|
PERF’s COVID-19 coronavirus resources, including past editions of the Daily COVID-19 Report, are available at https://www.policeforum.org/coronavirus.
What Law Enforcement Agencies Are Seeing in COVID-Related Cybercrime
Police departments and sheriffs’ offices have been telling PERF that fraud and cybercrime are of increasing concern, because criminal offenders are capitalizing on new types of vulnerabilities resulting from COVID-19 issues.
Today’s COVID-19 Report details what we have heard from the several federal and local agencies about these new threats. Today’s report also includes a PERF interview of Jim Emerson, Vice President at the National White Collar Crime Center (NW3C).
NYPD Outlines Types of Scams Being Perpetrated
Last week, the New York Police Department’s Intelligence Bureau and Counterterrorism Bureau published a four-page report titled “Scams and Fraud Campaigns Exploiting COVID-19 Likely to Continue.”
“The COVID-19 pandemic has created an environment ripe for fraudulent activity, with threat actors leveraging fears of the virus to perpetrate a variety of malicious and criminal exploitation,” the NYPD report said. “Observed scams and fraud have included selling fraudulent personal protective equipment, hawking fake cures and tests, spreading disinformation, phishing campaigns, and other related scams.”
The NYPD report provided the following examples:
- Fake PPE deals: A deal brokered by a California healthcare union that sought to facilitate the sale of 39 million N95 face masks to hospitals in California and New York turned out to be fraudulent. The fraud was detected when one of the buyers complained it had not received its order of six million masks.
- Fake cures: Opportunistic actors have also sought to push fake tests and cures for COVID-19, both online and in person.
- Malware and malicious websites: COVID-19-related phishing campaigns include emails impersonating healthcare professionals and organizations such as the CDC, which promise information on COVID-19, then send users to malicious websites that can steal log-in credentials and plant malware. The forms of malware employed include ransomware, spyware, and other types that steal or destroy data.
- Fake federal relief instructions: Exploiting newly-passed federal relief and stimulus packages, some campaigns claim to provide links for individuals to sign up for government assistance, instead stealing personally identifiable information.
- Blackmail threats: COVID-19 related blackmail scams have also been circulating in which the fraudster contacts the victim by email and threatens to infect the victim’s family with COVID-19 if s/he does not pay the fraudster money or cryptocurrency.Based on the researched dataset, this type of fraud has had limited success.
FBI Warns of Medical-Related COVID Schemes
The FBI issued a warning about two additional types of COVID-related fraud schemes:
COVID-19 testing schemes: Beware of individuals who contact you in person, by phone, or by email to tell you the government requires you to take a COVID-19 test. These scammers will likely ask for your health insurance information, including your Medicare or Medicaid number, and other personal information. Once scammers obtain an individual’s personal information, they use it to bill federal health care programs and/or private health insurance plans for tests and procedures the individual did not receive, and they pocket the proceeds.
Also beware of individuals offering to sell you a COVID-19 test kit or supplies, especially when these contacts are unexpected. Legitimate tests are offered free to patients when administered by a health care professional.
COVID-19 treatment schemes: Legitimate medical professionals and scientists throughout the U.S. are working hard to find a cure, approved treatment, and vaccine for COVID-19. Unfortunately, they don’t yet exist.
When an approved treatment or cure becomes available, the first time you hear about it will not be through an email, telephone call, online advertisement, or unsolicited in-person sales pitch from a stranger.
You should also beware of scammers claiming to be medical professionals and demanding payment for treating a friend or relative for COVID-19.
Homeland Security Investigations Flyer Provides the Public with Tips to Protect Themselves
ICE Homeland Security Investigations shared this flyer as part of its S.T.O.P. (Strategic Targeted Outreach Program) COVID-19 Fraud initiative. It provides the public with advice about how they can avoid fraud when online shopping, managing their finances, and searching for pharmaceuticals and medical devices.
Ottawa Police Service Details Phishing Schemes
The Ottawa, Ontario Police Service described how malicious actors are using COVID-related “phishing” attacks, in which they send fake emails or direct victims to fake websites, masquerading as legitimate government agencies or companies, in order to obtain credit card numbers, passwords, or other information:
Threat actors are actively using the COVID-19 pandemic as a cyberattack vector. There are active phishing campaigns that are attempting to get users to click on links by various means such as:
- Offering vaccines, cures, or tests,
- Fake insurance reminders or insurance claims,
- Providing information and/or updates regarding COVID-19,
- Providing maps regarding the spread of COVID-19,
- Soliciting donations to organizations.
Threat actors are using the branding of “trusted” organizations such as the World Health Organization or the U.S. Centers for Disease Control and Prevention as a way to establish credibility and get users to open attachments or click on links.
To help protect yourself:
- Go to the official websites of trusted organizations when looking for information regarding COVID-19, rather than clicking on a link in an email.
- Be suspicious of emails claiming to come from organizations such as the World Health Organization.
- Remember to hover over links to view the real destination.
Herndon, VA Police Chief Urges Special Care to Protect Children
Herndon, VA Chief Maggie DeBoard sent a video message to her community on Facebook that included a warning to parents about heightened risks in a time of a pandemic. See 5:55-6:50 of this video for Chief DeBoard’s message.
"If you are a parent, I really urge you to monitor your kids’ activities online. This is a time when our kids get bored, and they’re glued to social media at even greater levels. And child predators are lying in wait in the background to find creative ways to connect with your kids. Know this. Know that you need to monitor your kids. Know their passwords. Put parental controls in place. Have discussions about what is appropriate and inappropriate contact to have online."
PERF Interview:
NW3C Vice President Jim Emerson: How Police Can Help Protect Their Communities
Chuck Wexler spoke with Jim Emerson, Vice President at the National White Collar Crime Center (NW3C), about the threats that law enforcement agencies and the general public should be aware of.
Wexler: Tell me about the National White Collar Crime Center.
Jim Emerson: The National White Collar Crime Center has been around for over 40 years. As white collar crime and financial crime became more technology-based, the Center developed core competencies in that area.
Wexler: What are the trends that you’re seeing?
Jim Emerson: In a disaster, and specifically a pandemic, there’s an increased opportunity to take advantage of people’s emotional upset, or use the sense of urgency that people might have to do something.
Our highest concern has been around the healthcare sector. People are engaging hospital administrators, suppliers, and the general public in a fraudulent fashion, either trying to gouge prices or rip them off.
For example, people are looking for protective masks, and they may be paying way too much for a mask that may or may not be legitimate. Basically all N-95 masks are going to hospitals right now, so if you try to buy one online, it’s probably expired, or won’t fit properly, or is counterfeit. So, as a consumer, you need to follow the CDC guidance and recognize that you’re probably not going to have an opportunity to buy legitimate N-95 masks.
There’s also been a rash of people pretending to sell some sort of medical treatment or prevention online, which is just straightforward fraud.
Millions of people are expecting checks from the U.S. government as a result of the CARES Act. U.S. postal inspectors expect mail theft, which would ultimately result in identity theft to cash checks illegally. We’re also expecting check-cashing schemes, where people offer to cash checks for those who don’t want to leave their homes.
Wexler: What role do local police have in responding to crimes like this?
Jim Emerson: The amount of fraud investigative work handled by local police has dramatically increased over the last 5 to 10 years, so some agencies will have more experience than others. How complaints are reported and filed is important because, in some cases, evidence is fragile. The report should capture all the information it can, but a municipal agency may not have the resources to act on every complaint.
Last month, the U.S. Attorney General directed U.S. attorneys to assign a prosecutor in each district to coordinate these fraud investigations and work with federal, state, and local officials in a collaborative effort. Some states have formed task forces.
Smaller agencies, especially, may need to work with their county prosecutors and larger state police forces, which may be better equipped to work a complaint.
Wexler: How should police chiefs discuss this issue with the public?
Jim Emerson: The first message is that people should slow down, be deliberate, and verify information they receive.
The rules haven’t really changed. It wasn’t normal in the past for people to ask you for your personal information over the phone or online, and it’s not normal now.
The public needs to slow down, think through the circumstances, and verify information and requests they receive for information. When in doubt, they should check with legitimate, verified sources.
People also should make a copy or preserve documentation of anything they’re experiencing. That might just involve writing something down, or taking a screenshot of a text message that looks suspicious. Then they should report it. Even when people are savvy and don’t fall victim to a scheme, they can provide details that might help someone else from being victimized.
The PERF Daily COVID-19 Report is part of the Critical Issues in Policing project, supported by the Motorola Solutions Foundation.
PERF also is grateful to the Howard G. Buffett Foundation for supporting PERF’s COVID-19 work.
|
