The Better Business Bureau has been added to the list of well-known agencies being used by criminals in online phishing scams.
Julie Wheeler, president and CEO of the BBB in Western Virginia, said the problem arose about 18 months ago, with businesses getting emails that appear to be from the BBB and claiming a complaint has been lodged against them.
The businesses are asked to provide information to a link that often releases a barrage of malware that embeds itself in the company’s computer to steal passwords and gain other information.
“It’s been happening for 18 month in all different places,” Wheeler said. “They have really bad stuff in them; some will even track all your keystrokes to get information.”
Wheeler said the “phishers” are in countries all over the world, and like to use identities that will get them instant recognition, and copy the website, logos and other identifying information about the targeted agency.
Other agencies that have been used in these scams have included the FBI, IRS and EEOC (Equal Employment Opportunity Commission), Wheeler said.
“They want names that get people’s attention,” Wheeler said.
The scammers tell businesses — and sometimes individuals via their personal email accounts — that a complaint has been filed against them with the BBB. The targets are then told to click on a link to deal with the complaint.
Wheeler said there are several things people can do to avoid getting scammed, the first of which is to never click a link unless you are sure the email is really from the BBB.
Test this by simply rolling your mouse over the link and looking at the address it will really link you to. If it is not a local BBB address, then it’s not the BBB, Wheeler said. Scammer addresses are often in another country completely, she said.
“Here, you’ll never get an email from the Seattle or New York City office; it will always be from the BBB in Western Virginia,” Wheeler said.
Also check how many people are being sent the email. Wheeler said if the BBB is informing a business of a filed complaint, that business will be the only recipient. Phishers often send the same email out to many people at once.
The national council of the BBB has been fighting the phishing scams, and the BBB in Western Virginia has joined in that fight, Wheeler said.
“To date, we have shut down well over 100 sites,” Wheeler said, adding the effort has been done at the BBB’s own expense, using a private deactivation firm.
“That’s all they do; they can disable a site within 30 minutes of being notified,” Wheeler said.
For more information, or to check whether an email is really from the BBB, contact the BBB at (540) 342-3455 or (800) 533-5501.
Thibodeau reports for the Danville Register Bee.
SIDEBAR, IF YOU WANT IT
Recommendations
These are the steps recommended by the BBB if you get an email that looks like it is a BBB complaint:
1. Do NOT click on any links or attachments.
2. Read the email carefully for signs that it may be fake (for example, misspellings, grammar, generic greetings such as “Dear member” instead of a name, etc.).
3. Be wary of any urgent instructions to take specified action, such as “Click on the link or your account will be closed.”
4. Hover your mouse over links without clicking to see if the address is truly from bbb.org. The URL in the text should match the URL that your mouse detects. If the two do not match, it is most likely a scam.
5. Send a copy of the email to phishing@council.bbb.org (Note: This address is only for scams that use the BBB name or logo)
6. Delete the email from your computer completely (be sure to empty your “trash can” or “recycling bin,” as well).
7. Run anti-virus software updates frequently and do a full-system scan.
8. Keep a close eye on your bank statements for any unexpected or unexplained transactions.