I Think I’ve Been Hacked

The internet can be a scary place. One wrong click, and you’re looking at the screen of some terrifying popup. For someone who is not used to seeing these popups, it could look like a death stamp for your computer. These screens often prompt a saying like:

WARNING! YOUR COMPUTER IS INFECTED. PLEASE CALL THIS NUMBER TO REACH AN IT TECH MEMBER TO SOLVE YOUR PROBLEM.

Those screens are 100% fake and are only there to try and scam you. Unfortunately, many end up calling the number to be scammed out of hundreds, or even thousands of dollars.

Consider this TRUE story:

Jerry owns a small shop and uses an outsourced IT company. One day Jerry receives an email saying that his fax machine drivers are bad and he needs to install new ones. Jerry scours the internet for the company of said fax machine, finds a company that says they’ll help, and gives them a call. For $300, the company offers to remote into his computer and install the drivers for him. Thinking this is a legitimate company, he allows them access to his computer and pays the money. Once they supposedly install the drivers, they leave his computer and collect their money.

About a week later, he receives another phone call from the company saying that the tech who installed the drives did it wrong, and they need to go back into his computer and fix them. They offer him a full refund for the inconvenience. The tech asks Jerry to install Team Viewer so that they can remote into his computer. Jerry allows access, and they begin poking around his computer. Suddenly the company come across malware, convincing Jerry of this by showing him event logs that show common errors and warnings. They then begin asking for private banking information, which they use to create a fake spreadsheet showing his “bank account” at a balance of $0.00. They tell him that the malware forced itself into his bank account and transferred his money out. Not knowing much about malware, he begins panicking. The tech then tells him not to worry, he can transfer his money back if Jerry gives him $10,000 worth of gift cards codes, but the tech will transfer $10,000 of his own money into Jerry’s account to pay for these cards. Jerry, shocked but willing to cooperate to restore his bank account, sends the tech the codes to the gift cards. Unfortunately for Jerry, he has just fallen victim to a scam. Once he sent them the codes, the “tech” used a utility in Windows called SysKey, locked him out of his computer and told him if he tried to turn it on, it would erase everything on his computer.

The next morning, Jerry calls his IT department, tries to explain what happened, and asks them to try to fix his computer without the data being erased. Jerry went to his bank to learn that all of his money was there except for 10,000 dollars. You see, the “tech” told him that he didn’t have any money, but Jerry never checked to verify. Following blindly, he used what he thought was the tech’s money to purchase the gift cards. Jerry felt better that his money was still in his account but couldn’t believe he had been scammed out of $10,000. He went to the police station to file a report but was informed that they could not do anything for him. His money was not stolen but given willingly (albeit, unknowingly). The next day Jerry has his computer back with everything still on it but was still out 10 grand.

This story is scary and a little hard to believe, but it’s real. The entire scenario could’ve been avoided had Jerry contacted the IT company from the get-go. Let’s take some time to learn from this costly mistake:

Emails are a huge vehicle for scams and malware.

We’ve said it a million times before, be VERY wary of emails. If something looks suspicious, 99% of the time it is. If you are ever concerned about this kind of email, an IT consultant can help you determine whether it is legit or not. They would rather you be safe than sorry.

If you don’t have access to an IT team, the simplest way is to look at the real email address by pressing reply on the email and see what shows for the email address. Say you have an email that looks like it is from Microsoft, the email might look like it is from refund@microsoft.com, but when you click reply, the email is actually thanksforyourmoney@gmail.com or something that isn’t from Microsoft. Lastly, go to the company’s website and go to the support section. You can forward that email to them to see if it’s legit or not.

If you are sure the email is real, be sure to find the right number.

I would not recommend searching for a company tech phone number. Even though the real number may be listed somewhere, there will also be fake numbers that can put you in a similar situation as Jerry. Always go to the actual website and search through the site until you find their support number. If you pay for IT services, call them first. Even though they aren’t the direct company, they are trusted and will be able to help you (that’s what you’re paying them for, right?!).

Watch who you allow remote into your computer.

DO NOT LET THEM. Once the bad guys are in, your day (and probably more) is ruined.  Only allow your IT department or a representative from the ACTUAL software/hardware company to remote in to your computer. Scammers can infect your computer with malware or ransomware, even wipeware, which wipes everything from the computer.

Watch what information you are giving away.

The easiest way to know if you are about to be hacked or scammed is when the person on the other line begins asking for personal information, i.e., banking information, social security number, birthdate, etc. Your IT department will NEVER ask for this information nor will a company like Microsoft. Again, if it seems fishy, ASSUME IT IS.

If you get a threat concerning your bank account or other sensitive information, check all your accounts on your phone or another computer.

It may seem silly, but if you check and see that all your money is still there, you know these people are lying to you, and all you need to do is pull the plug. Scammers and hackers of all kind will trick and manipulate you into doing whatever they want. The internet is just as scary as the real world can be, so you need to make sure you are just as cautious.

If you have allowed someone sketchy onto your computer, remember you can disconnect anytime.

There are two easy wasy to disconnect:

1. If you are using an ethernet cord for your internet, unplug it. They will not be able to stay accessed to your computer if you are not connected to the internet.

2. Shut down your computer. Do not click and shut down. Manually hold the button or unplug the cord.

Follow up with your IT company.

If you’re caught in something like this, bring the computer to your IT department to make sure the hacker or scammer did not leave anything harmful on your computer.

These kind of scammer and hackers are constantly looking for new prey. Don’t find yourself a victim to these people. Treat the cyber world as you would the real world. My motto on something you are unsure of is “If in doubt, don’t.”

And as always, you can reach out to us, Keystone, for all of your IT questions and concerns.