How Does Malware Hurt a Business?

Right before Thanksgiving 2011, BBB became part of a huge phishing scam that continues to this day. Millions of pieces of email bearing our name and/or logo have been sent to consumers and business owners in the hopes the recipient will click on a link or open an attachment that launches malware. We responded aggressively to this illegal use of our name by assigning an IT professional on our national staff to manage the problem on the full-time basis, hiring a third-party vendor to help us shut down the referring websites, and launching BBB Scam Stopper (bbb.org/scam) to educate consumers about all kinds of scams.

Technology blogger Dan Steiner has an interesting post yesterday that just happened to mention “our” scam. He notes that globally malware is now a $100 billion problem, and he says all business owners need to think of IT security as a business necessity, not a luxury:

“How does malware hurt a business? By far the most damaging of cost of malware is on business reputation. Google, the world’s most popular search engine, protects users with its Safe Browsing Feature. If an online business, no matter how reputable, accidentally distributes a virus, Google automatically flags it. This leads to an ominous surfer warning or even removal from Google search results. Although a site can eventually be removed from blacklisting, it means weeks or months of lost business.  A lull like that is the kiss of death for many businesses.”

Read the whole story here on Business2Community.

How Fake FTC Emails are Tricking Business Owners

A new phishing scam is making the rounds disguised as a consumer complaint notification from the FTC. If you receive it, just hit "delete."  

How the Scam Works:

You get an email that appears to be from the FTC with the subject line: "Notification of a Consumer Complaint." (Sample email below) The email states that a complaint has been filed against your business, and you need to review and respond to the allegations. 

The email provides a link for you to supposedly click through to the FTC website and download a PDF of the complaint details. The link really goes to a third party website, and the file you download is actually malware that scans your computer for personal and banking information.

Like most scams, this one is not set in stone. Several variations already exist, and scammers will continue to alter the emails as news of the con spreads. Watch out for changes in the subject line and the complaint details. Older reports of the scam involve emails that urge recipients to call a fake FTC help hotline or complete an online complaint form.  

How to Spot a Phishing Email:  

• Don't believe what you see. Scammers can make links look like they lead to legitimate websites (as in the example above) and emails appear to come from a different sender. It's also easy to steal the colors, logos and email header of the FTC or any other established organization.
• Be wary of unexpected emails that contain links or attachments.Do not click on the links or open the files.
• Check a link's true destination by hovering over it and looking in the lower right hand corner of your browser.
• Try Googling the organization or the contents of the email. If the email is a scam, this is likely to reveal an alert or bring you to the organization's real website, where they may have posted further information.

For More Information  
Check out the Federal Trade Commission's official warning about the scam.
 
To find out more about scams, check out BBB Scam Stopper.

Another BBB Phishing Scam. Don’t Bite!

Phishing scams look like legitimate email, and they are getting more sophisticated every day. What these con artists are really after is your banking and financial information. And they won’t mind destroying your computer to get it.

Once again, scammers are sending emails that appear to come from your trusted Better Business Bureau. They’ll tell you that a complaint has been registered against your business, or that a customer has submitted a review of your business. (It doesn’t matter that you might not even OWN a business.)

The email will ask you to download and complete an attached form, or it will ask you to click on a link to view and respond to the consumer posting. Don’t do either!

The “attached form” is actually an executable file that will drop a nasty virus onto your system. Next thing you know, you’ll see a pop-up message that claims your computer is infected with dozens of viruses, and that will offer to clean your system for a fee. If you provide your credit card or banking information to have your system cleaned, you will waste your money, and the scammers will then have access to your funds and will steal even more of your money.

The links in the bogus email are dangerous, as well. They look like a link to a BBB page, but the code behind the link will actually route your browser to a website where malware is dropped onto your computer. The malware is written in such a way that it usually passes by anti-virus programs undetected. Once the malware is in place, the scammer can sniff for your banking information (including user names and passwords), and can use your system to send more scam emails out to your contacts under your name.

The bottom line is this: If you don’t own a business, you can disregard any BBB email that claims your company has been the subject of a customer communication. If you do own a business, you can always check with your local office to confirm the legitimacy of any email purporting to come from BBB. To find your local office, visit www.bbb.org/find. But never click on a link in an email or download an attachment unless and until you confirm that it truly came from BBB.

BBB would like you to send us any bogus emails claiming to come from BBB. Forward the email(s) to phishing@council.bbb.org. Don’t worry if you receive a notification that the email could not be delivered because of an attached virus. We pull them from quarantine and examine them anyway. Please understand that we would like to reply to each email, however, when the traffic to the phishing mailbox is particularly heavy, we might not be able to offer a direct reply. If you need personal assistance with an email, contact your local BBB.