Archives for May 2024

The operating system tools described in the prior post are adequate to back up and restore your devices. If you want a little more flexibility and ease of use, there are a wide variety of commercially available products to consider.

Before we start, let’s distinguish between three types of commercial cloud services. First, there’s cloud storage, also referred to as cloud archive services. To save your files, you must take action to copy them into the cloud. This is not the best backup approach. It’s easy to forget to do so, or to lose track of what changed. Second, cloud backup services automate backing up files to the cloud. They do so continuously or on a schedule you select. Third, cloud sync services synchronize files between your devices. This is technically not a backup service. If you inadvertently delete a file in one place, it’s deleted everywhere. There’s no backup for the deleted file.

Some services are hybrids, which combine parts of all the above services. I am only addressing commercial cloud backup services in this post.

Some basic criteria to consider as you evaluate these products are:

• Are there limits on the amount of data you can store in the cloud?
• Does the service maintain multiple versions of your files and, if so, how many?
• Are files encrypted in transit and at rest in the cloud?
• Can you choose your own encryption key for data stored in the cloud?
• How long does it take to back up files to the cloud? What is the upload speed?
• In case of an emergency, can the service send you a disk with your files on it for local restoration?
• Does the service support both continuous and scheduled backups?
• Does the license support one or more than one computer in the price? Is the price competitive?
• Does the service provide good customer support?
• Is it easy to configure and to use?

Most major commercial services are U.S. based, not independently audited and, no doubt, keep thorough logs of customer usage. So the criteria in the post “It’s a Jungle Out There” is not helpful here.

The most basic criteria is this: it just works, and my files are there when I need them (which hopefully never happens). Backup services are like life insurance—betting you’ll die, hoping you’ll lose the bet.

I recommend two commercial products: Backblaze and Carbonite. Both provide unlimited storage, keep multiple versions of files, encrypt files in transit and at rest, permit you to choose your own encryption key, have fast upload speeds, will send a disk with your files if requested, support continuous and daily backups, have good customer support, and work out-of-the-box (set-it-and-forget-it). Both work on both Windows and macOS. To back up video files on Carbonite, you must upgrade from Basic to Plus for a modest cost.

Both services cost around $100 per year, with significant discounts for the first year. Neither is the cheapest nor the most expensive. One potential downside, both license one computer at a time, so if you have multiple computers to protect, the cost goes up.

The link to Backblaze is: https://www.backblaze.com/

The link to Carbonite is: https://www.carbonite.com/

Given all this information, how should you proceed from here? I present two different strategies in the following posts.

Information provided in this post is subject to the disclaimer in the first post of this series.

Permit me to introduce Alice and Bob. Alice is smart, sophisticated, balanced and reasonable. Bob is, uh, less so. They each have backup and recovery strategies that meet their needs and risk tolerance. Let’s start with Alice.

Alice has a Windows 10 PC she uses for her personal IT consulting business. An avid amateur photographer, she prefers a MacBook Pro for photo-editing. She carries an iPhone for both personal and business calls.

Immediately after purchasing her PC, Alice generated a USB recovery drive using the Windows backup utility. The recovery drive contained no sensitive information, so she left it unencrypted. She stored it in a desk drawer in her home office.

While she was creating a recovery drive, she created a disk image backup. She stored the image backup on an encrypted external drive. The drive had a keypad to unlock it: an Apricorn Aegis Padlock. It was a little pricey, but worth it to protect her business data. She added the Padlock PIN to her password manager, stored the drive in her desk drawer with the recovery drive, and added a recurring schedule notice to Microsoft Outlook, reminding her to update the image backup every six months.

To protect her Windows files against catastrophic loss, and following the 3-2-1 rule, she backed up her files in two ways. First, she signed up for a cloud backup service with Carbonite. She installed the backup agent on her PC and configured it to back up continuously. While she could have selected her own encryption key for Carbonite, this option made viewing and managing her backups in the cloud less convenient. So she kept her sensitive business data in several virtual encrypted disks on her PC using VeraCrypt, and used the default Carbonite managed encryption key to protect her data at rest in the cloud.

She had confidence that Carbonite was protecting her files, but to honor the 3-2-1 rule, she also kept a local file backup. She found the Windows File History utility to be clunky and did not view her files as being at risk, so once a month she copied and pasted the Desktop, Documents, Music, Pictures and Video directories to an external drive. Three versions of these backups were rotated on the same drive. She used the same Apricorn Aegis Padlock she used to store her disk images, and added a monthly schedule notice to Microsoft Outlook to remind her to perform the backup.

Confident that she had strong and reliable protection for her business data, she considered the best strategy to back up her photographs. Following the rule of three, she setup both local and cloud backup. Since she already had a Carbonite account for her business data, she used Carbonite for MacBook Pro for cloud backup. She opted to use the default encryption key since she did not keep data she regarded as particularly sensitive on the Mac. She configured Carbonite for continuous backup. For local backup, she attached a USB stick and configured Time Machine to create and manage an encrypted backup every time she edited photos. She stored the Time Machine backup password in her password manager. When not in use, she kept the USB stick in her desk drawer with her other backups drives.

To create and manage a clone for the internal drive on her MacBook, she purchased a copy of Carbon Copy Cloner and stored the clone on her Apricorn Aegis Padlock drive. She set a schedule notice in Microsoft Outlook to update the clone semi-annually.

Alice configured iCloud to back up her phone automatically and enabled Advanced Data Protection to secure her data from prying eyes. She stored less than 5 GBs of data, so there was no additional cost for the service. Her iPhone data was not particularly important to her, so she chose not to make a separate local backup to her Mac,

Alice reviewed her backup and recovery strategy. She had solid protection for her business data files, and the Windows recovery drive and image backup would ease restoration of her PC in the event of disk or device failure. Strong encryption protected her sensitive data. Both local and remote file backup ensured the protection of her PC and Mac files following the 3-2-1 rule. She had a remote backup of her iPhone.

The costs were modest. There was a one-time cost for some external drives and Carbon Copy Cloner. VeraCrypt was open source and the Windows and macOS utilities came with the operating systems. There was an annual subscription for Carbonite, but she felt that the convenience and reliability of the service more than justified the cost. And after the initial setup, she only had to refresh the image backup and MacBook clone semi-annually and the PC file backups monthly. She was satisfied. It was a job well done.

We’ll see how Bob managed his backups in the next post.

Information provided in this post is subject to the disclaimer in the first post of this series.

Bob’s backup and recovery strategy was a little more eccentric. In part because he was more paranoid than Alice (think tinfoil hats), and in part because he was cheap.

Bob had a hopped-up desktop PC running Windows 10 and an Android phone. He’d built the PC from parts he’d scavenged from a recycling business. The Android phone was a hand-me-down from his older sister. He used the PC for gaming. The phone was strictly for phone calls—he disabled Wi-Fi and Bluetooth connectivity on the phone. Given his approach to telephony, he thought backing up his Android phone was pointless, so he didn’t bother.

Bob loathed Microsoft, in his view the biggest of the big brothers. He much preferred Linux, but his preferred gaming software only ran on Windows, so he was stuck. While he was arguably crazy, he was not crazy enough to do without a backup strategy. This was his plan.

Starting with USB drives he’d collected as giveaways at Comic-Con, he reformatted them and created a virtual encrypted disk on each one using VeraCrypt. He kept the encryption keys in an open-source password manager, Bitwarden, on his PC. He created a recovery drive (unencrypted) and image backup (encrypted) on these USB drives, which he updated monthly and stored them in his sock drawer.

For file backup, given that he had three independent disk drives in his PC, once a week he copied and pasted his data directories to another one of the three disk drive. It struck him as unlikely that more than one disk would fail at the same time. But not entirely trusting Microsoft with his precious data files, he used File History to create a second backup on an encrypted USB drive, updating daily, and keeping saved versions until space was needed. He kept this USB drive in the glove compartment of his car when not in use, which in his mind constituted a disaster recovery site. In any event, he surely would not back up anything to the cloud where “they” could get to it. And cloud backup costs money.

Bob was particularly paranoid about losing his password database (not an unreasonable fear). If he lost a record of his randomly generated 25-character passwords, he was doomed. In an abundance of caution, he backed up his password database to a separate encrypted USB drive which he wrapped in tinfoil, concealed in an old metal Sucrets box, and then shrink-wrapped. In the dark of night, he crept into the woods behind his house and buried the box at the base of a tree into which he’d carved “Bob+Alice,” when he was a lovelorn teenager. He felt sure that the love exuding from the tree would provide an extra level of protection.

When he mentioned this to Alice, she thought that this was sweet—if incredibly dorky.

So much for Bob’s strategy, now you must develop one that works for you.

Keep it simple and take one step at a time. Make sure that as a minimum you backup your files regularly, encrypt sensitive data, and follow the 3-2-1 rule. If you don’t do anything else, and your budget can afford it, purchase a cloud backup service and set it for continuous update to protect your files.

But most of all, just do it. This is a MUST.

Information provided in this post is subject to the disclaimer in the first post of this series.

“Who steals my purse steals trash … But he that filches from me my good name, robs me of that which not enriches him, and makes me poor indeed.” Othello

The problem with the above quote is this: identity thieves do enrich themselves at your expense—they steal your purse—and they take your good name as well.

Identity theft is a serious issue. The Bureau of Justice Statistics reports that 23.9 million people over the age of 16 had their identities stolen in 2021, the date of the latest report, with victims losing an average of $1,160 each. If you’re concerned about identity theft, or someone gaining access to your credit report without your permission, place a credit freeze on your report.

I very strongly recommend you place a credit freeze on your report with the three major credit reporting agencies. It’s quick, it’s free, and it’s the single most important thing you can do to prevent identify theft.

Some facts:

• You can lift a credit freeze online with a PIN in one hour.
• A credit freeze may also called a security freeze.
• A credit freeze differs from a credit lock or a fraud alert (use a credit freeze).
• A credit freeze should be in addition to, or instead of, credit monitoring.
• A credit freeze does not affect your credit score.
• A credit freeze also does not:
  • Prevent you from getting your free annual credit report.
  • Keep you from opening a new account or getting a loan. But to open one, you’ll need to lift the freeze temporarily. It’s free to lift the freeze and free to place it again when you’re done accessing your credit.
  • Keep you from applying for a job, renting an apartment, or buying insurance. A credit freeze doesn’t apply to these actions, so you don’t need to lift it.
  • Prevent a thief from making charges to your existing accounts. You still need to monitor all bank, credit card and insurance statements for fraudulent transactions.

In 2021, about 1 in 50 U.S. children were victims of identity fraud, and 1 in 45 had personal information exposed in a data breach. I very strongly recommend you place a credit freeze on behalf of your children, including newborns. If you have a social security number, freeze your credit.

A brief note on credit monitoring. I suspect that most adults in the U.S. have received notice from a financial or other institution that the business has suffered a security breach and that personal information may have been exposed. The remedy offered is free credit monitoring. Signing up for free credit monitoring with a reputable third party is a reasonable thing to do. In particular, if someone steals your identity, they should assist you in repairing the damage done to your credit and reputation.

But remember, monitoring is just that: monitoring. It does not prevent identity theft. It informs you it may be occurring. A credit freeze provides substantial protection against identity theft. It’s very difficult for Dr. Evil to open accounts in your name, take loans in your name, and “steal your purse” without a credit check with the big three. Credit monitoring may be in addition to, but not in place of, a credit freeze.

For more information on identity theft, see: https://consumer.ftc.gov/identity-theft-and-online-security/identity-theft

For more information on freezing your credit, see: https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs

For more information on protecting your child from identity theft, see: https://consumer.ftc.gov/articles/how-protect-your-child-identity-theft

To freeze your credit at the big three credit bureaus, go to:

• Experian: https://www.experian.com/freeze/center.html
• Equifax: https://www.equifax.com/personal/credit-report-services/credit-freeze
• TransUnion: https://www.transunion.com/credit-freeze

The credit bureaus may attempt to upsell you on other services. These services are unnecessary and a credit freeze is free.

To opt-out of pre-screen credit offers, which I recommend, go to: https://www.optoutprescreen.com

And you should review your credit report at least annually. You can obtain a free report annually from each of the big three credit bureaus. If you rotate among them, you can receive a free credit report every four months. See: https://www.annualcreditreport.com

As I said in the posts on backup and recovery, “A stitch in time saves nine.” This is a simple action to take. Freeze your credit report and those of your children.

Information provided in this post is subject to the disclaimer in the first post of this series.

In The Lord of the Rings, Gandalf struggled mightily to open the gates of the Mines of Moria. He didn’t know the password. Merry, of course, solved the riddle in a trice. The password was “friend.”

With all due respect to Gandalf and the Dwarf Lords, “friend” is a lousy password.

A study by Security.org states that two in three people use the same password across multiple accounts, one in three have shared passwords with their friends, and nearly 40% have been hacked. Multiple studies show that the three most common passwords are “123456”, “qwerty” and “password.” Apparently, the Dwarf Lords aren’t the only ones with a problem.

Now that you’ve had time to plan and implement your backup and recovery strategy, let’s talk about password management. I very strongly recommend that you follow sound password management practices. Compromised passwords put your personal information, and your financial and other digital assets, at risk.

What are good password management practices? I recommend the following:

• Use a password manager. Password managers generate strong passwords and passphrases while also keeping them organized, secure and synchronized across multiple devices. They can be readily configured to autofill passwords in most web browsers. It’s also simple to cut and paste passwords into applications.
  • Keep all your passwords and passphrases in your password manager. Delete them everywhere else. You should only need to remember one password, that being the password for the password manager itself. Make this password strong, easy to remember, and easy to type.
  • Don’t save passwords in your browser when prompted to do so. Browsers provide poor protection for passwords.
  • Backup your password database to an encrypted external drive. Although your password database is synchronized across all your devices, take no chances. You don’t want to lose it.
• Create a different password for every account. Would you have one key for your house, car, storage shed, safe deposit box and summer home? What if someone steals the key? Reusing passwords increases your risk of getting successfully hacked.
  • Some websites offer the option to sign in using your account from another site. Google, Apple and Facebook are often cited. I recommend against this. In doing so, you are effectively using the same password for multiple sites, and if you’re concerned with your privacy, why tell Google, Apple and Facebook what other sites you are visiting?
• Use long, randomly generated passwords. People are predictable. Predicable passwords are easier to compromise. Short passwords are very easy to guess. There’s a whole industry dedicated to hacking passwords.
  • Password managers generate strong random passwords and passphrases.
  • Passwords should include uppercase and lowercase letters, numbers and punctuation. A strong generated password is “4$Erk6*Q%wPR*aQGiWMd”. Don’t panic. You’re not going to type this into a website. Your password manager will autofill the password, or you will cut and paste it.
  • Some sites put constraints on the characters they will accept in a password and, for instance, may not permit punctuation. Length is more important than complexity. For technical reasons, the current guidance on minimum password length is 17 characters. I recommend 20 characters or more.
  • Passphrases should contain 5 or more words of varying length. A passphrase may include capital letters or numbers. Spaces or hyphens may separate words. A strong passphrase is “user-handrail-oops9-stiffness-treading”.
  • There is no need to change a password unless you believe it’s been compromised.  This is a change from prior guidance that recommended you change your password every 90 days.
• Take advantage of two-factor authentication (2FA) where it’s offered. Two-factor authentication requires you to prove your identity in two different ways. I’ll discuss this further in a later post.

In summary, good password management requires using a password manager, creating a different password for every account, using long, randomly generated passwords or passphrases, and taking advantage of two factor authentication.

In the next several posts, I provide evaluation criteria for selecting a password manager, recommend two products, discuss 2FA in more detail, and finally suggest a plan to get from where you are today to the halcyon future of good password management.

Information provided in this post is subject to the disclaimer in the first post of this series.

What criteria might you use to select a good password manager? The post “It’s a Jungle Out There” provides relevant overarching criteria: prefer products from companies based in good privacy jurisdictions, verify their claims through a reputable third-party audit, choose products that maintain little or no logs of your usage, and most importantly, choose products with strong encryption.

Some additional criteria to consider include:

• Encryption algorithms must not only be strong, but implement end-to-end zero knowledge encryption. Encryption and decryption of your password database must take place only on your devices (end-to-end), and the product provider must not have access to your encryption keys or data (zero knowledge).
• It must be available for common devices and operating systems.
• It must synchronize your passwords across your devices and in the cloud.
• It must provide browser extensions for common browsers and support auto-filling of your user id and password on websites that you designate.
• It must generate strong, random passwords and passphrases upon request.
• It should be able to import passwords from other password managers and files.
• It should offer the option to export a backup copy of the password database.
• It should offer a password strength checker, and password breach checking and notification.
• It should support 2FA to access the password manager when passwords are being added or edited.
• It should offer the option to securely store other important information such as credit cards, insurance cards, and personal IDs.
• It should have an excellent reputation in the marketplace with responsive customer support.

I recommend the following two password managers: Bitwarden and NordPass.

The link to Bitwarden is: https://bitwarden.com/

The link to NordPass is: https://nordpass.com/

Bitwarden is an excellent open-source product. It meets all the criteria above except for being U.S. based. I don’t view this as an issue given its implementation of end-to-end zero knowledge encryption. While there’s a free version, the Premium version is only $10 a year and I recommend it.

NordPass, by Nord Security, is a superior commercial password manager. Nord Security also offers an industry leading virtual private network (VPN) which I will recommend in a later post. NordPass meets all the criteria above and is also reasonably priced. The Premium version is $1.49 per month. The free version is limited and I recommend the Premium version.

In the next post, I will discuss two factor authentication (2FA).

Information provided in this post is subject to the disclaimer in the first post of this series.

In cybersecurity lingo, proving your identity is called authentication. Two Factor Authentication (2FA), also called multi-factor authentication, requires you to prove that you are who you say you are in more than one way. Authentication relies on something you have (a security token or bank card), something you know (a password or PIN), or something you are (a fingerprint or iris scan). Every time you use an ATM to withdraw money from your bank account, you are engaging in two-factor authentication. Factor one is your ATM card—something you have. Factor two is your PIN—something you know.

For most websites, entering your password is normally the first step to prove your identity. The second step can take several forms. I only address the three most common approaches here.

Short Message Service (SMS) is far and away the most common approach. After you enter your password, the website sends a short numeric passcode to your phone or email. You enter this number on the website and, if it matches the passcode sent to you, you may proceed. There are vulnerabilities with this approach that I will not belabor here. Any 2FA is better than none, so if SMS is all that’s available, I recommend you take advantage of it. I will discuss actions to combat one vulnerability, SIM swapping, in a later post.

Some sites support 2FA using time-based one-time passwords (TOPT). After entering your password, the website prompts you to enter a numeric code generated by a software authentication application on your device. The code cycles every 30 seconds, hence time-based. This is more secure than SMS for 2FA.

A few things to know about software authenticators providing TOTP:

• Just like a password manager, prefer a software authenticator that runs on all your devices, provides the capability to synchronize the authentication database across your devices, and provides for a secure backup of the database.
• Websites that support TOTP should generate a recovery key for your account. Make sure you capture this key and save it in your password manager. If the database for the software authenticator is lost or corrupted, you will need the recovery key to access your account.
• Software authenticators are time-based. Ensure that you have the correct time zone set on your devices and that the device’s clock is synchronized with the network (this should happen automatically). If the clock on your device is too slow or too fast, the time-based passcodes won’t match those generated on the website and you won’t be able to access your account.
• To synchronize a software authenticator with a website, you can either scan a QR code or type in a list of characters associated with the QR code. You confirm synchronization by entering the passcode generated on your device for the website.

Bitwarden includes the capability to generate time-based one-time passwords. If you use Bitwarden as your password manager, you don’t need a separate software authenticator. And Bitwarden runs on all your devices.

If you are not using Bitwarden, I recommend the software authentication application, Authy. You can find it at: https://authy.com/ . Note that Authy runs on iOS and Android but no longer supports a desktop app for Windows and macOS.

A third option for 2FA is using a hardware token. Few consumer facing websites support hardware tokens for 2FA, although this is slowly changing. Employers are more likely to use them to protect access to internal information technology assets. If you require a hardware token, I recommend Yubikey. You can find it at: https://www.yubico.com/  Make sure you have a strategy to access your account if your token is damaged or lost.

January 2025 Update: Passkeys are beginning to enter the marketplace. If you regularly visit  a website that offers passkey authentication, consider taking advantage of it. Particularly for sensitive data. Passkeys utilize public key encryption and are more secure than strong passwords with 2FA.  Your passkey can be stored on a hardware token or on a physical device, but I recommend storing your passkey in your password manager where it will be available on all your devices. After entering your userid on a website, when a password would otherwise be requested, you enter your passkey and your in.

Now that you’ve selected your password manager, how do you get from where you are today to a future state of good password management? I will discuss this in the next post.

Information provided in this post is subject to the disclaimer in the first post of this series.

“A journey of a thousand miles begins with a single step.” Dao De Jing.

So what are the next steps? If you already have a password manager you’re comfortable with, use unique, strong randomly generated passwords for every account, and use 2FA where it’s offered, congratulations! There is little more to do. If not, here are some steps to follow. I assume you are new to password management and are starting from scratch.

• Choose either Bitwarden or NordPass and create a Premium account on their website. The annual cost will be less than a Venti Lavender Oatmilk Latte, with a croissant, for you and your significant other. Make sure your password is strong, easy to remember, and easy to type. If there’s any risk of forgetting the password, write it down (without identifying the purpose), put it in a sealed envelope, and leave it with a friend, in your safe deposit box, or unobtrusively among your other papers. If you lose the password, the product provider can’t help you recover it.
• Download the password manager app to all the devices you commonly use: desktops, laptops, tablets and phones. Check out new user guides and tutorials on the website. Take the app for a test drive. Enter one account (with userid and password) and make sure it synchronizes across your devices. Note that you need to be connected to the Internet to add or edit passwords in your password manager. This ensures your devices stay synchronized.
• Download and install browser extensions for the password manager on all your devices. If you store the URL for an account in the password manager (e.g.: “https://www.amazon.com/”), the browser extension will autofill your userid and password when you access that site. Note that URL may be called URI. Bitwarden and NordPass work a little differently, but it’s easy to learn. Check this capability using the account created in the step above.
• Transition all your passwords into the password manager. Depending on where you have them now, this could take some time. If you have them electronically, it’s likely you can import your passwords into the password manager. If they’re on paper, you need to type them in. Save the old copies until the passwords are changed or verified in a subsequent step.
• Generate reports provided by the password manager that identify weak, compromised or duplicate passwords. It’s likely you have all three. Don’t panic. Take one step at a time. Note that some “weak” passwords, such as the PIN to order a movie on Amazon Prime, are likely okay.
• Starting with your more sensitive accounts—financial, healthcare, insurance—replace the weak and compromised passwords for those accounts (on their websites), with strong randomly generated passwords, storing the new passwords in your password manager. Caution: the site will require both the old and new passwords to make a change. Copy and briefly save the old password before you replace it in your password manager with a new, generated password. Save the new password in your password manager before you change it on the website. This suggestion comes from experience.
• Once you’ve replaced weak, compromised and duplicate passwords, verify or strengthen the remainder by accessing the account website. This ensures you have a complete and accurate password database in your password manager. Consider strengthening the password for any account that holds your credit card. Shopping sites are an example.
• As you replace or verify your passwords for each account, capture the website URL in the password manager. This enables autofill of your userid and password when accessing the site.
• Make a backup copy of your password database on either on an encrypted external drive or on a virtual encrypted disk on your internal drive. The password for the encrypted disk can be the same as that for your password manager. If different, write it down and put the password in a safe place.
• Delete all copies of your passwords outside of your password manager. In particular, delete any passwords stored in your web browser. The process to do this varies by browser. A web search should lead you to instructions for your browser.
• If you have sensitive accounts that support TOTP two-factor authentication, set this up either in Bitwarden, if you’re using it, or Authy. The Authy site can back up your authentication database. I recommend you take advantage of this.
• For extra credit, use the Card and Secure Notes to store information for everything in your wallet. You can even store pictures of the front and back of the cards. This can come in very handy if your wallet is lost or stolen. For instance, the 800 number to call if your credit card is lost or stolen is likely different for each card, even if they’re issued by the same bank. Should you lose your wallet, heaven forfend, having the number to call in your password manager on your phone will be quite handy.

Wow, that was a lot. The good news is that you only need to do this once. And once you accomplish this, your privacy and security posture greatly improves.

Alice and Bob both use Bitwarden for password management and, being appropriately paranoid, religiously practiced good password management. Alice purchased the Premium version and installed Bitwarden on her PC, MacBook and iPhone, which synchronized her password database across all three devices and the Bitwarden cloud. She installed browser extensions for the web browsers on all her devices and created an external backup on her Apricorn Aegis Padlock drive.

Bob installed the free version of Bitwarden on his PC. I mentioned his eccentric backup strategy in a prior post.

In the next post, I will discuss measures you can take to avoid getting scammed.

Information provided in this post is subject to the disclaimer in the first post of this series.

“Who is going to believe a con artist? Everyone, if she’s good.” Andy Griffith

Fraud is a big business. According to a 2022 report by the U.S. Federal Trade Commission, Americans reported losing nearly $8.8 billion to fraud, an increase of over 30% in 2021. The most common schemes were impostor scams, followed by online shopping scams and those that involved prizes.

Anyone can get scammed.

However, there are telltale signs, tip-offs that you are being scammed. Things scammers do, and things scammers say. And there are actions you can take to protect yourself.

Let’s review.

• Scammers pressure you to act immediately. They want you to act before you have time to think, before you have time to check out their story. They try to keep you on the phone. You must act now.
• Scammers tell you there’s a problem. You’re in trouble with the government. You could get arrested. Someone in your family had an emergency. There’s a virus on your computer. They’ve noticed suspicious activity on your account. Your account is on hold because of a billing problem. You need to confirm some financial or account information.
• Scammers tell you that you’ve won a prize. You won money in a lottery or sweepstakes, but have to pay a fee to get it. They have a coupon for a free stuff. You’re eligible for a refund.
• Scammers tell you there’s a conspiracy. Don’t trust anyone, they’re in on it. Say only what I tell you to say. Don’t talk to anyone else.
• Scammers offer you romance. You’re attractive. You’re desirable. Let’s talk. Let’s meet.
• Scammers tell you what to do with your money and how to pay. Move your money to protect it. Buy gold. Buy gift cards. Pay with Bitcoin. Withdraw cash and send it to this address or give it to this courier.
• Scammers pretend to be with an organization that you know: the government, your bank, the phone company, the electric utility, or a charity asking for donations.

In addition to following the recommendations in this blog as a whole, here are some simple actions you can take to protect yourself:

• Monitor your bank accounts and credit cards regularly for fraudulent charges.
• Freeze your credit report. Opt out of credit offers. And check your credit report at least annually. I discussed this in a prior post.
• Setup your phone to decline calls from people you don’t know. If the call is legitimate, they can leave a message. You can validate the message before you return the call.
• Don’t click on links in email or text messages. If you believe the email or text is legitimate, contact the sender through a verified website or phone number.
• Be careful what you post online. Scammers may exploit information that you post to conjure up a more believable scam.
• Never provide personal or financial information in response to a request you did not expect.
• Use a credit card rather than a debit card for online purchases. Credit card companies actively monitor your account for fraud. (Pay the card off at the end of the month.) Virtual credit cards offer even stronger privacy protection. I will discuss them in a later post. For now, prefer a credit card to a debit card.
• When in doubt, stop and talk to someone that you trust. Don’t hesitate to just hang up the phone.
• If you suspect a scam, report it to the FTC at: https://reportfraud.ftc.gov
• If you are a victim of identity theft, you can find help at: https://www.identitytheft.gov.

Forewarned is forearmed. Be vigilant. Don’t get scammed.

Next, I will discuss malware protection.

Information provided in this post is subject to the disclaimer in the first post of this series.