The Cyber Sushi

(serving up the cold facts, with some phish bytes)

Welcome back! Here's what we are covering in this issue…

Don't Sink With The (relation)Ship

Valentine’s Day in February put romance in the spotlight, however criminals will establish and leverage any type of relationship to obtain money and identity credentials.

IDCARE had over 2100 client engagements supporting individuals impacted by relationship scams last year, and over half of those people reported a financial loss, totaling over $17 million. While financial losses can be incredibly painful, individuals also suffer emotional and psychological impacts. In some cases, people affected by relationship scams still struggle to believe they have been scammed, even if all the signs are there.

So, how do you know if what you have is real or if it’s a criminal on the other end of the chat? Some red flags to look out for include:

Relationship begins online
Communication quickly switches to a new platform
Relationship began after a difficult life event
The person quickly expresses strong feelings
Video chats do not occur or are bad quality
They claim to be from a high-income country
They encourage the relationship to be kept secret
They seek to isolate you from your family and friends
They ask for personal information or ID
They request money or gifts
They want to set up a business with you
They ask you to receive or transfer goods or funds on their behalf.

A Case Study: Friendship With a Side of Scam

In the beginning…
Alice* became friends with a person on social media who leveraged her trusting and caring personality, manipulating her into more than she bargained for. The conversation started on WeChat, but moved to another Line over the period of six weeks.

The flip to investment
Before long, Alice* was shown the impressive looking (but unfortunately fraudulent) investment site and coached on how to start investing. Unbeknownst to her she was becoming embroiled in a cryptocurrency investment scam.

The realisation
Alice* started to realise something was wrong when she attempted to withdraw funds and the trading site disabled her account, demanding a verification payment to access her money.

The damaging secrecy and the bystander effect
After realising the investment opportunity was a scam, Alice* began to see the tactics of isolation the criminals had used against her. This included encouraging her to not discuss the investments with those closest to her, like her husband. She can now see that if she had included her husband earlier, he may have recognised the signs of the scam.

Stepping out in strength to support her community
Now, Alice* wants to share her story. Given her Chinese Australian heritage, she is particularly passionate about raising awareness within the Mandarin speaking community saying that “due to the language barrier, many of [the Chinese Australian community] are unaware of the current scam alerts in the mainstream English media” and “the Chinese ‘savings culture’, can make them targets of scams.”

The moral of the story
Unfortunately, stories like Alice’s are common. So, what should you do if you find yourself in her situation?

Our Top Ten Tips

Cease all communication with the scammer

Tell a trusted person what has happened

Advise your bank/s and superannuation fund/s of the scam, request additional account security and block international transfers

Consider the credentials the scammer may have accessed eg. driver licence, passport, Medicare card, and notify the agencies that issued these

Update or add passwords and multi-factor authentication to all your accounts

Check your email & remove forwarding rules

Be aware of other scam attempts

Contact the police if your identity is misused

Complete an online ReportCyber form if you have sent or received money online, provided remote access to your internet enabled devices, or shared credentials online

If the scammer accessed your internet enabled devices, contact IDCARE about our free Cyber First Aid services

Talk to an experienced IDCARE case manager

The stigma and embarrassment around scams works to the criminals advantage. They want to keep you silent. Instead, talk about the red flags of relationship scams and check in with your friends and family.

Behind the Mask - a guide to trending scams

The Peter Alexander “On Sale PJs” Scam: Circulating through TikTok and other social media outlets, this scam is targeting the young and trendy. Not only are these criminals after money, but they’re also aiming to obtain other personal information.
Our Tips: Always verify the website you are visiting. Peter Alexander only has the one website (peteralexander.com.au for Australians and peteralexander.co.nz for those in NZ). If you ever find a website selling popular wares at sale prices, do your research. If the deal appears to be too good to be true, it probably is!
The tried-and-true AusPost Scam: This scam has been around for quite some time, varying slightly to keep it fresh. It continues to be a focus for IDCARE clients. In February alone, over 20% of impersonation scam related cases referenced AusPost and almost $50,000 was lost. This scam comes in the form of either an email or an SMS link and may ask to verify details and delivery of anticipated packages. An SMS may say something along the lines of “to avoid the misplacement of your item verify and update your information as soon as possible via…” and a link to a fake AusPost website is provided. The scam can then prompt you to enter details including those required to facilitate a delivery payment.

Our Tips: AusPost will never SMS or email asking you to click a link that requires payment or ask you to update details. Head straight to the website or the AusPost app to verify the information if you’re unsure. The details AusPost have are the ones they have been provided by the vendor. They don’t require your personal information.
The PayID scam: In the last month alone, a staggering number of people have contacted IDCARE seeking support after being impacted by the "PayID Scam". In this scam, a potential buyer may contact someone on Facebook Marketplace or Gumtree regarding an item for sale. They will ask to pay via "PayID", a legitimate person-to-person payment method run through many banks. As part of this transaction, the seller will need to supply the buyer with their mobile number and email address. The seller will then receive a fraudulent email claiming to be from "PayID" saying that there was an issue with the payment as the seller doesn't have a business account. The "buyer", i.e. criminal, will then spin a story to leverage the seller for funds as reimbursement.

Our Tips: PayID will never contact you directly and is run through your bank. If you’re concerned, contact your bank via verified contact details. If a buyer starts to make unusual requests regarding payment or shipping methods, be cautious and if in doubt, back out. When buying or selling through Facebook Marketplace or Gumtree, try to use a person-to-person payment method you are familiar with. Avoid clicking on links and go directly to the payment methods website (after researching it).

CROC Spot: Tasmania

First up in 2023, CROC headed to Tasmania. Several staff from IDCARE’s HQ joined our roving clinician, Rob Blackmore, in the Apple Isle.

Our key sponsors, Westpac, hosted a community presentation in Launceston. This was a great opportunity for IDCARE and Westpac to join forces and share some of the recent scams impacting the community and the practical steps we can take to secure our online accounts. There was a lot of great discussion around scam prevention, cyber safety, and identity security.

Rob also visited Burnie library where the response from the participants was so positive that it resulted in additional presentations being requested across the state-wide network of Tasmanian libraries. These included St Helens, St Mary’s, and Huonville. This support from the local communities is crucial to our ability to spread the message of cyber resilience.

A key takeaway of the trip occurred during a briefing at St Helens Library. A parent outlined how her daughter and many of her friends had been impacted by the trending Peter Alexander online shopping scam. The girls shared the fake website amongst each other on TikTok. This scam shows how social media is leveraged to promulgate scams targeting the younger demographic. This story, like many others, reinforces that there is a scam for everyone, and targets are not limited by age or demographic.

Coming up in CROC

Take a look at where the team will be next! Keep an eye on our website for locations and times of our free community events. Come along and learn about scams, cybercrime and identity theft and how to navigate safely online.

The hAPPy score

What's Your Relationship Hinging On?

In a world of swipe right dating, Hinge aims to offer deeper connections, claiming to be an app designed to be deleted. If you’re looking for a Nobel-prize-winning algorithm, then Hinge may be for you. But is it scam proof?

The legal spiel

If you have a spare two-and-a-bit hours, and brain capacity for 37 pages, you will be right to read the Hinge Terms of Use and Privacy Policy. Although, since you’re putting yourself out there (quite literally), it’s good to know they’re being comprehensive. Fortunately, it’s not too complicated of a read and the headings are clear to help with navigation.

Pervability

How much they’re looking at you (one star being they’re looking a lot)

Is Hinge perving on you? Being a dating app, this is a valid question. The answer? It’s really up to you. In order to create an account, Hinge needs at least your phone number, email address and some basic details such as your gender, date of birth and who you want to connect with. But if you’re expecting Charming to sweep you off your virtual feet, you might need a bit more on your profile. Hinge is pretty clear in their Terms and Privacy Policy that you are responsible and liable for whatever you post. Just no posting any bank details or personal contact information. If they only want you for your money or your postcode, they aren’t worth it.

The Scamometer

How easy is your account to hack? (One is super easy, five is Fort Knox)

Hinge might take your account security seriously, but they’re not scam proof. In fact, with a quick google you can find a myriad of people who have been involved in romance scams that originated in Hinge. Unfortunately, Hinge, like other dating apps, haven’t gotten on board with Multi Factor Authentication, meaning your account certainly isn’t Fort Knox. Although they do offer "account verification" to help you avoid those who aren't real. But it isn't fool proof. Keep our red flags in the back of your mind when using Hinge, and be aware that even if someone has a verification tick, they may still have nefarious motives.

The two-left thumbs rating

Can grandma work out how to do it? (One star means "no way", five is "of course she can")

If Grandma wants to keep her hinges well oiled, she might find this dating app a bit more complicated than the “swipe right” style apps. Rather than judging based on photos alone, Hinge allows people to include blurbs, quotes and multiple photos. If grandma likes what she sees or reads, she can leave a “like”, similar to social media platforms. This will notify the person of Grandma's interest, and they can choose to respond and open up a dialogue. If she can use social media platforms, she can probably use Hinge.

Because everyone needs a... quick history lesson

2012 saw the first version of the Hinge app launch. During College, founder Justin McLeod was dumped and broken hearted and turned to technology. The outcome of this enterprise was Hinge. Justin states that “the app was built to help people find love, but over time, we added features just to keep up with our competitors” causing them to neglect their original “all about love” concept. A second chance at love with his college sweetheart spurred McLeod to rebuild Hinge and refocus on that original idea, resulting in an app that is “designed to be deleted” once your true love has been found.

The final countdown: (dunna na… dunna na na na..)

Just like any relationship that begins on an online platform, be cautious. You are in control of how much personal information you reveal. Avoid leaving Hinge to chat on different platforms. Take advantage of the Hinge video chat function, but with the advancement of AI technology, never rely on it as a sole source of verification. Read over the information on our website and consider the red flags when making relationship decisions. As an application, Hinge does what it can to protect its users, but criminals will always find ways around those defences. Users needing to remain vigilant. We recommend you never share explicit images and videos, or identity credentials such as your passports or driver licence. But DO share the good news about the exciting new relationship with your physical support network.