Fraudsters use states' COVID-19 lotteries to swipe PII, money

Suzy Colombo received a call from a supposed state agency employee who said she’d won a $10,000 cash prize in a COVID-19 incentive program. To claim the prize, the caller told Suzy that she had to send a $1,000 gift card for an “upfront fee” and provide her banking financial information that the agency would use to deposit the fee and prize. Soon after, she discovered her bank account had a zero balance.

This case is fictional, but according to the Identity Theft Resource Center (ITRC) scammers are indeed posing as government officials to tell victims they’re winners of state lotteries for motivating reluctant citizens to receive COVID-19 vaccinations. Of course, the fraudsters then ask for bank account details, Social Security numbers and other personally identifiable information (PII) to enable identity theft schemes. (See COVID-19 lottery and sweepstakes scams target vaccine recipients, ITRC.)

Several U.S. states offered cash and attractive gift incentives to the vaccine-reluctant.

West Virginia dangled college scholarships, pickup trucks and cash. Minnesota provided state park passes, fishing licenses, and state fair and regional amusement park tickets.

Arkansas proffered over $19 million in cash prizes. New York offered 50 scholarships to those aged 12 to 17 that covered tuition, room and board for four years at any New York public college or university. California provided $116.5 million in incentives, including a grand prize of $15 million to be split among 10 of the state’s vaccinated citizens.

Cybercriminals are pleased with these new opportunities to initiate schemes to rob eager individuals out of their PII. (See States have been offering big prizes for those who are vaccinated. Companies are now doing the same, by Malika Kallingal, CNN Business, May 28, 2021.)

The ITRC provides this advice:

• Be alert for anyone asking for banking and personal information that can lead to financial identity theft.
• Never pay money to receive money especially in a contest, sweepstakes or lottery.
• Check with your state’s department of public health or lottery authority to verify legitimacy.
• Victims can contact the ITRC at (888) 400-5530, or on live chat via idtheftcenter.org.
• Report phishing emails, texts or phone calls to the Federal Trade Commission at ReportFraud.ftc.gov.

Refund and recovery scams

Scam victims often experience long-term trauma. They feel embarrassed and stupid and are uncomfortable to discuss it with family and friends. Many victims keep these dreadful experiences to themselves, which leads to more depression and anxiety. They may be hesitant to report the crimes to law enforcement agencies, which leads to an understatement of fraudulent statistics that private and public agencies compile.

But what’s worse than getting scammed once is getting scammed again. Victims who’ve lost money might believe that it won’t happen again to them. But they need to be alert because they’re probably now on “sucker lists,” which include their addresses, phone numbers and how much money they spent on fake offers. Fraudsters buy, sell and trade these lists on the darknet where other PII is marketed. And they often retarget former victims with refund and recovery scams, which are the worst of all.

• You’ve already been scammed, and your name is on a sucker list. You may have given money to a phony charity, paid for a fake prize or lost money to one of the many other ways scammers try to cheat you.
• The scammer comes calling again by phone, mail or online. The pitch this time is that they’ll get back the money you lost or the prize or merchandise you never got. No problem if you didn’t know you were scammed. The scammer, using the information they bought, can “helpfully” tell you about the earlier fraud. The information helps the scammer sound credible.
• They make you think you can trust them. The scammers may say they’re with a government agency, a consumer advocacy group, a law firm, a charity or some other organization. Some even say they’re with the fake company that took your money, and they’re offering refunds to dissatisfied customers. They may say they’re holding money for you, offer to file complaint paperwork with government agencies on your behalf or claim they can move your name to the top of a list for reimbursement. Whatever they say, it’s a lie, designed to gain your trust — and your money.
• You’re told you need to pay. They may call the upfront money a “retainer fee,” “processing fee,” “administrative charge,” “tax,” “shipment and handling charge” or even a “donation” to a charity they name. Or, they may say they need your checking, debit or other financial account number so they can deposit a refund directly into your account.

How to avoid refund and recovery scams

• Be suspicious if you get a supposed refund check for more money than you lost. Some scammers will say there was an error and tell you to cash the check, keep the amount you’re due and return the balance. It can take weeks for a bank to discover that a check it cleared was a fake. In the meantime, if you use the money, even to return some to the scammer, the bank will want you to repay that money.
• Research any organizations or government agencies that contact you. Search for the name online, with words like “complaint,” “scam” or “review.” Check with your state attorney general to see if other people have complained about the organization.
• Only scammers will tell you to pay by gift card, cryptocurrency or wire transfer through companies like Western Union or Moneygram.

What if you paid a scammer?

• If you paid with a debit or credit card or wire transfer or if the scammer made an unauthorized transfer from your bank account, report the fraudulent transaction to the issuing organization and ask it to reverse the transaction and give your lost money back to you.
• If you paid with a gift card, contact the issuing company and ask for a refund of your money.
• If you sent money through a money transfer app or paid with cryptocurrency, call the related company and ask it to reverse the transfer.
• If you sent money via USPS, contact the U.S. Postal Inspection Service at 877-876-2455 and ask them to intercept the package.
• If you gave a fraudster your Social Security number, go to IdentityTheft.gov to see what steps you should take, including how to monitor your credit.
• If you gave the fraudster your username and password, create stronger ones.
• If the fraudster has remote access to your computer, update your computer’s security software, run a scan and delete anything it identifies as a problem. Then take other steps to protect your personal information.
• If the fraudster took control of your cellphone or account, contact your service provider to take back control of your phone number and change your account password. Also check your credit card, bank, and other financial accounts for unauthorized charges or changes. If you see any, report them to the company or institution. Then go to IdentityTheft.gov to see what steps you should take.

Report the scam and information about the company or scammer to the FTC at ReportFraud.ftc.gov and your state attorney general.

Here to help

Please use information about these scams in your outreach programs and among your family members, friends and co-workers.

I have an outreach program, and you may contact me with any questions on identity theft or cyber-related issues that you need help with or if you’d like me to research a scam and possibly include details in future columns or as feature articles.

I don’t have all the answers, but I’ll do my best to help. I might not get back to you immediately, but I’ll reply. Stay tuned!

Robert E. Holtfreter, Ph.D., CFE, is a distinguished professor of accounting and research at a university in the U.S. Northwest. He’s a member of the Accounting Council for the Gerson Lehrman Group, a research consulting organization and is a member of the White Collar Crime Research Consortium Advisory Council. He’s also on the ACFE’s Advisory Council and the Editorial Advisory Committee. Holtfreter was the recipient of the Hubbard Award for the best Fraud Magazine feature article in 2016. Contact him at doctorh007@gmail.com.