05/04/2020
“We Know Your Password” SCAM
This is an old one that seems to be rearing its ugly head again. The email reveals a password that you are using or may have used in the past. It then says how they have your entire address book and have been monitoring your internet activity, and unless you send them some specified amount of bitcoin, they are going to humiliate you in front of your friends, family and all-over social media. Sound familiar?
I have had several calls from clients about this one in the last week or so. Here are the facts.
1) Yes, they have a password that you used to or still use. Most likely it is a password from long ago or one you have been using for a very long time. People on the “dark web” acquire these passwords from systems that were hacked years ago. You may recall that AOL was compromised once, as was Yahoo. There are many instances where thousands of passwords have been stolen from compromised systems over the years. It is one reason that we are encouraged to change our passwords every so often and to not use the same password for multiple accounts.
2) No, they have not been monitoring you and have nothing on you.
3) They are banking on a couple things.
(1)You are still using that password.
(2)You have been doing inappropriate or embarrassing things on the internet.
Out of the hundreds of thousands of recipients of these emails, they are bound to hit a few that fit the bill.
What should you do?
1) Delete the email.
2) If you are still using that password or some variation of it on any account, change it, and make it unique. Don’t just increment a number.
3) If you happen to be using that password for a bank account it would not hurt to call the bank and ask them to monitor your account, but most likely nothing will happen.
I would also encourage you to explore the use of a password management utility. I use LastPass but know that Dashlane, Zoho and Keeper are good products as well. These programs keep track of your passwords, let you generate random passwords and will auto fill username and password fields on websites and even on apps on your mobile devises. And they are much more secure than letting your browser save your passwords. The idea is that you only need to know one password, and that is the password to unlock your password manager. I actually do not know most of my passwords because they have all been randomly generated for me, but I can get to them easily enough through LastPass.
I hope this information is useful. Stay safe.