Social Security agency warns of e-mail scam

By Jaikumar Vijayan, Computerworld, 11/10/06

The U.S. Social Security Administration is warning the public about a fraudulent e-mail purporting to be from the agency and designed to lure users into divulging personal information.

In a statement published on its Web site, the SSA said it has received several reports of an e-mail being circulated with the subject header of "Cost-of-Living for 2007 update." The e-mail is designed to appear as if it were from the agency and provides information about a 3.3 percent benefit increase for 2007. It then proceeds to ask the recipient for personal information warning that those who failed to provide it by Nov. 11 would have their accounts suspended indefinitely.

The mail contains a link to a Web site designed to look like the official one where users are asked for information such as Social Security numbers, as well as bank account and credit card information, the statement said.

Perceived Risk vs. Actual Risk

From: Schneier on Security - A weblog covering security and security technology.

I've written repeatedly about the difference between perceived and actual risk, and how it explains many seemingly perverse security trade-offs. Here's a Los Angeles Times op-ed that does the same. The author is Daniel Gilbert, psychology professor at Harvard. (I just recently finished his book Stumbling on Happiness, which is not a self-help book but instead about how the brain works. Strongly recommended.)

The op-ed is about the public's reaction to the risks of global warming and terrorism, but the points he makes are much more general. He gives four reasons why some risks are perceived to be more or less serious than they actually are:

Online ID Theft Hyped

From: Schneier on Security

Does this surprise anyone?

While keylogging software, phishing e-mails that impersonate official bank messages and hackers who break into customer databases may dominate headlines, more than 90% of identity fraud starts off conventionally, with stolen bank statements, misplaced passwords or other similar means, according to Javelin Strategy & Research.

"An insignificant portion of identity fraud actually starts with the Internet," said James Van Dyke, president of Javelin, who pointed out that many firms still rely on simple security questions such as one's mother's maiden name. "The Internet always grabs the headlines, but it is individuals who are close to the victims, such as family and friends, that are doing most of it," he said.

The new ride!

The new ride with David sticking his head through the "hole" in the roof.