Scams, Hoaxes & Methods of Protection

[zimok]

Just found this article on digg and it got me thinking about scams and thought it would make for an interesting thread if people shared their experiences..
Top 10 List

I liked this one, a MITM attack over the phone.

7. "Man-in-the-phone" scams
Man-in-the-phone scams use deception and trickery during a telephone conversation to persuade an individual to divulge information. The fraudster phones someone and informs them that there has been a security risk on their account. The fraudster then conference calls in the real bank, whose representative asks for the secret information. Since it’s the real bank with the real account information, the individual often answers the security questions, then provides all bank details, while the fraudster eavesdrops in the background.

How to protect yourself against it? Simple, if the bank or anyone calls saying there's a security risk, take the incident ticket the bank has in the system (if you're already talking to a bank representative and call them back.

A few off the top of my head is,

ATM Scams,
If you use the same bank all the time, make a memorization of what the card insert looks like, it should never change unless the whole machine does and some inserts are really seamless if you don't look for it. Simple, quick & easy.

Using Wi-Fi,
If you have a wireless connection and you're not on WPA2, you're basically doing everything online with a potential viewer snooping in, viewing all passwords and data going over the network, ability to install files on your PC/install remote shell/keylogger. I'd say this is the most relevant one to people on this forum. If you don't know how to configure WPA2 figure it out now.

Buying Domains,
If you're buying a domain for anything above x,xxx$ get the guy on the other side to send you his driver license and a spoon pic outside his house. Anyone who's trying to scam you will never go through with this - get him to drop domain privacy and double check his identity of course.. (sedo escrow is also the best way to transfer because it takes ownership of the domain) - I'd be interested in more methods of protection for buying domains if you guys have any.

The only way to protect yourself against a thief is knowing his methods, you guys know any interesting ones?

 

[kblessinggr]

I've always found that the surefire way to avoid a lot of these is to simply be the initiator of the conversation. That is to say if its a bank security call, hang up and call the bank themselves, or of its an online notice, don't click the links, instead open the browser and manually enter your banks web address and go in from there.