Chapter 3 Cyber Stalking, Fraud, and Abuse

Posted on by

Dr. Chuck Easttom, Computer Security Fundamentals, Fourth Edition. Pearson Education, Inc, 2020.

Chapter Objectives

  • Learn about investment scams and auction frauds
  • Take steps to avoid internet fraud
  • Understand identity theft and how it is done
  • Take steps to avoid identity theft
  • Understand cyber stalking and the law
  • Configure privacy settings in your browser
  • Know about computer crime laws

Introduction

Fraud is a common danger on the Internet as it is easy to do: it does not require specific skills like hacking or virus development. Many people engage in online fraud and the huge amount of ecommerce provides ample opportunities. Here we examine types of fraud, how the law applies and how to protect yourself.

How Internet Fraud Works

The SEC has a detailed list of types of Internet fraud, however we will only cover common scams and the general principles involved which can be universally applied.

Investment Offers

Investment offers are scams designed to entice people to invest in an investment plan which is not legitimate, or does not exist. Cold calls, emails and newsletters can all be used to display bogus information to encourage people to part with their money.

A well-known scam is that of the Nigerian prince who requests a stranger’s bank account to hold a significant amount of money. Once agreed, fees and taxes are required to release the money, which once paid are withdrawn by the scammer with no further communication.

Common sense is an important skill to exercise in these cases: if the offer is too good to be true, it probably is. Scammers depend on naïve or greedy people to fall for their tactics.

Investment Advice

Investment advice can be fraudulent if so-called ‘experts’ give what seems to be unbiased advice on the best plans in which to invest your money. Although not technically illegal, people can easily fall into this trap because it looks to be legitimate. This advice could simply be an advert to send a company money, which is then lost.

A type of scheme like this is known as a pump and dump, where scammers buy up large amounts of a certain stock and encourage others to do the same. This inflates the value and the stock goes up, them the company sells the stock once it reaches a profitable amount. This results in many investors losing their initial investment.

To avoid pump and dumps, the SEC has this advice:

  • only buy from well known stock
  • take advice from reputable stock analysts
  • do your own research on the company
  • do not succumb to high-pressure sales
  • use common sense and be skeptical

Auction Fraud

Online auction sites such as eBay can be used by scammers to make money out of buyers. Sellers list items that either don’t exist or are not as described which are then purchased, and make off with the money.

Auction fraud can also occur when the item is not delivered in the time frame advertised, or clearly not what the buyer expected.

The US FTC describe four categories of Auction Fraud:

  • 1. Failing to send merchandise
  • 2. Sending a different item or something not as described
  • 3. Failure to deliver within specified timeframe
  • 4: Failure to disclose relevant information about a product or terms

Bidding Fraud

Auction sites also fall afoul of bidding fraud, described below:

  • Shill bidding – fake bids to drive up price
  • Bid shielding – buyer bids on an item but also makes a high bid to discourage other bidders, once the auction nears its end the buyer withdraws the high bid so they win the item with a lower price
  • Bid siphoning – scammers offering bidders the same item at a lower amount on a different site or by sending money directly, then failing to deliver said item.

Identity Theft

Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully obtains and uses another person’s personal data in some way that involves fraud and deception, typically for economic gain.

https://www.justice.gov/criminal/criminal-fraud/identity-theft/identity-theft-and-identity-fraud

Identity theft is when a scammer obtains someone else’s credit card, driver’s license, etc, and leaving the original person with debts and tickets. Because this information can be found online, identity thieves can get copies of someone’s unique documents and pass them off as their own. Background checks on potential employees offer enough information to forge that person’s identity.

Phishing

Phishing is the process of manipulating someone into giving you their personal information, such as bank account details, usernames and passwords,

Phishing emails are sent out, seemingly from your bank or other legitimate source, that contain a link to a website that looks similar to the real website. When you attempt to log in to this website, it saves your details and the scammer then has the means to access your account.

Cross-site scripting is a way of fooling users into inputting their data into dodgy websites. The script is posted onto the website in a comment or review, which redirects the user to the scammer’s website.

Another phishing method is obtaining someone’s personal details and using them to blackmail users into giving them money.

Cyber Stalking

Cyber stalking is defined as harassing a person using the Internet. Anyone who uses the internet to harass, threat, intimidate or otherwise can be called a cyberstalker.

Real-life Cases

The cases below depict real-life cyberstalkers who have been convicted for computer crime, showing that hacking and fraud are not the only ways to land yourself in prison using a computer. Harassing someone over email, chat rooms or social media also constitute computer crime. Computers can also be used to hold evidence for proof.

Swatting is another type of cyberstalking, where a person calls the police, directs them to an address with a story about a violent crime, resulting in that address receiving a frightening and unexpected police response. A tragic real life example of this is Tyler Barriss. Because the perpetrator used VoIP to fool police into thinking he was actually at that address, this was considered a cyber crime.

How To Evaluate Cyber Stalking

Cyberstalking is essentially a person using the Internet to harass another person. Although this could be considered vague, a guideline to follow is if this person did this face-to-face, would it be a crime? Threatening to harm someone or blackmail are definite crimes and can be done over the Internet.

Another aspect to consider is whether that person is in actual danger or not. Is a person simply upset and angry saying things they do not mean, or do they have malicious intent? There are four criteria for evaluating cyberstalking:

  • credibility – reasonable expectation that the crime could occur; so if the harasser knows personal information about a victim
  • frequency – a one-off insult or comment could be offensive and threatening, however actual cyberstalkers target their victims and harass them over a period of time
  • specificity – when the cyberstalker describes in detail what they will do and when, coupled with knowledge of the victim’s whereabouts at that time, this is considered a specific threat
  • intensity – anybody can lose their temper and say things they might regret. Someone who threatens to kill someone and has a plan of action involving violent deeds is a very real threat.

A cyberstalking threat does not need to meet all of the criteria above, but each case should be considered with common sense and caution. Just like with physical crimes, the means, motive and opportunity should be examined to discover whether the threat could result in a violent crime being committed.

A credible, frequent, specific, and intense threat is very often a prelude to real-world violence. p79

Crimes Against Children

The Internet has become, sadly, an easy way for paedophiles to begin and conduct relationships with children. This is known as grooming, where adults groom children with the intent of having a sexual relationship.

There is a common process paedophiles employ to look for vulnerable targets:

  1. Initiation – the paedophile initiates a conversation on a public forum or chatroom with a minor pretending to have a similar interest
  2. Wanting privacy – the conversation is moved to another unsupervised means, such as private chats or emails.
  3. Introduction of sexual content – begins to start discussing sexual topics and hoping for a face-to-face meeting.

Because it is such an important issue, the US task force Internet Crimes Against Children, or ICAC works with authorities to keep children safe online. The UK equivalent is the National Crime Agency’s CEOP (Child Exploitation and Online Protection), and their site https://www.ceopeducation.co.uk/professionals/ is full of resources about protecting children online.

Laws About Internet Fraud

With the internet being a relatively ‘new’ technology, it has taken some time for the law to catch up. New laws have been passed against Internet fraud and identify theft, and many existing laws have been amended to cover cyber crime. Law professionals are now specialising in cybercrime cases, indicative of a problem that isn’t going away any time soon.

Romania currently has the strictest cybercrime laws in the world, according to some experts. This is due to Romania having a bad reputation for cyber crime in the 1990s. Read more here: https://abcnews.go.com/International/journey-hackerville-romanian-city-reputation-criminal-hacker-breeding/story?id=60123285

And an interesting PDF found online of Dr Ioan-Cosmin Mihai’s presentation from the ITU Cyber Drill for Europe Region: The Status of Cybersecurity in Romania

Protecting Yourself Against Cybercrime

For Investment Fraud:

  • invest with reputable brokers
  • avoid if it sounds too good to be true
  • be skeptical, why is this info being shared with you?
  • do not invest money you can’t afford to lose

For identity theft:

  • do not share personal information
  • destroy personal documents
  • perform a credit check frequently
  • check online driving records, if available

Cookies

When you browse the internet, most pages collect information from you, stored in a file called a cookie. The cookie is stored on your computer, and so other websites can potentially read that cookie and acquire your personal information. Anti-spyware software prevents cookies that could undermine your privacy controls.

For auction fraud:

  • only use reputable auction sites
  • don’t bid on items that seem too good to be true
  • research sellers and shops
  • use a separate credit card, not your debit

For online harassment:

  • do not use your real name on social media or chat rooms
  • keep any threatening emails for evidence
  • do not ignore cyber stalking – it can escalate offline

Summary

As communication technologies grow, so do ways and means for criminals to access your personal information. It is important to protect yourself and hide yourself online. Staying aware of the threats posed by investment fraudsters, auction scammers, identity thieves and cyber stalkers means you are less likely to be targeted and defrauded. Enjoy browsing and purchasing items online, but stay vigilant!