We know everyone is looking for that best deal online, especially during the Black Friday shopping blitz. Here are some quality online shopping tips from Intersections, Inc. (provider of the Identity Guard [4] identity theft protection service).

We also recommend a post from the always excellent Privacy Rights Clearinghouse - "Holiday Shopping? Ten Timely Tips [5]"

Don’t Let Would-Be “Grinches” Steal Your Financial Health and Identity During the Busiest Shopping Season of the Year!

As the biggest holiday shopping days of the year quickly approach, consumers everywhere will be lining up at stores on "Black Friday" for pre-dawn sales that will hopefully net great bargains and savings on holiday gifts. For those that don't want to fight the massive crowds at the malls and local shopping centers, they'll surf the Web on "Cyber Monday" - the Monday right after Thanksgiving - to catch even better sales, conveniently ordering their gifts online to have them shipped all over the world.

Finding the right deal on the perfect gift is going to be a priority this holiday shopping season as consumers everywhere are penny pinching during tougher economic times. The National Retail Federation expects average holiday spending this year will be around $682.74, down 3 percent from $705.01 last year, so getting the best value for your money is key, whether the gift is found on the Internet or at a retail store. With major online price breaks offered on Cyber Monday, online shopping sales are expected to increase 18 percent over last year, according to Information Resources, Inc.

To kick off the 2009 holiday shopping season, Intersections Inc. (Nasdaq: INTX [6]), a leading global provider of consumer and corporate identity risk management services, and provider of IDENTITY GUARD® Total Protection, the award winning identity theft protection service, advises holiday shoppers to take extra caution to avoid damaging their credit or becoming a victim of identity theft. Identity theft peaks this time of year -- wallets are stolen, credit cards are accidentally left behind and scammers everywhere are looking to prey on their next victims -- but there are simple steps consumers can take to avoid making careless decisions that can have a long-term effect on their financial well-being.

Intersections recommends the following safety tips for holiday shoppers:

1. Protect your computer from online threats including money-stealing Trojans. Fraudsters are eagerly waiting to take advantage of the millions of credit card transactions that will be made online this holiday season. They are lurking to find any weak links in your network to gain access to your personal and credit information. More recently, they are using sophisticated Trojans to grab your bank account and credit card login information, disable your security software, and sneak into your bank account by pretending to be you. Trojans are even smart enough to quietly drain your bank account over the holiday period based on the assumption that you'll be too busy to check exactly how much you're spending until the New Year. The best way to avoid Trojans is to (a) not open attachments or click on email links; (b) be careful where you surf and stick to online "neighborhoods" where you really feel safe; and (c) regularly patch your computer and update your anti-virus, anti-spyware and firewall software.
2. Take a tip from online merchants and "trust but verify." Whether it's online shopping searches, incredible gift offers, or holiday wishes from your Twitter "Tweeps" or Facebook friends, the best way to avoid gift-wrapping yourself for scammers this year is to turn your cynicism on to the highest level. If you think before you click, you might just play Grinch to an identity thief.
3. Be careful buying gift cards. Make sure that you purchase gift cards that are legitimate and secure, and avoid buying gift cards secondhand from an unverified source. UK-based security firm Corsaire recently found that the vulnerable magnetic-stripe technology used for gift cards and customer loyalty cards make these attractive targets for hackers. Additionally, the research revealed that gift cards can easily be "sniffed" off the shelf in the checkout line with a scanner and cloned, card numbers can be stolen, and retailers' gift card Web sites can be hacked.
4. Avoid Tweet Traps! Scammers fully understand the power and reach of social networks, and gathering places like Facebook and Twitter are a feeding ground for all kinds of thieves this holiday season. According to the eHoliday Study by Shop.org (a division of the National Retail Federation), 47.1 percent of retailers said they will be increasing their use of social media during the holidays. The biggest threat to be wary of this year is the "Tweet Trap" - a message that appears to be from a trusted friend or follower passing on some great news, a real bargain, or a worthy cause, but instead hides spam, phishing fraud, or a malicious download. Consumers should be cautious about Tweets or Facebook messages about great holiday deals, must-have gifts, or hard luck stories, even if they are coming from "friends." If they sound interesting, do your own research to see if they're genuine. But don't click or download.
5. If a deal sounds too good to be true, it probably is. This scam has focused on promising shoppers the hard-to-find gift at an irresistible price and in most cases, the gift doesn't exist, doesn't arrive, the seller demands far more for it, or simply steals the shopper's credit card information. But this year, hackers are upping the stakes by hacking into the search ranking systems of the major search engines like Yahoo! and Google so that their fraudulent or malware-infected web sites appear at the top of shopper searches. And most shoppers still believe that if a Web site is at the top of a search engine's list, it has to be legitimate.
6. Do NOT give out your financial information over the phone or email. If your bank or credit card company sends you an email or even calls you warning you of insufficient funds or other problems with your account, contact them directly using the customer service numbers posted on their web sites. Don't respond to their emails or to any number they provide in an email or phone message.
7. Keep travel plans private. Don't give a gift to digital burglars by Tweeting or posting updates to Facebook about your holiday plans like when you're going to be away from home or all the cool stuff you bought. Otherwise your new purchases may end up under someone else's tree.
8. Do a post-holiday credit health check-up. After the holidays are over, be sure to check your credit reports, credit card statements and bank statements to verify all transactions. Each transaction you made, either in retail stores or online, could have been compromised, adversely affecting your credit and your credit score. Notify your bank or credit card company immediately if you see anything suspicious.

"With a soft economy and higher unemployment rates, consumers are under increased pressure to cut holiday spending, and this may lead to an increased willingness to take on greater risks," said Steven Schwartz, Intersections' Executive Vice President of Consumer Solutions. "While retailers will respond with timely offers and special discounts, it's important for customers to protect themselves from scammers and cyber scrooges who may try to prey on their emotions with targeted offline and online schemes."

One way to protect yourself is to be vigilant about where you shop (online or at the mall), what information you provide and to whom, and to protect your computer from spyware, malicious code and Trojans. Intersections' IDENTITY GUARD® Total Protection [4] is the most comprehensive offering on the market today covering personal information, credit reports, public records, computer, Internet and mobile transactions. The service also provides sophisticated software that protects consumers against keylogging attacks, secures their passwords and user IDs as they navigate online, identifies legitimate websites, and protects their computers from advanced malware software. IDENTITY GUARD® Total Protection [4] also provides identity theft recovery services and financial reimbursement insurance in the event identity theft occurs. Find out more at www.identityguard.com [4].

Microsoft launched an update Tuesday to patch about fifteen holes in Windows 2000, Windows XP, Windows Server and Office. While most of the patches are related to various Word and Excel, or Windows Server issues, a critical vulnerability was found within the Windows OS kernel - a fairly rare occurrence.

The Big Hole

The Windows kernel is the core of the operating system and the flaw is related to how embedded font files are processed. We're not going to get into the technical mumbo-jumbo here, so we'll just tell you that the problem - if exploited - would allow malicious code to be passed directly to the system, bypassing any browser defenses that have been created to stop this sort of attack. The code could be downloaded just by visiting a web page prepared by hackers. With the increase of URL shorteners being used [63] as well as advertising attacks [64], it's easier than ever to be accidently exposed to some nasty code.

Microsoft rated the kernel flaw as critical and gave it an exploitability ranking of 1. This means that Microsoft expects there to be a working exploit within 30 days and is similar to "SEVERE - Severe risk of terrorist attacks" on the Homeland Security advisory system (if anyone is actually paying any attention to that any more).

Researchers agree that the bad guys are going to move quickly:

"An exploit will appear sooner rather than later," said Jason Miller, the security and data team manager for patch management vendor Shavlik Technologies. "The target is Internet Explorer, and browsing is the number one attack vector in the world right now. Users can be infected simply by browsing on a [malicious] site.

So this is a big hole that can do some nasty things on unpatched computers.

The Solution

Take the following steps to protect your computer:

• Set your computer to automatically download Microsoft updates [65].
• Run updates immediately or just set the system to install them automatically.
• Reconsider using Internet Explorer as your browser of choice. The same problem will not occur using Firefox or other non-IE browsers.

How to Update Windows Automatically

Windows XP

To set your PC to update automatically in Windows XP, simply access the Control Panel in the start menu, click "Automatic Updates," and choose "Automatic."

Windows Vista

For Vista, open Windows Update in the start menu, select "Change Settings," and then select "Install updates automatically."

More information can be found at Computer World [66] and The Washington Post's Security Fix blog [67].

Medicare receives 4.4 million claims a day and approximately 1 out of 10 of those are fraudulent. All of the fraudulent claims add up to a large sum of wasted time and money and the government is trying to put a stop to it. The Department of Justice (DOJ) and the Health and Human Services (HHS) Office of the Inspector General have been working together to reduce fraudulent activity.

In 2008, the DOJ and HHS and the Centers for Medicare and Medicaid Services worked together through the criminal and civil systems to secure 588 criminal convictions, obtain 337 civil administrative actions against individuals and organizations who were committing Medicare Fraud, and recovered more than a billion dollars in health care fraud monies . . . To date in fiscal year 2009, the Department of Justice has already recovered nearly a billion dollars in health care fraud monies and recorded 300 convictions.

In addition to catching Medicare thieves the DOJ and HHS want to enable seniors to participate in the fight. They want to raise awareness about the kinds of fraud that are happening and give seniors the tools they need to deter, detect and defend!

Medicare Fraud Examples

Here are a few examples of how Medicare is scammed out of billions of dollars a year.

• Medicare is billed for services or equipment not received
• An unathorized person uses a Medicare card to receive treatment, supplies or equipment
• Medicare is billed for equipment after it has been returned
• A company offers an unapproved Medicare drug plan
• A company leads you to join a Medicare plan using false information

Deter

Medicare recipients need to keep themselves safe.

• Treat your Medicare number and Social Security number like gold. Avoid carrying them in your wallet or purse.
• Your Medicare number is not needed to get free equipment. If someone offers you free equipment and then asks for your Medicare number, run away or hang up the phone.
• Your number is for your use only. It is illegal for others to file claims with your Medicare number.

Detect

Learn to recognize common schemes. A few common fraud schemes are:

• Being approached in grocery stores, parking lots, on the street, etc. and being offered goods, services or help in exchange for your Medicare number. Just run away!
• Receiving a call from a  phone solicitor doing a health survey and asking for your Medicare number. Just hang up! They don't need your number to conduct a survey.
• Receiving a call from a telemarketer claiming to be with Medicare or Social Security asking for you to pay for equipment over the phone or the internet. Again, hang up!

Defend

It's critical that Medicare recipients check their statement summary sheets and look for:

• Were you charged for the same thing more than once?
• Are there doctor visit dates look unfamiliar?
• Were you over charged for a service?
• Were you charged for equipment or services that you didn't receive?

If you see any of these problems make a phone call to your provider or Medicare to get it resolved. It could just be a clerical error or it could be a fraudulent act that needs to be reported.

Help is Available

To some the task above may seem very overwhelming. The DOJ and HHS understand that seniors want to protect themselves but may not have the knowledge to do so. For this reason Senior Medicare Patrols (SMP's) were created. SMP's are groups or seniors, formed in communities, that help other senior citizens learn how to combat Medicare Fraud. They bring awareness to seniors in the community, teach seniors how to read and understand their Medicare summary statements and offer support.

• Use the www.smpresource.org [77] web site to find a group in your area.

Medical identity theft and Medicare fraud are a huge problem that the government cannot tackle on its own. While they do their part it's important for senior citizens to do their part to protect themselves from medical identity theft and be on the watch for Medicare fraud.

Fight Back! Brochure

More detailed information is available in the Fight Back! Medical Identity Theft and Medicare Fraud brochure [78] put out by the HHS.

HHS Even Webcast on Preventing Medial Identity Theft and Medicare Fraud

Video Points of Interest

• Time 7:11 Assistant Attorney General of Civil Division of DOJ, Tony West, discusses the consequences of Medicare fraud and the work of the DOJ and HHS partnership.
• Time 14:38 Inspector General, Dan Levinson, discusses new fraud education materials.
• Time 23:08 SMP volunteer, Joanne, discusses her experiences with Medicare fraud and her roll as part of the SMP in her community.

More information is available at Stop Medicare Fraud's website [79].

So you received a data breach notification in the mail… no big deal, right? Not according to Javelin Strategy & Research’s latest report [89]. In fact, Javelin’s latest research reveals you are four times more likely to suffer identity fraud if you’ve received a data breach notification within the past year.

The average fraud victim will spend 30 hours and $496 out-of-pocket costs to restore their affairs, merchants and financial providers will spend billions to protect systems and brands, and law enforcement will work hard to chase the bad guys.

Many states around the country are enacting laws requiring entities that have experienced data security breaches to notify affected individuals whose personal information may be at risk. However, there seems to be a disconnect between breach notifications and consumer awareness of the risk they bring.

Why You Should Take Notice

• During each of the past three years, an average of 11% of consumers received a breach notification.
• Of these consumer breach victims, more than 33% experienced exposure of their Social Security numbers and 15% had their ATM PINs compromised.
• Despite 19.5% of breach victims suffering some kind of fraud in the past year, only 2% attribute their fraud to the breach.

Come On, Do I Really Need To Worry About This?

It might be a good idea considering the Identity Theft Resource Center [90] has already tracked 356 data breaches so far this year. Forty-six of those breaches have involved financial institutions, and when they or their third-party service providers are breached, it’s nasty.

Take for example the Heartland Payment Systems [91] breach earlier this year. The result of this breach was a staggering compromise of 130 million credit and debit cards. Now that’s a lot of Visa cards…yikes!

What You Can Do?

There is very little we can do to avoid data breaches, however there are steps that we can take to better prepare ourselves for the next time that breach notification shows up in the mailbox:

• If you get a data breach notification, don’t dismiss it. "Data breach notifications are intended to help consumers take protective action," said Mary Monahan, Javelin Managing Partner & Research Director.
• Obtain credit monitoring services. Most companies will provide this free of charge in the event of a security breach, so take them up on it. You may also consider employing a more complete credit monitoring service [92] or even initiating a credit freeze [93].
• Limit the amount of sensitive data you give out online or over the telephone. If the requested information has nothing to do with the transaction you’re making, don’t provide it. For more on this, read our article about becoming a "privacy grouch [94]."
• Avoid or be cautious using wireless devices, “convenience cards”, credit cards or unfamiliar online transaction sites.

Lastly, remember the words of the orator, Robert Green Ingersoll when he said:

“It is a thousand times better to have common sense without education than to have education without common sense.”