Overview

Extortion scams refer to any person who unlawfully obtains money, property or services from a person, entity or institution through coercion. Scammers come up with new reasons why you urgently need to pay them money.

Hostage Scam

The Canadian Anti-Fraud Centre (CAFC) is receiving reports from Canadian companies who are being scammed. The companies receive emails followed up with phone communication from suspects misrepresenting themselves/impersonating legitimate organizations, such as “National Defence” or the “Minister of Public Safety”. The communication is an attempt to obtain ransom for employees through hostage-taking scams or proprietary information. While the ransom demand is real, the actual hostage-taking is fake.

The emails are using generic domains, such as minister.com. They are well-constructed to appear to come from the Canadian Government or a person/company that may be known to the recipient. The suspects are targeting various levels within the company and often try to reach key executives to further the ransom demand.

Warning signs – How to protect yourself

• Beware of incoming calls from an area code outside of Canada.
• Beware of phone calls or emails not coming from the alleged hostage.
• Suspects will prevent targeted individuals from calling or locating the alleged hostage.
• Suspects have requested ransom money primarily via wire transfer service.
• Beware of ransom demands for employees held hostage abroad.
• Contact local police immediately!

Ransomware

Victims receive a pop-up message on their computer stating something similar to “this IP address was used to visit websites containing pornography, child pornography, zoophile and child abuse. Your computer also contains video files with pornographic content, elements of violence and spam messages with terrorist motives.”

The messages are engineered to appear as if coming from the Royal Canadian Mounted Police (RCMP) and tell consumers to pay to unlock their computer.

Warning signs – How to protect yourself

• Beware of pop-up messages or a banner with a ransom request.
• Be wary of free downloads and website access, such as music, games, movies and adult sites. They may install harmful programs without you knowing.
• Make regular back-ups of important files and keep your operating system and software up to date.

Ransomware – WannaCry

Sextortion

Victims are lured into an online relationship through social media or pornographic websites. As the relationship builds, victims are encouraged to use the computer’s camera and the scammer will coerce the victim to perform a sexual act on camera. The victim is later advised that the event was recorded and to pay a fee or the video will be released.

Warning signs – How to protect yourself

• Deny any requests to perform an illicit act over the internet.
• Disable your webcam or any other camera connected to the internet when you are not using it. Hackers are able to obtain remote access and record.
• Carefully consider who you are sharing explicit videos and photographs with.

Variations

Email Extortion Scam

A new extortion scam is threatening consumers that a video containing explicit content (i.e. masturbation) will be made public if they do not pay a fee via bitcoin immediately. Consumers are receiving emails from scammers citing a password that they are currently using or previously used as proof that they have hacked their computer while they were visiting a pornographic site and as a result, access to the webcam was gained and all proceedings were recorded. To prevent any humiliation, scammers urge victims to pay a “confidentiality fee” by bitcoin or the video will be shared with all family members, colleagues and friends.

Current reporting to the Canadian Anti-Fraud Centre (CAFC) indicates that this is a scam email attempting to extort consumers into paying the requested ransom and that no actual video exists. Reporting also suggest that the passwords being cited have been obtained from previous data breaches.

Warning Signs – How to Protect Yourself

• Change your passwords regularly – especially if you’ve been involved in a data breach.
• Although not a guarantee, consumers may search their email address to confirm possible involvement in a previous hack or breach: https://haveibeenpwned.com/
• Keep anti-virus programs updated and run checks routinely.
• Beware of unsolicited emails demanding personal information or immediate payment.
• If you’ve been involved in a data breach, contact the credit bureaus to place fraud alerts on your identity.

Source: Canadian Anti-Fraud Centre