DoorDash Data Breach: How to Tell if You’ve Been Hacked

DoorDash Data Breach: How to Tell if You’ve Been Hacked

Remember when home-cooked meals happened six nights a week instead of just during the holidays? I don’t really do either. Delivery is indeed a major convenience though. From groceries and prescriptions to corporate lunches, family dinners and late night snacks, if you can order it on an app, such as Uber Eats, it can be on your doorstep in about an hour. Yes, delivery is a major convenience but, just like with everything in life, there are risks and your data can be compromised. Just ask the almost $5 million DoorDash users, merchants and workers who were recently hacked. Hits a little too close to home.

 

Consumer behavior, along with the concept of dinnertime itself, have both evolved in the past few years, making food delivery one of the the newest up and coming fads. The industry, referred to as third party logistics, is experiencing “unprecedented growth to the tune of $43 billion in deliveries (2018) and is forecasted to rise to $76 billion by 2022.” As reported in Barron’s, GrubHub this past spring was losing the food-delivery war with DoorDash stealing the show. “For the industry, DoorDash’s pace of share gain is the dominant trend,” reported KeyBanc analyst Andy Hargreaves, March, 2019. DoorDash just recently surpassed Uber Eats as the second-largest food-delivery service in the U.S. after GrubHub. We regularly use all three providers, but with a preference for DoorDash only because of the availability of restaurant choices.

 

What actually was hacked?

The latest report according to Business Insider, detailed that the breach occurred in May and affects some users who started using the DoorDash app before April 5, 2018…. “DoorDash said an unauthorized third party was able to access some users’ profile information, including names, email addresses, delivery addresses, order history and phone numbers.” The article continued to report that the last four digits of some consumers’ credit cards were also accessed, but not full card numbers or CVVs. “For some delivery workers and restaurants, the unauthorized third party accessed the last four digits of bank-account numbers.” DoorDash did announce that the “credit card and banking information is not sufficient to make fraudulent charges or withdrawals.” That gives us a little peace of mind. Maybe.

 

How do you know if you were hacked?

DoorDash reported to Business Insider that it had begun contacting people affected by the data breach and will continue to do so as they become known. The company did recommend that even those who hadn’t been contacted by DoorDash regarding the breach should still change their password immediately to be safe.

 

– If you signed up for DoorDash after April 5, 2018, your data is likely safe. If you can’t recall when you signed up, contact them to find out.

– Check your bank account(s) which are tied to your DoorDash account for fraudulent activity. Hackers count on people not reviewing every item on their credit card and bank statements.

– Contact your identity theft solutions provider immediately and especially if you notice anything “off” in your statement(s).

– Do you use the same password for multiple accounts? We recommend that your passwords are updated on a routine basis and that the same one isn’t used across multiple accounts.

 

Hackers will continue to hack. That is a definite certainty in this day and age. When we set up any type of home delivery, it is unnerving to not be able to trust that they will keep us safe as well as our food. Maybe we all should go back to those home-cooked meals … now, how do you turn the oven on again?

 

Need help? Our Member Services team is here for you 24/7/365. Call us at 888.966.GUARD (4827) or email memberservices@guardwellid.com.

 

References:

Fortune. Morris, Chris. “DoorDash Data Breach: What to Do If Your Account Was Compromised.” September 27, 2019.

Business Insider. Holmes, Aaron. “DoorDash Hack: How to Tell If You’re Affected.” September 26, 2019.

Accidentally Clicked on a Phishing Link – Now What

Accidentally Clicked on a Phishing Link – Now What

You know that searing flush-faced feeling when you pretty much know you made a mistake with a slip of the finger? Sometimes it’s sending a text too soon or responding to an email without editing your response. Other times it’s when you click on something you likely shouldn’t have … and then the “uh oh” escapes … and then the big sigh.

 

When we multitask, whether it is at work or at home, we do tend to slip up at times and open something that we shouldn’t. Then enters adware, malware, ransonmare, spyware, and whatever-else-is-next-ware into our lives.

 

Oops! Now what?

 

There are some imperative steps to take to alleviate harm to you and/or the network you may be connected with:

– Try not to panic. This happens to everyone. Antivirus and anti-malware will come into play and you will need to have a full system scan. But first …

– End the session immediately by turning off Wi-Fi, unplugging from an ethernet cable or completely shutting down all of your devices.

– Initiate a back up of your files. Since you won’t be connected to the internet at this point, you won’t be able to accomplish this to the cloud. Having an external drive, DVD or thumb drive are always nice to have on hand during times like these.

– Change your login/password to email account(s) and enable two-factor authentication if this hasn’t already occurred.

– If you are employed by a company or organization, reference your manual and let your network administrator know of the potential issue.

– After all is said and done, check your antivirus/anti-malware software and run a full scan.

 

Being informed of what steps you may need to take before a slip up happens can help ease the potential damage (and your stress level) if it does. As always, if you need help or have any concerns, we are available 24/7/365 for you.

Guarding Against Business Identity Theft

Guarding Against Business Identity Theft

Individuals aren’t the only targets for identity theft. Corporate, also known as commercial identity theft, saw a 46% increase last year according to the National Cybersecurity Society (NCSS). Although businesses of all sizes are at risk, small businesses are particularly vulnerable. “Small business identity theft—stealing a business’ identity to commit fraud—is big business for identity thieves,” remarks Mary Ellen Seale, CEO of NCSS.

 

She explains, “Unlike larger corporations, small businesses don’t always have the required security controls in place to detect and deter fraudulent activity, which can make them easier targets. There is also a general unawareness, among large and small businesses alike, of the magnitude of the threat and the devastating effects that business identity theft can have.”

 

Stealing an organization’s identity takes a lot less work than one might think. State laws require the public disclosure of proprietary business information in annual reports, names and addresses of key company personnel as well as the employee identification number (EIN). All of this information can be used by thieves to apply for a line of credit or loan as well as intercept business credit card information.

 

What can business owners do to help mitigate their risk?

– Educate your employees about phishing scams. Phishers aren’t just targeting your business … they are grabbing your customers, employees, partners and vendors. Make sure your employees know what red flags to look for when they receive an email that is asking for an action from them. Examples include bad grammar, mispelled words, links to unfamiliar websites and attachments.

– Don’t post sensitive company information on your website.

– Stay on top of computer security updates.

– Check your credit reports regularly.

– Follow the IRS new procedures to protect businesses. Visit https://www.irs.gov/individuals/identity-theft-guide-for-business-partnerships-and-estate-and-trusts for detailed information.

– File your company’s annual report on time and regularly check the secretary of state’s website. Keep in mind that if you operate your business in more than one state, each state may have their own due date.

 

Unfortunately, identity theft is here to stay. With the number of incidents growing each year, and financial losses piling up, it’s more important than ever for businesses to be vigilant. Do you have an anti-phishing plan for your business? Please contact us if you need assistance developing one or educating your employees about the topic.

New American Express Phishing Attack

New American Express Phishing Attack

A new form of phishing attack has recently targeted Amex cardholders and is more sophisticated than what experts have seen in the past. A phishing attack can arrive via email, text, social media message or even as a phone call and appears to be coming from someone you know (a person in your contact list or a company that you regularly interact with, such as your financial institution). According to the Identity Theft Resource Center, “the link embedded in the current American Express phishing attack comes via email and is two different parts. This way the hacker can insert malicious code into the link while also confusing the recipient’s antivirus software. Instead of warning about a harmful link, the software does not recognize it as malicious.”

 

How can you tell if an email is a phishing scam? The Amex email itself was very typical of a phishing attack – it was filled with grammatical errors including spelling and punctuation mistakes. Along with being on the lookout for language errors, here are some additional tips to keep in mind:

 

– Verify that the information is legitimate. If an email comes from your supervisor, call them and make sure. If an email comes from a company that you regularly do business with, ignore it and go directly to their website and check your account.

– Don’t click on a link or download an attachment from an email or message that you aren’t expecting.

– Double-check the sender’s address or the website address. For example, if it says, “AmazOn.com,” it is probably fake.

– Remember that caller ID is not trustworthy.

 

If you think you have received an American Express phishing email, don’t click on any of the links. The company suggests that you forward it to spoof@americanexpress.com so they can act to close down the phishing link. After the email is forwarded, delete it from your inbox.

 

Please call Guard Well Member Services at 888.966.4827 (GUARD) or email memberservices@guardwellid.com if you feel you have been a victim of identity theft. We are always available for you – 24/7/365.

 

 

Flying This Summer? How to Prevent Juice Jacking

Flying This Summer? How to Prevent Juice Jacking

Vacations are indeed wonderful. Traveling to a new destination or to a familiar favorite locale is a treasured experience with memories that can last a lifetime. On the other hand, traveling on business might not be as fun, but it is a must for many. Going from point A to point B can be stressful at times. Weather, flight delays, overbooked flights, long layovers or not having enough time between flights causing you to miss your next connection … you name it, it can happen. Next thing you know, your device battery is getting low. So, what do you do? Is it safe to recharge at a public charging station? Not always.

 

Juice jacking is a type of cyber attack and typically involves public USBs. Public charging stations, such as those found in airports, train stations, hotel lobbies, and even your rental car, can make your personal data very vulnerable and open your device up to malware.

 

As reported in Forbes, a growing number of nation-state hackers have been training their sights on travelers. New research from IBM, in the 2019 IBM X-Force Threat Intelligence Index, reveals that the transportation industry has become a priority target for cybercriminals as the second-most attacked industry — up from tenth in 2017. Since January 2018, 566 million records from the travel and transportation industry have been leaked or compromised in publicly reported breaches.”

 

What steps can you take to prevent juice jacking from happening to you?

– Don’t leave home without a fully charged battery.

– Carry a charging cord with you so you can use a wall socket instead of a public USB.

– Purchase an external battery pack.

– Turn off your phone to save your battery when feasible.

– Learn how to optimize your device’s battery settings.

 

 

 

Two-factor Authentication Phishing  Scam

Two-factor Authentication Phishing Scam

Have you tried to log into an account of yours, such as your insurance or financial institution, and been told to confirm your identity in order to keep your credentials safe? You then receive a code either via text or email which is required for you to enter. Also known as 2FA, this SMS multi-step process has been the trusted security step to protect your accounts … until recently.

 

Unfortunately, there is an automated phishing attack on 2FA, which utilizes two tools: Muraena and NecroBrowser. Reported by Fortune, “The two tools work together like the perfect crime duo. Think of Muraena as the clever bank robber and NecroBrowser as the getaway driver.”

 

The attack was first demonstrated at the Hack in the Box Security Conference in Amsterdam last month. A video of the presentation was posted on YouTube on June 2nd bringing renewed attention to how hackers are getting better at penetrating extra layers of security, despite people using stronger tools, like 2FA.

 

So, what do you do? Do you still want to utilize SMS-based 2FA for your accounts? For the most part, the answer is yes.

 

Think of it like this. Say you want to put a lock on your front door to protect your home. Security professionals are arguing that the best type of lock available is way better than cheaper locks. Sure, makes sense. But if that more expensive lock isn’t available to you, isn’t having a cheaper lock still better than not having a lock at all?

 

As discussed on How-to-Geek’s website, there are some people who are more likely than others to be targeted by sophisticated hackers and should avoid using this SMS-based 2FA. For example, if you’re a politician, journalist, celebrity, or business leader, you could be targeted. Also, if you’re a person with access to sensitive corporate data, such as a system administrator, or just very wealthy, SMS may be too risky.

 

But, if you’re the average person with a Gmail or Facebook account and no one has a reason to spend a bunch of time getting access to your accounts, SMS authentication is fine and you should absolutely use it rather than using nothing at all.

 

If you suspect that your login credentials have been compromised, change your passwords as quickly as possible and report the website to the FTC and/or your identity theft resolution provider.

 

Sources:

https://conference.hitb.org/

https://Howtogeek.com/

 

 

Preventing a Mortgage Closing Scam

Preventing a Mortgage Closing Scam

Searching for a new home, can be as exciting as it is stressful, tedious and time-consuming. It will likely be one of your most memorable life moments, especially for first-time buyers. So when you do find that perfect home for you, your bid is accepted and the inspection comes back great, you and your family celebrate and start down the long check-list of things to do prior to your move.

 

As that closing date approaches, unfortunately, the risk of being a victim of a phishing scam does as well. The ultimate cost could be the loss of your entire life savings and there is usually not an insurance policy that will recover your money if this happens to you.

 

The FBI has reported that scammers are increasingly taking advantage of homebuyers with very complex, sophisticated schemes with reports of mortgage fraud rising over 1,100 percent each year. There was an estimated loss of nearly $1 billion in real estate transaction costs in 2017 alone.

 

How would mortgage fraud happen to you? Mortgage fraud, a sub-category of financial institution fraud (FIF), typically starts with a phishing email that appears to be coming from a trusted professional involved in your property purchase. The email claims to be notifying you of changes to your wiring instructions or that they had made a mistake and previously discussed the wrong wiring instructions with you. Wire fraud is so prevalent that many attorneys, lenders and realtors are starting to include a warning about it in their emails. “We do not accept or request wiring instructions or changes to wiring instructions via email. Always call to verify.” But, be wary that even phone conversations may be fraudulent.

 

What can you do to prevent mortgage fraud from happening to you? Consult the Consumer Financial Protection Bureau’s Mortgage Closing Checklist. Identity two trusted individuals involved in the closing process and have multiple ways for you to contact them. Real estate professionals suggest that you create a code phrase that is only known to the trusted parties involved in the transaction in case there is a need to confirm their identities in the future. Be mindful that email is never a secure way to send financial information or closing details.

 

What if mortgage fraud happens to you? Try to ask for a wire recall with your financial institution. Being swift in reporting the crime can greatly increase the likelihood of recovering your funds. Report the fraud to your identity theft resolution provider. Lastly, file a complaint with the FBI.

 

 

Sources:

https://www.fbi.gov/investigate/white-collar-crime/mortgage-fraud

https://consumerfinance.gov

 

Photo credit:

Tierra Mallorca via Unsplash

Ten Signs You Have Been a Victim of Identity Theft

Ten Signs You Have Been a Victim of Identity Theft

Identity theft is rampant. One in three data breach victims will experience fraud according to a 2018 study by Javelin Strategy & Research. The number of identity fraud victims in the United States alone is at 16.7 million with over $16.8 billion stolen. Read More

 

Do you know the latest signs of identity theft? Here are the top ten red flags that trouble is brewing:

– You receive a notice, either in the mail or via email, that you have been a part of a data breach.

– Your credit score quickly drops without explanation.

– Withdrawals from your bank account start to occur … and they are withdrawals that you haven’t scheduled or already made.

– Although you haven’t filed any insurance claims, your rates rapidly rise.

– Your Social Security statements aren’t matching your records.

– There are suspicious charges on your credit card.

– You are turned down for a loan or credit card unexpectedly.

– Your credit report shows accounts that you have not opened.

– Either federal, your state or local taxing authority alerts you to their receipt of multiple filings in your name.

– You receive a bill for an item or service that you have not purchased … and from a company that you have never done business with.

 

Have you experienced any of the above? If yes, contact a fraud resolution specialist immediately.

Quick Steps for Lost Wallet

Quick Steps for Lost Wallet

You know that flustered feeling when you can’t find your cell phone? Imagine if you had your driver’s license, ATM debit card and your AMEX in a pocket inside your phone. Not only would you have a lost wallet, but you would have a lost cell phone as well. Talk about panic.

There are many reasons why you should not carry every ID you have on you at any given point in time. Your Social Security card … should be in a safe. Your passport should be in there as well. If you own more than one credit card, don’t carry all of them in your wallet at the same time. Your health insurance card? Now, that’s a toss-up.

Before a lost wallet scenario could happen to you:

• Make a detailed list and/or keep photocopies of the contents in your wallet in a safe place (ideally in a home safe or bank lock box). Make sure phone numbers are included for your providers as well so you can swiftly contact your creditors if the moment arises.

What to do if you have a lost or stolen phone, wallet or both:

• Call your bank(s) immediately to report your debit and/or any credit cards as stolen. This is different from canceling or closing your credit cards, which can cause problems with your credit reports. “You’re only responsible for up to $50 in unauthorized purchases if you report a debit card as missing within two business days of the loss. But, if you wait more than two days (but less than 60), you could be on the hook for up to $500 in unauthorized purchases.
• Call your cell phone carrier if your lost wallet also included your phone. Service providers have tracking that can help trace the footsteps of your burglar as well as the ability to shut off any apps, suspend social media accounts and email for the time being.
• File a police report.
• Initiate a fraud alert on your credit report.
• Replace your driver’s license as soon as possible. Every state has different requirements for replacing a license. Some may ask you for a police report number if your ID has been stolen.

• IF your Social Security card was in your wallet (not recommended), contact the Social Security Administration immediately. They can send you a new card but they won’t give you a new number.

• Download a credit report. If you see anything you don’t recognize, call the IRS Identity Protection Unit 800.908.4490.

What types of cards and documents can be replaced?

It can be overwhelming when we think of everything that could be in our wallet. Your driver’s license, debit card, passport, military ID, health insurance card, Medicare/Medicaid, auto insurance card, US Visa or residency card, even retail store cards and any specialized license or driver’s permit all can be replaced, but it takes time.

It’s best to minimize what you carry with you. Our Lost Wallet service assists our Members in quickly and effectively terminating and re-ordering wallet contents. Our services include:

• Identifying missing documents.
• Contacting document issuers while Member is on call (if required by issuer).
• Cancelling of all lost cards and report documents missing.
• Completing the required forms and delivering to subscriber for completion.
• Initiating fraud affidavit and police reports for stolen wallets.
• Additional resolution calls based on the severity of issue, as needed

Don’t Let Identity Theft Become a Vacation Memory

Don’t Let Identity Theft Become a Vacation Memory

We all look forward to vacations … time off of work, fun with the family, a few days of laziness… but, when we are excited about buying sunscreen and new flip-flops, we need to remember that there are some other ‘things to do’ on our checklist to help keep our family and identities safe.
In addition to finding pet care, remembering your passport and making sure your  lighting is on schedule, there are some pre-, during and post-trip items that you can do to help prevent identity theft from becoming a huge vacation memory.

Just some small preventative measures like updating the operating system and antivirus software on your mobile devices can go a long way toward fending off a few identity thieves.

Before you leave home:

  • Password protect your devices and update operating systems
  • Alert your bank(s) about your travel plans
  • Visit your post office and put your mail on a vacation hold
  • Keep the number of credit cards you travel with to a minimum and have copies of your driver’s license, medical id cards, passports and travel confirmation numbers at home in a safe place
  • Turn off auto-connect Wifi and Bluetooth connections
  • Consider adjusting your social media account settings so posts aren’t tagged with GPS data

While out of town:

  • Avoid using public Wifi and even your hotel’s if at all possible
  • Do not use public computers
  • Keep your travel documents in a hotel safe
  • Log out of websites on your smart phone and any websites if you bring a laptop or other device with you on your trip

Upon your return home:

  • Consider changing passwords for your major accounts
  • Thoroughly go through your account statements for any irregularities
  • Check your credit report to make sure no new accounts were opened in your name while you were away
  • We hope you have a wonderful vacation. Stay safe!