“I know where you live!”: the latest sextortion scam exposed
Written by Amanda Lee (Senior Program Manager, Tech for Good & TELUS Wise ®) In September, the Internet was abuzz again with reports of the latest sextortion scam email making the rounds. Now known as the “Hello Pervert” email, it followed the typical formula of a sextortion email, except for one new and very scary tactic – a photo of the recipient’s home! Hackers are getting smarter and more menacing, so we have to be on our digital security game to stay protected. It’s important to understand how to identify scam emails, what do you do if you get one and proactive measures you can take to stay secure. A typical sextortion scam Typical sextortion scam emails intimidate victims to pay a certain sum (using Bitcoin or some other non-trackable digital currency). If they don’t pay, the hacker threatens to expose “deviant” behaviour to all their personal contacts. That follows the typical formula of a sextortion scam. Here’s how to identify it if you ever receive the same type of email: The email seems legitimate because it appears to come from your own email address (spoofing) and may reference your personal information (name, address, email, phone number, username and/or a password you may have used in the past) There is a threatening and urgent tone to the email (you better pay or else; you have 24 hours to pay) The hacker informs you they have taken over your devices remotely They have recorded “compromising” video and images of you and have your browsing history They will share these images/videos with your family, friends and other contacts to humiliate you and ruin your reputation When they receive the money from you, they will wipe their stored files Taking intimidation to the next level There is a wealth of information available on the dark web from data breaches (if you’ve never done a dark web scan, you would be shocked about what you find). And hackers mine it to use as much personal information as possible to try to fool you into giving them money. In the Hello Pervert scam, hackers added two new elements of threat and intimidation: They insisted they had used Pegasus spyware to commandeer recipients’ devices (Pegasus got a lot of media hype but was sold primarily to governments for high level surveillance) They included a photo of the recipients’ homes from the outside It’s fairly easy to find someone’s address online, and once hackers have it, they use location mapping technologies like Google Maps to capture an image of that person’s home and street. How to protect yourself How can you fight against this new intimidation tactic? According to Forbes, you can blur your house on Google Maps Street View to protect your property and yourself by following these steps: Search for your home address in Google Maps Click on your home on the Street View sidebar to go to the full street view page Find your house and click on the image If the property and address information are correct, click on the three dots and select report A new form will pop up with a view focused on the property you are reporting You can then request Google to blur that property If you receive the Hello Pervert email or any scam/sextortion emails like it, there are important actions to take: Specific to the email: Do not respond or engage with the hacker under any circumstance Resist the urge to pay, no matter what Document the scam email with screenshots Report the email to local law enforcement and The Canadian Anti-Fraud Centre For your general online protection: Do a dark web scan to see how much of your personal information has been compromised in data breaches (TELUS Online Security offers this service) Keep up to date on your password hygiene – use a strong password, change passwords often and use a secure password manager Conduct regular virus and malware scans on your computer and devices Review and adjust your privacy settings across all your devices and apps to proactively maximize your online protection The reality of life today is that hackers are gonna hack. It’s an unfortunate but inevitable part of our digital existence. It’s important to educate yourself on the latest scams and intimidation tactics, so you can identify them if they pop up in your inbox. In addition to awareness, there are proactive steps you can take to protect your personal information and devices from compromise. By combining awareness with action, you can create a safer digital environment for yourself and your family. FR versionUnderstanding SIM Swap fraud and how to protect yourself
Written by Amanda Lee (Senior Program Manager, Tech For Good & TELUS Wise®) Your phone number is worth more than you think, and fraudsters know it. Our mobile phone numbers have become more valuable than ever, not just for communication, but as a gateway to our most sensitive accounts. This makes them a prime target for cybercriminals using a sophisticated scam known as SIM swap fraud. If you've never heard of it, it's time to learn, because this attack could compromise your banking, email, and social media accounts in minutes. What Is SIM swap fraud? A SIM swap (Subscriber Identity Module swap) occurs when a fraudster convinces your mobile provider to transfer your mobile phone number to a new SIM card that they control. Once they have your number, they can intercept text messages and calls meant for you, including the two-factor authentication codes that protect your most important accounts. Here's how it typically works A scammer gathers personal information about you through social engineering, data breaches, or public sources. They then contact your mobile carrier, posing as you, and request a SIM swap. They might claim they've lost their phone, upgraded their device, or switched carriers. If the provider's representative doesn't verify their identity properly, the swap is approved. Within minutes, the fraudster has access to your mobile phone number and can reset passwords, drain bank accounts, even steal cryptocurrency. Why SIM swap fraud is so dangerous Unlike other cybercrimes, SIM swap fraud bypasses many of the security measures we rely on. Two-factor authentication via SMS, which millions of people use to protect their accounts, becomes useless when a fraudster controls your phone number. Banks, email providers, and social media platforms often use text message verification as their primary security layer, making it a critical vulnerability. The consequences can be devastating. In June 2023, Toronto Police Service arrested 10 people and laid 108 charges in Project Disrupt, a major SIM swap fraud investigation. The combined losses to individual victims, telecom companies, and financial institutions exceeded $1 million. Even more alarming, one of the largest thefts in Canadian history involved a teenager who stole $48 million from a single person in a single day using SIM swap fraud. Beyond these headline cases, countless victims have been impacted by account takeovers, identity theft, and cryptocurrency theft. The emotional toll of having your digital identity compromised can be significant. How to identify SIM swap fraud The warning signs of a SIM swap attack are often subtle but noticeable: Sudden loss of service: your phone suddenly loses signal, and you can't make calls or send texts, even though your carrier shows no outages in your area. Unexpected password reset confirmations: you receive emails confirming password changes you didn't make. Missing two-factor authentication codes: when trying to log into accounts, you don't receive the SMS codes you're expecting. Unfamiliar account activity: you notice unauthorized transactions or changes to your accounts. Provider notifications: your provider sends alerts about SIM changes or account modifications you didn't authorize. If you experience any of these signs, act immediately. Protecting yourself from SIM swap fraud Add a PIN or password to your account: this creates an extra barrier that prevents fraudsters from making changes without your knowledge. Make sure your PIN is unique and not easily guessable. Use authenticator apps instead of SMS: whenever possible, enable two-factor authentication using authenticator apps like Google Authenticator, or Microsoft Authenticator. These apps generate codes on your device that can't be intercepted via SIM swap. Secure your email: your email is the master key to your digital life. Protect it with a strong, unique password and enable two-factor authentication using an authenticator app. Never use SMS-only verification for your email account. Be cautious with personal information: limit the personal information you share online. Scammers use details like your mother's maiden name, address, or date of birth to impersonate you with providers. Review your social media privacy settings and be wary of oversharing. Monitor your accounts regularly: Check your bank, email, and social media accounts frequently for unauthorized activity. Set up account alerts with your financial institutions to notify you of suspicious transactions. Additionally, consider using TELUS Online Security to monitor for threats, which will alert you if your personal information appears on the dark web or if suspicious activity is detected in your financial or social accounts. Use strong, unique passwords: ensure all your important accounts have strong passwords that are different from one another. Consider using a password manager to keep track of them securely. Stay informed about your provider: know your provider's security policies and contact information. If you suspect fraud, call the provider directly using the number on your bill, not a number from a search result, which could be fake. What to do if you're a victim If you believe you've been targeted by SIM swap fraud: Contact your provider immediately and report the unauthorized SIM swap Change all your passwords from a secure device Alert your bank and financial institutions File a report with the Canadian Anti Fraud Centre and your local police Monitor your credit and consider placing a fraud alert with credit bureaus SIM swap fraud is a serious threat, but awareness and proactive security measures can significantly reduce your risk. By taking these steps today, you can protect your digital identity and keep your accounts secure. Your safety matters to us. Because scammers never stop, we're dedicated to providing you with information on the latest tactics used by them so that you can stay informed. For more on various scams and how to protect yourself, explore these other articles: Call Related Scams Brand Impersonation Scams Digital/Online Scams Identity Theft
