|
|
Welcome to February. I hope you have been enjoying our mild winter - I certainly have been, and would like to to continue!
February's SOTM is more a tutorial, about how to spot a scam email. Next, I address the LastPass breach, a major security issue that affects anybody who has passwords stored at LastPass. And lastly, I had a client who accidently deleted all his files by not understanding the difference between backing up and syncing, prompting my final article of the month.
Stay warm and stay well!
Regards,
Julie Marto
508-359-8176
508-333-8176 (cell)
P.S. Time for a tune-up? Call me to schedule an annual visit! |
|
SOTM: Spotting a Scam Email |
|
I see so many scam and hack attempts that I have added a feature to my newsletter called Scam of the Month. In these articles, I hope to explain common scams, how to avoid them, and what to do if you fall for one.
Many of the scams I see are initiated through phishing emails - emails that are designed to trick you into calling or otherwise engaging with scammers, or giving away your on-line credentials. |
|
|
I often get calls from clients who have received questionable emails and want to know if I think they are legit. I have them forward the emails for me to inspect and render judgement. Usually, I can quickly determine if an email is a scam or not, but sometimes it takes a bit more time. Here's what to look for so you can keep yourself safe:
The wrong return address - Most professional organizations send emails from their own domain. Emails from me come from julie@thecomputermom.com, not from juliecomputermom@yahoo.com. The very first thing you should check when you get an email from a corporation is that the domain is correct. Most informational emails from big companies like AOL, Yahoo, Comcast. Microsoft, etc., come from internal email addresses like noreply@companyname.com, sales@companyname.com, or info@companyname.com. If the return email address is from a free email service, or a personal email address, you can be sure it's a scam. Unfortunately, there are ways to make an email look like it came from the correct domain, so just coming from the correct email address does not guarantee the email is not spam, but it's a good place to start.
Poor English spelling or grammar - Before you act on an email, read the subject line and the email itself with a critical eye. When legitimate companies communicate with customers, their corporate image depends on those communications looking professional and well written. Most scam emails are sent from outside of the country, and written by non-native English speakers. Apart from obvious grammar and spelling errors, the use of British vs. American idiom is very common. If the email doesn't seem as if it's been written by an American and properly proof read, it is a scam.
A prominent phone number to call - it's expensive to staff customer service lines with human beings. That's why it's hard to find support phone numbers, and once you have one, you are forced through an automated "help" system that can be frustrating and less than helpful. Any email that includes a prominent number to call is suspect, because making it easy to call means they plan to make money on that call, by initiating their scam.
The email is in your spam or junk folder - I can't tell you how often people ask me about emails that are in their spam folder. Truthfully, if your email service decided that the email is junk, they are probably right. Unless it's an email you were actually expecting (in which case you have another problem), if your email provider tells you an email is spam, trust their judgment!
Most of the time, emails sent to me to check turn out to be scams - However there are a few legitimate emails frequently forwarded to me, emails that seem suspicious but are actually real. Here are a few to look out for:
- Apple letting you know you need to buy more iCloud storage
- Google letting you know it's time to pay for more storage - that comes from the Google Play store, which you may or may not know you are actually using.
- Microsoft informing you it's time to pay for your Microsoft 365 subscription
- Any cloud based subscription service that you actually use, saying stored credit card information is out of date and needs to be updated
If you get an email you are unsure of, don't act on it until you forward it to me at julie@thecomputermom.com. I'll get back to you as soon as I can, and let you know if it's legit, or if you should just delete and ignore. And, if you get one that seems to be legitimate, don't call the number in the email, or follow any links. Go directly to the senders website to log in, or call the phone number on the back of your credit or debit card. |
|
For a number of reasons, I have never written about password managers, although many of my clients use them. I, personally, have used LastPass for years, and have recommended it when specifically asked about password managers. Unfortunately, LastPass has not only suffered a bad breach, but handled it badly, prompting action on my part, and this article. |
|
Password managers are programs that keep all of your user names and passwords in what's called a vault, usually stored in the cloud. The vault is locked with a master password, and the password manager includes tools to automatically fill in your user name and password when you visit a web site, freeing you from needing to remember anything but the master password. Password managers have other features as well, offering to generate strong new passwords for you, letting you know if your passwords are safe or have been breached, and working across platforms, filling in password data on all different browsers and mobile apps. The idea is that, as long as you create and remember a strong master password, you won't have to recall any of the other passwords you have created and use at any other site.
Regardless of what you do next, you should immediately change your LastPass master password. However, due to the type of breach, just changing your master password is not enough to mitigate the threat. If hackers manage to figure out your master password, they will open your personal vault and know every single password you have stored there. If you used LastPass in August 2022 or before, you need to change every single password you use. Yes, I know, this is a huge project. I know because I am in the middle of doing it myself. Here is the process I am following:
-
Export your existing LastPass password vault - log into LastPass, click on "Advanced Options", then click on "export". Enter your master password, and all of your stored logins will download as a CSV file - a file that can be opened with a spreadsheet program. It might be easiest to print the file, but be careful to keep it safe, and shred it once you are done.
-
Prioritize which accounts you work on - once you have your vault exported, you can make a plan as to which passwords to change first. You want to start with email accounts (even accounts you rarely or never use), financial accounts, social media accounts, and work and health care related accounts. Use this opportunity to clean things up - close accounts you never use, and enable two factor authentication for any accounts that offer it.
- For each account you need to change, start by going to their website and attempting to log in with the credentials stored at LastPass. If those credentials don't work, the account is safe. This happens a lot with older accounts that you rarely use - they get closed, or the password requirements change. If you can log in with the stored credentials, look for the account settings for that website, and follow their steps to change your password. This will be a different process for every account. Make sure you choose a strong, unique password for each site.
Obviously, for LastPass users, this is a very serious situation, especially if you have a master password that is less than 12 characters, or has been reused on any other site. If you need any help working through this process, please give me a call.
|
|
Difference between Backup and Sync |
|
Most of us are using some sort of cloud system to store our pictures, emails, and documents. Keeping your data in the cloud can be a very good idea, as it means your pictures and documents are stored off-site, and can be recovered if your computer dies or you lose your phone. However, it's very important to understand the difference between "back-up" and "sync". |
|
|
Syncing is a two way street. When you make changes on one device, the changes are updated in the Cloud and then mirrored on your other devices.
Backup is a one way street - Backups make a copy of everything on your device, and that copy remains static, regardless of what happens on your devices. If you make changes on your device that you wish to undo, you can go back to the copy and retrieve your files.
iCloud, OneDrive, and Google Drive are all syncing systems. Although they can be thought of as "backups", they actually maintain the exact same data on any signed-in device. So, if you are using iCloud for your photos, when you delete a picture on your iPhone, it will also be deleted on your iMac and in iCloud. If you are using OneDrive to sync your documents, editing a document in one location will change it in all locations. This is an excellent approach when you want to be device independent - you want all your data to be the same, regardless of which device you are using when you edit it. Most email systems work this way, and so you don't have to delete an old email twice - it's very convenient.
Time Machine, File History, Acronis, and Carbonite are back-up systems. These programs make continuous copies of what's on your computer, so if you accidentally lose some or all of your files, you can recover them from the backup. These backup systems are excellent for restoring anything you have on your system, even if you accidently delete a synced file. Time Machine and File History store their backups on an external drive attached to your computer. Acronis uses an external drive with an optional cloud component. Carbonite, and its competitors, are fully cloud based back-up systems.
Why is it important to know this? Because, if you are using a syncing system, you must be VERY careful what you delete, and how you delete it. If you need to free up space used by photos on your iPhone, you cannot just delete the photos - you need to go into settings and tell the system to optimize storage. If you want to wipe your system for disposal, you need to sign out of your cloud storage system first.
It's fine to use a cloud based syncing system as your main backup - I do so myself. But you must understand the limitations of that approach, and handle your personal files accordingly. If you are unsure if you are backing up or syncing, give me a call and we can figure it out together! |
|
ComputerMom | 508-333-8176 | www.thecomputermom.com |
|
|
|
|
|
|
