What is a social engineering attack?

To launch a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization’s network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

What is a phishing attack?
Phishing is a form of social engineering. Phishing attacks use email or malicious web sites to solicit personal, often financial, information. Attackers may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.

How do you avoid being a victim?

* Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.

* Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information.

* Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.

* Don’t send sensitive information over the Internet before checking a web site’s security (see Protecting Your Privacy for more information).

* Pay attention to the URL of a web site. Malicious web sites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).

* If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a web site connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group.

* Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (see Understanding Firewalls, Understanding Anti-Virus Software, and Reducing Spam for more information).

What do you do if you think you are a victim?

* If you believe you might have revealed sensitive information about your organization, report it to the appropriate people within the organization, including network administrators. They can be alert for any suspicious or unusual activity.

* If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.

Legitimate letters of credit are never sold or offered as investments.

Legitimate letters of credit are issued by banks to ensure payment for goods shipped in connection with international trade. Payment on a letter of credit generally requires that the paying bank receive documentation certifying that the goods ordered have been shipped and are en route to their intended destination.

Letters of credit frauds are often attempted against banks by providing false documentation to show that goods were shipped when, in fact, no goods or inferior goods were shipped.

Other letter of credit frauds occur when con artists offer a “letter of credit” or “bank guarantee” as an investment wherein the investor is promised huge interest rates on the order of 100 to 300 percent annually. Such investment “opportunities” simply do not exist.

Some Tips to Avoid Letter of Credit Fraud:

• If an “opportunity” appears too good to be true, it probably is.
• Do not invest in anything unless you understand the deal. Con artists rely on complex transactions and faulty logic to “explain” fraudulent investment schemes.
• Do not invest or attempt to “purchase” a “Letter of Credit.” Such investments simply do not exist.
• Be wary of any investment that offers the promise of extremely high yields.
• Independently verify the terms of any investment that you intend to make, including the parties involved and the nature of the investment.

Medical Equipment Fraud :
Equipment manufacturers offer "free" products to individuals. Insurers are then charged for products that were not needed and/or may not have been delivered.

"Rolling Lab" Schemes:
Unnecessary and sometimes fake tests are given to individuals at health clubs, retirement homes, or shopping malls and billed to insurance companies or Medicare.

Services Not Performed:
Customers or providers bill insurers for services never rendered by changing bills or submitting fake ones.

Medicare Fraud:
Medicare fraud can take the form of any of the health insurance frauds described above. Senior citizens are frequent targets of Medicare schemes, especially by medical equipment manufacturers who offer seniors free medical products in exchange for their Medicare numbers. Because a physician has to sign a form certifying that equipment or testing is needed before Medicare pays for it, con artists fake signatures or bribe corrupt doctors to sign the forms. Once a signature is in place, the manufacturers bill Medicare for merchandise or service that was not needed or was not ordered.

Some Tips to Avoid the Health Insurance Fraud:

• Never sign blank insurance claim forms.
• Never give blanket authorization to a medical provider to bill for services rendered.
• Ask your medical providers what they will charge and what you will be expected to pay out-of-pocket.
• Carefully review your insurer’s explanation of the benefits statement. Call your insurer and provider if you have questions.
• Do not do business with door-to-door or telephone salespeople who tell you that services of medical equipment are free.
• Give your insurance/Medicare identification only to those who have provided you with medical services.
• Keep accurate records of all health care appointments.
• Know if your physician ordered equipment for you.