The State of Identity Theft and Consumers Scams in the U.S.

The scammer sends emails or text messages with a link to a website where malware is installed on the device. Sensitive information may be captured on the website or via the malware on the device going forward.

The scammer convinces the consumer to provide sensitive information, make a payment, or click on a link to a specific website (installing malware on the device) in order to quality for a large windfall.

The victim pays in advance for goods or services that are never received. Often, these scams are run through online auction websites or social media where goods are offered for sale.

The scammer takes control of a trusted third-party’s email and sends an email appearing to be from that person to an employee of the business instructing that a specific payment be made. Funds go to an account controlled by the scammer. This can also occur with individuals’ personal email accounts but is best known for business transfers that result in very large losses.

Scammers use various methods to install malware on consumer devices. The malware may be a keylogger to capture online credentials when keyed, be a trojan to allow remote access to the device, enable a man-in-the-middle attack during future online sessions, or be various other types of malware installed on the device.

The scammer claims to be with a reputable firm and says there is a problem with a device such as a mobile phone or laptop that needs to be corrected. The focus of this scam is to either get consumers to pay for unnecessary repairs to deices or leverage access to the victim’s machine to deploy malware or ransomware.

The scammer convinces a consumer to pay a fee. In exchange, the scammer promises to release a much larger amount of money or a price that never materializes.

The scammer convinces a consumer to pay a fraudulent invoice or to redirect the payment for a legitimate invoice to a different account (that is controlled by the scammer).

The victim (typically female) is convinced to send money to a person that she has never met in person but met through a social media website or dating service. The consumer believes she is in a relationship with the person she is corresponding with; generally, additional sums are extracted over time.

The scammer convinces the consumer to release an OTP sent by the consumer’s bank, mobile carrier, or other company to enable the fraudster to conduct fraudulent transactions successfully (e.g., releasing a fraudulent transaction, authoring the purchase of a new mobile devices).

The consumer is specifically directed to use a P2P payment method when purchasing online goods, paying an advance fee, sending funds to invest, or participating in another scam. P2P transactions are real-time and cannot be canceled, so they are particularly attractive to thieves.

The scammer contacts the consumer claiming to work for that person’s bank and convinces the consumer to make a payment, provide confidential information, or provide an OTP so the scammer can steal funds.

The scammer claims to represent a charity, government agency, utility provider, mobile carrier, family member in crisis, or other firm and convinces the consumer to make a payment.