Question 1

Be aware of the risks of online fraud

Accepted Answer

Companies and individuals need to be aware that fraud attempts happen almost daily. No one believes they will be a victim of online fraud. Online fraud risks need to be communicated to employees by company managers.

Question 2

Card fraud

Accepted Answer

Card fraud can occur anywhere, including Facebook, Messenger, e-mail, online giveaways, etc. When a family member or friend asks for a picture of your credit card, it's most likely a criminal has hacked into their account. These fake logins can be spotted by keeping the following in mind: Word usage: Does the wording seem garbled and translated? Icelandic alphabet: Are there any Icelandic letters missing in the name of a business or service provider? Unusual font: Is the font different from what's usually used on Facebook? Several logins contact individuals and tell them they've won a giveaway and only need to send their payment card details. Whatever the case, this is a scam that's too good to be true. Giveaways at stores never require card numbers or pictures of payment cards. Normal circumstances should never require you to: Share any details about your cards, e.g.  number, date and CVC number Send a picture of your card to someone, regardless of whether you know them or not Share information because you think you've won money or a giveaway at a store

Question 3

Cyber fraud and attacks

Accepted Answer

Romance scams Unscrupulous parties use social media, e-mail, and other methods to defraud people. It begins with a close acquaintance, followed by the request for valuables, for example, to facilitate a visit from abroad. Money should not be sent to strangers or new friends you have met online. Not everything is as it seems. Romance can quickly turn into blackmail if an acquaintance becomes intimate.  Investment scams/golden opportunities online Don't fall for golden opportunities that sound too good to be true. Even fraudulent advertisements can appear professional, so tread carefully.  Blackmail video footage A hacker can obtain embarrassing content and use it for blackmail. Nevertheless, this form of blackmail is uncommon. If you fall victim to this type of blackmail, be careful to document all interactions and report it to the police.  Email fraud In this case, emails are used to trick someone into making a foreign payment in good faith, but the money goes to the wrong person. Email fraud can be divided into two different categories. Instructions are received from the official party's e-mail address, where hackers have accessed the e-mail address. Instructions are received from an e-mail address that looks like they are from the official party but are not. Check the email address for slight changes, such as a different ending. If you receive an email from someone you don't know, you should call the person who sent it, e.g., for payment orders. We advise you to call anyone requesting payment to confirm the email, even if you recognise the email address and sender.  Ransomware A ransomware attack usually encrypts data or blocks access to assets unless a payment is made. In baiting attacks, false promises such as refunds or other tempting offers are used to lure the victim. They encourage the victim to click on a false link or attachment enabling them to encrypt the data.  Fake offers – rent fraud – Airbnb Hackers convince their victims to make international transactions by steering them away from pages like Airbnb, offering a seemingly alternative booking service through fake websites or email contact. They then steal your money, which cannot be traced or paid back to you. They often make offers that are too good to be true, such as 50% discounts. Official booking sites will not take responsibility if you do not use their booking system.  Pretending to be management Hackers often pretend to be company managers requesting staff members to make international transactions. These requests are often high priority as the hackers want to complete the criminal act as quickly and efficiently as possible. The member of management will often claim to be overseas and unable to contact you by phone. You should never agree to make any transaction of this kind without contacting the individual requesting you to do so. You should also ensure that the telephone number is correct.  Computer takeover scams Once hackers have connected with their victim, they may perform actions that the victim isn't aware of. They then send a link to software allowing them to control a person's computer. There is no way to distinguish what the criminal does from what the victim does in the aftermath, and all actions will be the responsibility of the victim. Older people are more likely to fall victim to this type of fraud.  How can you pro­tect your­self? You should always verify payment requests by phone before making a payment. Red flagging potential cyber-attacks: The email address has been slightly altered. The sender's name is correct, but the email address ending is different, e.g. @aol.com or @hotmail.com. When viewing an e-mail on your mobile, click on the sender's name to see their e-mail address. Soon after receiving an invoice, a new invoice was received stating that the previous invoice contained incorrect payment information. When you receive an email from a high-ranking person within the company, do you feel pressured to make a payment? Call the person immediately for confirmation. Are the payment details new, a new bank, a new country or a newly established company? Are they communicating differently than you expect, e.g., sharper, shorter, using another language, even rude and highly demanding? Is the person abroad and unable to answer the phone? Mistakes and grammatical errors are more likely to be overlooked since communications appear to be from a mobile device.

Question 4

Electronic ID

Accepted Answer

You are not required to enter your PIN if you did not sign in with an electronic ID but still receive an authentication message. Possible reasons are that someone entered the wrong number or it is a scam. Your electronic ID belongs only to you. Someone who asks for your phone number online (often via messenger) and sends you authentication is likely part of a scam. You should never Log in electronically to online banking and apps at the request of others, e.g., via Facebook and Messenger. Sign documents with electronic ID created by and asked for by others, e.g., via Facebook or Messenger)  Please be careful with electronic IDs, and do not accept anything without knowing the source.

Question 5

Have a plan

Accepted Answer

Despite our best efforts, we can still fall victim to scams and online scams. To deal with these situations effectively, we must have plans and practice them regularly. Among company employees, there is a greater risk for specific jobs, such as those responsible for transferring and paying bills. They are popular targets for hackers, so they should know what to do when a situation arises. If a payment order is sent by email without confirmation from a higher official, such as the CEO or CFO, then they should not immediately accept the order. Managers should understand that all payment instructions they give will not be processed unless they are confirmed by the recipient, for example, by phone. Management needs to realise that hackers apply pressure and try to make things happen quickly, so those accepting payment orders should hesitate and seek confirmation.

Question 6

Investment Fraud

Accepted Answer

Facebook is currently flooded with fake investor fraud ads. Recently, an ad prompted victims to provide their phone numbers. Numerous calls from foreign numbers were made to the victims, inviting them to invest. During the phone calls, they sent the victims e-mails where they asked, among other things, for card information. They also sent a link to AnyDesk, which lets them control the victim's computer. Fraudsters used the victim's credit card to create a Binance account in the victim's name. The victim had trouble understanding their English, so they invited him to communicate with them in another language and suggested Danish, Norwegian or Swedish. After that, the victim selected Swedish, and all e-mail communications were in Swedish. While it is significant that the hackers offered a Nordic language to communicate, the emails indicate that they used Google Translate to write in Swedish.

Question 7

Keep a copy

Accepted Answer

Regular backups should be performed, stored securely, and tested regularly to ensure that they are intact. Data hijacking attacks often result in hackers encrypting copies, which render them useless.

Question 8

Phishing

Accepted Answer

Actual fraud was committed during a Hópkaup giveaway. Hópkaup announced the giveaway on their Facebook page. The game required people to leave a comment on the post. Participants were then told by the false Hópkaup Facebook page that they had won the giveaway. People were fooled into giving out their card details through a fake Hópkaup link included in the comments.  What is phishing? Hackers often send credible email messages that look like they're from legitimate companies. However, the messages are intended to trick you into clicking a URL, downloading software, or opening an attachment. Consequently, unscrupulous parties can access passwords, usernames, or funds. This method is called phishing. In addition to attachments with viruses, fraud can also take the form of messages (e.g., Facebook) or e-mails sent by people you know or are customers of. This can happen to you through your personal email address and Facebook. Hackers usually make the messages look exciting, making them more likely to be read.  How can I defend myself against this type of crime? Never enter a username and password on a page that pops up after you click on a link unless you're sure it's the right one. Always enter domains yourself for any services you want to log into. Use two-factor authentication on personal services, e.g. Gmail and Facebook, to minimise the risk of hackers accessing your computer if they know your username and password. Use a variety of different passwords.  What can I do if I think I have been hacked? You will need to call in a computer expert to assess the situation. Changing your password is never enough.  The expert and owner of the account must take the following action: Take screenshots of everything, including the event log and settings. These can be handed over to the police as evidence. Take these screenshots immediately without making any changes to the computer. Review the rules and how you save documents (archive, move). Review your auto-forward settings in your email account. Review your password recovery settings (recovery passwords) and phone recovery settings (recovery phones) in your email account. Change your email account password and anywhere else where you have used the same password. Never use this password again. Turn on the two-step authentication in your email account (two-factor authentication, multi-factor authentication). Review every service used in connection with your email account, e.g. PayPal, eBay, Amazon, tax office, LastPass, passwords.google.com. The hackers may have reset your password for some of these services (password reset) using your email. Review all the information in your email account. You can assume that private information is now compromised, including any information you may have stored in notes (passwords, bank account /credit card numbers). Inspect mailbox data for leaks, e.g., people sometimes save passwords and credit card numbers in messages and notes. Take appropriate action if this is the case. Find out if any email addresses you use have also been compromised. You may need to inform anyone you think may have been affected. Hackers are known for sending emails to other contacts from within your email account to find new victims. They can resend or alter invoices previously received or sent by your email account.  How can I stop an international transaction? Individuals and businesses should contact us by telephone (440 4000) immediately. We will send you a document entitled Changes to Telephone Transaction, which you must fill out and send back here. Immediate action is necessary as 2-3 days is all it takes to make it almost impossible for us to retrieve your money.  Important to remember Only pay according to instructions in an email if you can reach the person on their phone number. It is important to report incidents to the police and to your bank. You can report fraud to the police by calling S: 444-1000 or by sending them an email to cybercrime@lrh.is  Examples of web scams
This is an example of phishing, where hackers pose as Netflix in an email. Example of web scams (youtube.com) 
Computer fraud in the name of Pósturinn
A brief explanation of the method used by fraudsters to steal card numbers. See video here

Question 9

Pyramid schemes

Accepted Answer

What's the difference between legitimate income and a pyramid scheme? Legitimate income is generated by selling a product or a provided service. In a pyramid scheme, the income is generated by convincing new participants to "buy into" the system, often paying a "mentor" or an "investor" and then becoming a mentor themselves, and so on. Pyramid schemes inevitably collapse when no more people can be recruited, leaving the newest participants with heavy losses, often from their savings, and sometimes even debt. How can you recognize the warning signs? You are promised quick profits and guaranteed income, but the source of these earnings is unclear. You are asked to pay a high “membership fee” or “initial investment” that you’re told you’ll get back later. When you ask what product or service is being sold, you get vague answers filled with trendy buzzwords like artificial intelligence, blockchain, algorithms, or automation to avoid explaining the pyramid model and make the scam sound credible. The “mentor” uses emotional language to appeal to excitement about making money or fear of missing out on a great investment opportunity, and discourages you from discussing participation with family or trusted friends. You’re not just sold an investment or job opportunity but a dream lifestyle, where your success (and failure) is portrayed as tied to your willpower or your personal worth as an individual. You’re told to take out a loan for the investment or “lend” your bank account to others but not inform the bank. If something sounds too good to be true… it probably is. In pyramid schemes, scammers mainly target ambitious and innovating individuals who desire to work independently online. If you encounter a suspicious job or investment opportunity, make sure to pause and check for the above warning signs.

Question 10

Smishing

Accepted Answer

SMS fraud often takes place in the name of companies like DHL and UPS. These scams involve hackers obtaining card information, installing payment cards in Apple/Google Wallets, and accessing online banking accounts. They can increase authorisations on cards, apply for overdrafts and loans, and transfer money from the victim's accounts.

It's crucial to be alert when receiving texts or emails that appear to come from companies. There have been many SMS messages posing as mail delivery messages recently. An     example would be to ask the recipient to click a link to update their information. Have a look at the example of SMS fraud involving DHL, where the phone number, amount, and URL indicate it's a fraud.
"The package is waiting for delivery. Please submit the payment (1.99 EUR) under the following link."
In this case, the relevant link leads to a fraudulent site. Text messages rarely contain payment information, so always be on the lookout and check the sender's name and number if the message appears via text.

Question 11

Social media fraud

Accepted Answer

Cyber fraud has been a significant problem recently, with unscrupulous parties gaining access to sensitive customer information. If you become aware of online fraud, please let us know and take screenshots of suspicious interactions. Under no circumstances should you disclose your card number or security number (CVV, validity period, Secure Code) to anyone on social media, in an email, in an SMS message, or over the phone. You should carefully read what you agree to when you receive a Secure Code security code or electronic credentials request. Facebook and Instagram have been scammed recently with sites that claim to pay people for watching videos. One of these sites is called Telegram Money. A real communication between the victim and fraudster is shown here, but the fraudster used Facebook Messenger to commit fraud in this case. See communication.

Question 12

Spend the necessary time and money to defend yourself

Accepted Answer

Individuals and companies need to invest in defences, plans, and exercises. Risk-appropriate measures must be taken.

Question 13

Vishing

Accepted Answer

Icelanders have been receiving fraudulent phone calls in recent weeks. Here are the scam phone numbers we know about: 539-5244, 539-5263, and 539-5264. Various methods are used to defraud people. Some of these scams are investor scams, where they pretend to be brokers and try to convince people to invest. They may also claim to have a large sum of money waiting for you. A recent incident occurred when a foreign entity claimed to work for a UK regulatory agency. The criminal said they were trying to access the person's bank account.

Online security

Do you suspect fraud?

Chargebacks and recovery of funds

Good habits

Take your time

Never share sensitive information

Be cautious with links

Check the sender

Never approve blindly

Hang up immediately

Do not trust unexpected calls

Beware of investment offers

Online shopping

Main types of fraud

Want to know more?

Island.is

112 Online Safety

Netvís