1. How to Protect Yourself from ID Theft and Social Engineering
Jeffrey Hall, CFI

2. Recent Data Breaches Equifax (2017) Anthem (2015)
143mm people impacted
Customer names, SS numbers, birth dates, addresses
Anthem (2015)
79mm people impacted
Anthem Blue Cross and Blue Shield
Customer names, birth dates, medical ID’s, SS numbers, addresses, and employment information
JP Morgan Chase (2014)
83mm accounts (business and consumer)
Customer names, address, postal addresses, and phone numbers

3. Is My Personal Information Affected?
Equifax web site is delivering inconsistent results to potentially impacted members
Have I Been Pwned?
Recommendation:
Operate under the assumption that your personally identifiable information (PII) has been compromised either in the recent Equifax breach or other large past data and compromises

4. Next Steps to Protect Against ID Theft
Take advantage of the free identity-monitoring service (TrustedID Premier) that Equifax is offering
Equifax has clarified that you give up no legal rights by enrolling with the service
Contact the 3 credit bureaus to place a credit freeze on your credit file
You can unfreeze your credit file when you legitimately apply for credit
Place a 90 day fraud alert on your credit file
Equifax
Experian
TransUnion
Get a free credit report from each agency

5. Credit Freeze and Fraud Alert
Don’t forget to include your phone number when placing an alert

6. Multifactor Authentication (MFA)
Multifactor authentication (MFA) is a security system that requires more than one method of authentication from independent categories of credentials to verify the user’s identity for a login or other transaction. This is usually done by requiring something you know (password) and something you possess (a challenge code)
Challenge code can be sent by SMS (text), or voice
I recommend SMS over the other two methods
Drawbacks to voice challenge code
If the phone is a landline, someone in the home can intercept the call
I have seen examples of suspects forwarding/hijacking a phone line
Drawbacks to challenge code
Breached data or malware can lead to hacked
If you use SMS, ensure that you don’t display message on locked screen

7. More MFA TIPS

8. What Applications Should Use MFA?
Financial Services
Online banking, investment and retirement accounts
Mobile Banking may only require MFA when there is an unrecognized device
Always have your cell phone screen lock set
Social Media
Health Care
Medical and Dental insurance
Online retailers that have your information stored
Amazon
Utilities
To include broadband and cell service

9. Social Engineering following Data Breach
Expect a big increase in targeted spear phishing campaigns
Criminals will purchase compromised information on the dark web and than start building dossiers on the people who’s information they have purchased
Do not ever click links in s from untrusted sources
Hover your cursor over any links to see the actual URL
Do not ever click on links in text messages
If you receive any links from unknown senders – delete immediately
Confirm with your friends if they are the senders
Clicking on a malicious link in your phone can result in the phone being hacked
Do not ever release any PII over the telephone. If an organization calls you requesting information, instead go to the web and get their contact info and call them directly

10. Social Media Privacy Settings

11. Social Media Security and Login

12. Social Engineering on Social Media

13. Social Engineering on Social Media

14. Social Engineering on Social Media
Social engineers will try to obtain personal information about you from social media posts
Information that they are looking for could be answers for standard challenge questions:
What is your favorite food?
What is your favorite band?
What was the color of your first car?
Being able to identify your birthdate or family members will help social engineers locate you on free search websites
Social Engineers will now be able to answer standard challenge questions or out of wallet verification questions from information they obtained from you on social media and free people search websites
Protect your private information as if it were a valuable asset because it is