Watch out for post-transaction marketing charges on Facebook

Are you addicted to those cute little games like YoVille and Mafia Wars on Facebook? You might incur unexpected charges on your credit card if you’re not careful.

Let’s say you’re on Facebook connecting with your friends. While there, you accept an offer for a risk-free trial as part of an ad that might be embedded in a game. You’re typically asked for a credit card or checking account number to participate in the supposedly free trial, but then your account is charged up to several hundred dollars.

Facebook has so far denied any responsibility for this post-transaction marketing. Zynga, meanwhile, allegedly made up to $80 million from these offers.

But it’s not just social networking giants doing this kind of stuff. The Los Angeles Times reports RealtyTrac has been accused of working with a post-transaction marketer that charges people $45 each month for a subscription to a sister service that promises to make you “a real estate investment pro.”

The takeaway here is simple: Be sure to check your credit card statements and bank accounts each month for unknown charges and dispute them.

E-greetings might contain dangerous spyware

If you’ve been receiving phony e-greeting cards in your inbox, you risk getting spyware and other kinds of malware on your computer upon opening them.

I’m really upset about this because e-greeting cards should be a pleasant thing. Unfortunately, something that’s so innocent has been corrupted.

The latest incarnation in this rip-off scheme works in the following way: Criminals send out bogus e-greeting cards, and if you open them, you download a program that steals e-mail addresses from your contacts list. Once the criminals have those e-mail addresses, they send out another fake e-greeting that appears to be coming from you, starting the cycle all over again.

The worst part is that when the initial e-greeting is opened, it usually unknowingly downloads a “keylogger” program to the user’s computer. A keylogger is a malicious program that tracks every keystroke you made on the computer, including usernames and passwords for bank, brokerage, or mutual fund accounts.

Under the law, you are protected if money is stolen from your bank account but not from your brokerage or mutual fund account. Some brokers have issued their own policies that allow for customer protection. But the bottom line is that you must run antivirus and anti-spyware software on your computer.

I like Spybot Search & Destroy (available through Safer-Networking.org), Malware-Bytes. org, and SuperAntiSpyware.com, all of which offer free downloads (donations suggested but not required) that eliminate keyloggers and other spyware on your system once you’re infected.

Of course, prevention is the best medicine. That’s why you should run a good antivirus protection program, do periodic scans for spyware, and avoid clicking on suspicious e-mail links or websites.

I recommend free options like Avast! Antivirus Home Edition (available through Avast .com/Free-Antivirus-Download), AVG Free Antivirus (available through Free.AVG.com), or Microsoft Security Essentials (available through Microsoft.com/Security_Essentials).

Pick just one of these to help protect your computer from infection before the fact. There will be conflicts if you try to run more than one at a time.

“Scareware” viruses can masquerade as antivirus warnings

We’ve all been so browbeaten into watching for viruses on our computers that it was only a matter of time before crooks wised up and started creating viruses that actually mimic common antivirus warnings!

That’s the idea behind what’s called “scareware”—bogus virus warnings that actually load a virus on your computer when you click on them.

You’re surfing the Net and suddenly an official-looking screen pops up warning you that there is a problem on your computer, such as: “Your computer may be infected with harmful spyware programs. Immediate removal is required. To scan, click ‘Yes.’ ”

You’re not sure if it’s real or not, so what do you do? Be careful, this might be scareware, and you’ll be snared from the minute you click on the impostor pop-up window that supposedly alerts you to an existing virus.

If there’s any doubt, you can close your browser immediately by pressing ALT+F4 (Mac users press Command/Apple+Q). This will prevent any scareware from loading.

My executive radio producer, Christa DiBiase, recently had her computer compromised by a pop-up that masqueraded as a virus warning from Norton Antivirus. It even displayed a virus count, as many popular antivirus programs will do.

So if you see a pop-up window that seems to be from your antivirus program, don’t click on it. Instead, go directly to the antivirus or spyware program on your desktop and run it from there so it can find any security threats.

I mentioned several free spyware removal options in an earlier tip. I also recommend having multiple browsers on your computer in addition to the ever popular Mozilla Firefox—such as Google Chrome, Avant Browser, and Opera—all of which are free. The idea is that you can still navigate around the Web even if scareware hits your usual browser.

Never reply to an e-mail from your bank asking for personal info

Scammers got very sophisticated in their phishing attempts following the numerous bank failures in our nation at the end of the last decade. I received a phishing attempt that looked very legitimate after Wachovia collapsed in 2008.

Within minutes of the original plan for Citibank to take over Wachovia, the scammers were blasting out e-mails. Each message said that in order to access your Wachovia account, you’d have to fill out an online form asking for all kinds of personal info. Unfortunately, many people fell for it because they were dumbfounded by the news about Wachovia, which was later bought by Wells Fargo.

Around that time, I also read a Los Angeles Times report stating that British researchers had found that sophisticated phishing scams such as this one have a 90 percent success rate. That’s really scary!

You should never reply to any supposedly legitimate e-mail from a financial institution asking for personal info. Nor should you ever click on a hyperlink in an e-mail that supposedly takes you to your bank or brokerage house’s website.

If you are in doubt, close out the e-mail in question, open a new browser window, and type the URL directly to verify the info contained in the e-mail.

If you think you might have already given up sensitive info, then you should immediately contact your financial institution and tell them to restrict access to your account. You’ll also need to change all your passwords.

Social networking work-at-home offers are likely to be rip-offs

As social networking gains in popularity, so too does the prevalence of scammers pushing supposedly amazing work-at-home opportunities using hot new websites.

One company called Easy Tweet Profits claimed you could make up to $873 a day online using Twitter. They even claimed one person earned $400,000 annually using their method of tweeting your way to success. The catch? By signing up for their program, you agree to be charged nearly $50 each month! They’re the only ones getting rich.

There are a whole host of other companies with similar names (usually involving “make money” or “make profits”) that suggest social networking can be a cash cow. But their game is all the same.

Whether you are talking about something you see on Facebook, Twitter, MySpace, Craigslist, eBay, or whatever’s the next hot thing, you’ve got to be wary.

Speaking of eBay, beware of anyone who promises to show you how to get instant credibility as a power seller and have the opportunity to make a fortune selling online.

The once popular e-commerce site’s transactions are way down and the company is going through a midlife financial crisis. One big problem has been the credibility factor of sellers and buyers alike. There’s no insta-business solution when it comes to eBay. As a seller, you sustain yourself over time only by specializing in a niche market.

“Vishing” and “smishing” are the new phishing

It seems like everyone’s gotten hip to crooks using bogus e-mails that masquerade as official communications from a bank or a brokerage house. We all know these e-mails are really intended to try to trick you into divulging sensitive account information. Phishing is so 1990s!

Well, leave it to the scammers to up the ante and develop a sophisticated ruse where they use the triple threat of e-mail, phone calls, and text messages to trick you into yielding your info. The latter two attempts are being called “vishing” (voice mail) and “smishing” (text) because they follow on the heels of the traditional phishing (e-mail) attempt.

As always, this trio of messages will look and sound completely legitimate. They may prompt you to call a seemingly legit toll-free number and talk to an “investigator,” or direct you to a website that looks real, with logos from your bank, credit union, or brokerage house.

The truly scary thing is that the criminals already have access to all your contact info and just need your private usernames and passwords to empty out your account.

What should you do if you think you’re on the receiving end of this trifecta? Certainly you don’t want to divulge your PIN number or other sensitive information.

After you close out the suspect e-mail, open a new browser window and go to your bank’s website. You can find their real contact info there and call them to verify the vishing, smishing, and phishing. Never respond to what you see in an e-mail, even if it looks legit.

If you think you might have already fallen prey, contact your bank and tell them to check into it before the suspected crime progresses any further.

Spear phishing and whaling pose a threat to businesses

Spear phishing is the latest, hottest criminal effort to crack the computer systems of wealthy individuals and businesses, including large corporations. As the name implies, it’s a phishing attempt that’s highly targeted to a specific person in a company.

Spear phishers will usually find a third-tier executive in a company’s organization and send a direct personal e-mail to the recipient, pretending to be an official bank communication.

The San Francisco Chronicle reports that spear phishing is becoming more and more sophisticated all the time. In one variation, the criminals will use a subject line that’s directly related to a new product or specific issue at that company and bam!—the executive loads malicious software on the computer when they open the e-mail.

Business types are also at risk of what’s called “whaling.” While commonplace phishing targets the general public, whaling targets only the big fish in corporate America or wealthy independent business owners—hence the name.

According to a CNET.com report, top corporate executives and business owners were getting e-mails alerting them to a bogus U.S. District Court subpoena. When they clicked on the link in the e-mail (never a good idea!), they were taken to what looked like a real subpoena.

But it wasn’t, and it loaded a keylogger virus onto their computers. A keylogger captures all your account numbers and passwords, and it even alerts the criminals when you log on to your bank or brokerage account. The criminals can then sign in, change your password, and steal your money.

There’s actually a low-tech way to assess the danger of a link if you’re thinking about clicking on it in an e-mail or on a webpage, which, again, is never advisable in the first place. Simply run your mouse over the link and look at the bottom of your Web browser to see what it says.

If you’re about to click on a link that purports to be “ClarkHoward.com” but points to “StealYourIdentity.com/ImGonnaGetcha,” well, you better not do it!

You should also be wary of seeing an “at” sign (@) anywhere in the URL. It could be a dangerous redirect. To avoid this, try right-clicking on the URL in an e-mail or on a website and selecting “copy.” You can then paste it into a word processing document and vet it carefully for the @ character without ever having to click on it.