Can you believe this is my last newsletter of 2021! I hope you all had a lovely Thanksgiving, and are all set for the holiday season.

This month I start with two shopping related articles - a fake receipt scam which is making the rounds, and an updated set of tips for safe online shopping. Also in this month's issue, AOL changes that need to be addressed in December.

Here's to a safe and warm end to the year!

Regards,

Julie Marto

508-359-8176
508-333-8176 (cell)

P.S. Take advantage of the holiday break and give your student's laptop a cleanup and upgrade!
Scam of the Month - Fake Receipts
I see so many scam and hack attempts that I am adding a feature to my newsletter - Scam of the Month. In these articles, I hope to explain common scams, how to avoid them, and what to do if you fall for one.

The Scam of the Month for December is the "fake receipt" scam, appropriate for this month when we all do plenty of shopping.
How it works: This scam starts with an official looking, but fake, receipt in your email inbox. It might be for an antivirus program (Norton, Windows Defender, or McAfee are most popular) or for a high priced technology purchase, like an iPhone or a computer. Regardless, the fake receipt thanks you for your purchase, lets you know your item is on its way, and gives you a phone number to call, or a link to click on, if you have any questions about the transaction.

What they are trying to do: The key here is how easy they make it to get in touch with them. The receipt is simply bait to try to get you on the phone, so they can engage you in conversation and start their scam. They might offer to log onto your computer to "uninstall" the security software you didn't order, or find some other pretext to get onto your computer.

Once they get onto your computer, there is no telling where the scam will lead. Last year I posted, verbatim, the following police report from Wellesley:

On November 10, 2020 Officer Kane spoke with a female reporting party who stated she was scammed out of $8,000 by a person who claimed to be from a technical support company.  She had received a renewal notice from US Tech Support regarding antivirus protection and contacted them to cancel the service.  When she contacted them she was advised there were several steps necessary to complete the process.  The male party advised her because she had never used the service they would credit her $100 and that she needed to open an account where the funds could be deposited.  She opened an account and provided the male party with the account information.  A transfer of $10,000 had occurred and the male party told the reporting party that she had made a mistake . . . which resulted in excess funds being transferred and she could repay the funds by obtaining $500 gift cards from Best Buy and . . . then buy more from Stop and Shop, Target and CVS.  The male party advised her to tell the store employees she was purchasing these gift cards as Christmas presents for family members so they wouldn’t decline the purchases.  The additional gift card purchases were declined by her bank.  She offered to withdraw cash to repay the company at which point the male party stated they would accept $6,000 in a transfer and he provided information for a bank account in Thailand.  He advised her to tell the bank that she was planning a trip to Thailand and the payment was for a travel agency.  After the wire transfer was completed she checked the account she opened and found the deposit had not cleared.  

What else can happen: Once you let a scammer onto your computer, they have carte blanche to do whatever else they want. This includes stealing passwords and financial information, and leaving behind software that tracks your keystrokes. Additionally, they often call previous victims back in order to try to scam them again.

How to avoid the scam: If you see an emailed receipt you don't recognize, don't call the phone number or click on the link to question it. Call your bank or credit card company directly (using the phone number on the back of your card or on your statement) and see if there are any unauthorized charges. If there are none, you can safely ignore the email. Remember, your limit of liability for unauthorized charges on your credit card is only $50.00.

If you are unsure if a receipt is real or fake, you can always forward it to me for review - I'll get back to you as soon as I can and let you know if you need to take action.

What if you fall for it: The sooner you act, the better. If you have let the scammers onto your computer, shut down your system until it can be cleaned by me or another computer professional. You should also change all of your key passwords on a known clean system.

If you have lost money to the scammers, you should contact your local police department and file a fraud report. If you used your credit card to pay the scammers, call the number on the card to report the fraud and see if you can reverse the charges. And, if you allowed the scammers access to your bank account, you should go to your local bank branch and follow their procedure for scam victims, which might involve closing your account and opening a new one.

Remember, if you get a receipt you don't recognize, never call the phone number or click on the link they provide. Check your credit card accounts for transactions you don't recognize. If there are none, you can assume the receipt is a scam. Even if it's not, you can always dispute the charges later with your credit card company. That hassle, unlikely though it is, is a lot easier to deal with than what can happen if you allow the scammers to get you!
Shopping Safely Online
I first wrote this article when online shopping was still a novelty. Now, most people do at least a portion of their holiday shopping online. I've updated it to reflect current changes, but it's more important than ever to follow these tips to stay safe.
With the holiday season upon us, it's a good idea to review some basic safety tips for shopping online. I am often asked if it's "safe" to shop online, and I answer that it's probably safer than driving to the mall, as long as you follow these simple guidelines:




  • Buy from trusted merchants. If the deal looks too good to be true, it probably is. Remember, Google is your friend. I often search online for a specific product and am presented with a long list of vendors sorted by price. Frequently the least expensive options are from companies I have never heard of. I always use Google or another search engine to do a quick investigation of the vendor and see if they are reputable or not. This small extra step can save you from ordering a gift that will never arrive, or worse, giving your personal information to a crook.

  • Know who and where you are actually buying from. Amazon, Rakutan, even Walmart, act as storefronts for multiple small vendors. Prior to placing your order, check who the seller is. If it's not the store you went to, exercise caution, especially for big ticket items. And while you are at it, make sure the product you are buying is new (if you expect it to be) and comes with a US, not international, warranty.

  • Keep an eye out for fake reviews. Multiple 5 star ratings for an obscure product should raise your suspicions. With so many online options to choose from, unscrupulous merchants might hire some creative writers to make their product look better than it actually is. I use Fakespot Analyzer to review the reviews, and weed out the counterfeiters. 

  • Create a separate email address just for shopping. You need to get email communications from merchants about your orders, and you might want to hear about future sales or promotions. But who wants their personal email inbox cluttered with that type of communications? Also, less scrupulous merchants sometimes sell your information to spammers, or leave email addresses vulnerable to harvesting by hackers. If you set up an email account that you use exclusively for shopping you can limit your vulnerability to spammers and keep control over your "real" inbox.

  • Check your credit card accounts frequently. Don't wait until you get a statement to check accounts you use for online transactions. Log into your credit card account online periodically, or call the number on the card to see what charges have been made. Remember, the sooner you report any unauthorized charges the sooner any problems can be nipped in the bud.

  • Don't shop online from a public WIFI hotspot. Public WIFI is inherently insecure, as you are basically sharing a network with everybody else around you. The person drinking coffee next to you could be using very simple "sniffing" software to track your keystrokes and try to steal your personal information. Wait until you are home and on your own network to do any type of e-commerce, or use your phone as a personal hotspot.
AOL Security Changes
Last month, most of you who use AOL, including anyone migrated from Verizon, received an email notifying you that, due to security changes, you would have to take some steps to continue to access your AOL mail in third party email applications. Many of you were concerned this was a scam email, and many of you were confused about what to do.
Firstly, this is a legitimate email, and you should pay attention to it. Whether you need to do anything or not is hard to tell. As a security measure, AOL is requiring third party apps to use something called OAuth2, which opens up a browser window to log directly in to AOL, rather than just entering your password into the app. The problem is that many apps don't have the capability of opening up that browser window, so what you need to do depends on how you get your email. It also might be unclear whether you have already logged in with OAuth2, and are fine.

You can tell if your email application supports OAuth2 if it pops up with an AOL sign in screen when you add your account to the application. If it doesn't, not only won't it log you in, but it will tell you that your password is wrong. The solution is to generate something called an "application specific password" - a one-use password meant only for that application, that you create at the security page of your AOL account. Yes, this is confusing, and yes, it's not obvious what you have to do.

Here's a list of common ways to get your AOL mail, and whether or not they support OAuth2:

  • Log directly into AOL with a browser, or use an AOL application like AOL Gold or the AOL app for IOS or Android - no change needed. If you can't get your mail in your third party app, you can always go directly to AOL to get your email until I can fix the problem

  • MacMail with MacOS Catalina or higher - OAuth2 compatible, probably have to do nothing, but might have to sign out and in again

  • MacMail with an older Mac, Outlook, Windows Live Mail, or Windows 10 Mail - cannot use OAuth2, you will have to generate and use an application specific password

  • iPhone or iPad Mail App - OAuth2 compatible, probably have to do nothing, but might have to sign out and in again

  • Gmail application on Android or iPhone - cannot use OAuth2, you will have to generate and use an application specific password

This particular change has been in the works for a long time, and a lot of you are already signed in the correct way. If you have had me set up an AOL or Verizon account for you in the last 6 months or so, there is every reason to think you will be fine. If you find that you cannot access your email in your applications after the date in your letter, just go directly to www.aol.com to get your email until I can get there to fix things for you!