Toronto police are warning the public to be wary of an ongoing email scam throughout Canada, and a cybersecurity expert is sharing tips on how to protect yourself online.
In a public advisory released on Monday, Toronto Police Services (TPS) shared details of the email scam being reported across the country and how it works.
Victims will receive an email addressed to them, containing personal information such as their name, phone number, and address. The email falsely claims the victim has visited a pornographic website and that malware has been installed. The scammer then threatens to send alleged videos from the victim’s phone to their contact list unless a payment in Bitcoin is made. The scam claims that once a payment is made, all alleged videos will be deleted.
In the email, the scammer also warns the victim not to share the message with anyone else, according to TPS.
The personal information included in the email likely originates from a past data breach, TPS suggested in the news release. The police service also mentioned images of the victim’s residence may be attached in the email, which is also likely taken from Google Maps and not from someone physically visiting the location.
TPS urges that at no point is the victim’s device ever actually compromised.
Humber College Associate Dean of Information and Communications Technology and cybersecurity specialist Francis Syms notes that scammers have quite a few ways to receive potential victim’s personal information.
Earlier this year, U.S.-based background check agency National Public Data experienced a significant data breach, which was acquired and sold by data brokers, affecting millions of people living in the U.S., as well as in Canada and the U.K.
He also says Ticketmaster’s recent breach, which was rumoured to be committed by a 26-year-old engineering student from Ontario, caused approximately over 560 records to be stolen. Syms says hackers allegedly made between $10 to 20 million off of selling that data.
Read More
“What happens is, in those breaches, there’s sometimes credit card information, but that’s usually sort of encrypted or hidden a little bit. More often, what’s there now is a name, address, cell phone, or email. It could be some personal information, like your mother’s name, the type of information that might convince you that they’re legitimate,” Syms explained to Now Toronto on Tuesday.
“And then what fraudsters do is they use that information… to try to get access to your accounts or to convince you to give them money. And that’s what we’re seeing here.”
Syms says that most Canadians have logged into about 100 websites over the general course of their internet use, which can easily make them susceptible to encounters with fraudsters.
“Think about the data that you put on those websites… it’s very easy for somebody to know your information,” he says.
In order to protect yourself online, Syms says the first step one should take if receiving a suspicious call is to hang up, and call the business back, such as if they claim to be CRA or a bank, to check its legitimacy. If the deception is through email, he urges to never click the link.
He also encourages victims to call the police, as they can advise you on your next steps.
“Likely what police will do in that situation is if significant enough and you’ve lost money, or there’s been some harm, they may look to file some sort of report. But most often, what they’ll do is just tell you to ignore it, because the reality is that these people could be calling anywhere in the world,” Syms said.
TPS urges the public to report these kinds of emails to the police, and to avoid paying the scammers any money, as they do not have any compromising videos or images that they claim to. For added security, it’s recommended to change your account passwords and to enable multi-factor authentication.
