Beware of social media takeovers and compromised credit reports

Aaron Johnson recently tried to get into his Instagram account but found out it was locked. He called his brother, Jake, for help. Jake asked if Aaron had recently received an email from a “friend” who needed help getting back into their Instagram account. Aaron said he did, and he’d also clicked on a link sent to him. Lights out! A fraudster, who was no friend, had hacked into Aaron’s Instagram account to try to steal his personally identifiable information (PII).

This case is fictional but represents a common example of a recent social media account hack and takeover scam. The Identity Theft Resource Center (ITRC) says fraudsters are increasingly taking over Facebook and Instagram accounts to steal PII for identity theft crimes. The ITRC reported that it had received 320 inquiries about the scam in 2021, but that number had skyrocketed to nearly 500 through the first quarter of 2022. (See “ITRC: Identity Criminals Add New Twist to Facebook & Instagram Account Hack Scams: Pose as ‘Friends’ of the Victim,” Identity Theft Resource Center, April 4, 2022.)

In the past, fraudsters used bitcoin scams to hack into the social media accounts of victims, but recently they’ve been sending email messages masquerading as “friends” of victims to proliferate the scam.

Hacked accounts are a valuable commodity. Fraudsters can buy Instagram accounts for $45 each on the dark web, according to PRIVACY Affairs’ Dark Web Price Index 2021. Compare that with the going price of $2 for a Social Security number, according to the index. It’s no surprise that the social media hack and takeover scam accelerated in the first months of 2022. No doubt, the trend will continue.

The ITRC provides advice to help reduce the risk of becoming a victim of this scam:

• Never click on any links sent to you until you verify a message’s validity. If a friend supposedly sends you a message that contains a link, attachment or file, reach out to the friend directly to make sure they sent you the message. It could be malicious material that locks you out of your account.
• Never share your PII with anyone. Scammers try to play on our emotions and want to build trust with us so we’ll hand over our PII. Of course, never share passwords, PINs, codes or any other type of sensitive information.
• Use two-factor authentication (2FA) and a strong and unique password on your account. A 12+ character unique passphrase and 2FA on your account provides added layers of security and protection to keep criminals out.

If you believe your Instagram account has been hacked, the ITRC recommends to:

1. Check your email account for a message from Instagram.
2. Request a login link from Instagram.
3. Request a security code or support from Instagram.

If your Facebook account was hacked, the ITRC Help Center is able to help you recover your account. Also contact the ITRC at 1-888-400-5530 to speak with an advisor. As always, contact the Federal Trade Commission (FTC) at ftc.gov and your local media outlets to report the scam.

Check your credit report for fraudulent activity

When you borrow money for a vehicle or a house, creditors will check your credit report to see if you’re a good risk. Of course, timely loan repayments will increase your credit score.

But unscrupulous outsiders can seriously compromise credit scores by creating unsolicited transactions. For example, a fraudster can steal your PII and use your identity to obtain a loan or new credit card. The fraudster defaults on the payment of a balance due, the victim organization reports it to the credit agencies and your credit score is compromised — all without your knowledge until you apply for preapproval on a loan.

So, periodically check your credit reports to find any errors and, if necessary, begin the process of restoring your credit score and identity.

According to the FTC, everyone in the U.S. can obtain a free credit report each week from all three nationwide credit bureaus, Equifax, Experian and TransUnion. [See “Give yourself some credit (reports),” by Seena Gressin, FTC, April 25, 2022.]

Here are steps the FTC offers to expedite the process:

• Order your free credit reports. Go to AnnualCreditReport.com or call 877-322-8228.
• Read the reports carefully. Do you recognize the accounts? Do they list applications? Did you apply for credit at those places? Check your PII. Are your name, address and Social Security number correct?
• Dispute mistakes. Contact the credit bureaus and the businesses that reported the information. Ask both to correct their records. Include as much detail as possible, plus copies of supporting documents, like payment records. (See the FTC’s sample letters disputing errors on credit reports and disputing errors on credit reports to the business that supplied the information.)

Report the theft of your identity to the FTC and begin a recovery plan at IdentityTheft.gov. The agency will help you produce a sworn identity theft report to clear your name and your credit reports.

Also, fraudulent “credit repair” companies are taking advantage of those who are dealing with compromised credit reports and attempting to restore their credit scores. These fraudsters create schemes that tell potential victims that they can “repair” their credit scores. Victims lose hundreds and even thousands of dollars. Double whammy!

The FTC reported on May 6, 2022, that a federal court temporarily shut down a fraudulent credit repair scheme known as The Credit Game for promoting deceptions. The agency alleged that the operators of the scheme, Michael and Valerie Rando of Florida, not only deceived credit agencies about information on consumer credit reports but also fleeced victims out of hundreds and thousands of dollars for credit repair services of little to no value.

The defendants allegedly also took advantage of the ongoing pandemic by telling consumers to “invest” pandemic tax benefits into their credit repair schemes. The FTC reported that, since 2019, the defendants allegedly accumulated more than $15 million in their fraudulent activities. (See “FTC Acts to Shut Down ‘The Credit Game’ for Running a Bogus Credit Repair Scheme that Fleeced Consumers,” FTC, May 6, 2022.)

The FTC’s complaint alleged that the defendants’ deceptive tactics violated the FTC Act, the Credit Repair Organizations Act, the Business Opportunity Rule, the Telemarketing Sales Rule and the COVID-19 Consumer Protection Act. The defendants’ tactics included:

• Deceptive marketing: The defendants misled consumers in numerous ways, including lying to consumers about whether their products were legal and effective, and whether they could receive refunds when they requested them.
• Credit piggybacking: In a piggybacking scheme, a consumer seeking to raise their credit score pays to be added as an “authorized user” to a credit card account belonging to someone with higher credit. However, the consumer is an “authorized user” in name only and doesn’t have actual access to the account or line of credit.
• Filing false identity theft reports: As part of their efforts to remove accurate but negative information from consumers’ credit reports, the defendants filed thousands of false identity theft reports on behalf of consumers with the FTC. Knowingly filing a false identity theft report with the FTC is unlawful.
• Bogus business opportunity: The defendants also pitched consumers on a supposed business opportunity that consisted of reselling the defendants’ own unlawful credit repair services. They used outlandish earnings claims as part of the sales pitch; they told one undercover FTC investigator they could make “tens of thousands” of dollars every month.
• Illegal advance fees: The defendants charged consumers upfront, often thousands of dollars, for their credit repair services with high-pressure sales tactics. They failed to give consumers required information before they were pressured to buy. Charging advance fees for credit repair services is illegal.

Here to help

Please use information about these scams in your outreach programs and among your family members, friends, and co-workers.

As part of my outreach program, please contact me if you have any questions on identity theft or cyber-related issues that you need help with or if you would like me to research a scam and possibly include details in future columns or as feature articles.

I don’t have all the answers, but I’ll do my best to help. I might not get back to you immediately, but I’ll reply. Stay tuned!

Robert E. Holtfreter, Ph.D., CFE, is a distinguished professor of accounting and research at a university in the U.S. Northwest. He’s a member of the Accounting Council for the Gerson Lehrman Group, a research consulting organization, and is a member of the White Collar Crime Research Consortium Advisory Council. He’s also the vice president for the Pacific Northwest ACFE chapter and serves on the ACFE Advisory Council and the Editorial Advisory Committee. Contact him at doctorh007@gmail.com.