Security tips

“The WhatsApp Wedding Invitation Scam: How to Protect Yourself from Digital Fraud”

Sending wedding invitations is easier than ever. Digital invitations can easily replace traditional paper cards. However, this shift has opened doors for a dangerous trend: the WhatsApp wedding scam. Fraudsters are now using fake wedding invitations to target unsuspecting individuals, and you could be their next victim. In this article, you can get more information about fake wedding invitation scams. How the Fake Wedding Invitation Scam Works Imagine receiving a WhatsApp message from an unknown number. The sender claims to be inviting you to a wedding. The message feels genuine, with friendly language and attachments labeled as wedding cards. Without much thought, you tap on the file to see the invite. However, these attachments are not actual invitations but malicious APK files. Typically, APK or Android Package Kit files are used to install apps on Android devices. If these APK files are corrupted and you download and open them, you may unknowingly grant the scammers access to your device. The digital wedding scam feels personal and believable. Weddings are joyous occasions, and most people wouldn’t suspect foul play. Scammers exploit this trust to trick you into downloading malware. How a Fake Wedding Invitation Scam Can Lead to Financial Losses If you fall victim to this digital wedding scam, you could face financial losses in the following ways: Compromised Sensitive Banking Data: Through malware, cybercriminals can extract banking information you may have saved on your phone. This could include account numbers, card details, passwords to various financial accounts, payment details saved on browsers, and auto-fill credentials. OTP Theft: Scammers can use malware to intercept messages containing OTPs. This way, they can authorize unauthorized payments or money transfers. They can also gain access to your banking and payment apps. Exploiting Payment Apps: Malware can allow scammers to access banking and payment apps. They can use the information stored in the app to steal money from your accounts. Saved card details could be used to make fraudulent transactions. Unauthorized Subscription to Paid Services: Cybercriminals may use your compromised data to subscribe to premium services, apps, or websites. These services might charge recurring fees directly to your Credit or Debit Card. Hence, you ought to check your transaction history regularly to prevent scammers from draining your funds. Account Takeover: By hijacking your financial accounts, scammers can lock you out of your accounts and steal your money. They may also use your account to conduct fraudulent activities. Therefore, you must report this immediately and protect yourself from liabilities. Identity Theft: This digital wedding scam can also put your personal identification details at risk. Scammers can access these details saved on your phone and use them to open new accounts, apply for Credit Cards or loans, or impersonate you to commit fraud. Phishing: Malware can enable scammers to monitor your activities and create opportunities for phishing. This may include sending targeted phishing emails or messages to trick you into sharing more private information. Extortion: Fraudsters can use your data to blackmail you. They can demand ransom in exchange for not leaking sensitive photos and videos. This can lead to not only monetary losses but also emotional distress. How to Spot and Avoid the WhatsApp Wedding Scam By staying cautious, you can avoid falling victim to this fake wedding invitation scam. Here are some simple steps: Be Wary of Unknown Numbers: Be suspicious if you receive a message from a number you don’t recognize. Scammers often target random users, hoping someone will take the bait. Verify the Sender: Before downloading any file, confirm its authenticity. If it’s a wedding invitation, ask the sender directly—preferably through a call or message on another platform. Avoid Downloading APK Files: Typically, you’d receive wedding invitations in the form of images, video files, or URLs as they are convenient. Legitimate wedding invitations don’t require you to download separate apps. Use Antivirus Software: You can keep your phone secure with antivirus apps. These can detect and block malware before it causes harm. Enable Security Features: Review your phone’s permissions from time to time. Make sure your apps can’t access sensitive data without your explicit consent. How Do You Know Your Phone Has Malware? Your phone may be infected with malware if you notice the following: You notice an increased number of pop-ups and inappropriate ads. You see apps you haven’t downloaded or don’t recognize. You may not be able to uninstall unrecognized apps. You notice your phone slows down or crashes often. Your contacts may receive messages that you did not send. You may see unauthorized transactions in your account due to scammers using bank details saved on your phone to subscribe to paid services. What to Do If You’re a Victim Taking prompt action can minimize the damage against this fraud on WhatsApp: Disconnect Your Phone: You must immediately switch off Wi-Fi and mobile data to limit the hacker’s access. Change Your Passwords: Update all important accounts, especially banking, email, and social media, to prevent further misuse. Alert Your Contacts: If scammers are using your WhatsApp account to send fraudulent messages, inform your contacts not to engage. Report the Incident: Don’t let cybercriminals get away. Report the scam to authorities by dialing 1930, the National Cyber Crime portal helpline in India. You can also visit https://cybercrime.gov.in to complain. Protecting Yourself in a Digital World and Stay Vigilant As the use of digital platforms grows, scams like the WhatsApp wedding scam will only become more sophisticated. Staying informed is your best definition. *Disclaimer: Terms and conditions apply. The information provided in this article is generic and for informational purposes only. It is not a substitute for specific advice in your circumstances.

“Gmail’s Holiday Scam Defense: How AI is Keeping Your Inbox Safe”

As the holiday season kicks into full gear, so does a rising wave of email scams. Scammers seize this time of year, using deceptive tactics to trick people into giving away sensitive information or money. Whether it’s fake invoices, celebrity endorsements, or malicious threats, these fraudulent emails are everywhere. If you’re a Gmail user, you’re in luck. Google has ramped up its defenses, fighting back with new, innovative AI technology designed to protect billions of inboxes—especially during this high-risk season. Here’s a look at how Gmail is stepping up its game to combat these scams and what you can do to stay safe in your inbox. Scammers Go into Overdrive This Holiday Season Every year, as the holiday season approaches, email scammers go into overdrive. With billions of emails exchanged daily, especially during sales events like Black Friday and Cyber Monday, the sheer volume of email traffic presents a perfect storm for scammers to launch their attacks. Since mid-November, we’ve seen a massive uptick in suspicious email activity, making it even harder to spot malicious messages. It’s no surprise that scammers are targeting holiday shoppers—whether it’s an urgent invoice, an enticing offer from a “celebrity,” or a threatening message to extort money. The holidays make people feel hurried and vulnerable, making them easy prey for these deceitful tactics. Gmail’s Security Features: Keeping You Safe from Scams As the world’s largest email provider with over 2.5 billion users, Gmail recognizes the responsibility it has in keeping users safe. Over the years, Gmail has invested heavily in security measures to combat spam, phishing, and malware, blocking over 99.9% of these threats before they even reach your inbox. These efforts are especially crucial during the holidays, as the volume of attacks increases. Gmail has seen a 35% decrease in the number of scams reaching users’ inboxes this holiday season compared to last year. This improvement is largely thanks to new AI-powered features rolled out over the past year, which have made Gmail’s defenses stronger than ever. How AI is Transforming Gmail’s Defense Against Scams AI is at the heart of Gmail’s defense against scams, leveraging advanced models to protect users from a wide variety of threats. One such model is a large language model (LLM) that’s been trained to recognize the subtle patterns of phishing, malware, and spam. This AI has made a huge difference, blocking 20% more spam than ever before and reviewing 1,000 times more user-reported spam each day. This means fewer unwanted and potentially dangerous emails slip through the cracks. Additionally, a newly introduced AI model acts like a “supervisor” to help filter out risky messages. By instantly evaluating hundreds of threat signals when a suspicious message is flagged, it deploys protections in the blink of an eye, ensuring quicker and more effective detection of potential scams. Top Scams to Watch Out for This Holiday Season While Gmail’s defenses are stronger than ever, users need to stay vigilant. Scammers are always adapting and trying new tactics. Here are the top three email scams that are making waves this holiday season: Invoice Scams Scammers send fake invoices claiming that you owe money for a product or service. These emails often ask for urgent action, and scammers may even go as far as to convince victims to call and dispute the charges, using that connection to further trick them into making payments. Celebrity Scams Many scams this year feature celebrity names—whether pretending the email is from the celebrity themselves or claiming they endorse a product or service. The goal is to exploit the trust people have in famous personalities to convince them to act on fraudulent offers. Extortion Scams These vicious scams involve threats, such as emails with personal information (like your home address or even a picture of your house). Some of these emails include threats of harm or blackmail, demanding money in exchange for keeping supposedly acquired personal material secret. 4 Simple Tips to Stay Safe This Holiday Season While Gmail’s defenses are incredibly effective, scammers are always evolving. It’s just as important for you to be cautious when handling emails. Here are four simple tips to stay safe: Slow it Down Scams often create a sense of urgency with phrases like “immediate action required” or “deactivate now.” Take a deep breath and think through the message before you act. Spot Check Double-check the details. Does the email make sense? Validate the sender’s email address to ensure it’s legitimate. Scammers often use addresses that seem close to real ones but have small discrepancies. Stop! Don’t Send Legitimate companies or people will never demand immediate payment or personal information through email. If you’re unsure, don’t respond—just delete the message. Report Suspicious Emails If you spot a suspicious email, report it as spam or phishing in Gmail. Doing so not only helps protect you, but it also helps Gmail improve its security defenses for all users. Conclusion: Stay Safe and Secure with Gmail The holiday season may bring festive cheer, but it also brings an uptick in malicious email activity. Gmail’s new AI technology is designed to fight back against these threats, blocking millions of harmful emails before they reach your inbox. However, staying vigilant and following basic email security tips can further ensure that you don’t fall victim to scams. By working together—whether it’s Gmail’s powerful defenses or your awareness—you can keep your inbox secure this holiday season and beyond. Stay safe, stay informed, and report any suspicious emails to help keep the digital world safer for everyone.

How to Protect Yourself Social Engineering Cyber Fraud

The biggest weakness in a cybersecurity strategy is humans, and social engineering takes advantage of a targeted user’s inability to detect an attack. In a social engineering threat, an attacker uses human emotion (usually fear and urgency) to trick the target into acting, such as sending the attacker money, divulging sensitive customer information, or disclosing authentication credentials. What is Social Engineering? Social engineering is the technique where unscrupulous actors manipulate, deceive, or influence an individual into divulging confidential information like personal or financial information. These include bank account information, passwords, transaction history, social security numbers, etc. These techniques can also manipulate individuals into performing specific actions that “help” the fraudster. For example, if someone tells you to download a particular app or software or share an OTP you received. Social engineering, by itself, isn’t an attack. It is the art of using psychological tactics to build trust and then using that information to commit crimes like theft, money laundering, account takeovers, remote takeovers, etc. The Global Impact of Social Engineering Social engineering has become a key element in the landscape of cyber fraud. It has become the primary technique behind many attacks targeting individuals, businesses, and government organizations. A report by the Association of Certified Fraud Examiners (ACFE) revealed that businesses lose up to 5% of their revenue every year due to fraud, and a significant portion of these frauds can be attributed to social engineering tactics. In India alone, the Reserve Bank of India (RBI) reported an alarming increase in fraud, with digital frauds rising by over 700% in recent years. Social engineering is not limited to the financial sector, although that is where the majority of its consequences are felt. Cyber-attacks based on social engineering techniques have far-reaching consequences: In India, bank frauds increased by nearly 300% over the last two years, with a major surge in digital frauds. A LexisNexis survey found that digital channels were responsible for 52% of overall fraud losses across the EMEA region. Social engineering attacks affect both businesses and individuals. Not only do victims suffer financial losses, but they also face emotional distress, feelings of guilt, and a lack of trust. Victims often hold themselves accountable, particularly in lower-income households, where such attacks can have a devastating impact on family dynamics. For businesses, the consequences go beyond financial losses; the erosion of consumer trust and the potential for high customer churn are significant challenges. For instance, the LexisNexis survey highlighted that 96% of companies in the Middle East reported a drop in customer conversion rates after incidents of fraud. Social Engineering Examples Social engineering attacks can take many forms, targeting both individuals and organizations: On an Individual Level: A retired Indian Administrative Service (IAS) officer fell victim to a scam where he was tricked into investing in a fake forex trading scheme. He ended up losing nearly Rs. 1.89 crore to the fraudsters. On a Corporate Level: The CEO of OCBC Bank, Helen Wong, described how her company battled against sophisticated phishing attacks, resulting in fraudulent transfers amounting to millions of dollars. National Security Level: Russian hacking groups have reportedly targeted Ukraine with multiple spear-phishing campaigns aimed at disrupting national security. The ripple effect of social engineering is significant. Victims may unwittingly become money mules, transferring illicit funds to further criminal activities. The emotional toll, combined with the financial impact, can be long-lasting. Common Social Engineering Tactics Fraudsters employ a variety of social engineering tactics to manipulate their victims. Some of the most common methods include: 1. Phishing Phishing is one of the most prevalent social engineering techniques. Fraudsters send fraudulent emails that appear to be from legitimate sources. These emails often contain malicious links designed to: Direct victims to fake websites to steal login credentials. Download malware onto the victim’s device, leading to account takeovers. Phishing is not limited to emails; it also manifests in other forms, such as smishing (SMS phishing) and vishing (voice phishing). In India, where literacy and email usage are lower, vishing is particularly dangerous. 2. Whaling Whaling is a form of phishing that specifically targets high-profile individuals, such as CEOs or other executives. The emails are often meticulously crafted to appear as if they come from trusted sources within the company. The goal is to steal sensitive information or request financial transfers. 3. CEO Scam This scam involves fraudsters impersonating high-level executives of a company, often through email or text messages. Employees of the targeted company may be tricked into following directives from the supposed CEO, such as transferring funds or sharing sensitive data, under the belief that the request is legitimate. 4. Baiting Baiting involves offering something enticing, like free software, services, or rewards, to lure the victim into a trap. The “bait” might include malicious files, which when opened, compromise the victim’s device. Physical baiting involves leaving infected USB drives in public places, hoping someone will pick them up and plug them into a device, unwittingly exposing themselves to cyber threats. 5. Quid Pro Quo This tactic involves offering a service or benefit in exchange for personal or confidential information. For example, attackers may pose as IT support personnel, offering to help resolve technical issues in exchange for login credentials or other sensitive data. 6. Pretexting Pretexting involves creating a fabricated scenario to persuade the victim to share confidential information. This can involve impersonating trusted figures like police officers, bank officials, or colleagues. Over time, attackers build trust with the victim before executing their fraudulent schemes. Who are the Most Likely Targets of Social Engineering? While anyone can fall victim to social engineering attacks, certain groups are more vulnerable: The Elderly: Older adults are often less familiar with digital technologies and cybersecurity practices, making them more susceptible to fraud. Common scams targeting seniors include fake government agent impersonations and investment scams. Young Adults and Teenagers: While they may be more tech-savvy, younger individuals often lack experience and may fail to recognize sophisticated scams, such as fake job offers or lottery wins. Low-Income Individuals:

How to Protect Yourself Against the Growing Threat of AI Voice Cloning Fraud

Synopsis Voice cloning replicates your voice and can mimic the tone, pitch, and style of talking. Fraudsters use voice cloning to scam you into sharing sensitive information like your account details. Creating awareness and being alert can help you steer clear of vice cloning frauds. In recent years, advancements in artificial intelligence (AI) and machine learning have made it possible to replicate voices with stunning accuracy. Voice cloning technology can now replicate the tone, pitch, and style of your voice, even making it indistinguishable from the real thing. While these advancements are beneficial for various industries, they also open the door for potential fraud and scams. Fraudsters use this technology to impersonate others and trick victims into sharing sensitive information like passwords or bank account details. What Is a Voice Cloning Scam? Voice cloning scams involve fraudsters using AI to create a synthetic version of someone’s voice. The technology can accurately mimic not just the words but the unique qualities of a person’s voice, including tone, pitch, and speaking style. Scammers use this technology to impersonate trusted individuals, such as bank officials, family members, or colleagues, to deceive victims into taking harmful actions—like transferring money, sharing personal information, or authorizing transactions. While voice cloning can have legitimate uses in entertainment, education, and customer service, its misuse has led to serious concerns about privacy and security. It’s important to be aware of the risks and take steps to protect yourself. Key Risks of Voice Cloning Fraud Here are some of the primary risks associated with AI voice cloning fraud: Financial Fraud: Scammers can use cloned voices to impersonate bank officials, convincing victims to transfer money or reveal sensitive financial details. Since voice recognition is commonly used for identity verification, a cloned voice can bypass traditional security checks. Identity Theft: Cloned voices can be used to extract personal information, which may then be leveraged to steal someone’s identity. Fraudsters may impersonate you to access personal accounts or make unauthorized purchases. Corporate Espionage: Voice cloning technology can also be misused in corporate environments. Scammers may impersonate executives or employees to steal sensitive corporate information, potentially leading to significant financial or intellectual property losses. Social Engineering Attacks: By mimicking the voice of a trusted individual, scammers can manipulate you into actions you would otherwise avoid, such as disclosing passwords, making payments, or even sharing confidential business information. Protecting Yourself Against AI Voice Cloning Fraud While voice cloning scams are a serious threat, there are steps you can take to protect yourself. It requires a combination of technological solutions, awareness, and personal vigilance. Technological Solutions Voice Biometric Systems: Robust voice biometric systems are designed to detect synthetic voices and distinguish between real and cloned voices. These systems analyze various characteristics, such as speech patterns, rhythm, and tone, to authenticate a speaker’s identity. AI Fraud Detection: AI-driven solutions can identify anomalies in voice patterns and flag potential fraud. These tools use advanced algorithms to recognize subtle differences between a natural voice and a cloned one, helping prevent scams before they occur. Encrypted Communication Channels: Make sure your voice data is protected by encryption. This prevents voice samples from being intercepted and used to create voice clones. Secure communication channels ensure that any voice samples captured are safe from unauthorized access. Multi-Factor Authentication (MFA): Combining voice recognition with additional security measures, like passwords, biometrics, or One-Time Passwords (OTPs), can significantly strengthen security. Relying on voice alone is no longer enough—MFA provides a second layer of protection. Public Awareness and Education Raise Awareness: Public service announcements, workshops, and online resources can help individuals understand the risks of voice cloning. Awareness campaigns can empower people to take action before becoming victims of a scam. Train Employees: Companies, especially those in sensitive sectors, should train employees to recognize and respond to voice cloning attempts. This includes verifying callers and being cautious when handling financial transactions or sensitive data. Verify Caller Identity: Encourage people to always verify the identity of anyone calling, especially when they are asked to share sensitive information. Call the person back using a known phone number or request secondary verification methods before proceeding. Steps You Can Take to Protect Yourself Here are some simple yet effective steps you can follow to safeguard yourself from AI voice cloning fraud: Verify the Caller’s Identity: Always double-check the identity of a caller before sharing any sensitive information. If the caller claims to be someone you know, such as a family member or colleague, call them back on a trusted phone number. Be cautious when receiving unsolicited requests for sensitive information, especially over the phone. Be Mindful of Public Voice Sharing: Avoid posting voice recordings online or sharing them on social media, as these can be used to create clones. Be cautious with voice assistants like Siri or Alexa, which may store your voice data. Enable Multi-Factor Authentication (MFA): Whenever possible, enable MFA on your online accounts. Use a combination of factors—such as passwords, text message codes, and biometric verification—along with voice authentication for better protection. Update and Strengthen Your Passwords: Regularly update your passwords and use strong, unique passwords for each account. Avoid using easily guessable information like your name, birthdate, or common phrases. Monitor Your Bank Statements: Stay vigilant by regularly reviewing your bank statements and transaction histories. Report any suspicious activity immediately to your bank or relevant financial institutions. Stay Informed About New Technologies: Keep yourself updated on the latest developments in voice cloning and AI technology. Understanding how these technologies work can help you recognize potential threats and respond accordingly. Conclusion AI voice cloning offers great potential but also significant risks, especially in fraud and identity theft. Scammers use it to impersonate trusted individuals and trick victims into revealing sensitive information or authorizing transactions. To reduce the risk of falling victim to voice-cloning scams, stay informed and follow protective steps. Be proactive—use technological safeguards, raise awareness, and stay vigilant when sharing sensitive information. Always verify identities and be cautious of unusual requests. If you suspect fraud,

Beware of online sextortion: boys and girls

Online Sextortion occurs when a fraudster threatens to circulate your private and sensitive material online if you do not provide images of a sexual nature, sexual favors, or money. The perpetrator may also threaten to harm your friends or relatives by using information they have obtained from electronic devices unless you comply with their demands. Sextortion is a form of online abuse, wherein the cybercriminal makes use of various channels like instant messaging apps, SMS, online dating apps, social media platforms, porn sites, etc., to lure the users into intimate video/audio chats and makes them pose nude or obtains revealing pictures from them. The fraudsters later make use of this material to harass, embarrass, threaten, exploit, and blackmail the victims. Dangers Abuse and Exploitation Harassment Blackmail Threats of public humiliation Mental distress Modus Operandi The fraudsters try to lure the users into sharing intimate content in different ways posting messages for video/audio chat using fake accounts/profiles creating pages/ad campaigns The users get victimized when they pay for such services and pose nude or in a compromising position in video calls accepts or sends friend requests to the fake account/profile and is involved in intimate interaction posing nude in video chats, sending revealing pictures, etc., The fraudster records video/ takes screenshots/ takes pictures/makes use of revealing pictures/morphs the pictures sent The fraudster starts blackmailing the victim leading to sextortion. The users of porn sites may also fall prey to sextortion when their chats/video calls on porn sites are used for blackmail by fraudsters. Channels used for trapping the victims into sextortion The fraudsters resort to sextortion following the modus operandi given above using various channels like – Messaging apps Dating apps Social media platforms Porn sites etc., Warning signs indicate attempts of sextortion by cybercriminals Repeated untoward messages/video calls from unknown number/s Repeated friend requests from an unknown person Repeated requests for private intimate pictures, video chats, photos Manipulating or redirecting the conversation toward intimate topics Rush through the things and try to develop intimacy Warning signs that may indicate victimization Signs of fear, nervousness, anxiety, depression Isolating self and being very reactive & emotional Feeling desperate and frustrated Having suicidal thoughts and self-harming behavior. Safety tips to protect yourself against online sextortion Never share any compromising images, posts, or videos of yourself with anyone, no matter who they are Remember that the internet never forgets or forgives. If you have shared something once, it will remain present on the Net forever, in one form or the other. Never accept or request friendship from unknown people on social media platforms. Enable privacy and security features on your social media accounts and instant messaging apps. Use the “Report User” option on social media platforms to report any such Do not share your personal/private pictures publicly. Turn off your electronic devices and web cameras when you are not using them. Use two-factor authentication with strong passwords and different passwords for different social media accounts. During an online interaction or chat, if the person on the other side is trying to rush through things and develop intimacy, then it is cause for alarm. Never allow anyone, however close to capture any private part or intimate activity with any device. Such data can be misused at a later stage. Do not accept video calls or open attachments from people you do not know. Save the evidence and the screenshots for referring to the incident later. Do not suffer in silence, know that you are not alone, and reach out and seek help from trusted family and friends. File a complaint against sextortion online or at your nearest cybercrime cell. Remember that you can also anonymously file an online complaint against such an offense on the national cybercrime reporting portal cybercrime.gov.in. Avoid clicking intimate/nude/semi-nude photos/videos on your phone, which if leaked could cause embarrassment. Several rouge mobile apps could access your gallery/storage and can be used to blackmail you. Don’t hesitate to file a complaint or contact the police due to shame, embarrassment, and self-blame. Know what the Law Says about this offense? It is a punishable offense by law and attracts sections 354 (D), 506 / 507, 509 IPC, and 384 IPC, and Sec.67 of the IT Act is also applicable. Offenders in such crimes usually thrive on the victim’s silence and lack of clarity in the law. Hence, everyone needs to be aware of the codes and sections that will help them in such cases. Section 108(1)(i)(a) of the Criminal Procedure Code empowers the victim to call the magistrate of her locality and inform him/her about the person whom she believes could circulate any obscene matter. The magistrate has the power to detain such person(s) and can order him to sign a bond to stop him from circulating the material. This might deter the accused. This is a quick remedial section because the victim can complain to the magistrate without any direct evidence against the accused. Section 292 of the Indian Penal Code (IPC) incriminates any person who distributes or threatens to disperse any intimate and compromising images of someone through any electronic means, including apps and other social media. If a picture of the woman is clicked obscenely without her knowledge and is distributed, a voyeurism case under Section 354C of the IPC can also be filed along with the aid of other relevant sections from the Information Technology Act.

10 the Top News Stories and Cybersecurity of 2024

“Cyber Crime Theory to Practice – A Comprehensive Guide for Law Enforcement. (10)

The ransomware juggernaut rolled inexorably in 2024, yet again, leaving more devastated victims in its wake. This year, the UK’s NHS found itself at the receiving end of some particularly nasty attacks, but there were other high-profile victims as well. Meanwhile, state-backed cyber intrusions from China and Russia continued apace, driven by global geopolitical uncertainty. Many long-running cyber espionage campaigns were exposed. But if 2024 proved one thing only, it was that shining a light on the cyber underworld is working. The British are coming for the bad guys, as new attributions from the National Cyber Security Centre (NCSC), takedowns led by the National Crime Agency (NCA), and proposed legislation highlighting ransomware threats to critical sectors is proving. If 2024 is remembered for anything in the cyber community, it may just be the year in which the good guys took the gloves off and fought back properly. Here are Computer Weekly’s Top 10 Cyber Crime stories of 2024. British Library ransomware attack could cost up to £7m The effects of the British Library ransomware attack at the end of 2023 continued to be felt into 2024 as the venerable institution continued to struggle to bring its crippled systems back online. In January 2024, it emerged that the scale of the ransomware attack was so immense and its effects so devastating, that it could end up costing the British Library up to £7m, dwarfing the £650,000 ransom demand. Later in the year, in a remarkable display of transparency, the British Library’s leadership published a detailed breakdown of their experience at the hands of the Rhysida ransomware crew, to help others learn and understand. SolarWinds hackers attack Microsoft in apparent recon mission Also in January, Cosy Bear, the Russia-backed hacking outfit behind the SolarWinds Sunburst incident, was back in action, breaking into Microsoft’s systems with a brute force, password spraying attack and from there accessing corporate accounts belonging to leadership and security employees. Microsoft is one of some suppliers that finds itself at the receiving end of such intrusions, thanks in part to its global reach and scale, and its in-depth relationships with Western governments, and has faced tough questions over its security posture in recent years as a result. Lock Bit locked out in NCA-led takedown One of the biggest stories of the year unfolded dramatically on a dull February day when the infamous Lock Bit ransomware gang was taken down and its infrastructure hacked and compromised in Operation Cronos, led by the UK’s National Crime Agency (NCA). In the immediate aftermath of the takedown, Computer Weekly took the temperature of the security community, finding upbeat sentiment, but also tempered by the knowledge that one swallow does not make a summer. Throughout the year, the NCA has been sharing a trove of information it gathered during the exercise, as well as taking time to mock and troll Lock Bit’s leader since named as Dmitry Khoroshev, who at one time boasted of his luxury lifestyle as he toyed with law enforcement. Mandiant formally pins Sandworm cyber-attacks on APT44 group In April, threat intel leaders Mandiant formally “upgraded” the malicious activity cluster known as Sandworm to a full-blown, standalone advanced persistent threat (APT) actor to be tracked as APT44 – other companies have different taxonomies, Mandiant’s is alphanumeric. APT44 is run out of Russia’s Main Intelligence Directorate (GRU) within Unit 74455 of the Main Centre for Special Technologies (GTsST) and is described as one of the most brazen threat actors around. Although it confines its activities to those in service of the Russian state rather than financially motivated criminality, the links between cybercrime and cyber espionage continued to blur during 2024, with some nation-state APTs even acting as initial access brokers (IABs) for ransomware gangs. NHS services at major London hospitals disrupted by cyber attack In early June, a major cyber-attack on Synovia, a pathology lab services provider that works with Guys and St Thomas’ and King’s College hospitals in London, as well as other NHS sites in the nation’s capital, was laid low by a Qulin ransomware attack. This intrusion resulted in a major incident being declared in the NHS, with patient appointments and surgeries cancelled, and blood supplies running dangerously low. The ramifications of this truly callous cyber-attack are still being felt six months on. UK Cyber Bill teases mandatory ransomware reporting All eyes were on Westminster in July for the first King’s Speech held under a Labour government in over a decade, and for the security community, there was plenty to pick over as Keir Starmer’s administration proposed implementing compulsory cyber incident reporting – including ransomware – for operators of critical national infrastructure (CNI), in a new Cyber Security and Resilience Bill. According to the government, the law will expand the remit of existing regulation give regulators a more solid footing when it comes to protecting digital services and supply chains, and improve reporting requirements to help build a better picture of cyber threats. The Bill will likely be introduced to Parliament in 2025. NCSC and allies call out Russia’s Unit 29155 over cyber-warfare In September, the UK and its Five Eyes allies joined forces with the European Union (EU) and Ukrainian cyber authorities to highlight a dastardly campaign of cyber espionage conducted by Unit 29155, another Russian APT. Unit 29155 targets victims to collect information for espionage purposes, sabotages websites and daily operational capabilities and tries to cause reputational damages by selectively leaking important data. It has conducted thousands of exercises across NATO and the EU with a notable focus on CNI, government, financial services, transport, energy, and healthcare. It is also particularly notable for its involvement in the Whisper Gate campaign of destructive malware attacks against Ukraine in advance of the 2022 invasion. Money transfer firm MoneyGram rushes to contain cyber attack US-based financial services and money transfer outfit MoneyGram was another high-profile cyber attack victim to emerge in 2024, with its systems taken down in an apparent ransomware attack in September 2024. MoneyGram’s customers in the

Protect Yourself from Cybercrime in 2025

In 2025, cybercrime has become more complex, with new threats like AI-driven attacks, IoT vulnerabilities, and advanced ransomware emerging. To stay safe, it’s crucial to use strong passwords, multi-factor authentication, and encryption. As technology continues to evolve, balancing security with innovation is key to protecting ourselves. Introduction Welcome to the not-so-distant future: the year 2025. By now, we’ve seen an explosion of digital transformation across every industry and sector. The convenience of online services has grown significantly, but so have the risks. Cybercrime in 2025 has reached unprecedented levels of complexity and scale. Hackers are more cunning, and new forms of cyberattacks are emerging faster than ever. Are you ready for what’s coming your way? In this article, we’re about to unpack the ever-shifting world of cybercrime, focusing on the trends, threats, and solutions that define 2025. We’ll journey through the evolution of hacking, dive into the scariest new tactics criminals are using, and explore what governments and individuals can do to keep themselves safe. Ready to peer into the digital crystal ball? Let’s get started. The Evolution of Cybercrime The world of cybercrime is like a twisted carnival, morphing its attractions and illusions year by year. Oldies ransomware to hang on with the newbie Digital arrest and AI-enabled Deepfakes. Understanding how we got here is critical if we want to predict where we might end up next. Early Hackers In the earliest days of computing, hacking was more like an intellectual sport for tech enthusiasts. They broke into systems to show off their skills and explore the hidden corners of the digital realm. Think of these early hackers as curious adventurers rather than criminal masterminds. Over time, however, the novelty wore off, and malicious intent began to take shape. The “harmless” pranks of the past gradually paved the way for more nefarious schemes that now have global consequences. 2020s: A Decade of Transformation The 2020s were a turning point in cybercrime. Smartphones, social media, and cloud computing have become ubiquitous. Remote work soared in popularity, and digital communication replaced face-to-face encounters. With these changes, criminals found an open invitation to exploit human error and poor security practices. Suddenly, huge data breaches became the norm rather than the exception, and ransoms were demanded in Bitcoin rather than unmarked bills. By the time 2025 rolled around, hackers had upped their game with sophisticated toolkits, AI-driven attacks, and specialized criminal networks that span the globe. Emerging Threats in 2025 So, what do cyber threats look like in 2025? The short answer: sharper, smarter, and far more disruptive. Cybercriminals leverage cutting-edge technology and exploit societal trends, causing havoc for both individuals and organizations. AI-Powered Attacks Remember when we used AI mainly for chatbots and Netflix recommendations? Those days feel distant. In 2025, AI is a double-edged sword. On one hand, legitimate businesses use it to automate tasks and enhance customer experiences. On the other hand, cybercriminals deploy AI to conduct highly targeted attacks. Thanks to machine learning algorithms, phishing emails are more convincing, malware adapts in real-time, and intrusion attempts remain persistent yet stealthy. AI helps hackers automate reconnaissance, profile their victims in astonishing detail, and dynamically modify their strategies. It’s akin to battling an ever-evolving virus that learns from every defensive move you make. IoT Vulnerabilities Our world is packed with interconnected devices, from smart TVs and refrigerators to entire factories wired with sensors. While the Internet of Things (IoT) makes life more convenient, it also expands the potential attack surface exponentially. A single vulnerability in a connected device can provide a backdoor into the broader network, compromising everything from personal data to critical infrastructure. In 2025, criminals exploit IoT devices to orchestrate vast botnets, carry out data exfiltration, or even sabotage critical services. It’s like having a million tiny, unguarded windows in your digital fortress. Ransomware 3.0 Say goodbye to the days when ransomware simply locked your files. In 2025, criminals go beyond encryption. They threaten to publicly leak sensitive data, sabotage critical cloud systems, or even manipulate files in real-time, confusing what’s genuine and what’s corrupted. Some are calling this Ransomware 3.0—a vicious trifecta of encryption, public exposure, and data tampering. Victims face the ultimate dilemma: pay up or risk catastrophic damage to personal finances, reputations, or entire business operations. Cryptocurrency Heists With cryptocurrencies dominating the global financial landscape, it’s no surprise they remain a major magnet for cybercriminals. Far from being just about Bitcoin, a plethora of digital tokens are now in circulation. Criminals use sophisticated exploits to steal private keys, manipulate smart contracts, or hack crypto exchanges. This is the Wild West of the financial world, where the digital gold rush meets digital banditry. By 2025, we’re seeing elaborate networks of hackers targeting high-value wallets and decentralized finance (DeFi) platforms, leaving victims on shaky ground in a market famous for its volatility. Impact on Individuals You might be thinking, “I’m just an average person. Why would cybercriminals target me?” The truth is, in 2025, no one flies under the radar. It’s not just the wealthy or the high-profile individuals who face risks—everyone is a potential target. Identity theft remains rampant, with criminals siphoning off personal details to open lines of credit or commit fraud. Social media profiles become treasure troves for information, allowing hackers to guess security questions or craft hyper-targeted phishing attacks. Moreover, personal devices—phones, tablets, wearables—are more integrated into daily life than ever. A single click on a malicious link can give a cybercriminal access to personal photographs, financial accounts, and private communications. It’s like handing a stranger the keys to your home. The digital age has made everyday life easier, but it also requires us all to stay on guard. Corporate and Institutional Risks It’s not just individuals at risk. Large corporations and institutions are prime targets in 2025’s cybercrime arena because the payoff can be enormous. When a hacker gains access to a corporate network, the loot can include proprietary data, customer information, and massive financial sums. The result? Ransom demands can reach

“SIM Swap Scams: A Growing Danger to Your Online Security”

“Cyber Crime Theory to Practice – A Comprehensive Guide for Law Enforcement. (2)

In today’s digital world, smartphones are not just tools for communication—they hold the keys to our personal information, finances, and online identities. Unfortunately, this also makes them targets for fraudsters. One of the most dangerous types of fraud is SIM swapping—a scam that can leave you vulnerable to identity theft, account takeovers, and financial loss. What is SIM Swap Fraud? A SIM swap scam, also known as SIM hijacking, occurs when a fraudster transfers your phone number from your legitimate SIM card to one they control. Once they have access to your number, they can intercept texts, calls, and, most importantly, One-Time Passcodes (OTPs) used for securing your accounts. This means that if your bank or social media account sends a 2FA code via SMS, the scammer can intercept it and take control of your accounts. In 2021, SIM swap scams cost victims an astonishing $68 million, with over 1,600 complaints in the US alone in 2022. And this threat is not limited to the United States—it is a global problem that continues to grow as more people rely on mobile devices for securing their digital lives. How SIM Swap Scams Work To pull off a SIM swap, fraudsters need to gather personal information about you. They usually do this through social engineering, phishing, or data breaches. Social Engineering: Scammers manipulate victims into revealing sensitive personal information, often by pretending to be customer service representatives from a mobile carrier. They may call, email, or message you, asking for account details. Phishing: This type of scam involves sending fake emails or messages that look like they’re from trusted sources, such as your bank or phone provider. These messages often include malicious links or requests for personal details. Data Breaches: When organizations experience data breaches, personal information—like your name, address, and phone number—can end up in the hands of criminals. Scammers can use this stolen information to impersonate you when attempting a SIM swap. Once the fraudster has gathered enough personal data, they contact your mobile network provider, pretending to be you. They claim they’ve lost their phone or need a new SIM, and provide the stolen information to convince the carrier to transfer your phone number to a new SIM card. After the transfer is complete, the scammer has full control over your phone number. The Dangers of SIM Swap Fraud SIM swapping can lead to devastating consequences. The main risk comes from Two-Factor Authentication (2FA), which is used by most online services to protect your accounts. Many services send a one-time passcode (OTP) to your phone number when logging in, and if a fraudster has hijacked your phone number, they can intercept these OTPs and access your accounts. Once a fraudster has access to your phone number, they can: Access your online banking accounts by resetting your password with the OTP. Take over your social media profiles and cause reputational damage or blackmail. Steal your personal information and use it for identity theft. Given that so many services now rely on SMS-based 2FA, the risk of SIM swapping is more dangerous than ever. The FBI reported that SIM swapping scams resulted in a loss of $12 million between 2018 and 2020. How to Protect Yourself from SIM Swap Scams There are several steps you can take to protect yourself from SIM swap fraud: Enable Stronger 2FA Methods: Where possible, use app-based 2FA (like Google Authenticator or Authy) instead of SMS-based 2FA. These apps are harder to hijack because they don’t rely on your phone number. Use a PIN or Password with Your Carrier: Many mobile carriers allow you to set a PIN or password on your account. This adds an extra layer of security and makes it harder for fraudsters to convince your carrier to transfer your number. Monitor Your Accounts: Regularly check your bank accounts, email, and social media for unusual activity. If you notice something suspicious, report it to the service provider immediately. Be Careful with Personal Information: Avoid sharing sensitive details like your full name, date of birth, or address on social media or public forums. Scammers often use this information to gather the data they need for SIM swaps. Notify Your Carrier if You Suspect Fraud: If you think your phone number has been hijacked, call your mobile carrier immediately. They can lock your account to prevent further damage. eSIM Technology: A Step Toward Better Security? One promising development in mobile security is the rise of eSIM technology. Unlike traditional SIM cards, eSIMs are embedded directly into the device and don’t require a physical SIM card. This makes them harder for fraudsters to manipulate and swap out. Advantages of eSIMs: Convenience: No need to physically swap SIM cards when changing carriers. Increased Security: Since eSIMs are harder to tamper with, they make it more difficult for fraudsters to carry out SIM swap attacks. Space-saving: eSIMs free up space in devices, allowing for slimmer, lighter designs. Though not yet widespread, eSIMs are an exciting development that could significantly reduce the risk of SIM swap fraud in the future. SIM Swap vs. Porting Attacks You might hear the terms SIM swapping and porting attacks used interchangeably, but they refer to different methods of fraud. SIM Swapping: This is when fraudsters hijack your phone number and transfer it to a new SIM card that they control. Porting: Porting involves transferring your phone number to a different mobile provider. While porting doesn’t require the fraudster to physically swap your SIM card, it can still result in account takeovers. Both SIM swapping and porting attacks are methods used by fraudsters to gain access to sensitive accounts, and they are often the first step in account takeover fraud. How Does SIM Swapping Lead to Account Takeovers? Fraudsters don’t just want to hijack your phone number—they want access to your online accounts. Here’s how it works: Once the fraudster has your phone number, they can reset passwords for your bank accounts, social media profiles, and email accounts. Most online services use two-factor

How to Protect Yourself from Unified Payments Interface (UPI) Frauds

In India, UPI (Unified Payments Interface) has become the go-to method for digital transactions, but with this rise in usage, UPI frauds are also increasing. Over 95,000 UPI fraud cases were reported in the 2022-23 financial year. Understanding how these scams work is your first step toward staying safe. Here’s everything you need to know about UPI frauds and how to protect yourself from falling victim to them. UPI (Unified Payments Interface) was launched on April 11, 2016, by the National Payments Corporation of India (NPCI). It was introduced to make digital payments easier and faster in India. Key figures in its creation included Dr. Raghuram Rajan, the RBI Governor at the time, and Nandan Nilekani, former chairman of UIDAI. Multiple UPI payment app’s Google Pay is a widely used app that offers seamless UPI payments and integration with multiple banks: – Phone Pay – One of the leading UPI apps with features like bill payments, recharges, and money transfers. Paytm – Known for various services beyond UPI, such as mobile recharges, shopping, and financial products. Amazon Pay – Amazon’s payment platform also supports UPI for easy transactions. BHIM (Bharat Interface for Money) – An app developed by the Indian government to promote UPI adoption, specifically aimed at simplifying digital payments. Know About UPI Fraud? UPI fraud happens when someone tries to trick you into revealing your UPI PIN or personal information, so they can steal money from your bank account. Fraudsters use a variety of tricks to gain access to your UPI details and carry out unauthorized transactions. Multiple Types of UPI Frauds Vishing (Voice Phishing) Vishing (Voice Phishing) is when scammers trick people over the phone to steal personal information, like bank details or passwords. The scammer might pretend to be someone trustworthy, like a bank employee or a government official, and try to get you to share sensitive information. For example, they might call you saying there’s an issue with your bank account and ask for your account number, or claim they need to fix a problem with your computer and ask for remote access. Always be cautious about unsolicited calls and never give out personal details over the phone unless you’re sure of the caller’s identity. Fake UPI Payments or Transfers Fake UPI payments refer to scams that fraudsters use to trick people into believing that they have received money or manipulate them into transferring money. Scammers use fake payment links, screenshots, and misleading payment requests to steal money. The fake UPI payment is a concern for UPI users. Fake UPI QR Codes Fraudsters create fake QR codes that lead to phishing sites or malicious apps. When you scan these codes, they steal your UPI details. Impersonation Scammers pose as bank staff or customer service agents to trick you into sharing your OTP or UPI PIN. The penalty for identity theft is imprisonment for up to three years and a fine of up to one lakh rupees. Impersonation: Impersonation is an offence under Section 416 of the IPC. Fraud Sellers Seller fraud happens when a seller tricks or deceives a buyer to make money unfairly. This could include things like: Taking payment but not delivering the product. Selling fake or damaged items while claiming they’re real or in good condition. Providing false or misleading information about the product to get a sale. Screen Monitoring Apps Some scammers use apps that secretly monitor your screen to capture sensitive information like your UPI PIN or OTP. They’re often used by parents to monitor kids, employers to watch employees, or for security purposes. They can capture screenshots, track apps, and even log keystrokes. SIM Cloning SIM cloning is when someone makes an exact copy of another person’s SIM card. A SIM card is a small chip in your phone that stores important information, like your phone number and contacts. Cloning a SIM card means creating a duplicate of that information, so someone else can use your phone number and access your calls, texts, and other services, usually without your permission. It’s a form of identity theft or fraud, and it can lead to privacy violations or financial loss. Malware Malware is short for “malicious software.” It’s a type of harmful software designed to damage, disrupt, or steal information from your computer, phone, or other devices. Think of it like a virus or a sneaky bug that gets into your device without you knowing and causes problems. Malware can steal your data, like passwords or credit card numbers, or it can slow down your device and make it stop working properly. Money Mule A “money mule” is someone who is used by criminals to transfer stolen money or illegal funds. In simple terms, it’s like being a middleman who helps criminals move money, often without knowing that it’s illegal. Here’s how it works: A criminal might trick someone into accepting money in their bank account or through other methods, then ask them to send that money to someone else, often overseas. The person doing this is called a “money mule.” They might think they are helping with a legitimate job or transaction, but in reality, they are unknowingly part of a crime. Deceiving UPI Handles “Deceiving UPI handles” refers to fake UPI (Unified Payments Interface) IDs that are designed to trick people into sending money to the wrong account. In simple terms, scammers create UPI IDs that look very similar to the ones of trusted people or organizations, like a friend or a well-known business. When someone tries to send money to the correct person, they accidentally send it to the scammer’s fake account instead. So, “deceiving UPI handles” are essentially fake payment IDs that are made to deceive and steal money from people. Collect Request Fraud “Collect Request Fraud” is a type of scam where a fraudster tricks someone into paying money by sending them a “collect request” through a payment platform, like UPI or other apps. Here’s how it works: The scammer sends

Duplicate SIM Card Fraud: Protect Yourself from Cyber Scams

SIM Card Misuse, & How to Stay Safe from Duplicate SIM Fraud in India. Duplicate SIM card fraud is one of the most alarming cybercrimes in India today, allowing scammers to gain unauthorized access to sensitive information such as OTPs, banking credentials, and personal data. This crime often leads to financial loss and identity theft. Despite stringent guidelines from the Telecom Regulatory Authority of India (TRAI), fraudsters exploit loopholes to issue duplicate SIM cards using stolen identities or forged documents. we’ll explore how this fraud occurs, TRAI’s rules to prevent it, and how you can stay safe. How Does Duplicate SIM Fraud Happen?