Social Security agency warns of e-mail scam

By Jaikumar Vijayan, Computerworld, 11/10/06

The U.S. Social Security Administration is warning the public about a fraudulent e-mail purporting to be from the agency and designed to lure users into divulging personal information.

In a statement published on its Web site, the SSA said it has received several reports of an e-mail being circulated with the subject header of "Cost-of-Living for 2007 update." The e-mail is designed to appear as if it were from the agency and provides information about a 3.3 percent benefit increase for 2007. It then proceeds to ask the recipient for personal information warning that those who failed to provide it by Nov. 11 would have their accounts suspended indefinitely.

The mail contains a link to a Web site designed to look like the official one where users are asked for information such as Social Security numbers, as well as bank account and credit card information, the statement said.

Online ID Theft Hyped

From: Schneier on Security

Does this surprise anyone?

While keylogging software, phishing e-mails that impersonate official bank messages and hackers who break into customer databases may dominate headlines, more than 90% of identity fraud starts off conventionally, with stolen bank statements, misplaced passwords or other similar means, according to Javelin Strategy & Research.

"An insignificant portion of identity fraud actually starts with the Internet," said James Van Dyke, president of Javelin, who pointed out that many firms still rely on simple security questions such as one's mother's maiden name. "The Internet always grabs the headlines, but it is individuals who are close to the victims, such as family and friends, that are doing most of it," he said.