Japan earthquake and tsunami spark malware and donation scams
Within minutes of tragedy striking, crooks have launched scores of Japan earthquake and tsunami scams.
It prompted warnings from security services, the Department of Homeland Security and aid agencies for the public to be on their guard against bogus fundraisers and malware attacks.
As happened with the 2010 Haiti earthquake, and, more recently, the quake in Wellington, New Zealand, scammers don't waste a minute in trying to cash in on other people's misfortunes.
According to Internet security specialists Trend Micro, crooks immediately set up a number of virus-laden sites that showed up in search engines for people searching on the words "earthquake in Japan."
Anyone who clicked on the links activated a pop-up "scareware" window that tried to frighten victims into believing they had a badly infected PC and must pay to have it removed.
According to specialist online publisher SecurityWeek.com, scams spread like wildfire across Facebook within minutes of the Japan earthquake being reported.
And as the Japan tsunami spread across the Pacific, Security Week's Mike Lennon warned: "(S)cammers are hard at work registering new domains and cranking out templates for their fake donation sites.
"This will be followed with massive volumes of email spam, Tweets through Twitter, and Facebook posts, as scammers gear up to solicit donations from around the world."
One trick the scammers use involves setting up websites with either official-sounding names or based on a misspelling or variation of a legitimate organization, to trick anyone who mistypes the name.
After the New Zealand earthquake, for instance, scam sites mimicking both PayPal and the Red Cross tried to lure victims into making donations.
You can read more about this kind of trick, known as typosquatting, in an earlier Scambusters report.
In the case of the latest tragedy, expect to see websites and donor appeals using site names with the words "Japan earthquake" or "Japan tsunami". Not only will they collect and pocket victims' money but also their credit card details for use in identity theft.
Remember too that, since the tsunami also inundated parts of Hawaii and threatened West Coast states, scammers will also use these incidents as levers for phony fund raising.
On social networks and via email spam, they use hijacked accounts to try to convince message and mail recipients that the cash plea or site links have come from a friend.
Others use spoofed email addresses that, again, appear genuine -- like "@paypal.com" or "@redcross.org" -- but really conceal a totally different address that belongs to the scammer.
However, a few simple measures will ensure that you don't get duped into giving your earthquake and tsunami donations to crooks or downloading malware on to your PC.
We covered many of these in some of our earlier issues dealing with disaster scams, including earthquakes, hurricanes and flooding.
Start with the following report on the Haiti earthquake, which contains links to other issues.
7 Key Security Steps
In summary, here are the seven most important things you can do to avoid getting scammed.
- Don't click on links or attachments supposedly relating to the earthquake or tsunami, even if they come from people or organizations you know (unless you can confirm they're genuine).
- Don't respond to email or door-to-door solicitations for donations. Charities generally do not use this method to raise funds, especially for emergencies such as this.
Be wary even of face-to-face "fund-raisers" you may encounter in a mall or parking lot. Better to give your money direct to the charities (see below).
- Similarly, don't give your credit card details in response to a telephone solicitation. Again, most charities don't use this technique and you have no way of being sure who the caller really is.
- If you want to make a donation, visit the websites of established charitable organizations such as the American Red Cross
or the Salvation Army. - If you are looking for news updates, by all means use a search engine, but opt for visiting sites you know and trust -- like the major media organizations.
- As always, ensure that you have Internet security software on your PC and that it's up to date.
This will stop most attempts at installing malware and should identify suspect websites.
- Never click on pop-up security warnings unless you know for sure they're messages from your installed security software.
If you see one on a PC, try to avoid clicking on it at all. Instead, use the Windows task manager to exit from your browser. Then run a security software scan.
(It's beyond the scope of this article to explain how to use Task Manager but you can find more information here:
http://support.microsoft.com/kb/323527
or, for Windows 7, http://windows.microsoft.com/en-US/windows7/Open-Task-Manager)
Our hearts go out to the victims of the Japan earthquake and tsunami tragedy, and we also want to ensure you don't become a victim too.