Wyoming Businesses are affected by the Situation in Ukraine:

A Sheridan business reported a fake invoice imitating their human resources system, but it actually came from Croatia. The email had a zipped file for the invoice and the file required a password. CyberWyoming Note: In speaking with our members (technology companies throughout the State), a marked uptick in attempted cyberattacks on Wyoming businesses from IP addresses from Russia and the Netherlands is taking place. One of our members said “The types of attacks haven’t really changed but the volume has significantly increased.”

Scambuster’s Warning about Ukraine Conflict:

Scambuster’s has issued a warning that scams will be coming soon that target Americans. Here are the lines that will likely be used:

1. You may get a phone, text or email from someone you may know saying they are trapped in the war zone and need money to escape.
2. Watch for fake charities that spring up because of the war. (Remember you can validate charities using CharityWatch.org or the IRS’s tax exempt search tool.
3. Watch for fake news in edited videos. For more about deep fakes, check out library.wyo.gov/services/special-programs/wyocan/. The Wyoming State Library published a short 3 part series about deep fakes.
4. Online bridal scams were already bad in Ukraine but will probably get worse.
5. Fake government officials or businesses asking you to help them smuggle money out of the country because of the war.

Norton Email Scam:

If you receive an email from the Norton Team, quickbooks@notification.intuit.com to renew your antivirus software, note that Quickbooks is a different company and Intuit is not listed in Norton’s list of email addresses that they use to contact you. Reported by a Sheridan citizen. CyberWyoming Note: Remember the tip a Sheridan citizen provided last month and check with the real Norton to see if the email is correct: support.norton.com/sp/en/us/home/current/solutions/v71088498

Costco Fake Offer Email:

If you receive an email from “CosTcoReward!” but the email address is really long and not from Costco, a Big Horn citizen wants you to be wary. The email congratulates you on being selected to answer a survey and win $90 worth of Costco rewards. Do not click on the link.

Amazon Kindle Store Email Scam:

You know it is a scam when the Kindle store (which primarily sells books) sends an email about purchasing an expensive laptop. A Sheridan citizen wants you to know that this came from a Gmail address and it was set up to look like a very real Amazon order. CyberWyoming Note: When these look very real with the right branding and are for a high dollar amount, they are designed to make you panic a little to call the number. Take a deep breath and check your actual Amazon account orders page.

Coinbase Support Email Scam:

If you receive a PDF attachment in an email that requires a password (and note that the email conveniently tells you the password) to see a support ticket for Coinbase, note that the sender’s address is actually bosmudamudi3833sampoernamerahini@samanekala.com and not Coinbase at all! CyberWyoming Note: The website Samanekala.com is in a language called Pashto.

Aetna Payment Email Scam:

If you receive an email from AETNA eft, but really from a Gmail address, with an attachment called “Aetna Payment Claim.pdf” don’t open it. The subject line is “AETNA Payment Awaiting Approval.” The PDF looks like a link to a Microsoft shared document. Reported by Laramie citizen.

Authorize.Net Settlement Payment on Hold Email Scam:

Even if a sender’s return address has the word ‘trust’ in it, like this one reported by a Laramie citizen, it may not be trustworthy. This email asks you to login with your Microsoft credentials to authorize your ‘settlement payment.’ But the email is actually from a Gmail address, so don’t believe it.

VRBO Scam Alert:

A Laramie citizen made a reservation for a VRBO for a vacation and was suspicious when the rental owner asked for a copy of the citizen’s driver’s license. The citizen called the VRBO owner directly after looking up the phone number on the rental agreement and ensuring it matched the contact information on VRBO. The rental owner said that someone had rented her house for 2 weeks with a stolen credit card and the local police had instructed her to validate that the driver’s license address matched the credit card address. The rental owner said to use a post it note to cover the driver’s license number and date of birth on the Wyoming driver’s license and then submit it.

You Know it is a Scam When the Subject Line Probably Meant to be Hello but the Scammer Forgot the “O”:

This email was reported by a Laramie citizen who thought it was pretty funny that the scammer sent her an email from “HELL” (yes it was all capitalized). The email came from “Anna Michelle” at dhiraj.btmoversseas@gmail.com and asks you to help develop a charity foundation with $1.4 million.

‍

Please report scams you may experience to phishing@cyberwyoming.org to alert your friends and neighbors.

Other ways to report a scam:

• Better Business Bureau Scam Tracker: bbb.org/scamtracker/us/reportscam
• Wyoming Attorney General’s Office, Consumer Protection 307-777-6397, 800-438-5799 or ag.consumer@wyo.gov
• File a complaint with the Federal Trade Commission at ftccomplaintassistant.gov
• Report your scam to the FBI at www.ic3.gov/complaint
• Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at donotcall.gov/report.html or call 1-888-382-1222, option 3
• Office of the Inspector General: oig.ssa.gov
• AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
• IRS: report email scams impersonating the IRS to phishing@irs.gov
• Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
• Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit www.aarp.org/fraudsupport to learn more about the free program and register