skip to content
rss Subscribe print Printer Friendly Share this Page

Technology

Medicare receives 4.4 million claims a day and approximately 1 out of 10 of those are fraudulent. All of the fraudulent claims add up to a large sum of wasted time and money and the government is trying to put a stop to it. The Department of Justice (DOJ) and the Health and Human Services (HHS) Office of the Inspector General have been working together to reduce fraudulent activity.

In 2008, the DOJ and HHS and the Centers for Medicare and Medicaid Services worked together through the criminal and civil systems to secure 588 criminal convictions, obtain 337 civil administrative actions against individuals and organizations who were committing Medicare Fraud, and recovered more than a billion dollars in health care fraud monies . . . To date in fiscal year 2009, the Department of Justice has already recovered nearly a billion dollars in health care fraud monies and recorded 300 convictions.

In addition to catching Medicare thieves the DOJ and HHS want to enable seniors to participate in the fight. They want to raise awareness about the kinds of fraud that are happening and give seniors the tools they need to deter, detect and defend!

Medicare Fraud Examples

Here are a few examples of how Medicare is scammed out of billions of dollars a year.

  • Medicare is billed for services or equipment not received
  • An unathorized person uses a Medicare card to receive treatment, supplies or equipment
  • Medicare is billed for equipment after it has been returned
  • A company offers an unapproved Medicare drug plan
  • A company leads you to join a Medicare plan using false information

Deter

Medicare recipients need to keep themselves safe.

  • Treat your Medicare number and Social Security number like gold. Avoid carrying them in your wallet or purse.
  • Your Medicare number is not needed to get free equipment. If someone offers you free equipment and then asks for your Medicare number, run away or hang up the phone.
  • Your number is for your use only. It is illegal for others to file claims with your Medicare number.

Detect

Learn to recognize common schemes. A few common fraud schemes are:

  • Being approached in grocery stores, parking lots, on the street, etc. and being offered goods, services or help in exchange for your Medicare number. Just run away!
  • Receiving a call from a  phone solicitor doing a health survey and asking for your Medicare number. Just hang up! They don't need your number to conduct a survey.
  • Receiving a call from a telemarketer claiming to be with Medicare or Social Security asking for you to pay for equipment over the phone or the internet. Again, hang up!

Defend

It's critical that Medicare recipients check their statement summary sheets and look for:

  • Were you charged for the same thing more than once?
  • Are there doctor visit dates look unfamiliar?
  • Were you over charged for a service?
  • Were you charged for equipment or services that you didn't receive?

If you see any of these problems make a phone call to your provider or Medicare to get it resolved. It could just be a clerical error or it could be a fraudulent act that needs to be reported.

Help is Available

To some the task above may seem very overwhelming. The DOJ and HHS understand that seniors want to protect themselves but may not have the knowledge to do so. For this reason Senior Medicare Patrols (SMP's) were created. SMP's are groups or seniors, formed in communities, that help other senior citizens learn how to combat Medicare Fraud. They bring awareness to seniors in the community, teach seniors how to read and understand their Medicare summary statements and offer support.

Medical identity theft and Medicare fraud are a huge problem that the government cannot tackle on its own. While they do their part it's important for senior citizens to do their part to protect themselves from medical identity theft and be on the watch for Medicare fraud.

Fight Back! Brochure

More detailed information is available in the Fight Back! Medical Identity Theft and Medicare Fraud brochure put out by the HHS.

HHS Even Webcast on Preventing Medial Identity Theft and Medicare Fraud

Video Points of Interest

  • Time 7:11 Assistant Attorney General of Civil Division of DOJ, Tony West, discusses the consequences of Medicare fraud and the work of the DOJ and HHS partnership.
  • Time 14:38 Inspector General, Dan Levinson, discusses new fraud education materials.
  • Time 23:08 SMP volunteer, Joanne, discusses her experiences with Medicare fraud and her roll as part of the SMP in her community.

More information is available at Stop Medicare Fraud's website.

November 3, 2009

26% of Twitter messages contain links, half of which are from spammers and lead to malicious websites.

With only 140 characters per Twitter message, it makes sense to shorten URLs and leave characters to say what you have to say. But with shortened URLs you have no idea what your final web destination will be. A spreader of malware and malicious websites couldn't be happier!

Malicious Links in Abundance

Researchers at Kaspersky Labs have found that as many as one in every 500 links on Twitter lead to sites hosting malware. They have also discovered that about 26% of Twitter messages - tweets - contain links and about half of those are created by spammers and people with bad intentions.

The two most popular URLs that the Krawler found posted to Twitter so far passed through the system in September. Both directed users to online dating sites. One of the sites, getion.com, is known to have hosted malware in the past, Raiu said.

What Twitter is Doing

So why isn't Twitter doing something to keep its users safe?  Well, it is to an extent. In August Twitter started using a filtering system by Google to detect malicious URLs. The system checks the URLs against a blacklist and then either blocks the malicious URL from being posted or warns users to think before clicking on the link. However, the system only scans URLs that are shortened using the Bit.ly shortening service - the most commonly used on Twitter. Any links shortened using any of the over 200 other formats are not picked up by Twitter's filter.

Malicious URLs were discovered over a year ago before Twitter gained it's current level of popularity. Now, malware links regularly appear in "trending topics" where people are often checking to see what is the latest and greatest.

What You Can Do

  • There are several companies that have developed more inclusive filters to sift through the shortened URLs on Twitter. Kaspersky has developed the Krab Krawler that currently examines 500,000 unique URLs a day. Of the URLs examined, 100 to 1,000 a day are sites hosting malware.
  • AVG Technologies offers LinkScanner, a tool that scans and strips URLs of any malware that they may contain. Finjan Inc. has a tool, SecureTwitter, that sends out a warning message when a malicious URL is detected.
  • You also have the option of expanding the shortened link before you click on it. The bit.ly blog has instructions on how to get the plug-in tool to expand bit.ly (and other) shortened URLs.
  • Consider using stand-alone Twitter software such as TweetDeck. They will often provide filtering of their own and/or a preference item to expand shortened URLs before you click them.

Video Interview with Kaspersky Lab Malware Researcher Costin Raiu

 Read more at the Threat Level blog. Graph courtesy of Kaspersky Labs

October 29, 2009

Data Breach

So you received a data breach notification in the mail… no big deal, right? Not according to Javelin Strategy & Research’s latest report. In fact, Javelin’s latest research reveals you are four times more likely to suffer identity fraud if you’ve received a data breach notification within the past year.

The average fraud victim will spend 30 hours and $496 out-of-pocket costs to restore their affairs, merchants and financial providers will spend billions to protect systems and brands, and law enforcement will work hard to chase the bad guys.

Many states around the country are enacting laws requiring entities that have experienced data security breaches to notify affected individuals whose personal information may be at risk. However, there seems to be a disconnect between breach notifications and consumer awareness of the risk they bring.

Why You Should Take Notice

  • During each of the past three years, an average of 11% of consumers received a breach notification.
  • Of these consumer breach victims, more than 33% experienced exposure of their Social Security numbers and 15% had their ATM PINs compromised.
  • Despite 19.5% of breach victims suffering some kind of fraud in the past year, only 2% attribute their fraud to the breach.

Come On, Do I Really Need To Worry About This?

It might be a good idea considering the Identity Theft Resource Center has already tracked 356 data breaches so far this year. Forty-six of those breaches have involved financial institutions, and when they or their third-party service providers are breached, it’s nasty.

Take for example the Heartland Payment Systems breach earlier this year. The result of this breach was a staggering compromise of 130 million credit and debit cards. Now that’s a lot of Visa cards…yikes!

What You Can Do?

There is very little we can do to avoid data breaches, however there are steps that we can take to better prepare ourselves for the next time that breach notification shows up in the mailbox:

  • If you get a data breach notification, don’t dismiss it. "Data breach notifications are intended to help consumers take protective action," said Mary Monahan, Javelin Managing Partner & Research Director.
  • Obtain credit monitoring services. Most companies will provide this free of charge in the event of a security breach, so take them up on it. You may also consider employing a more complete credit monitoring service or even initiating a credit freeze.
  • Limit the amount of sensitive data you give out online or over the telephone. If the requested information has nothing to do with the transaction you’re making, don’t provide it. For more on this, read our article about becoming a "privacy grouch."
  • Avoid or be cautious using wireless devices, “convenience cards”, credit cards or unfamiliar online transaction sites.

Lastly, remember the words of the orator, Robert Green Ingersoll when he said:

“It is a thousand times better to have common sense without education than to have education without common sense.”

October 28, 2009

Halloween is all about tricks, treats and pretending to be something your not. Scareware must think every day is Halloween.

Computer experts are reporting that scareware is on the rise. Scareware - a sneaky hacker technique used to steal personal information and spread viruses - is being found in more and more places online and even on trusted sites, like the New York Times.

"The recent scareware attacks are cropping up everywhere and can be found on even the most trusted Web sites online," said Alison Southwick, BBB spokesperson. "The threat of scareware undermines consumer trust in compromised Web sites, and on the Internet in general, but there are steps computer users can take to protect themselves."

How Scareware Tricks and Treats

Scareware usually presents itself as a pop up window on your computer that looks like it is from your computer. It gives some message that your computer has been infected with a virus that needs to be removed. Often the message tells you to go to the link provided to purchase and download anti-virus software. Once the software is purchased the download begins. Unfortunately, it is not anti-virus software that is being downloaded, but more viruses and malware.

If that weren't bad enough, now the hackers have your credit card information too.

This senario is playing out all over the internet. It was in mid-September that visitors to the New York Times web site started getting the infected pop up window. The New York Times traced the infected window back to an unauthorized ad. They later found out that the ad space was sold to hackers posing as Vonage.

But The New York Times is not the only site being affected and pop up windows are only half the story with scareware. According to Computer World Magazine, hackers are also "poisoning Google search results." Hackers monitor popular search topics and then create infected web pages with related content. They work to get those to the top of Google search results and when someone clicks a link in the search results - the infamous pop up window appears.

 

How to Protect Your Computer

Fortunately there are steps that you can take to protect your computer from scareware:

  • Never let your guard down. It is a fact that scareware can show up on even the most trusted sites, Google, Twitter, The New York Times, etc.
  • Protect your computer. Keep your operating system updated and install a good quality anti-virus program. We recommend the following packages: Norton 360 (includes backup and other features), Norton Internet Security 2010 (good all around option), or avast! (free and good), and keep it up to date. Also make sure that all security patches and updates are installed for your webrowser and programs like Adobe Flash Player.
  • Take immediate action during an attack. If a scareware window opens up, force close it using the task manager and then run your trusted anti-virus software.

If you clicked on the link and have downloaded the software all is not lost, but things aren't good. The Washington Post offers advice on their Security Fix blog of how to rid your computer of the viruses and malware. But if you aren't computer savvy, you may think about calling a professional to clean up the mess.

 

UPDATE: An article from Wired magazine's Threat Level blog sheds more light on how web sites are being targeted for malware distribution:

Web ads have become much more advanced over the years and many now include scripts that provide data tracking and other functions. Because of this, crooks are working to have their "ads" run on popular websites. Their ads also contain scripts, but the code displays scareware instead of tracking clicks or views.

In the article, Gawker Media - a major blog network of sites like Gizmodo, LifeHacker, Jalopnik and others - was targeted for ad placement, but fortunately Gawker has a team of geeks that digs into the code of any ad and confirms that it contains no malicious code. I'm guessing the NY Times now is enforcing a similar policy (yep, it is now).

Heaven help us when we visit sites that have no such team of geeks to protect us from malicious ads...

October 27, 2009

July 2009 not only brought the hopes of fun summer activities, but it also brought the new vicious Trojan virus called Clampi. Clampi is a newly sophisticated virus designed to attack online banking systems. And unlike most Trojan viruses this virus can be picked up from trusted sites like blogs, online magazines, search engines and mainstream news websites, not just gambling and pornography sites. It also is only designed to attack computers running the Microsoft Windows operating system. So Mac users are safe from Clampi, for now.

Currently, Clampi is tracking over 4,500 financial websites. Most Trojan viruses usually track 30-40 sites at a time. Clampi is designed to watch: banks, credit card companies, e-mails, retail sites, utilities, online casinos, wire transfer services, share brokerages, government sites and mortgage lenders. Clampi is also not just limited to the United States. It has been found attacking in the United States, Britain and other English speaking countries.

How Clampi Operates

Once Clampi has been picked up it settles into your computer and waits.  What does it wait for? It waits for the user to log on to a bank account, credit card or some other financial website. Once the login information is entered, Clampi grabs it and shoots it to the cyber criminal's computer. From there the criminal uses the information to fulfill their desires. Whether it is taking money from a bank account, using a credit card to make purchases or reek whatever havoc they may. 

What Clampi Can Do

Maybe you're thinking that this can't happen to you and maybe it won't. But it has been reported that through the use of Clampi criminals have stolen $75k from a car parts company in Georgia, $30k from a non-profit childcare organization in Seattle, $480k from an online city bank account, $150k from a public school district in Oklahoma, $350k from a Chicago-are school district and $700k from the Western Beaver School District in Pennsylvania. There have also been reports of companies losing anywhere from $10k to $500k because of this one virus. There is really no telling how many people have been victims of the Clampi virus.

What You Can Do

The most important thing you can do is to be proactive about protecting yourself from getting Clampi. Here are some ways to be proactive:

  • Protect your computer with security software. It should be a natural part of being online. Make sure that you have the most current version of your anitvirus software and download any necessary patches to keep it current.
  • Avoid clicking on suspicious links on blogs, e-mails and social networking sites. If you are not sure that it can be trusted, then don't go there.
  • Don't use e-commerce sites that you are not familiar with and use a credit card instead of a debit card when making online purchases.
  • Use caution when using a wi-fi network - especially one outside your home, like at an airport or coffe shop. Don't access financial web sites when using wifi in these kinds of locations. Make sure that your connection is password protected so that others cannot hack into your connection. Use WPA2 (or stronger) encryption and strong passwords when setting up your wireless network at home.
October 22, 2009

Zone Alarm has made their excellent Zone Alarm Pro 2010 software available for download today - October 13, 2009 - free of charge. It will be available until 6am PST on October 14, 2009.

The free download has the following stipulations:

  • License valid for one year (10/13/09 to 10/14/10)
  • License valid for up to 3 PCs
  • This offer is valid for new customers only
  • Limit one per customer

The software is available for download here - http://download.zonealarm.com/bin/free/sum/index.html?cid=W100020

October 13, 2009


Do You or Your Friends Take Facebook Quizzes?

Have you ever taken one of those ridiculous and inane quizzes on Facebook that tell you which color you are ("I'm Orange! Now what do I do?"), which Harry Potter character you are (see above), or which superhero your dog resembles?

Maybe you hate these quizzes and avoid them completely, but do your friends on Facebook take them? If so, all your private info is likely being shared with the quiz developers - whoever they may be. This access to your personal information has alarmed many groups, including the ACLU. Here is a warning from the ACLU of Northern California:

Even if your Facebook profile is “private,” when you take a quiz, an unknown quiz developer could be accessing almost everything in your profile: your religion, sexual orientation, political affiliation, pictures, and groups. Facebook quizzes also have access to most of the info on your friends’ profiles. This means that if your friend takes a quiz, they could be giving away your personal information too.

The ACLU of Northern California has heard from thousands of concerned internet consumers using the popular social networking software, Facebook, about privacy issues. The ACLU went digging and found there is good reason for concern: as it stands, quiz developers have access to just about everything in your profile and postings and those of your Facebook Friends.

Here are a series of screenshots where we show exactly what happens when you take a quiz or run other applications on Facebook:

Asking for Permission - For You and Your Friends

As you can see, Facebook tells you specifically that it will let the application developer "... pull your profile information, photos, your friends' info, and other content that it requires to work.

This is the privacy problem. Your friends are agreeing to share your information without your knowledge or consent. Not good.

Exactly What is Shared?

These, I believe, are the default privacy settings for applications. As you can see, you or your friend are agreeing to share a lot of personal information with a completely unknown party.

The ACLU Creates Its Own Quiz

Even if you are careful about your privacy settings in Facebook, quiz developers probably will be able to access your profile and your postings through the accounts of your Facebook Friends. To drive the point home the ACLU created their own short, instructional Facebook quiz. (And no, according to their privacy policy, the ACLU will not collect or sell your information from their Facebook quiz.) Even though I was expecting some kind of revelation it was a bit creepy to suddenly see my Facebook profile information and photos start scrolling on the screen.

What You Can Do

  • Be aware that fraudsters dig through Facebook and other social networking sites looking for information to about you. Creating quizzes - any lame quiz appears to spread rapidly across Facebook - are one of the simplest methods they have to collect data.
  • Adjust your Facebook privacy settings to project yourself. From the Facebook menu bar choose Settings > Privacy Settings > Applications > Settings. You should see a screen similar to the screenshot earlier in the article. Deselect anything you don't want shared without your permission (I'd suggest deselecting everything).
  • Choose your Friends wisely. Many people are excited at the possibility of gathering hundreds if not thousands of Facebook Friends—many of whom are friends of friends instead of people they actually know. Anyone you accept as a Facebook Friend will be able to view your profile and postings unless you say otherwise.
  • Sign the ACLU’s petition urging Facebook to tighten up their privacy policies.
  • Say ‘no’ to those playful/stupid Facebook quizzes - and any Facebook applications.
  • More on this story from the San Jose Mercury News.

September 7, 2009


Consumers’ obsession with celebrity news and culture is harmless in theory, but one bad download can cause a lot of damage to a computer.
—Jeff Green, McAfee, Inc.

Jessica Biel Sites Are #1 for Malware

Internet security company, McAfee, Inc. has just released its yearly update of most dangerous celebrity web sites for online threats such as spyware, adware, spam, phishing, and viruses. In the survey, web searches for actress, Jessica Biel, had a one-in-five chance of ending up on a website that has tested postive for malware—putting Biel’s name at the top of the danger list and beating out last year’s most dangerous name, Brad Pitt. Biel became popular on TV’s “Seventh Heaven” and recently starred in “Easy Virtue”.

Pop star, Beyonce, placed second on the list. Web searches on “Beyonce ringtones” led to a dangerous website linking to a distributor of adware and spyware. Over 40 percent of the survey searches for “Jennifer Aniston screensavers” contained computer viruses. Other celebrities on this year’s list included Miley Cyrus, Ashley Tisdale, Lindsay Lohan, Megan Fox, Angelina Jolie and newlyweds, Tom Brady and Gisele Bundchen.

Every day, cybercriminals use celebrities’ names and images, like Kim Kardashian and Rihanna, to lure surfers searching for the latest stories, screen savers and ringtones to sites offering free downloads laden with malware.

What You Can Do

  • Be aware of the connection between celebrity websites and malware. You may not visit those sites but your kids might.
  • Be aware that malware-connected celebrity web sites change with the tide of popularity of the celebrities.
  • Make sure you’re using anti-malware software on your computer and it is current.
  • More info from Reuters - http://www.reuters.com/article/internetNews/idUSTRE57O2P520090825

September 4, 2009


From a recent UC Berkeley report:

More than half of the internet’s top web sites use a little known capability of Adobe’s Flash plug-in to track users and store information about them, but only four of them mention the so-called Flash Cookies in their privacy policies.

Under the direction of Chris Hoofnagle of the Information Privacy Programs at the Berkeley Center for Law and Technology, the researchers discovered that most web users aren’t familiar with Flash cookies and that Flash web cookies can’t be controlled through the cookie privacy controls in a browser. Even more interesting was the use of Flash cookies to ‘re-spawn’ or bring back to life traditional browser cookies that had been deleted on customer computers. In the study even several federal government web sites were found to contain Flash cookie ID information. The federal government has a policy of banning the use of traditional browser cookies.

What’s all the fuss about? Internet web sites often attach browser ‘cookies’—small strings of identifying text and numbers—to your computer to help them keep track of you and your preferences when you visit their sites. In theory this is a useful connection between you and the web sites you visit. For instance, an online book vendor could store your customer preferences information to better help you find what you want and make it easier to make your purchases.

However, like many useful, good things on the web, browser cookies have turned out to be an avenue for identity thieves to find us and our personal information. A cookie that no one knows about and that is not controllable through our web browsers, and can be used to re-spawn traditional browser cookies—could be a useful avenue for identity thieves indeed.

Changing Flash Preferences

Removing Current Site Cookies

Turns out, Adobe has a Settings Manager on its site where you can control how Flash cookies are stored along with other things. If you right-click on a piece of Flash code in your browser you can select "Settings" and get to this special place. Or you can just click our handy link: Adobe Website Storage Settings Panel.

What you should be seeing is something like this:

Here you can see which cookies have been written to your computer along with the ability to DELETE all of them. That's something I would strongly consider. Remember, however, that there are some benefits with these cookies. If you frequent sites that use this technology (and many do) you will be deleting some of your settings with those sites and you may have to re-enter text each time you visit.

There is risk/reward with every choice you make in life...

Even if you decide to push the Delete all Sites button, you still have some work left.

Stopping New Sites from Writing Cookies

Even if you deleted the cookies that have already been written to your computer, you'll need to keep new cookies from being written as well. Luckily, Adobe has created a way to do that:

Adobe Global Storage Settings Panel

If everything goes according to plan, you should be seeing something that looks like this:

Here you can tell Flash not to store any cookies in the future. Just drag the slider over to "None" and select "Never Ask Again." That's it!

Flash Cookie Removal Tools

Here are some other tools if you want 3rd party help with managing or controlling Flash cookies:

Windows:

Mac OS X:

Flash Cookie Storage Locations

You can always go to the directory where the cookies are stored and remove them manually. It's not a permanent solution - new cookies will get created in the future - but it works.

Windows:

LSO files are stored typically with a “.SOL” extension, within each user’s Application Data directory, under Macromedia\FlashPlayer\#SharedObjects.

Mac OS X:

For Web sites, ~/Library/Preferences/Macromedia/FlashPlayer. For AIR Applications, ~/Library/Preferences/[package name (ID)of your app] and ~/Library/Preferences/Macromedia/FlashPlayer/macromedia.com/Support/flashplayer/sys

GNU-Linux:

LSO files are stored in ~/.macromedia.

Wrap Up

Now you know about the mysterious and curiously difficult to remove Flash cookies. They are pervasive - even on government web sites - and won't be going away anytime soon.

Please post any follow-up questions or concerns below...

August 19, 2009


A recent article by Kevin Poulsen on Wired.com made a sobering observation: software hackers are becoming as sophisticated in their programming as the software they're trying to attack. Where hacking used to be something of a harmless, if annoying prank by bright, restless kids before they went off and got regular jobs, hackers are increasingly well-funded and making use of state-of-the art technology to design the trojans, viruses and spyware that attempt to get into your computer.

Today, the best hackers have the skill and discipline of the best legitimate programmers and security gurus. They're using mind-bending obfuscation techniques to deliver malicious code from hacked websites undetected. They're writing malware for mobile phones and PDAs.

The Case of the Clever Conficker

Poulsen cited the the worst case of computer infection in recent years, the Downadup worm , also known as the Conficker worm (see “Latest Worm Infect 9 Million PCs”). One reason the Conficker worm spread so quickly was that it was the first widely-released program—good or bad—to incorporate M6, a state-of-the-art cryptographic algorithm developed at MIT. When crypto expert Phillip Porras first dug into Conficker's code, M6 was available only from the websites of MIT and the U.S. National Institute of Standards and Technologies—and no one even recognized M6 at first. When it came to implementing M6 the bad guys had beat the good guys to the punch!

Other portions of Conficker were equally impressive: the way it doggedly hunts for anti-virus software on a victim's machine, and disables it; or the peer-to-peer mechanism. "There were points where it was pretty clear that certain major threads inside Conficker C seemed to be written by different people," Porras says. "It left us feeling that we had a more organized team that brought different skills to bear.... They aren't people who have day jobs.

Another reason the Conficker worm wriggled its way into so many computers was the flexibility and responsiveness of its software engineers. Just like legitimate software engineering teams, when the authors of Conficker discovered a security hole in the first release of their program they stayed up nights and patched their code within just a few weeks. Experts are observing new malware coming out as quickly as a couple of days after a new vulnerability is announced.

What You Can Do?

  • Be proactive. Now. Believe that you're computers connected to the Internet are at risk and it's up to you to fortify them.
  • If your anti-malware software doesn't run automatically get in the habit of running it daily. If you haven't updated your anti-malware software lately, do it today.
  • Make sure your operating software is updated regularly. The best method is to let it download and update automatically. Software vendors will update their software as quickly as possible after a serious weakness is discovered.
  • More Info

    Read the article - Future of Cyber Security: Hackers Have Grown Up.

August 13, 2009

Special Offers

Connect With Us

We invite you to become a fan of Fight Identity Theft or just join in the discussion.

Join Us on Facebook Join Us on Twitter

Subscribe to Breaking News

Subscribe to Fight Identity Theft and receive top stories and breaking news via email.