-Great to have all of you here.
This is the launch of our campaign, as Jon mentioned,
Taking Charge of Your Digital Identity.
How many of you have been a meeting
like this of ours before?
Raise your hand. Great.
So there are several of you who have been.
You will be familiar with some of the content,
but there's a lot of new stuff that we've got here this year,
and what we're really just trying to continually
do among many other things AARP does is to warn folks
about the current trends going on that might threaten them,
and I really just, by way of introduction,
want to preface this particular presentation
and all the speakers that are coming to say
we are really not trying to scare you.
We are trying to empower you to have knowledge
to be able to take steps, and as Jon mentioned,
while there's a lot of this breach stuff going on,
there's a lot of very simple things you can do
to avoid being victimized by it,
and I think that's the theme I want to just start
and end with is it's scary enough out there.
There's enough anxiety out there,
but if you have facts and data
about what's really going on and some concrete steps,
then hopefully we can feel safer
and leave here feeling safer today.
That's really what I wanted to say.
On your table there's an agenda,
and I just want to go over what we're going to do today,
and then I'll get into my presentation.
First I'm going to talk about some of the new stuff
we gathered in the last year since maybe some of you
have been here about especially the dark web,
and I think you'll find that very interesting.
Then we're really fortunate to Jeff Lilleskare from Microsoft
who's going to talk about online safety and security,
and I'll introduce Jeff after I'm done.
Then we're really fortunate to have Attorney General
Bob Ferguson will be here at 10:30,
and he will talk about what's going on in the AG's office
and a new law that has just been passed
relating to the topic we're going to talk about today.
Then we're going to take a break at about 10:50,
and then we'll come back, and we're really fortunate
to have Chuck Harwood here.
Where's Chuck? Is Chuck in the room?
There he is in the back.
Chuck Harwood is the regional director of the FTC
and has been a long-time colleague of mine
and is extremely knowledgeable
about this whole area of privacy,
and so he will end sort of the morning presentations.
Then we're going to do something we haven't done in the past,
which is to have a panel discussion just before lunch,
and we're going to have Monique
Avery from the Seattle Police Department's Financial Crimes
Unit, Kirk Larson from Social Security Administration
and Kyle Welsh, I think Kyle is here, hi, Kyle,
who's been with us on other events from BECU,
and they're just going to be talking
about their perspective on this issue
and also take questions from you all.
And then we'll have lunch, and then we'll be done.
Anything else, Amanda that I --
This is Amanda Frame who's our --
No, nothing else from you? Okay.
I'll introduce my staff as we go around,
and there's a lot of volunteers.
Raise your hand if you're an AARP volunteer
with the red shirt.
Thank you for your service.
Yes.
I can't tell you how much free labor we get.
Anyway, I shouldn't say that. Okay.
Let's talk about the issue here that we're here to talk about,
protecting your digital identity,
and I'm just going to summarize
what I'm going to talk about here.
First I'm going to describe what Washingtonians
are currently doing or not doing,
as the case may be, to protect their identity.
We're releasing a new survey today of adults
in the state of Washington on this topic,
and I'll get into that in a minute.
Understand the threats that are out there
so that you can defend against them
and learn the three essential tips you need to know.
There's only three.
Okay, there's maybe four.
Okay, maybe there's 10.
There's three really big ones, though,
and they're not that hard to remember or to do,
and I think that the thing to hold onto here.
So what do we mean by digital identity?
Digital identity is the body of personal
identifying information that exists online about you,
whether or not you are online,
whether or not you have a computer.
You have a digital identity,
even if you've never been on the Internet,
and I was in Vermont about a month ago,
and I gave a presentation, not this presentation,
but one sort of similar,
and a woman came up to me at the end and said,
"I don't have to worry about any of this
because I don't have a computer even, you know?"
Well, that doesn't matter.
You have a digital identity,
and I think Jeff is going to talk about this.
We were talking about it earlier.
If you exist in the world, you have a digital identity,
or information about you is being bought and sold,
some of it legally, perfectly legal, harmless,
and others of it that is not legal and not harmless.
So what about the survey?
Are people taking the prevention steps
that we think you should be taking?
And I'm going to ask the audience to just raise your hand
and answer some of these questions,
and then I'll tell you what the statewide survey found.
Don't feel like, you know -- There's no --
I mean, I guess there's a right answer,
but just try and be honest here.
So we surveyed 1,000 people in the state
of Washington over the age of 18.
This was just in April, so it's a very new --
We just are releasing this today.
You are the first people to see the results of this,
and we asked this question:
A security freeze means that your credit file
can't be shared with potential creditors.
A security freeze can help prevent identity theft
since most businesses will not open credit accounts
without checking a consumer's credit history first.
Have you ever issued a security freeze on your credit?
How many of you have ever done a credit freeze?
Wow, that's a lot more than -- Really?
Let me see that show of hands again.
That's a large number. That's almost half of you.
Well, in the state of Washington you guys
are way ahead of the game
because only 14 percent of Washingtonians
have placed a security freeze on their credit file
and only 13 percent of those 65 plus,
so you guys are way ahead of the game,
and there's more things that we're suggesting that you do,
but that is a very big one.
And it's about to get a lot easier and a lot cheaper,
and the attorney general will talk about
that when he gets here.
Next question.
Thinking about your bank accounts now,
including checking, saving, money market or CD accounts,
have you set up online access to all,
some or none of your bank accounts?
How many of you set up access to all of your bank accounts?
Raise your hand.
How about some of them only?
Okay. How about none of them?
Fair. Okay.
Only 38 percent of Washingtonians
have online access to all of their bank accounts.
That means six in 10 people in the state of Washington
have not got online access to all their bank accounts,
and 75 percent of people 65 and older
don't have online access to all their bank accounts.
They may have to some of them, but not all of them,
and this is another big tip
and theme you will hear throughout the day
is we think that's a very important thing to do
for reasons that should become clear.
Last question, thinking about your Facebook account,
have you ever changed the privacy
settings on your account?
How many of you have changed the privacy settings
on your account?
Okay. Not quite as many.
How many of not done that? Okay.
How many of you have a Facebook account?
That's still -- Yeah.
Okay.
Seventy-three percent of Washingtonians
have changed their Facebook privacy settings,
but only a third of those 65 and older
have never changed their Facebook privacy.
So we've heard in the news about Facebook,
and they're buying and selling our information.
Arguably, there's not much we can do about that,
but there is something you can do
about it your privacy settings,
and I think Chuck is going to talk
about that at the end of the day.
Not the end of the day.
This morning.
So what are some examples
of personal identifying information?
What do we mean by personal identifying information?
Social Security number, passwords,
mother's maiden name, birth certificates,
these are just some examples of personal
identifying information that is out there
or that you need to manage in some way.
"How do bad guys get our personal information?"
you might ask.
Well, I would suggest there is three ways,
there may be more than three ways,
but these are the three ways I'm going to talk about:
hacking or data breaches,
which we hear about a lot, phishing,
which is pretending to be somebody you're not to get you
to voluntary give your information out to somebody,
you know, your bank is pretending there's a problem,
and you give them your personal information,
and skimming, credit card skimming.
I'm going to talk about each one of these
in the time that we have.
Okay.
So, you know, this is in the news.
If you own a TV or a radio, you have heard about these hacks
that are going on, Target, Yahoo!, Equifax.
A hundred and fifty million credit files
hacked in the Equifax case, and the whole Facebook thing.
There's a lot of them.
According to the Privacy Rights Clearinghouse,
since January of 2017 there's been 738 data breaches
and over two billion records
exposed to various kinds of hacking,
and a lot of this hacking information,
a lot of this hacked information,
ends up on what we call the dark web,
and you're going to hear a lot about the dark web,
and I'm about to introduce you to a guy
who's going to take us on a tour of the dark web.
Let me just give you a brief description of it.
When you think of the web, you think of the ocean,
and on the surface, the surface web
are the things that we're all familiar with
when you go online, Google, Facebook.
You search for things on Google,
and you find websites, your bank accounts.
All of that is on the surface web, but then go deeper.
Go below that, and there's another part of the Internet
called the deep web,
and the deep web is thousands of times bigger
than the surface web
and not necessarily illegal or bad.
It's just where a lot of the huge government databases
are stored, things like LexisNexis,
NASA's data, massive amounts of data,
but it's not linked to those search engines,
so you have to have access to it to get to it,
and you're not going to find it by Googling it, okay?
That's another part of this whole Internet world.
Go a level deeper than that, though,
and you have this thing called the dark web,
and really the only way to get on the dark web
is to download this special software
that was invented 15 years ago by the Navy.
It's called The Onion Router,
and it's software that allows you to go onto this place
called the dark web anonymously.
It was invented by the Navy
so that spies could talk to each other anonymously.
In other words, there was a good reason
for this thing called the Tor browser,
but criminals being enterprising,
and you're about the meet one of them,
they became early adopters of that, saying,
"Wow, you mean we could communicate
and we could even exchange money completely anonymously?
Let's try that." Right?
And so this is what we're talking about with the dark web,
and there are lots of places on the surface web
that connect you to the dark web.
There used to be this thing on Reddit
called the Dark Net Forum or DarkNetMarkets,
but before it was taken down, there were 171,000 people in it.
Some of these other dark websites have had 200,000,
like AlphaBay, which was taken down by the FBI last year.
Those 200,000 people are all criminals.
There's a lot of them,
and they're all communicating anonymously,
buying and selling things using cryptocurrency,
which is also anonymous,
and the other thing with regard to our digital identity
we just pay attention to is the amount of personal information
that's just legally available.
These are public search sites,
BeenVerified, truth finders, people finders.
There's a lot of them, and for a very small fee,
you can go onto one of these sites
and find out an awful lot about either yourself or someone else.
I joined one of these just to experiment with it,
and they came up with a 92-page report about me.
I mean, everything you could imagine, my neighbor's name,
how much I pay for my house, how much my mortgage was.
This information is all legally available,
not just illegally available,
and so we conclude that what we're living in
is kind of a postprevention world
when it comes to our personal information,
and what I mean by that is everybody's information
is already out there,
and so what we have to figure out is, if so, then what?
If all of our information is already out there,
what do we need to do to make sure
that we don't fall victim to it,
and so that's kind of going to be the theme of the day,
but I want to introduce you to one of the most
interesting characters I've interviewed.
His name is Brett Johnson,
and the Secret Service 15 years ago
dubbed him the Original Internet Godfather.
He sort of helped invent the early version of the dark web,
and we've got a little video here
that's going to introduce you to Brett.
-Meet Brett Johnson, your tour guide
for the back alleys of the dark web.
-The Secret Service from Columbia, South Carolina,
they called me the Original Internet Godfather.
I'm the guy that built what is today's dark net market.
The credit cards, the tax scams, I was on the ground floor
of developing that stuff and figuring out
how criminals should go about ripping other people off.
-Using the hacker name GOllumfun,
Brett began connecting with hackers and scammers
around the world in 2002.
He founded an online group called ShadowCrew
that quickly became an international crime syndicate.
-ShadowCrew is the first dark net market.
It's the forerunner of all of today's cyber crime.
It was loaded with the top-tier criminals,
just the worst of the worst.
-The dark net market system that ShadowCrew pioneered
allowed hackers and criminals to connect and cooperate
pulling off scams and sharing information.
It operated like a Wild West criminal form of eBay
or Craig's List.
Credit card numbers could be stolen in one country,
sold in another and the funds laundered through yet another,
and just about anything could be bought and sold.
Brett was at the center of this hidden web.
So criminals see this way to remain anonymous online,
and they're like, "Let's try that."
All of a sudden you've got all these criminals
conducting business, and no one can figure out who they are.
To give you an idea of how ShadowCrew operated,
so Ukrainians were very good
about getting the credit card numbers and everything.
The United States people tended to cash out for the Ukrainians,
and we ended up partnering together.
When you look at cyber crime,
people tend to specialize in one specific type of area.
-But eventually the US government's Operation Firewall
brought down ShadowCrew.
Federal agents had arrested a member
named CumbaJohnny for credit card theft.
I flipped and began working as an informant.
On October 28th, 2004, the ring came crashing down.
-When the secret service busted our site,
we were 4,000 people total,
but they arrested 33 people from 14 countries
in a matter of hours.
Actually, I didn't go to jail immediately.
The Secret Service offered me a job,
so idiot here takes the job and starts breaking the law
while working for the Secret Service,
sometimes from within their offices.
Once they find out I'm ripping them off,
I take off on a cross-country run,
and I steal over $400,000 out of ATMs.
I get placed on the United States Most Wanted list,
get caught, get sent to prison.
I escaped from prison,
get caught and finally get sent to prison.
When I got out, couldn't get a job, couldn't do anything else,
and I went back to my old ways.
I victimized everybody.
I hurt friends, family, people I didn't know.
I was fortunate enough by that point in time,
the woman who would be my wife,
she had found me, and she ends up saving me.
You're looking at the origins of credit theft,
stolen credit cards --
-Today, after 7 1/2 years in prison,
including hard time in Texas and 8 months in solitary,
Brett is no longer GOllumfun and has found a new career
as a cyber crime consultant, author and educator.
He gives presentations and seminars around the world,
including to our AARP Fraud Fighter volunteers in Seattle.
Brett credits the FBI and Secret Service agents
who brought him down and put him behind bars
with helping him find purpose
in developing new ways to fight dark web crimes.
He says it takes a criminal mind
to get inside the methods of a dark web criminal,
and he's trying to give back.
-I have a lot of people that helped me out, the FBI,
Identity Theft Resource Council, the Card Not Present Group.
All these people took me under their wing
and gave me an opportunity to do things legally.
-Brett gave us a quick rundown.
I'm going to give it to you again.
He started out shoplifting.
Then he went to fake charity donations for the homeless.
Then he faked autographed baseballs on eBay,
Sammy Sosa, Mark McGwire.
He signed their names and sold them on eBay,
pirated software and video games online,
fake bank accounts using Indiana state
sex offender registry, credit card fraud --
I'm trying to build his credibility so you'll --
Filing fake taxes on dead people,
filing fake taxes on living people,
failed attempt to file fake
Social Security benefits on dead people.
It goes on.
Created the first dark web auction,
arrested then hired by the Secret Service,
used his undercover position to scam people,
escaped from prison, FBI top -- You see.
You get the picture.
He's a really bad guy, which I find really credible
because all we're trying to do is, you know,
I mean, law enforcement does the best they can,
but this is really whack-a-mole, right?
And so getting that inside perspective,
and if you want to ask me at the break,
we interviewed another guy last month
who goes by the name of BlueLondon who also did this,
but that's another story.
Anyway, let's hear from Brett.
He's going to take us on a tour of what it's like
to actually be on the dark web,
what kind of stuff is available, and here is another video.
-Most of these markets,
most of these auction sites are drug-based
because there are so many buyers for drugs.
There's so much profit in it that all of these sites
have the ability to buy drugs,
but they also have the ability to buy personal information,
identity theft information, bank accounts,
any number of things like that.
So what we're going to do is we're going to search
for what's called a FULLZ,
and that is the complete identity profile,
and let's see what type of things that we find.
So we've typed in FULLZ.
We've pressed the search button, and here are the results.
So here is a guy selling a Brazilian FULLZ for C33.
There's a Skrill cash-out, cash-out.
Let's find a USA,
and we're going to take a second to scroll down.
There's UK.
Here is a gentleman selling a United States bank
drop with a verified PayPal and a remote desktop protocol.
That is a nice item to buy if you're a criminal.
He's selling that for C119.
Another ID theft guide.
So a FULLZ will have the social, date of birth.
It will have a background check, everything,
whereas a credit report just has the accounts on file
and sometimes the credit score as well.
Okay.
So the FULLZ is every single aspect
whereas the credit report are just the accounts on file.
So here is a gentleman selling random
United States credit cards with a FULLZ.
Says he has the date of birth and Social.
You could search for a specific age group.
So you could tell him, "Hey, I'm looking for people
that are born prior to 1955," and he will give those to you.
His screen name is called Hackyboy.
This is his feedback.
So on these auction sites,
the buyers will actually give feedback,
like any legitimate auction site.
How is the product? Was it real?
Did it work all right?
And he has good feedback.
He has positive feedback of 288 people have said,
"This guy is outstanding."
Eighteen people have complained.
That's a pretty good feedback score,
so you know that this guy
is going to deliver the products to you.
-Two hundred and eighty-eight people said,
"I'm going to deliver the stolen stuff
that I said I was going to deliver."
It's just like an underground version of these auction sites
we see on the surface web.
You know, here is another example
where you can buy somebody's identity
that has a credit score above a certain level.
You have to pay more the higher credit score
because the higher credit score, the better the credit.
There's also data dumps on the web,
and this is an example of one that Brett found for us.
I've changed all the information,
so none of this is the right information.
This person doesn't exist,
and any similarity to someone real
is completely accidental, as they say in show business,
but, you know, he just showed me a site
that said there was this particular individual
decided to get out of the crime business
because his mother had just died,
and so he dumped 50 full identities like this
onto the web and said,
"Have at it, whoever wants this," you know.
But generally speaking, and this is a point
I want to make about this whole thing
about you can scan the dark web.
There's a lot of companies advertising free scans
of the dark web.
You really can't scan the dark web
because there's an occasional identity like this,
and if you happen to be Joan Schneider,
yes, maybe, but most of it is behind a paywall,
and so somebody who tells you,
"I've scanned the dark web, and you're not on it,
so you're good," don't believe them.
It isn't true.
You can't really do that.
So let's go on to the next one, phishing, which is defined as,
"Phishing is an attempt, usually by e-mail,
to steal your personal identification or information
by pretending to a business or other organization
that you know and trust."
How many of you think you've gotten a phishing e-mail before?
Great.
How many of you think you know how to spot one now?
A lot of you do, which is good.
Let's hear from Brett about that.
-All attacks, every single breach that occurs,
92 percent of them begin with a phishing attack
because it's much easier to ask somebody than it is
to try to force somebody to do something, okay?
So you're asking somebody for their information.
Now, the way you stop that is, we understand as criminals,
we understand that people are lazy,
and criminals are lazy, too.
All right?
But people are lazy, and they tend to use the same passwords
across multiple platforms, okay?
And what happens is a person,
because phishing is so prevalent now,
people are aware when they get a phishing e-mail
that looks like it comes from a bank.
They're like, "Oh, no. I'm not going to fall for that.
That is clearly someone trying to steal my information."
But if they get a phishing e-mail
that comes from Netflix or Amazon or Apple
or their dating site or anything like that,
why would somebody do that?
That doesn't make any sense.
Who cares about my Netflix account?
So what do they do?
They go ahead and they fall for that phishing e-mail.
A lot of people use the exact same passwords
for Netflix account and the banking account.
So as a criminal, you've got that information.
Yeah, you'll sell the Netflix account for $3,
but you also will try that log-in
on several bank accounts as well.
-How many of you, now be honest,
use the same password for more than one account?
Good.
Good, honest response, but bad behavior.
This hopefully is a clear explanation
of where it's evolved to,
where phishing has become more sophisticated
in two ways, at least two ways.
One is trying to get, as Brett said,
your Netflix account or something
that you think might be less important than a bank account
hoping that you're using the same password for both
and that you've got both and they'll try
and hack into your bank account,
and the other reason they're more sophisticate
is because there's so much information out there about us
that they can customize that appeal
and make it look like this has to be real
because they have so much information about me
and my account.
Here is a phishing, and I think Jeff is going to talk about --
I think we're all going to talk about this, so repetition
is the mother of learning, or something like that.
But, you know, this says, "Update payment method.
We were unable to bill your membership
for the current month," yada, yada, yada.
When you look at who sent it, though,
this is not really Netflix.
It's noreply@netl.com, and here is another one.
Amazon, you know, this one really looks real
because it's got the Amazon logo on it.
It's got amazon.com at the bottom.
The only thing that's different about it is this 800 number.
Someone tried to reset your password.
Please call us immediately, and when you call them,
it's a tech support scam number,
but that looks really real, you know,
and it's from olivia@amazonsupport.com,
which also looks real,
but could be a spoofed return e-mail address.
And so rather than having to -- Oh, before I get to that,
so when you think about worrying about this and,
"Could I spot it?" and so forth, I think the general advice
is if any of the people you do business
with are e-mailing you with a request for information
that has anything to do with your account being --
Just don't respond do it at all.
Delete it, and if you're worried about it,
independently contact Netflix or Amazon
or whoever the vendor is and find out
if there's something wrong with your account,
but essentially, it's like we say in the telemarketing world,
just don't answer the phone.
Don't respond to anybody telemarketing.
I wouldn't respond to any of these e-mails.
Doesn't mean you can't check it out independently.
Where you get into trouble is if you click on the link
they want you to click on or call the number because --
And it is hard to determine.
Here is a fake Capital One phishing attack,
which kind of is obvious
because there's not a lot of logos,
and it's kind of low-tech, and, you know, it's from
marcyybarrow@ uwfoundation.wisconsin.edu,
which means they probably hacked into some employee list
at the University of Wisconsin,
and they're using that to do this phishing attack.
But I wanted to show you this because here is
a Capital One alert that I got that is real.
I actually made this charge.
I won't tell you what it was for.
You can imagine what it might be for,
seven hundred and seventy --
You know, it was for a trip with my wife just on vacation,
but it was a real charge,
but I have an alert on my credit card
that alerts me when there's any charge
over a certain dollar amount, and some people do it for zero.
So any time there's any charge, you get notified.
This is a legitimate thing, and it says,
"Is everything okay? Yes, fine."
And it's from Capital One notification.
I'm so used to these alerts that that's fine,
but that's another way to sort of monitor
your accounts is to put alerts on them.
Now, let me talk about skimming for a minute, and this is --
I don't know if any of you have seen this video,
but another way that people can get
your personal credit card information in particular
is to put a fake skimmer over a legitimate one
at a store or a gas station, and this is an incredible video
because this is an actual video of three guys
working as a team installing a fake skimmer in,
like, an am/pm-type of store,
and I want you to look at the three guys --
You see all three of them there.
Let's see. Yeah.
Two of them are going to distract the clerk by saying,
"Oh, you know, what's that over there?"
And the third guy is going to put this thing on here.
So see if you can spot it.
Watch the guy in the white shirt.
See how he's distracting the clerk?
Go over to the right. Oh!
Right there.
See that?
Sneaky, huh?
That's how long it took.
Now there is a fake scanner on there,
and every credit card that goes onto that machine,
they're going to be able to remotely access the number.
Here is a still.
It's not very clear, but you saw him in action.
It took a split second,
which also means that these scanners they put over there
are not well affixed often to the thing.
So how do you check to make sure this doesn't happen?
Well, see this is another example
of sort of a fake one you can put on there.
So what do you do when you go to a gas station and
you're putting your credit -- I mean, I do this every week.
We all do, you know?
How do you spot that?
I have made my own video of me
checking at my local gas station.
You want to see it?
It's really exciting.
It's pretty low-tech actually.
Oh, what? -Wait.
What happened, Bruce?
This was -- I built it up,
and now you've got to look sideways.
All it really is --
Oh, just a minute.
You think I should try that again, Bruce?
Or should I move on? It's going to be sideways.
All I was doing was just tug on it lightly, right?
You're not going to break it, and if it's a fake thing,
it'll pull off really easily
because you saw how fast they put it on there.
They don't screw it down or anything like that.
Let's see if I can. Yeah.
Try and do it sideways like that.
It works better.
Anyway, so this is just a sort of a brief introduction
to the Web, then the dark web.
There is a lot more there to, you know,
but we don't want to scare people too much.
It is frightening to see how much traffic
is going on on the dark web.
You know, AlphaBay, which is one of the biggest sites,
we've interviewed people there.
They had 200,000 users on it.
They did $2 billion worth of business in about 2 years.
That's $1 billion a year.
That's a lot of buying and selling of illegal stuff,
and when the FBI took them down,
they had something like, you know,
22,000 stolen credit cards on their site
and lots of volume like that. How do we avoid it?
Well, the very first thing, and the most important thing,
and a lot of you apparently have already done this,
is to place a security freeze on your credit,
and in the back table by where Leeta is standing,
Leeta Scott -- Leeta?
Leeta.
Hi.
Leeta Scott, who runs our Fraud Fighter Call Center,
introduce yourself to her, by that table there.
There's an article that's coming out in the "AARP Magazine"
next month called "The Big Freeze,"
and it's a step by step guide on how you can freeze your credit,
so those of you who haven't done it --
There, she's holding it up.
Just go back there and pick that up,
and that should give you a step-by-step guide,
and effective June 7th --
I think the Attorney General mentioned this --
The legislature passed a law this year that makes it free.
It used to be $10 for each credit bureau
and pretty expensive to do this.
Now it's free, so that's the first thing:
Freeze your credit.
The second thing is monitoring your online accounts,
and in two ways, I would say.
The first would be, make sure you have online access,
especially to the bank accounts and credit cards
that you use most frequently.
I check -- I have, you know, one main bank account,
one main credit card, and I check them every day.
It takes 5 seconds.
It doesn't take very long,
and it's kind of empowering to do that
because you're really closely monitoring this.
The people who say, "Well, I don't need that
because I get a monthly bank statement
in the mail," a lot --
In the world we live in, 30 days is an eternity.
You know, a lot can happen in 30 days,
so I would suggest monitoring.
I would also suggest, you saw that alert thing
from my credit card company.
You could put alerts on everything, you know,
and you can if the dollar amount,
and I have a couple accounts
where I put the alert amount at 0
because I don't use them very often.
The one I do use a lot is not at 0,
but if you have a couple that you just don't use that often,
you'd want to set that alert rate at 0
so that anytime it's used at all,
you'll get a text message that says,
"Hey, somebody's using your account.
If it's okay, great." This is --
The technology has made this problem worse, arguably,
but it's also made the prevention steps
we can take better and easier
if you can have a basic level of facility
with things like texting and online monitoring,
so that's the second thing,
and the last thing is using a password manager.
I think a lot of people when we ask them,
"Why do you use the same password for multiple accounts?"
it's because, "I can't remember them. I can't.
There's too many of them. I can't remember them,
and they keep telling me to make" --
I mean, I wrote a column in the magazine
a couple months ago that says,
"Your password should have at least 25 characters."
Well, who -- You know,
we can have a whole conversation about that.
Like, how do you remember a 25-character thing?
One tip I will give you that was in that article was,
consider using pass phrases.
Make up a sentence and then some characters at the end
that you could get to 25 characters, if it's like,
"Once upon a time, I rode a boat in a blue sea,
dot," you know, that kind of stuff,
but the password manager has a number of benefits,
and there's a lot of them out there.
They will create a really hard password to break
and store it for you.
They will store all of your passwords for you.
They'll also tell you when there's been a breach
on any of the accounts that you have,
you know, recorded passwords for.
Now, people say, "Well, what happens
if somebody gets into that?"
It's possible,
but they're pretty good about encrypting them,
and, you know, you got to trust somebody,
so I recommend using a password manager,
and Chuck is going to talk more about credit bureaus,
but the question does come up about whether or not
you should get ID theft monitoring,
and I'll just give you my spiel proactively in case some of you
were going to ask that question, which is,
ID theft monitoring is kind of like, you know,
some people like to cook at home and cook their own meals.
Other people like to go out to the restaurant
and have other people do the cooking,
and if you want somebody else to do the cooking,
ID theft monitoring can help monitor,
but what none of those companies can do, I believe,
is they cannot stop you from having your identity stolen.
You know, they don't really say that in ads,
but they come pretty close to saying,
"If you want to just prevent all of it,
you can't prevent that from happening,"
and hopefully today we've shown you that,
that all of our information is out there.
What they can help you do is alert you
if somebody's trying to open a new account,
but if you freeze your credit, they can't open a new account,
and freezing your credit is free,
so that's my 2 cents about that.
The last thing is just reiterating
on the question of suspicious e-mails,
even from companies you work with.
Just don't respond to them.
If you have a concern about your Amazon account
or your Netflix account, go and independently check with them.
Now, I'm going to end with some good news here,
now that we've hopefully not scared you to death.
While it is true that everybody's information
is probably out there, in 2017,
only about 6.6 percent of the adult population
has actually been victimized by identity fraud of some kind.
In other words, people who that information has been used
to actually victimize you.
Well, that means that 94 percent of us have not been,
and that's something, just a reality check to keep in mind
if you -- I don't want you to leave here
too worried about this, but there is a way.
These steps we're talking about can get that percentage
down to almost zero, and I just want to leave you
with one final thought from Brett about that
because, you know, criminals told me this for 20 years.
"We follow the path of least resistance."
Have you heard him say, "Criminals are lazy?"
He thinks consumers are lazy too,
but I think consumers are busy,
and that's partly why it's hard, but they're lazy.
They follow the path of least resistance,
so if you put up any resistance at all, you're going to be fine.
Here's the lazy criminal guy.
I don't know actually who that guy is.
I hope he doesn't sue me.
And here is Brett talking about it.
-You're no longer that low-hanging fruit,
and understand, criminals are lazy.
You know, they're not going to waste all day
trying to get somebody that's got a password manager
or has the monitoring services or the credit freeze.
No, they're not looking for people like that
because there's countless other people who don't have that.
They can just go up to that tree, pick the fruit,
make money right there, and that's what happens.
-Avoid being the low-hanging fruit
I think is just the message.
These are the three things, at least for my money,
that if you do these three things or any combination of,
you're really going to reduce your chances of being a victim.
Okay, so that's all I have,
and should I take some questions?
Where's -- no.
-I have a question. -Oh, no.
Oh, no, I can't.
-I am. I'm sorry.
When you get an e-mail that you don't know who it's from,
and you hit "spam," it says,
"mark it as spam," what happens to that?
-Who are you using?
Who's your Internet service provider?
Like... -Comcast.
They'll put it into a spam folder.
Oh, so we're going to do the mic thing?
Okay, yeah, we've got -- -Yeah, sorry, we need to do mics
just because of people with hearing disabilities.
-Yeah, we got a couple minutes to do questions.
-They probably put it in the spam folder, and --
-But nothing happens to it.
-No, I don't think it affects your computer.
It depends on your system, but --
-Okay. -What did you think
happened to it? -I don't know.
-Oh, you just worried about what --
-Well, you're talking about all these things,
and then it seems like it's a safe thing to do
to put your stuff into the spam folder.
-Yeah. -It's not like somebody monitors
that and then goes back to whoever sent it
and says, you know, "Shame on you"?
-Yeah. No, I don't think so.
I would just delete. -I'm not reading it.
-I would delete. -I don't read them
-I would delete them. -What?
-I would delete them. -Oh, okay.
All right.
-Just delete them, I think is the safe way.
-That's what I've been doing, too.
-Yeah, and spam filters are getting better and better.
Maybe Jeff can talk about that, but they're getting better.
Other questions?
-So if you're going to buy a car or something,
do you have to unfreeze your account?
-Yes, if you're buying it on credit, you do have
to thaw your credit after you freeze it.
You thaw it, and this is where the new law comes in
because it used to be that it'd cost $10
to freeze it and $10 to thaw it.
Now it's completely free to do both,
and I've done this before.
You know, for us folks I'd say in this room
who aren't opening a -- I don't know.
I don't want to speak for anybody,
but for younger people, it might be more of a hassle.
For us, it's like, "You know, I'm not taking out
a new mortgage anytime soon."
All of my credit is frozen.
-Okay.
-Do you have any recommendations for the password manager?
-Yes, but you could talk to me afterwards about that.
There's a number of them that are very credible,
and I would just Google them
and do some consumer research about it.
-So if you do get a junk e-mail, you can designate it as junk,
and it'll block it,
so that's one thing you can do with junk e-mail.
The other thing is, one of the things
you didn't show them was about
hovering over those links. -Yes, that's right.
-So if you get a suspicious e-mail,
if you simply hover over the link,
you'll see this long, convoluted,
crazy URL that doesn't make any sense.
That's one you don't want to go to.
-Yep, good, thank you. That's absolutely right.
-What about one on this side of the room, Doug?
-Okay. -Okay.
-How easy is it
for somebody else to unfreeze my security freeze?
-When you freeze your credit file,
they give you, like, a 23-digit PIN number,
which is pretty hard to crack, and that becomes your key to it.
It's almost --
I don't want to say it's impossible, but it's very hard.
Even if somebody has hacked into your credit file --
That actually came up when we were interviewing
Brett, didn't it?
So yeah.
Yes?
-Several times I've been noticed on my statement
that somehow a charge was made obviously
that I didn't do, so I'm challenging it,
but I'm trying to understand how that's done.
Is it just random?
You know, a shoe store in California,
when I haven't even traveled there,
so I call, and it's removed,
but, I mean, it's happened often enough.
Does that mean my card number is out there sold somewhere?
-Probably, yeah,
and there's this whole "card not present" thing.
I don't know if Chuck is going to --
Chuck might talk about that, but we're --
You know, it's always this trade-off
between security and convenience.
You know, we want to be able to go out anywhere in the world
and buy things, and, you know, think about it.
When you buy something on the Internet,
you're not actually physically giving your card
anywhere anyway,
so it's all zeros and ones at this point,
so that's why the monitoring is so important.
Yes?
-What about online banking using my smartphone
to deposit a check or pay a credit card payment?
-Yeah, I mean, I think that smartphones are getting better
and better at that, and I don't know.
Maybe Jeff -- I'm not an expert on that part.
Maybe our folks at BECU can talk about that
because BECU is all online.
Remember that question,
or do you want to answer that now, Kyle?
-Did you have a question? -No, I'm fine.
-Yeah.
We've got time for a couple more questions,
and then we're going to have to move on.
-Yeah, so great question.
The mobile app that BECU uses and the mobile app
that a lot of the financial institutions use,
same security if not better than actually the Internet browser,
so honestly I usually tell people I recommend people
to actually use the mobile application
versus actually using a browser
and going through online banking.
-Good, thank you.
One more question, then we got to move onto the real expert.
-How about here? Hang on a second.
-I was going to suggest that you check the spelling of your name
and maybe a middle initial because I have an unusual name,
and I can spot immediately something
that's misspelled is not mine.
-Ah, so, yeah, good advice,
to determine whether it's a phishing attack?
-Yeah. -Yeah, that's good advice.
Okay, great.
I'll be around if there's more questions,
and I'm sure there are. Write them down.
I would say write them down and hand them to Amanda,
and then when we do the panel,
I'll try and address those at the panel time,
but I really want to get to, and if you want to come in here
and change the deck while I'm doing this,
except that I have to talk on the mic,
so can we do both of those?
-Yes. -We can do both of --
-I'll squeeze myself small. -Jeff --
Jeff Lilleskare, am I pronouncing your name right?
Lilleskare --
is the Senior Manager for the Customer Service
and Support Online Safety and Security team at Microsoft.
He's been at Microsoft for more than 25 years, leading teams
across a broad array of sales and service products,
and he tells me that he focuses on the consumer interface
and the security within that context,
so we're really fortunate to have a real computer expert,
Jeff Lilleskare.
-Wow, thank you very much.
I don't know if I was oversold, Doug,
but I appreciate the introduction.
First of all, thanks for having me.
It's great to have a chance to come out and share
what Microsoft has to offer from an online safety perspective.
Now, obviously I'm Microsoft, so a lot of things
you're going to see and hear reference Microsoft,
but quick show of hands,
how many people have a Microsoft device, computer, laptop?
Great. How about Apple, iPhones?
How about Android, Google stuff? Great.
The great news is, this all applies to everybody.
I will typically use Microsoft software as an example,
but anything I show you
is pretty applicable across the board.
So what we're going to talk about is a little bit
of a broad scope
of what you might be able to look for for online scams.
From a selfish Microsoft perspective,
we do spend a little extra time
diving into online tech support scams.
That's been a pretty pervasive experience the last couple years
that I want to give you some insight into
and hopefully have some guidance
on how to protect yourselves from that,
so we'll spend some time on that,
and also I don't know how much time
we'll have at the end for questions.
I'll try to get through the content,
but I will be around as well, so if you have something,
feel free to track me down later,
and we can have a conversation.
So a quick little survey here: Who's most at risk?
Lots of great options here, really anybody, right?
If you're alive today, as Doug was saying,
and you've interacted with anything, you're at risk.
Your digital identity is out there
and is accessible to bad guys, good guys, everybody.
Microsoft did a study, 2016, so a year --
Been using this data for about a year, but it still holds true,
that about two out of three people have experienced
some kind of approach of a scam.
Whether that's an e-mail or a phone, a pop-up,
all these different things we'll talk about,
so pretty pervasive out there that if you're engaged online,
you're being exposed to these.
The real interesting component was, 14 out of that subset,
so one in five or so actually took the bait
and took some steps down the fraudster's path
to become a victim,
so hopefully some of the things I'll share with you
will prevent you from being one of those five people.
This is really great news for this audience,
so well done, everybody.
This is very interesting
because this has shifted a bit in the last several years.
When I first got involved a couple years ago
with more of the Customer Direct
and consumer-focused online safety,
I did have an opportunity to spend some time with AARP
in some of the call centers, and you were really a target,
especially with the phone scams.
I think you might have known another scam called the IRS
that you might have run across,
but the tax scams were really prevalent,
and that's just because you weren't as computer-savvy.
You just didn't have the background in it,
so you were prime targets.
Well, if you look at this, in the last couple years,
that has shifted quite a bit in that the vast majority
are really, you know, our nieces our nephews,
our kids or grandkids.
That millennial generation
has become significantly more victimized,
and a lot of that has to do with their online trust
and behaviors.
They are just less cautious in general,
and also they're at stages in life
where they might be a little more risky in going
and downloading media or other content
that we might not go pursuing,
so a very, very interesting dynamic, so congratulations,
and hopefully I can help you shrink
that number a little bit more.
So here are some common approaches.
Web browsers, I know Doug mentioned that,
and actually, I'll elaborate a little bit on the devices.
That was good information.
E-mail, good old classic,
social media and chat, we'll talk about that,
and then also the good old reliable phone calls.
So Web browsers: This has become
probably the predominant route for the bad guys,
the fraudsters to get into your systems.
They'll try to infect you.
They'll try to damage or disable,
and obviously the fake support where in the end,
their ultimate goal is really to remove you from money.
A lot of times they'll go through various tactics,
a lot of it very social engineering
focused versus technical,
so we'll talk a little bit about how that works.
So here are some examples that you may experience.
Hopefully they're big enough
where you can kind of get some idea of what these are.
So this is in your normal course of browsing the Web,
you might be on trusted websites.
You might be on less trusted websites.
We have --
If you've noticed, there's this whole advertising network
and infrastructure that a lot of the Internet
actually runs on where ads are bought
and sold and propagate to different sites,
so you could be on a completely trusted site
that you've been on 100 times before,
yet one of these will pop up because somehow, the bad guys
have snuck a malicious ad into that environment,
and boom, they're going to present you
with one of these warning signs,
and usually they're pretty kind of salacious
and exacerbating the situation,
and a lot of times they'll provide a number or a link
for you to kind of engage with them at a deeper level.
So these are some classic examples.
The next step is, if they can get you to click
on something within that environment.
So if you see the "more options," the "close"
button, the "okay" button, the "x" to close it down,
even in your traditional upper-right hand closing,
that could actually be fake
and bring you in deeper to their plan,
so we'll talk about that,
so that's a great way for them to trick you,
and sometimes even if you've been on legitimate sites,
you'll get these new ads that come up
that have the center as the ad.
Then the rest of it is kind of transparent,
and way up in that right corner, you can find the real "x."
Well, imagine just with that environment,
they put that "x" in the square
that's really visible in the moment.
Even if they put a legitimate "x,"
you might still be suckered into clicking that fake one,
so it's a pretty good method to trick you,
and boom, this would be that next step.
Let's say you clicked on "more information," "options."
You tried to close that down.
They'll bring you into a pretty legitimate-looking support
experience that,
in this case, they're pretty much mimicking
what they're posting as a Microsoft support site,
and if you notice that little castle with the flag,
they're actually using Microsoft product names,
Security Essentials.
That's our antivirus-malware product in Windows 7 and 8.
Now Defender is predominant, but legitimate terminology.
They throw the term "Windows" out there,
obviously a couple of these alert icons
to make it even more important,
and then obviously a big Microsoft logo in the corner,
and the ultimate goal of this
is to help build some trust with you that this is real.
So another experience that that might lead to or you
might come across in another experience
would be what we call this looping dialog box,
and we probably have experienced this
where you get into one of these experiences
where you just can't get out of it.
It keeps coming back and back and back.
The really only way to get out of those a lot of times
is to use the task manager,
so for those who have been around and had Windows,
there's the good old control-alt-delete
that you can get into the menu system,
but I can give you a shortcut: control-alt-escape.
-Oh! -Whew!
Note that: control-alt-escape.
So control-alt-escape
actually gets you right to the task manager
so you don't have to menu through the system
that tells you to reboot or restart.
It'll just give you a list of your active processes,
so it'll show you your browser right there,
whether that's Chrome or Edge or Internet Explorer,
that you can then close that instance right there,
so that's a pretty easy way to kind of mitigate those loops.
This is also a fun one.
We have -- In most browsers these days,
you have this opportunity to do a full-screen type of a view.
Now, maybe you've used that for a movie on Amazon.
Maybe you used it to look at pictures or something else,
but it's kind of handy.
You have screen-to-screen,
no dialogs or anything else to bother you.
Well, what the fraudsters have figured out
is if they create a fake picture
that looks like a legitimate site
with a legitimate address bar across the top,
they can trick you into engaging with their site,
so this is one of those examples
where this whole experience here is just an image,
just a picture that they've put into full-screen mode
to try to get you to interact,
and obviously a big part of that is,
if you read the scary text in there,
it'll be talking about
how everything is going to be deleted.
You're going to lose everything
if you don't call their number right away,
which is a common, common thing with these.
So here, if you were to hit escape and kind of obviously,
if you're in a movie, hit escape.
You kind of get back to the smaller screen.
You'll see that in this instance,
the real browser address bar across the top
and the fake one in there.
The best one about this is -- You can't see it.
I can't see it from here, but when I get really close,
not to generate any conspiracy theories,
but the Microsoft Support site they faked was from Russia,
so I don't want to spread anything,
but the Russians have some activity here
in our support network, but to be truthful,
we have Support in Russia, so it's a legitimate site.
So uh-oh, looks like I've got a problem.
Anybody been around
and seen the good old blue screen of death?
Hands, yeah, the good old days?
We don't see those much anymore, and if we do see them today,
your system typically will recover on its own,
but this is a great way for them to elicit
that same kind of feeling that,
"Oh, no, here is the blue screen of death all over again.
Now how am I going to fix this?
I know that the blue screen of death means everything is gone.
Well, that's nice because I think everything is gone,
but here is a nice phone number
that I can call that they're going to
help me recover everything and protect me."
So that's a great way for them to do that,
and there's actually another example of this, too.
So here's another one, basically exact same kind of a scenario
where they're really trying to scare you into taking action.
The interesting thing is, the pop-ups and the interaction
they're doing in the browsers here
really isn't harming your computer at this point.
It's purely a social engineering exercise.
They're presenting you with some information and some options
and trying to get you to interact with them.
Now, they could,
if you interacted with these dialog boxes,
download malware and do other things,
but I think as you heard earlier,
they don't need to do that anymore.
They can trick you into giving you
their credit card information.
They can trick you into setting up a remote session
to get deeper into your system,
which oftentimes is not to infect you
or even steal your information,
although they would have access to that.
It's to anchor you into their fake support scam engine.
So to give you an example, you get kind of bought in
to having them help you out this time.
You call.
You buy their Silver support plan
for a couple hundred bucks for a year.
They fix the problem, right. They created it.
They turn off the pop-up,
and you've allowed them to remote into your computer,
so you've given them control of your computer.
They fix the problem. They go away.
Well, then they just put you on your list.
A couple months later, boom, they'll have another one pop up,
and a lot of times, they'll actually have now access
to your systems because you gave it to them,
and they'll present you with a new one,
and you'll call up and say, "Hey, I thought we fixed that,"
and they say, "Well, you didn't buy the Platinum service,
so that's going to be $500, please,"
and, "Oh, dear, you know, I guess I blew it.
I should have bought the bigger package originally,"
so not an uncommon tactic
to kind of loop you into that experience
before you can break out of it.
Now, this one is a good segue from my comment
that a lot of those experiences we walked through
weren't necessarily harming your computer directly,
although indirectly they certainly could
if you were to interact with them
and allow them remote control.
This ransomware, kind of almost an epidemic
where if you've been watching the news in cyber
at all in the last year,
this is a little scary in that the bad guys here
are actually using
industry-standard encryption technologies.
It's not some homegrown hacked encryption that they're using.
They're using the same encryption technology
that Microsoft uses,
so I feel horrible when I'm talking to a customer
that's been infected with ransomware where they think
there's just got to be some secret backdoor way
to decrypt my files without engaging these folks,
unfortunately not true.
If you can't decrypt the Microsoft or government data,
you're not decrypting these guys' data,
and also, it's kind of fascinating in that
you will hear reports where,
if you pay the ransom, you'll get your data back.
I'm suspicious that a lot of those reports
come from the bad guys themselves,
so no recommendation to play ball
with these guys and pay them off.
They also are looking for ways to get money anonymously,
and the cybercurrency Bitcoin,
you've probably heard those terms,
allows for anonymous transactions
to happen in a relatively easy way,
which really has created a highway of money
transfer for these guys to do this,
and they're really helpful.
They have customer service centers.
They have blogs.
They'll walk you through how to open a Bitcoin account,
get some Bitcoin, mine some Bitcoin,
and send them the Bitcoin.
If that doesn't work, they'll tell you to go down to 7-Eleven
and buy some Apple iTunes cards and send those to them, right?
So they will be creative
in getting your money however they can,
but that Bitcoin avenue has really been helpful to them.
This one is actually the -- About a year ago in May,
I think, we had this WanaCrypt outbreak,
and this is an example of the detail of information
they're providing you to decrypt your files.
They'll also sometimes even give you a teaser
where they'll give you a dialogue box,
and to prove to you that they have your files
and that they can decrypt them,
they'll let you decrypt a few files
and then remind you that you got to pay for the rest of them.
So let me close up on the ransomware really quick,
so since I don't dive into this too deep
in the closing slides there,
there are some things that you can do to protect yourself.
Most modern browsers, most modern antivirus software
has come a long way in building protection
into their systems for this, to prevent it,
so there's a thing called a signature
that your AV software uses to detect different types
of malware or viruses or ransomware in that
for whatever category it falls into.
So advice is to protect yourself from this
as well as some of the other traditional viruses
is to be running a modern operating system.
Whatever current version is out there, run that.
Run an AV software and keep it up to date.
I know that I advise people as well to ensure
that their operating system automatic updates are always on,
so you're always consuming the latest security
updates most predominantly,
and also I recommend keep your laptops and your computers on.
Let the computer itself manage the security updates
and the signature updates
because imagine you turn it off for a week,
and you don't interact with that often.
You come back.
You've got a week's worth of security updates and signatures
that haven't been downloaded to your system,
so whatever excitement has happened in that last week,
your system now has to go update,
and sometimes that's frustrating
because, all of a sudden, now your system is slow
because you're downloading a bunch of backed-up content.
Usually that streads it out though
so you don't experience that.
Do the thinking and control that.
In the long term, you're going to be better off,
and I've talked to people about,
"Well, it uses power. You know, the light comes on.
I don't like to have the screen up."
All those are good talks,
but my recommendation is leave it on
and let the system manage itself.
All right.
So let's talk a little about safety tips.
I talked about that.
Within our browsers, whichever browser you use,
there's lots of great control now
on how you can kind of control that environment.
Pop-ups are good.
Here is a cool --
a new technology that is in the Edge browser
that will -- Basically what it does is,
it looks at the site you're going to,
and it'll throw up this warning if it believes
there's some nefarious activity on that website,
and most modern browsers will have this
kind of technology built in, and that's why I recommend
make sure you keep your browsers up-to-date
because you're missing out on the latest technology,
and all the companies that support this space
are investing a lot of time and effort and research
into protecting you from these things,
so take advantage of the work
that we're all doing in this technology.
This one is -- This one is good as well.
I talked about that looping experience where you get stuck,
and it keeps coming back, keeps coming back.
Well, the browsers these days can actually detect that
and pop you an option to turn that --
"Hey. We detected there's a service here
that keeps spinning.
Would you like us to stop that for you?"
And it gives you that option.
This is a great new feature that has turned up
in most browsers now is, we did a great job
of guiding you to do a Control-Alt-Delete
and turn off your browser instance
if you're stuck in some kind of a scary situation.
We shut it down, and then when you started it back up,
we were so helpful to say, "Hey. The browser shut unexpectedly.
Let me go ahead and put you back to where you were."
Yeah, that wasn't very helpful,
so now it actually has a little bit of smarts to say,
"Hey. When you shut down,
do you want to come back in a clean state
without dropping you back into a frozen screen?"
So that's pretty common these days.
And here is a little bigger view of that --
We talked about the picture that takes up the whole screen.
Well, the browser now if you look
at the little green box down below
gives you a little warning that say, "Hey.
You just got flipped to full-screen mode.
Notice that something's going on here,"
might be completely legitimate,
but it could be trying to trick you into that fake picture
that it wants you to interact with.
So we talked about this a little bit.
Use the close button, and if that's not working
or you think it's nefarious,
do the Control-Escape and close the process.
Never ever ever call the numbers in the pop-ups.
A great, great story that I have permission to share,
so my father-in-law obviously has heard a lot about this
for me the last couple years,
especially since I'm his personal tech support, right?
So those late-night calls and rebooting his system
and taking care of that and the fun part
of helping him shop for new devices, it's all great,
so he's not ignorant to these issues, right?
I've sat down at Thanksgiving, at football games
and talked to him about the stuff I'm doing
and told him the stuff not to do,
never do this, watch for this.
So not 3 months ago, kind of over the holidays,
I get a call at midnight.
I pick up the phone, "Yeah, Dad. What's going on?"
And I hear this beeping in the back, beep, beep, sounds
like a fire alarm is going off, and I kind of like, "Oh, no."
He goes, "Oh, my gosh. My computer is frozen.
It's making this horrible sound, and get this.
I can't get through to the number they gave me."
I'm going, "Thank the Lord
you didn't get through to the number."
I go, "Really?"
So even the most well-versed, you know,
"how many times have I told him" stories,
that he still got suckered
really in a social-engineering way, right?
They had the beeping going, so he panicked.
They had a big red screen.
They had all those things we were talking
about popping up in front of him,
and he's going, "Oh, my gosh. There's all my pictures.
There's all my financial records.
They're gone unless I call this number
and have these guys help me,"
so he didn't have time to really process all the don't-dos.
He was just reacting, and that's where these guys are brilliant.
They're looking for ways to do that to you.
And I tried to get him in here,
but you guys all sold out too quick,
so I don't know if I would've been quite as transparent
with that story if he was here but --
So we're talking about some other safety tips.
When you're looking for Microsoft support selfishly
obviously to our issue here is, we want to make sure
that if you need us, we want to be available,
and the prevalence of these tech-support scams
has really tarnished the use of phone numbers in general,
so just so you know, unequivocally Microsoft
will never call you out of the blue
telling you your system has a virus,
or your system is running slow or whatever we,
you know, you can imagine we might say.
We don't do that. There's no phone calls.
The only way we would phone call or dial you up
is if you initiated an engagement with us, right?
So for example, if one of us are on the back talking today
and you said, "Hey, Jeff.
You know, can you give me a call on that?"
again, I'm -- Just to reinforce,
I'm not a security or a support engineer.
I speak.
I don't necessarily do as we'll --
But let's say I was going to -- I said, "Yeah, I'll call you."
Well, now we have a relationship,
and you should expect the call, so just be notice of that.
Diving into the support.microsoft.com,
I say, "Support.microsoft.com," is the official site.
You can engage us right through there in a variety of ways,
and as Doug kind of mentioned,
don't trust a lot of times those links in your e-mail
and your browsers.
Take it upon yourself to type the address
right into the address bar, yes, not as convenient,
but, boy, it eliminates a lot of risk.
And this allows you just to drill down
into that a bit further, but we don't have time.
So back to that security or that support-scam story,
just a little bit of education on
when you're on search engines, search engines sell ads, right?
If you look here, you can see these top two are ads,
advertisements that an independent company has used
or has purchased to propagate them
to the top of the screen here.
That's fine, perfectly legitimate,
and these may be perfect legitimate businesses.
I'm not suggesting that these are tech-scam folks,
but they could be, so if you're looking for actual Microsoft,
watch for the actual address,
and obviously that next section down
is where you find the Microsoft support area
where you see the real address
and can have a little bit more of a trusted experience,
and even then, I would say,
"Okay. You see the address there?
Just go type that into your address box," and you're there.
This is great.
Doug hit on this a little bit,
so I'll reinforce just for a second that e-mail scams,
phishing attacks, it's very interesting
in that we hear about all these hacks
and these breaches and the technology that's broken,
but once you dig down into a lot of that,
the real footprint or that first crack in the door
was probably a phishing attack.
Somehow somebody gave up a little information
through some kind of a social interaction,
so a phishing attack is just that.
It's a social manipulation of you to give information
or to do something that then helps them,
so as Doug said, watch for the real e-mail addresses.
Obviously the Microsoft account team is not at npl.com.
When we're looking at strange characters,
you know, I don't know exactly what those characters are,
but I know they're not English language characters,
so that's important, also the scary language,
and this kind of goes back to the nuance of the blaring alarm
and the big red screens.
They can do the same thing with language
and how they talk to you in these dialogue boxes
and these pop-ups, right?
They'll use words like,
"Your hard drive is going to be deleted.
All your information will be gone."
They'll throw, you know, "Your personal information
is currently leaking," right?
They'll give all these scary terms.
Microsoft and other legitimate partners that you work
with aren't going to use those kind of terminologies.
Blurry images, classic.
I didn't blow this up because it's already blurry.
And here I think a gentleman over here
was talking about the misleading links.
When you hover over a link, you can get its actual path,
the actual URL that it's going to,
so if you hover over this and it says,
"Support.microsoft.com/help," it's probably trustworthy.
Again, I'd say, "Oh, just hop the top of the browser
and type it in. You're even safer,"
but another good thing to identify
something as a phishing attack or fake support.
Obvious typos, these are some of my favorites,
so the Micorsoft, you know,
sometimes I give our marketing department a bad time,
but I know they know how to spell our company name, right?
Then my favorite one, actually some of you in the back
might even think that second one says Microsoft.
Does it say Microsoft back there?
Yeah?
So that's one of my favorite ones.
You'll see a lot of that.
You'll see that pop up as microsoft.com, right?
They'll use that to try to spoof you into thinking
that's our actual URL,
so that's one of my favorites with the R and N.
So here is a real example
of what you're going to experience for Microsoft
and obviously a trusted vendor as well is,
microsoft.com is where the e-mail is coming from.
Your personal information is protected,
and this is an important point.
A lot of times in those e-mails
if they're kind of broad-based attacks
where they don't have a lot of your details yet,
obviously with a very targeted attack,
they might be able to feed some information on you,
but here you can see that when we're interacting with you,
"Wow, we have your e-mail address,"
so that hopefully verifies that we know who you are.
You know who we are, and we're obfuscating the actual address,
which hopefully denotes that, "Okay.
This is somebody who is trying to protect me
a little bit versus abuse me."
Nonthreatening language, none of those big terms
I mentioned would be in our description
of what we're doing here, links to a Microsoft website
back to the whole hovering scenario,
which is a great practice,
and even if you don't plan to click on it,
even if it is Microsoft, it's a great, quick way
to see what's going on, on that e-mail as well.
So look for the warning signs.
Don't respond or call to whatever they present you.
We talked about the links,
and we talked a little bit about the spam junk mail,
so what's really great these days is,
most of your providers,
whether it's Comcast or Outlook or Google
or whatever mail service you're using,
they've invested a lot of energy
the last 10 or 15 years in their backend infrastructure
to catch a lot of the stuff before it gets to you.
Now if you're signed up for one of the services,
and somebody's mentioning about, "What happens if I put it
in spam or junk?" if you put it in a spam or junk,
a lot of services actually are going to know
what you flagged as junk, put it back into your system
and try to help the whole ecosystem,
so it's great that we can block you
from getting that one piece of spam again.
It really has value if we can block
that spam for millions of customers
and really shrink the whole ecosystem,
so throwing it in spam, not a bad thing,
throwing it in junk, not a bad thing,
but depending on how you want to manage that,
different e-mail clients would delete
or not delete depending on your time frame
or how you want to manage it because sometimes it's,
"Hey, Jeff. Did you check your junk mail?"
"Yes, honey. I did."
So that can catch you.
So watch who you give your address out to as well,
pretty standard.
Now the thing is, you watch that,
but as Doug kind of mentioned,
our information gets out there, right?
If we've logged into Netflix and we've got an e-mail
from our local power company or our telephone company,
our information is on a server somewhere,
hopefully protected and secure, but it's somewhere,
and if you've watched the attacks
in the last couple years, you know a lot
of big trusted companies have had their data exposed,
so the guidance I always say here,
and my longer history has been more with enterprise
customers and corporate accounts,
is assume your data has been breached
and is available externally, right?
Assume that you're going to be breached.
Assume that that's going to happen,
and that will change your footprint a little bit
on how you're thinking about this.
Instead of building all these walls and perimeters
that at one point have a high risk of being breached,
think about what you do when it happens, right?
Do you want a monitoring system out there to know
when a hole has been knocked in your wall, right?
Do you want a service to help you fix
that once the hole has been knocked in the wall?
So it applies to us as well, a little bit more critical
for those folks holding our data, though.
Social media, online scams, everything I've said
when it comes to the social interactions,
the links all apply to social scams as well.
Whatever platform you're on
and you're interacting with friends and family,
the same principles apply from e-mail.
The only difference is,
sometimes you're even more comfortable
on that social environment
where you're with friends and family and acquaintances
that can kind of grow, and it's a friend of a friend.
They seem to have the same interests.
Okay.
I trust them now, and would you have invited that person
to your living room to have tea with?
Who knows, right?
So try to keep that friends list at the people you know.
And this is exactly the same on chat
in these environments as well,
and Doug did a great job asking people to raise their hands
on who's edited their Facebook privacy settings,
and this holds true to any of the platforms
you on, whether it's ChatStep,
WhatsApp, Instagram, whatever platform my kids
are forcing me to go look at pictures on.
Make sure you do take advantage of the privacy opportunities
they provide you because they have provided
a pretty rich ecosystem of your ability
to control those these days, but the vast majority of people
just don't take advantage of them.
And obviously if it sounds good to be true,
it is, so phone calls, we went over this.
I think people are a little bit more sensitive these days,
but watch for kind of the abusive,
influencing, kind of --
Sometimes, they're even, you know,
trying to humiliate you into accepting their service, right?
And not super different than the IRS scams
where they're telling you the police
are going to be at your door in 1/2 hour
unless you pay your balance today, right?
They'll use that same kind of tactic,
but they also could work you a little bit nuanced
to get you to connect up like
I mentioned earlier, and what they'll do is,
they'll show you some scary file name
on your computer, or if they have control,
they can put their own picture on your computer
and tell you you're all infected,
and your whole world is falling apart,
and you need to give them a couple hundred bucks
to fix it.
Again, Microsoft never makes phone calls.
Don't purchase that stuff over online, on the phones,
and this remote-control software is very risky,
so if anybody but your personal son-in-law tech support,
be careful about who you're letting remotely control
your computer,
and worse comes to worst, hang up,
and also worse comes to worst on your laptop
or your computer, unplug it.
Slam the lid down.
Any damage you would do to the operating system
or the computer at that point
is far less than what would happen to your identity
and your content if you were to go down that path,
so a lot of of us get down the path a little bit and go,
"What am I doing?"
Boom, just exit out however you can.
So with that, thank you very much,
and I'll be around later for questions it.
Appreciate it.