Author: City of Linden

Latest Scam Methods

The Bank Impersonation Scam – In this scenario, scammers impersonate your bank using spoofed caller IDs. They falsely claim fraudulent activity on your account, then either trick you into sending payments (‘to reverse the fraud’) or ask for sensitive information to gain access and steal your money.

The Smishing Scam – Smishing, an SMS-based form of phishing, involves scammers impersonating legitimate organizations via text message. These communications often create a false sense of urgency, directing recipients to malicious links where payment information or personally identifiable data is solicited for fraudulent purposes.

The Social Media Deposit Refund Scam – Scammers who are impersonating artists on social media platforms entice victims with offers to purchase photographs. The scammers issue counterfeit checks and subsequently request a partial refund, often citing ‘supply’ costs. Despite the check appearing to clear initially, it is later identified as fraudulent by the bank. By this time, funds sent by the victim to the scammer cannot be recovered.

Here are steps you can take to protect yourself against these and other scams.

• Verify Phone Calls – Hang up on suspicious calls. Verify legitimacy by contacting the company using a number from their official website. For bank calls, always end the call and then dial the number on the back of your debit or credit card to be certain that you are actually communicating with your bank.
• Be Skeptical – Exercise skepticism toward unsolicited investment opportunities guaranteeing substantial returns. Prior to transferring funds, conduct due diligence using reputable sources to confirm the entity’s legitimacy. Exercise heightened caution if the arrangement requires cryptocurrency, as this is a common fraud tactic.
• Don’t Give Into Pressure and Urgency – Scammers employ urgency tactics, such as false account compromise alerts, service termination threats, or legal action claims, to bypass rational judgment. Always consult a trusted contact before acting on such demands. Legitimate entities provide written notices and due process. Legitimate companies and/or government agencies will never demand gift card payments. Never share gift card codes with strangers, as this is the equivalent of handing them cash.
• Never Send Money To People You Have Not Met In Person – Always exercise extreme caution toward online acquaintances soliciting funds or promoting investment opportunities, particularly those involving cryptocurrency. These scenarios represent very common social engineering fraud tactics.

Report vishing scams and other malicious cyber activity to the FBI’s IC3 and the NJCCIC. If you or someone you know is being physically threatened, then contact the police department or dial 9-1-1 immediately.

What’s Happening?

Law enforcement continues to receive reports of fraudulent phone calls in vishing scams. Typically, threat actors (hackers) acquire publicly available information found online and impersonate specific organizations or individuals. They contact the recipient to extort money or convince their targets to divulge sensitive information, grant access to their accounts or devices, or purchase fraudulent goods or services. In one report, an educational institution received repeated suspicious phone calls from different phone numbers, including spoofed official ones, to appear legitimate. The threat actors claimed to be “Online IT Training” and asked for the head of the information technology department. When questioned, the threat actors could not respond “off script.”

Threat actors are increasingly leveraging voice cloning and artificial intelligence (AI) technologies to carry out impersonation and extortion scams. They can find and capture snippets of a person’s voice online, through social media platforms, in outgoing voicemail messages, or when the recipient caller answers a call. They can weaponize AI technology with the captured audio to clone a person’s voice and create fraudulent schemes, such as family emergencies, kidnappings, robberies, or car accidents. In one reported vishing scam, the threat actors impersonated the target’s daughter, claiming to be involved in a car accident. A male voice was also on the line, claiming to be a local law enforcement officer and reporting that the daughter supposedly admitted to using her cell phone while driving. He indicated that she was being held for charges of injuring the other driver, who was pregnant. The purported officer stated that a bail bond agent would contact them to post bail. Minutes later, a male caller posing as a bail bond agent contacted the target to indicate bail was set at $15,000 cash only, and threatened not to tell anyone because it would go on the daughter’s permanent record. After hanging up with the threat actors, the target called their daughter to confirm the call’s legitimacy before going to the bank. The daughter revealed she was not on the call or involved in a car accident.

What Should We Do?

• Refrain from answering unexpected calls from unknown contacts.
• When receiving unsolicited phone calls, do not respond to any requests for sensitive information, access, or money.
• If suspicious inquiries are made by individuals claiming to represent a trustworthy organization, hang up and call the organization back using the official phone number found on their website.
• Block and delete unsolicited or suspicious phone numbers received on cell phones and other devices.
• Establish a unique password or passphrase with important contacts, such as loved ones, employers, and coworkers, and request it if suspicious inquiries are made by individuals claiming to represent them.
• Report vishing scams and other malicious cyber activity to the FBI’s IC3 and the NJCCIC.
• If you or someone you know is being physically threatened, then contact the police department or dial 9-1-1 immediately.

Over the last week, the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) received several incident reports from NJ residents regarding an SMS text phishing (SMiShing) scam impersonating the Department of Motor Vehicles (DMV).

These messages claim that the user has an outstanding traffic ticket and payment is due. If not paid by May 29, the user will have their vehicle registration and driving privileges suspended, receive a toll booth charge increase, and their credit score will be impacted. The URL displayed in the message includes “ezpassnj” and “.gov” in an attempt to appear legitimate. The message itself does not allow the user to click the included link directly but instead instructs them to reply to the message with “Y” and reopen the message to click the link or to copy the URL to their browser. These links lead to fraudulent websites that attempt to extract personally identifiable information, financial details, or account credentials.

This SMiShing scheme is similar to others that have circulated impersonating NJ toll services and EZ-Pass claiming the user has an outstanding toll that needs to be paid to avoid a late fee.

• NJ MVC – The NJ MVC only sends text messages to remind residents about scheduled MVC appointments. It does not send text messages regarding driver’s licenses or vehicle registration status.
• New Jersey E-ZPass – NJ E-ZPass does not send unsolicited text messages to collect payments. If your account is in collections and being handled by Credit Collection Services, you may receive text messages from Credit Collection Services regarding your account. Their text message will list a phone number, their website www.ccspayment.com, and reference a file number.