
So they'll say, "oh,
are you still using the HP LaserJet A330?"
Now, they may or may not know
what model the company is using
but they're trying to set up a pretext during the call.
The employee might agree if the attacker guessed right
or may correct the attacker by saying something like,
"oh no, we are currently using the Lexmark B612 printer"
and then the attacker will acknowledge the change
and react by saying something like,
"oh, I'll make sure to get that fixed on the order.
I have an order for two boxes of toner
ready to ship out to your office.
It should be there by tomorrow, okay,"
and instinctively, the employee will say "yes" or "okay"
and the attacker now has them recorded saying yes
then a couple days later,
the boxes of toner will arrive to the office.
The employee thinks nothing is wrong
since they took the call and verified the order
and then the toner arrived
but the company gets the bill for that toner
and it will be a really large amount over the retail cost
of the same toner from an office supply store.
For example, you might be able to order that toner
for $100 per box on Amazon or at Office Depot
but you just received a bill for $950 for two boxes of toner
that an attacker shipped to your office.
Now, the reason this is called an invoice scam
is because you have now received a legitimate invoice
from this attacker for the toner
and it will state that there was no refunds or no exchanges
and they have a recording of your employee saying okay
or yes to place that order.
Now, this invoice scam doesn't just involve toner
but it can be anything your office consumes regularly.
So your staff needs to be trained
on how to avoid falling victim to these types of attacks.
Another more technical attack involving invoice scams
occurs when an attacker sends an invoice
to the billing department of your company
as a PDF attachment to a spear-phish email.
When the billing department's employee opens the invoice
to see how much is due, the PDF uses embedded malicious code
to inflict their computer
and provide the attacker access to it
using a remote access trojan.
Again, if you receive an email from an untrusted
or unknown sender, it should be analyzed
before you open the attachments especially PDFs of invoices
since they could contain malware
that could affect your entire enterprise.
So remember, when we talk about identity fraud
and invoice scams, these are considered
to be rather low tech social engineering techniques.
For example, with identity fraud,
an attacker might call you on the phone
and get you to give the information
just like your date of birth or your mother's maiden name
or things like that to steal pieces of your identity
but these attacks can be technical such as embedded malware
inside of an invoice scam spear-phishing email.