Security Zone

Mobile Phone Fraud on the Rise — Stay Protected!

Phone fraud via mobile devices is rapidly increasing. Learn how these scams work and what you can do to avoid becoming a victim.

‍

Don’t Click Suspicious Links!

‍If you receive a random message asking you to “click here,” don’t do it. These links often install malware that gives scammers remote access to your device.

‍

Signs of an Attack — What to Do:‍

If your phone suddenly stops working, visit your cell provider immediately. Let them know you may be experiencing a SIM swap attack and request that your SIM be deactivated and replaced.

‍

How to Stay Safe:‍

Before clicking on any links in texts or emails, ask yourself:

• Was I expecting this message?
• Do I recognize and trust the sender?
• Does the contact info match what’s saved in my phone?

If any answer is “no,” verify the message by contacting the sender using a different method — not by replying directly to the message.

Stay alert. Stay safe.

‍

‍

‍

What Is SMShing?

SMShing is a type of phishing scam — but instead of coming through email, it arrives via text message (SMS). The term combines “SMS” (short message service) with “phishing.”

How SMShing Works

Scammers send messages that appear to be from trusted sources — like your bank, the U.S. Postal Service, Amazon, Costco, or Home Depot. These messages often claim that:

• A delivery needs your attention
• Your account has been compromised
• You’ve won a gift card or reward

But they’re all fake. The goal is to trick you into sharing personal and financial information, including:

• Account usernames and passwords
• Social Security numbers
• Birthdates
• Credit/debit card numbers
• PINs

Once obtained, this information may be used for identity theft or financial fraud.

Think It Might Be Real?

If a message seems legitimate, don’t respond directly. Instead:

• Look up the company or agency’s official website
• Contact them using a verified phone number or email
• Never use the contact details provided in the suspicious text

A quick search can help confirm whether the message is a scam.

‍

How to Avoid SMShing Scams

The Federal Communications Commission (FCC) recommends the following tips:

• Never click on links or respond to texts from unknown senders
• Do not reply, even to requests like “text STOP”
• Delete suspicious messages immediately
• Keep your phone’s operating system and security apps up to date
• Consider installing anti-malware software for extra protection

Final Tip: Stop. Think. Verify.

No matter how real a message looks, pause before taking action. Scammers count on quick, emotional reactions — don’t give them the chance.

If you believe you’ve fallen victim to a SMShing scam:

• Report it to local law enforcement
• File a complaint with the FCC at fcc.gov/complaints

Stay alert. Your awareness is your best defense.

‍

‍

‍

What Is a Spoof Website

A spoof website is a fake site designed to mimic a legitimate one, aiming to trick you into entering personal or financial information such as:

• Usernames and passwords
• Credit card details
• Social Security numbers

These sites often appear in search engine results — especially when you enter vague search terms or make a typo in the web address.

Even savvy internet users can fall victim to these sophisticated scams. A minor slip-up, like typing a URL too quickly, could lead you straight to a spoof site.

‍

How to Spot a Spoof Website

Watch for these red flags:

• Misspellings and grammar mistakes: Legitimate sites rarely have typos or odd punctuation.
• Suspicious URLs: Check the web address. If it looks strange or doesn’t match the real site exactly, leave immediately.
• Blurry logos or images: Fake websites often use low-quality versions of real brand assets.
• Unexpected pop-ups or forms asking for sensitive info.

Tip: If something feels off, it probably is. Close the site right away.

‍

How to Avoid Spoof Websites

• Bookmark trusted websites so you can access them directly.
• Type URLs carefully to avoid mistakes that lead to fake sites.
• Be specific in search engines and double-check spelling.
• Hover over links to preview the actual URL before clicking — check the bottom-left of your browser window.

What to Do If You Suspect a Spoof Website

Help protect others by reporting it:

• To the FTC: https://reportfraud.ftc.gov
• To Google Safe Browsing: https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

Final Reminder: Pause Before You Click

Cybercriminals rely on speed and distraction. By slowing down, checking URLs, and staying alert, you can avoid spoof websites and keep your information safe.

Protect Yourself from Cryptocurrency Scams

Cryptocurrency (or “crypto”) has become increasingly popular in recent years. Unfortunately, scammers have taken advantage of this growing interest to carry out fraud involving digital currencies such as Bitcoin.

According to a 2022 report from the Federal Trade Commission (FTC), consumers reported more than $1 billion in cryptocurrency losses to scams since the beginning of 2021.

‍

Why Crypto Is Attractive to Scammers

• No central authority: Unlike traditional financial systems, crypto transactions are not monitored or protected by a centralized bank or institution.
• Irreversible transactions: Once a cryptocurrency transfer is completed, it typically cannot be reversed or recovered.
• Lack of familiarity: Many consumers are still learning how cryptocurrency works, which makes it easier for scammers to exploit misunderstandings.

How Crypto Scams Typically Work

Scammers may initiate contact through various channels:

• Email phishing attempts
• Text message scams (“smishing”)
• Phone calls
• Social media messages or impersonations
• Packages delivered by private couriers (e.g., FedEx or UPS)

These scams often include:

• Promises of unusually high investment returns
• Requests to deposit cash into a Bitcoin ATM and send funds to a digital wallet
• Messages impersonating friends, relatives, or trusted organizations
• Pressure tactics, intimidation, or urgency designed to rush decision-making
• Delivery of suspicious checks or items via non-USPS carriers

⚠️ Please note: Scammers often avoid using the U.S. Postal Service to deliver fraudulent materials, as this may constitute mail fraud, a federal offense.

‍

Steps to Protect Yourself

Before engaging in any cryptocurrency-related transaction:

• Verify legitimacy with a trusted financial professional (e.g., your banker, CPA, or tax advisor).
• Never send money on behalf of someone else, especially if asked to do so via cryptocurrency.
• Do not cash checks or accept funds from unknown senders. A check with your name on it does not confirm account ownership.
• If you receive a package or check from an unfamiliar source—especially one not delivered by USPS—exercise extreme caution.
• If any conversation seems suspicious, contains poor grammar, or puts pressure on you to act quickly, do not proceed.

Scammers may instruct you not to speak with your bank or others. If you are ever asked to keep a transaction secret, consider that a red flag.

‍

What to Do If You Suspect a Scam

If you believe you may have been the target of a cryptocurrency scam, take the following actions:

1. Do not send any additional funds.
2. Contact your financial institution immediately.
   • If you bank with FNB Miami Bank, you may call us at 918-542-3711.
3. File a complaint with the FBI’s Internet Crime Complaint Center (IC3) at www.ic3.gov.
4. Be alert to future fraud attempts. Victims are sometimes contacted again by additional scammers posing as law enforcement or recovery agents.

When in Doubt — Reach Out

If you're unsure whether a message, check, package, or transaction request is legitimate, we're here to help. Contact your banker or financial advisor before taking action.

Source:
Emma Fletcher, FTC Consumer Protection Data Spotlight, June 3, 2022
"Reports show scammers cashing in on crypto craze"

‍

‍

‍

What is Ransomware?

Ransomware is a type of malicious software (malware) that encrypts or blocks access to data or systems. The attacker then demands a ransom payment in exchange for restoring access. This form of cybercrime continues to affect individuals, businesses, and public institutions worldwide.

‍

Who Is at Risk?

All sectors and individuals may be targeted. However, ransomware attacks frequently impact:

• Small to medium-sized businesses
• Educational institutions
• Government entities and municipalities
• Energy and utility companies
• Healthcare providers
• Financial services

In recent years, municipalities and school districts have increasingly become targets. According to industry reports, small to mid-sized organizations account for the majority of ransomware incidents.

‍

What Is at Stake?

Ransomware attacks can compromise:

• Financial data
• Customer and employee records
• Personal information
• Trade secrets and intellectual property
• Access to critical operational systems

Paying a ransom does not guarantee data recovery and may increase the risk of future attacks.

According to public data, the average cost of downtime following a ransomware attack exceeds $64,000. Some organizations have reported recovery costs in the millions.

‍

Can Ransomware Be Prevented?

While no method can offer complete immunity, organizations can reduce their risk significantly by adopting cybersecurity best practices and implementing a layered defense strategy.

‍

Recommended Prevention Measures

• Security Awareness Training: Regularly train staff to identify phishing attempts and social engineering tactics.
• Access Control: Use the principle of least privilege. Limit admin access to essential personnel only.
• Network Segmentation: Separate critical systems from broader network access.
• Endpoint Security: Deploy up-to-date anti-malware and antivirus tools from reputable vendors.
• Email Filtering: Use robust email filtering tools to block malicious attachments and links.
• Patch Management: Ensure software and operating systems are regularly updated and patched.
• Multi-Factor Authentication (MFA): Add MFA to accounts with sensitive access or administrative control.
• Strong Password Hygiene: Enforce secure password creation policies and the use of password managers.
• Regular Backups: Maintain secure, offline backups of critical data and test recovery procedures regularly.
• Use of VPNs: Require VPN usage for remote access, especially on unsecured networks.
• Cyber Insurance: Consider a cyber insurance policy to help offset potential financial exposure.

What To Do in the Event of an Attack

1. Isolate the Affected Device: Disconnect from networks immediately.
2. Notify IT and Security Teams: Report the incident without delay.
3. Do Not Pay the Ransom: Law enforcement agencies recommend against paying, as it does not guarantee data recovery.
4. Engage Cybersecurity Experts: Contact your organization’s incident response team or a third-party cybersecurity firm.
5. Report the Incident: Notify local authorities and consider filing a report with the FBI’s Internet Crime Complaint Center (IC3) or the Cybersecurity and Infrastructure Security Agency (CISA).

Potential Consequences

Ransomware can result in:

• Operational downtime
• Loss or theft of sensitive information
• Financial and reputational damage
• Regulatory and legal exposure

Proactive security measures, staff awareness, and a well-developed incident response plan are essential for minimizing the impact of ransomware and supporting business continuity.