Source: Federal Bureau of Investigation (FBI) State Crime News

Welcome to the Oregon FBI’s Tech Tuesday segment. Today: Building a digital defense against Chinese shipping and shopping scams.

According to the FBI’s Internet Crime Complaint Center, bait and switch cases by online Chinese vendors targeting Oregonians have increased by 30 percent since June 2020. They account for 65 percent of all online shopping scams reported to the FBI in Oregon.

The scam usually starts with victims buying items from vendors they think are located in the U.S. From there, the bad actors do one of two things.

In the first version of the scam, the victim orders an item online, but instead of receiving that item he ordered he receives a package of small, lightweight materials such as disposable face masks, stickers, or plastic trinkets. Once the vendor generates a shipping tracking number, it can provide that information to the payment processor (such as PayPal) so that the processor will release funds to the seller. At the same time, the seller is able to minimize its shipping costs due to the light weight nature of the package.

In another version of this scam, the vendor sends an item that is loosely-related to the one purchased, claiming that was the item the buyer had ordered. This is an attempt to convince consumers they had mistaken their orders and accept the switched item. Consumers who requested refunds received offers of partial refunds if the victim returned the item to an address in China.

In these cases, shipping costs to China almost always exceeded the refund amounts, discouraging consumers from completing the refund. Notably, many of the victims reported the packages they were sent actually showed sender information originating in the United States, so there should have been be no need to return the item to China. Additionally, no invoices or order information were included in the packages so any returns could not have been attributed to that particular customer.

To protect yourself, make sure you research vendors—particularly those who advertise through social media platforms or through unsolicited messages. Use a credit card to pay and pay through a reputable payment processing platform. Make sure whatever platform you use has strong refund and dispute processes.

If you believe you are a victim of an online scam, you should report the incident to the FBI’s Internet Crime Center at www.ic3.gov or call your FBI local office.

Source: Federal Bureau of Investigation (FBI) State Crime News

The FBI has seen Emotet hit nearly every sector within the U.S.—paralyzing school systems, small and large businesses, non-profits, government services, and individuals. “Emotet did not discriminate,” Nye said.  
 
Even if a victim of Emotet avoided a ransomware attack or direct financial loss, the disruptions and expense of remediating the infection were substantial. “Victims incurred substantial monetary costs to effectively clean compromised machines,” Nye stressed. According to the U.S. Cybersecurity and Infrastructure Security Agency, Emotet infections cost local, state, tribal, and territorial governments up to $1 million per incident to remediate.  
 
Last week’s global action allowed law enforcement to dismantle the foundational components of Emotet’s operation—taking down multiple layers of infrastructure located around the world. “Through the combined efforts of the incredible FBI team, foreign partners, and private sector partners, the command and control network of Emotet was dismantled,” Nye said. “To recreate this botnet, the criminals would have to rebuild from scratch.”  
 
The unprecedented effort closed off the access this malware had opened to millions of machines. “When you can take out the delivery arm of all these countless pieces of malware, it means greater protection and limiting the ability of cyber criminals to get onto machines throughout the globe,” Nye explained.

The FBI identified more than 45,000 computers and networks in the United States that had been recently affected by Emotet malware. “The Emotet malware on those machines is no longer harmful to those it infected,” Nye reassured.

The cyber strategy the FBI released in 2020 prioritized efforts to impose greater cost and risk to cyber criminals—relying on strong partnerships across every industry and around the world to do so. Nye said that the action on Emotet shows how the FBI can use its insight, expertise, and global reach to make an impact.

“The beauty of the FBI and our partnerships across the world is that they create remarkable opportunities to achieve a disruption,” Nye said. “It can mean finding new techniques like this one that targeted the infrastructure behind the malware.”