Webinar replay: Staying safe online for Seniors

[Visual] The screen opens displaying a slide tile with the webinar title. The host, Hadyn Green appears in a small window at the top right-hand corner. He is moving around but is on mute. He waits there until a minute 30 in. Throughout the video, the webinar slides change to match what the speaker, Sam Leggett is discussing. At times Hadyn, the host will cut in – as each speaker speaks, they appear in the top corner.

[Audio: Host/Hadyn] Okay. Kia ora, Mōrena, good morning everybody. Welcome to CERT NZ's seminar on staying safe online for seniors. My name is Hadyn Green. I'm the Senior Comms person here at CERT NZ and with me is Sam Leggett, he's our Threat Analyst, Senior threat Analyst and he's going to be guiding you through today's session. You may have noticed that you're already muted.

[Slide change] There we are. That's our fantastic photos. Mine was obviously taken at a time when I had longer hair. You may have noticed that you're muted and, and your videos are off that's on purpose to make sure that the call goes a bit easier.

If you do have any questions, however, you can pop those in the chat and we will get to those at the end. Although we will be reading them in if anything pertinent comes up during then we'll make sure to stop Sam midway through and get, get his attention to answer those questions.

[Slide change] So just a quick thing about CERT, we're the government's public facing cyber security agency looking after small businesses and individuals. So if you yourself have a problem you can come to us with any cyber security incidents. No one too big, no one too small.

And we will, help you out with those. And we, what we do is we, we triage those to make sure that they get through to the correct place if it's not us then we'll move it on to a bank or whoever needs to see that so we're the ones that you should definitely come to at CERT NZ, and so we've got a quick agenda for today.

[Slide change] We're going to cover off some common misconceptions about cyber security. Different types of threats and scams that you might see out there, some stuff to keep you safe from those threats you might see out there.

And then just a little bit of information about where you can go to get to get more info and more facts. So with that, here is Sam Leggett.

[Audio: Speaker/Sam]  Thank you very much. Hadyn. Thank you so much for everyone coming along today.

[Slide change] Really excited to deliver today's webinar and hopeful that everyone can take something away from today's session in order to help you stay safe online.

Now in my role I'm responding to these incident reports that come through to CERT New Zealand and in that we actually see quite a lot of misconceptions often coming up, especially when we're talking about this demographic.

[Slide change] The first one is that our seniors are 65 and older. Are they targeted more for these types of things? Well, and the data that we collect and we're going to look at a snapshot of the starter in a moment, we can actually see that that's not necessarily the case.

These things happen to everyone and in a lot of cases, these types of scams and attacks are volumetric in nature.

And that means that they're bad guys are sending these out to as many people as possible. Sending out as many emails as many text messages as possible trying to get as many people as possible no matter what they age they are to click on these things and provide information.

Are you targeted more? The data does not support that. The truth is everyone can be a target if they're online.

[Slide change] Second common misconception we often see, are seniors, or people 65, 65 years old and older, more susceptible to these types of things.

Again, the data doesn't really support this. The truth is that anyone can fall victim to these types of things.

These scammers, these attackers are very good at what they do in creating narratives that are convincing in order to trick people to click on links and provide personal information.

Are you more susceptible? No more so than anyone else. The reality is that all it takes is something else going on in our day-to-day lives that distracts us and in that moment of distraction we can click on these links we can fall victim to various types of scams.

Everyone is susceptible and everyone is a target.

[Slide change] So what happens if you do fall for a scam should you feel embarrassed?

Well, the reality is you probably will. And that's okay. The most important thing to take away is that it's not your fault.

When these things happen. That's the bad guy's fault. And don't let any embarrassment that you may feel about falling victim to these types of things stop you from looking for help from reporting it to appropriate organisations and talking to people in order to get help with what you may be dealing with and help yourself out in the future so that you don't have to deal with these things again.

[Slide change] [Audio: Host/Hadyn] Sam, would it be fair to say that the scammers are hoping that you're feeling embarrassed so that you don't report it.

[Audio: Speaker/Sam]  Yeah, absolutely. It's a really good point to raise

[Slide change – back to previous slide] and often when you report something through to an organisation like CERT New Zealand, the information that you're providing in that report may very well help the next person stay safe from this type of scam.

So it's very common that attackers or the bad actors, the bad guys, they want you to feel embarrassed, they don't want you to reach out for help. They don't want you to share your story so that it's more likely they can convince the next person to fall victim to the scam as well.

[Slide change] So looking at some of the data that we mentioned and this is just a snapshot of reports that we received in quarter two of twenty twenty three.

About 41% of people provided their age and their reports but what we can actually see is that there is a whole range of people from all different age groups being affected from these types of scams and actually when we look at the 65 and older demographic, that's not even the the biggest area where these reports are coming from. The most reporting, age group is 35 to 44. And there's a couple of reasons why this could be.

Maybe they're online more and so they're seeing more types of these scams. Maybe they're actually more aware that they can report it and they can reach out for help.

The truth is that this these types of things can happen to anyone no matter what background they have, what age they are.

Everyone can be a victim if they just online. Actually, CERT New Zealand did a little bit of research recently and we can see that in a six-month period about half of New Zealanders have all age groups are seeing cyber security incidents and all online scams.

Part of that research, we got some really great insights where we can see that seniors or 65 and older are actually taking cyber security more seriously than the younger demographics. They're actually taking more steps to keep themselves secure and to stay safe online whereas younger audiences are less likely to take those steps in order to keep themselves safe.

And actually 65 and older are better at not sharing personal information online. Better at not clicking links and better at using different passwords for all their online accounts.

Now we're going to talk about some of those things and why those things are important. But actually this age group that we're talking to today are some of the best in terms of taking actions to protect themselves online in terms of taking cyber security seriously and wanting to be more secure, which is really amazing.

And so to help you stay secure online and take some of those actions to stay nice and safe, we're going to look at some of the most common scams and attacks that we see affecting this age group.

[Slide change] So the first one that we see most of the time and this is the biggest incident that we see affecting all age groups is what we call phishing.

Now I'm going to throw that term around quite a lot. What does phishing mean? Obviously this is phishing with a p h rather than with an f.

Phishing basically means pretending to be someone else in order to get a victim to provide information. So there's a couple of forms that we see this in most cases and this is the forms of emails and the form of text messages.

Where you receive an email that claims to come from a really big or really reputable organisation. I'm asking you to click on a link. Or provide personal information like login details, bank account details, credit card details. And so let's take a quick look at one of these examples.

Now what you also see when we are stepping through these various types of scams and threats is a photo of someone next to the scam that we're looking at.

And the reason that we've included that is because on our new platform, OwnYourOnline.govt.nz, which we will talk about in a little bit, we actually have real stories from real New Zealanders who have gone through each of these types of scams and they're telling this story to hopefully bring some light to what happens when we don't necessarily get cyber security quite right. In order to share their stories and maybe help the next person stay safe and take it a little bit more seriously.

 

[Slide change] So, phishing emails commonly look like this. IRD and NZTA are some really commonly impersonated brands for these types of things.

The first thing that I want you to look at if you receive an email and you have any reason to think to think it may be suspicious or it may be a scam the first thing I want you to look at is the email address that its comes from.

So in our first example, the IRD email. You can see that the email address that that one comes from ends in at 'krf.big lobe.ne.jp. That sounds really weird, right?

And so one of the most powerful things that we can do to spot when a email or a text message as a scam is by familiarising ourselves with the genuine website of that organisation. So in this case, I believe it's ir.govt.nz. And so we would expect any email addresses coming from that organisation to end in that same string. It should look like coming it's from ir.govt.nz rather than biglobe.ne.jp.

[Audio: Host/Hadyn] So Sam, just very quickly, when you say that do, it's everything after the 'at' - So is that correct?

[Audio: Speaker/Sam]  That's right.

[Audio: Host/Hadyn] Everything after the 'at', so person's name, AT and it might be it might not say the whole thing, but it'll be something and the last little bit should always be ir.govt.nz Is that, Yeah.

[Audio: Speaker/Sam]  Yeah, exactly right. Taking a look at everything that comes after that at symbol and making sure it's the same as what we see on the genuine website of that organisation as a really good step to take to acknowledge whether or not we may be dealing with a scam.

Now as we look at the next example, NZTA, we can see that this can actually get a little bit tricky. So in the case of the NZTA email, this looks like it's come from NZTA.co.nz. An email address ending in NZTA.co.nz. That looks pretty legitimate. But an actual fact NZTA's website is NZTA.govt.nz.

So while it's only a slight discrepancy we can see that it's not actually coming from the appropriate place for the New Zealand Transport Agency. And so familiarising ourselves with the NZTA website again gives us the tools to be able to spot that this is a scam email. If we know that the website of NZTA is NZTA.govt.nz, And then we look at the email address that this has come from.

Again, looking at everything after that at symbol, we can see that it doesn't line up. And that's a really good indication that we may be dealing with a scam.

The next thing that I want you to look at in these types of emails is what they're asking you to do.

So in most cases with phishing emails or with scam emails, they're trying to get you to click on a link which will take you to a dodgy website where it will ask you for personal information. Again, this is usually account credentials or login information or maybe credit card information or bank account information.

In the case of the NZTA email, what we can see is that there's a big button that says renew now. And so the link that it's asking us to click on doesn't actually appear. In the email itself. What we need to do in this case is take our mouse and hover over that button. And then the full link will appear just like it has on screen there.

Now you might be asking, well, how do I do that on a cell phone? And maybe I'm using my mobile phone to check my emails.

How do I see what that full link looks like in that case? Usually what you can do is long press or press and hold on that button and that'll bring up a menu of additional options and should show you that full link as well.

In the case of the NZTA email, the link that it's asking us to click on, again, this doesn't line up with what the genuine NZTA website is.

We're looking for something like NZTA.govt.nz. But in this case, we've got a website that says in NZTA.dnsdojo.com. Now that doesn't line up at all. And that's another really good indication that we're probably dealing with a scam.

[Audio: Host/Hadyn] The, this, link is also a little bit sneaky in that it's got NZTA.govt.nz listed inside of it. So is it, is it easy to Is it easier, rather, to just simply not click it if it looks a bit dodge if it gets a bit long and complicated?

[Audio: Speaker/Sam] Absolutely. And that's a that's a concept that we're going to talk about with all these types of things. If you're looking through these emails or these text messages or anything like that and there's anything that makes you suspicious of it, the best thing to do is not engage with that email. Don't click on any links. Don't respond to that email. In actual case, often the easiest thing to do is contact that organisation and a completely separate manner. So hit to their website directly.

Maybe there's a number that you know to call and with things like bank accounts we've actually got some numbers that we can provide you a little bit later on so you can you can take that down you can take note of the appropriate number to call.

But get in touch with the organisation directly and actually ask them, hey I received this email and I'm just wondering if it's legitimate or not. It's far better to get an organisation to contact you multiple times, than it is to click on the link and provide that information and try to recover it after those kinds of things have happened.

So if you're looking through an email and the email address that's come from looks a little bit suspicious, or maybe the link it's asking you to click on looks a little bit suspicious, if you have any reason to be concerned, the best thing to do is not engage with that email at all.

[Audio: Host/Hadyn] We've hit a couple of things in the questions. Someone's asked click and, hold on what? So that's, ah pretty simple, if you're using your phone and you press and hold with your finger down on, on a link it'll pop up with a little menu but that should also say what that full address is. But someone's asked how do you show the senders email address?

[Audio: Speaker/Sam] Yeah, that's that's also a really good question. So a lot of times what you'll see and you can actually see it in these email examples as a display name pops up first.

So the first thing that we can see in the from section is Inland Revenue or in the other example New Zealand Transport Agency. If you're on a computer, typically all you have to do is click on that display name and that should show you the actual email address that it's come from.

In the same situation with your mobile phone, if you click on that display name and an additional menu should pop up which should show you that full email address. And again, we're just looking for everything after that at symbol and trying to check whether or not that aligns with the genuine website of the organisation that we're dealing with.

Now, not in all cases they're going to ask you to click on a link in the case of the inland revenue example that's on screen what they're actually asking you to do is send an email to a specific email address and this is a really good example of how they try to convince you that the email address is genuine so in this case if we look at everything after that at symbol it says refund dash update dash IRD dash GOVT dash NZ dot com. And so there's a lot of keywords in there that try and make it look genuine. But again, what we would expect here is IRD dot GOVT dot NZ. The fact that it ends in dot com is another giveaway that that's not a genuine New Zealand government email.

If you're dealing with a New Zealand government organisation, then their email address will always end in GOVT.nz.

Unfortunately, it's not all emails though, and as we use mobile phones in our day-to-day lives even more, we become a lot more accessible via things like text message.

[Slide change] So unfortunately we see these scams and text message as well. But the good news is that we can look at the same kinds of things in these cases. Now, rather than having an email address that's in this to us we have a mobile number that sent it to us and in this case on screen you can see three examples from big organisations.

We've got NZTA again, we've got BNZ, we've got NZ Post. Now in these cases, each of these text messages have come from individual mobile numbers and even in one case is an Australian mobile number in there.

Now if you're dealing with a big organisation like an NZTA, like a BNZ, like an NZ Post, they have so many customers that they need to contact and when they do that via text message they use what's called a text service, in most cases.

And what that will look like for you as a text message coming from a short code number. Now that's usually either a three-digit or a four-digit number. When we can see text messages coming from big reputable organisations from individual mobile numbers, that's a good indication that we may be dealing with a scam.

Unfortunately, this isn't a catch all and there may be some cases where there are mobile numbers used by organisations, but it's far better to take this as an indication that text message may be suspicious and step back and not engage with that text message at all.

And these cases we're being asked to click on a link in each case, and the other thing that I want you to be aware of is a sense of urgency that is often created and these in these various types of scams that we're talking about.

So in the first instance, a vehicle registered in your name recently travelled toll road, you need to pay that toll as soon as possible. Trying to create that sense of urgency, you've got an outstanding fee that you need to pay.

And the BNZ example, we've temporarily restricted access to your account due to suspicious activity. So they're saying we've locked down your accounts, you won't be able to do anything unless you click here and follow our instructions. And in the NZ Post example, you've got a package that we tried to deliver but we couldn't. If you want that click here and arrange alternate delivery. If you want your package, you're going to have to click here and provide information.

And all these are examples they are trying to create a real sense of urgency so that we click on these links and provide whatever information they're asking for without really thinking it through.

We can look at the links in this case and this is when text messages become a little bit easier to navigate. So we can see the full length that they're asking us to click on displayed in that message there.

And again, if we familiarise ourselves with the genuine website of that organisation, so for BNZ, BNZ.co.NZ, we can actually start to tell when these links are not legitimate. So if you look at their BNZ example, we've got BNZ auth details.com. That doesn't align with BNZ's genuine New Zealand website which is BNZ.co.nz that's a really good indication that we're dealing with a scam again.

So if you get a text message, it's come from an individual mobile number, a personal mobile number, but from a really big organisation, it's got a link in there and that link doesn't look quite right. These are really good indications that you're dealing with a scam and the best thing to do is to not engage with that text message at all.

[Audio: Host/Hadyn] We've had a question about those, phone numbers as well. So these are, these are sort of real phone numbers. Can you give a very succinct, quick explanation, of why these phone numbers look like real phone numbers and how exactly a telco gave these out.

[Audio: Speaker/Sam] Yeah, so, the reality is that, scammers, when they send out text messages, they simply go through the same process that we were to get a mobile number. So you can pop into a lot of different stores and you can buy a SIM card, prepaid SIM card and it has a mobile number loaded and ready to go and that's one way that they can, that they can get a hold of these numbers in order to send these scam messages.

There's also some software out there that can enable these types of things and that's something that's come around more recently. But this is, the scam is simply go through the same process that we do to get a hold of of a mobile number.

[Audio: Host/Hadyn] Yeah, I personally receive phone calls from people saying, hey, you sent me a text, or you called me up and it's not that, it's that my number has been used by scammers to start a scam and then I have to apologise to people and say I'm not a scammer, my number has just been used in this in this situation.

And just very quickly, we've had a couple of people ask about the previous slide with that had, quite small text on it, we will make these slides available so people can see them.

Later. Okay.

[Audio: Speaker/Sam] Yeah, yeah, that's a really good point. But all the information that we're talking about today, we're going to make this accessible for you afterwards that don't feel like you have to jot it all down, you have to take notes on every single slide.

There's a lot of key pieces of information that we will absolutely make accessible to you after the presentation.

Okay, so we've got the same kind of things across emails and text messages. We can look at where it's coming from. Either that email address that sent it to us or the mobile number that sent it to us. We can also look at where it's asking us to go. Whether that's a link it's asking us to click on or an email address it's asking us to message. And we're just checking to see if that aligns with the genuine website of the organisation that we're dealing with.

If anything doesn't match up, if there's any reason to be a little bit suspicious and the best thing to do is step away from that text message, step away from that email and not engage with it at all.

If you're really concerned in contacting that organisation directly through alternative means is a really good step to take that way you can confirm that email or text message as a scam or maybe it is actually legitimate in the end. And then you can follow through with any actions that you may need to.

[Slide change] Okay, so the next thing that I want to talk about here is what's called a remote access scam. Now sounds quite technical. Basically what this means is where a scammer that persuades you to give them access to your device. Now that may be a mobile, in most cases it's a computer. And the way that they get access to that devices by getting you to download what we call remote access software.

Basically, that just means being able to access a device, whilst being remote. Outside of the, actually physically being able to access that device. Often this happens in the way of a phone call. So the typical cases that we see, you know, where someone calls you up out of the blue.

And they often claim that there's some kind of issue with either your internet connection, your device itself, or whether your bank account. After trying to convince you of this issue, what they'll ask you to do is download remote access software.

There's a few different types of this. The biggest ones that we see are things like Team Viewer and any desk. Once you download that software and you give them access to that software, they can essentially access your whole computer.

And now what happens in these cases often is that they'll open up your browser and they'll try to automatically log in to all the accounts you have online. Now if you save your passwords to your browser or if you, auto log into certain accounts, then they've probably got direct access to those accounts.

If you don't, then typically what they ask you to do is simply log in whilst they're in that remote access session.

[Slide change] Some red flags to look out for. The reality is, remote access software is a genuine tool used for genuine reasons. Unfortunately, the bad guys use them for malicious reasons. If you get a call out of the blue and they claim that there's some kind of issue with anything, you're internet, your device, your bank account. And they ask you to download some specific software.

That's a really big red flag. So call out of the blue, claiming to come from some kind of technical expert, then they claim that there's an issue with your internet or your bank account, they ask you to download remote access software and then they either request that you log into certain online accounts.

These are all really big red flags that you may be dealing with a remote access scam. And so the number one thing that I want you to take away in this type of scam is that unsolicited contact so a call out of the blue claiming that there's a technical issue.

If you get a call and someone asks you to download any kind of software, the best thing to do is to terminate that call. Now the other thing that you'll probably find in these situations as you are dealing with a scammer over the phone. Is that when you say, I'm sorry, I'm not comfortable with this, I'm going to terminate the call, the scammers often get quite upset with that. If you're dealing with someone genuine, their response to that's going to be, okay, you can call us back at a time that suits you.

 

If you're dealing with a scammer, they're probably going to get quite upset with us. They're going to try to convince you even further that the issue at hand is really pressing. You need to deal with this then and there, and that's another really big red flag that you're probably dealing with a scammer.

The best thing to do with these types of things, if you get a call out of the blue from anyone asking you to download software is to simply hang that call up and call that organisation back directly. Have a conversation with them. Navigate to their website.

Log into the account yourself, the same way that you always do, and see if there are any issues with your bank account. If you're internet working perfectly fine that's a good indication that there is no issue with your internet and you can carry on with your day.

Any calls out of the blue asking you to download remote access software should spin up that red flag.

[Audio: Host/Hadyn] Yeah. I was going to say terminate the call sounds incredibly harsh and it is it is tough for New Zealanders to, to simply just hang up on someone. But places like banks and things, they now understand that these scams are happening and so they are more accommodating when when you say things like that.

[Audio: Speaker/Sam] Yeah, absolutely. Again, it comes back to if you're dealing with someone genuine and you say, I'm sorry, I'm just not comfortable with the call of this moment.

Or maybe even a different kind of narrative. You know, I've got something else to deal with but I will call you back and deal with the issue a little later date, someone genuine is going to be okay with that and going to accommodate that request to call back.

[Audio: Host/Hadyn] Okay.

[Audio: Speaker/Sam] Someone not genuine, a bad actor, a bad guy, a scammer, they're going to try to convince you further that you need to deal with the issue at hand, then and there.

[Audio: Host/Hadyn] And they will try to sort of blind you, with techo babble as well they try and, you know, you need to recalculate your server to blah, blah, blah, and I'm going to need some software to do this, right?

[Audio: Speaker/Sam] Yeah, so a lot of different narratives used to try and get you to and install that software. But the thing that I want you to remember is that any request to download any software should should be a red flag for us.

Okay, now the next one. The other thing to remember is that a lot of these things are kind of scary and we're talking about the big bad things that can happen. There's a key that I want you to take away with each one. We're kind of talking about it as we go through.

But there are some simple things that we can do to stay nice and safe. So I don't want you to be too afraid when we're talking about these things. The internet is still a good place and there's a lot of good things about it.

[Slide change] One of those things is actually finding partners online. I know a lot of people that have met their partners online. But unfortunately there are some risks when it comes to looking for romance online.

Dating and romance scams is unfortunately another thing that we see, commonly reported to CERT New Zealand. And basically this is where scammers will use social engineering techniques to build a relationship with their victim, with their target and then leverage that emotional relationship for things like financial gain or services.

[Slide change]  So what is this look like in practice when you've meet someone online you start talking to them and the relationship moves really really fast they start saying things like I love you very very quickly and then they've very quickly moved to requests of money. Financial aid. Often there's a bit of a sob story to come along with that.

There's a family emergency, a business emergency, a personal emergency and they need some help with some money so that they can deal with that with whatever that emergency may be. So the key red flags to look for in these types of scams, where you've met someone online and typically they're going to be based overseas.

When there's a lot of excuses why you can't meet up with them, why they're not returning to New Zealand, why there's no opportunity for things like video calls or phone calls.

They use very intimate language very quickly you know that relationship moves very very fast and they're trying to build their relationship and build their trust.

And then they very quickly move to having an experience personal business emergency and requests for things like money or loans. Often this comes in the form of I just need a little bit of money so I can buy a plane ticket so that I can return to New Zealand.

These are all really big red flags to take away from this. And the key here is when that conversation moves very quickly, when there isn't that kind of engagement of things like video calls, voice calls, or meeting up in person and then those requests for money or financial aid, that's probably most likely a scam.

Now these can be really tricky. It's often very hard to acknowledge when we're building relationship, we genuinely think we're building a relationship with someone and then those requests for money come through it could be hard to acknowledge that we may be dealing with a scam, especially because we've invested our time, we've invested our emotional energy into these types of things.

But if there's anything like these red flags that we're talking about that are popping up in the best thing to do is to step away from that conversation because we're likely dealing with a scam.

Unfortunately, in these cases when things do go wrong, it's not just the financial loss that's a big deal, it's also the emotional harm that's happened as a result and unfortunately these scammers that are involved in these types of things, they don't care so much about that. And so we definitely wan to see people protected from these things and not entering in and providing money or financial aid to these kinds of dating and romance scammers.

[Audio: Host/Hadyn]  I, I guess it's one of those things that, it feels like, most people would be, oh no, I would definitely spot that, sort of thing. And, and we've seen over and over the case that it's No, people don't spot them. These scammers are very, very sophisticated, very sneaky in what they do. And you know, they take photos of other people and say, this is what I look like and and so forth.

[Audio: Speaker/Sam] Yeah.

[Audio: Host/Hadyn]  So I guess again the preying on the the idea of embarrassment and that you won't tell people that you'll that you'll hide the fact that you've been asked for. You've been asked for money from, from someone overseas, that sort of thing.

[Audio: Speaker/Sam] Yeah, absolutely. What we actually sometimes see is that people are so convinced by the relationship that when they attempt to transfer money. And their bank actually warns against that and they may be suggest, hey, this doesn't look quite right.

We think this may be a bit of a scam. That they actually proceed with that anyway. If you are in one of these situations and you do get a your bank coming back to you saying we don't think you should go ahead with this transaction with this, this payment that we think it may be a scam, the best thing to do is to listen to them in those cases. They can see a lot of information on on their end of things that we can't see as consumers.

And so if we get that warning, it's definitely best to follow along. Fortunately the reality is that sometimes, sometimes you may be a family member or a loved one who notices that someone you care about may be, that falling victim to something like this.

And the best thing to do is take note of these red flags and if you start seeing these things popping up in this situation is simply to have a conversation about it. It be understanding there's emotional investment that's gone on here. Reach out to organisations like CERT New Zealand who maybe would be able to provide a bit more additional information to help you help your loved ones see that they may be dealing with a scam.

Again, that number one thing to take away here is that if you're getting involved in an online relationship and it moves very very quickly and then it moves to requests of financial aid or money, it's most likely a scam.

[Slide change] The last one that I want to talk about today is investment scams. And the reason I want to talk about this is often people in this age group may actually have some money sitting in the bank, pension funds, things like that, that they could potentially invest in sometimes scammers are actually going after those types of things.

Now, investment scams can look a little bit different, this can be you more standard sort of investments that have been around for a long time. Sometimes this is under the guise of things like cryptocurrency. The goal here is for a scammer to get you to provide money into an investment opportunity, so that they can ultimately steal that money away from you.

[Slide change] There's a couple things to look out for here again and there's a there's a trend that starts to appear across these different types of schemes is when a investment company or organisation reaches out out of the blue, that unsolicited contact. That's actually illegal for financial service providers to do in New Zealand. So if you get contacted out of the blue if you get called with an investment opportunity. It's actually not something they're allowed to do. So that's our first red flag.

Now the second one is again that sense of urgency, that time pressure, you know, the offer that they're calling you with is going to expire really soon is that time crunch to get involved.

Usually the offer is going to be too good to be true offering really high returns at a really, really low risk. And then the last thing that we can look for is when the investment company or the advisor is based outside New Zealand.

And they may not have the same sort of consumer protections if they were based in New Zealand.

Now in order to provide financial advice and guidance with a New Zealand to New Zealanders they do need to be registered on what's called the financial service providers register.

We've included a link to that down below. So if you were contacted by someone, offering the investment opportunity offering financial advice or guidance, you can actually take the organisation name and you can look it up in this register and if they're not in there, then they're not allowed to provide you that advice and guidance.

The biggest things to remember here is if the offer is too good to be true, if there's that time pressure around that offer, if it's really high return with really low risk, it's probably something we're dealing with as probably a scam.

Couple things to look for. We get called out of the blue and they're offering that financial advice and guidance, that's something that they're not allowed to do. We are probably dealing with a scam again.

And then if you want to take it a little bit further, you can look for that organisation on the financial service providers register. And you can actually see whether or not they're in there and actually allowed to offer you that advice and guidance.

The other thing I really wanted to quickly talk about with investment scams is that often what we see is that the initial part of a dating and romance scam often leads to these investment scams.

So you start building a relationship with someone online. That trust that relationship begins to grow and then rather asking you for money for something like a flight home what they actually offer as an opportunity to get involved with this really great investment opportunity.

And so they build that trust. They get you to believe what they're offering is genuine and then they get you to invest in that scam and they take all that money away. Again, I want you to remember that the offer is too good to be true. These really high returns and really low risk, it's probably a scam that we're dealing with there as well.

[Audio: Host/Hadyn]  Is, is one of the things to look out for, like how you're being contacted as well?

Like, for example, I'm not expecting a financial advisor to message me on Facebook suddenly is that is that something else we need to be looking out for?

[Audio: Speaker/Sam] Yeah, definitely. That's a really good call out as well. And something to keep in mind as how you've been contacted by the organisations that you've had business with in the past. So if you bank with someone and they always send you an email. And then suddenly out of the blue you've got a text message from them that's a really good indication as well.

So keeping in mind how we usually get contacted by these organisations, there's a really good call out there as well, Hadyn.

Now that's actually reminded me. One good piece of good news that has come out recently here in New Zealand is that all the banks have gotten together and they've agreed that they will no longer send text messages to their customers.

That include links to websites. So if you get a text message and it claims to come from a bank in New Zealand and it includes a link for you to click on, the banks have agreed to no longer do that. So that's probably a scam that we're dealing with as well.

It's a really good thing to remember. And it's a good piece of news to come out and the New Zealand landscape recently.

 

[Audio: Host/Hadyn]  And just one last thing on investment scams, the Google ads, like if I if I look up I'm looking to invest blah blah blah in New Zealand, scammers are setting up their own websites so that it'll pop up in Google now. Like making it even harder to tell that their scammers.

[Audio: Speaker/Sam] Yeah, unfortunately that is true. And I guess the key thing to take away there is just because something returns in a Google web search or even returns high in those search results does not mean it's genuine.

The best thing to do in these cases is look for New Zealand based organisations so that you know that they have to be beholden to New Zealand consumer laws and protections.

That way they also need to be registered on that financial service providers register. If you are looking for investment opportunities and you want to make sure you're staying a little bit safe, you're using something like Google to find these opportunities.

Just because that research result comes from Google does not mean it's necessarily genuine. Look for those New Zealand based organisations. Look for those dot co dot NZ's. And then do a little bit of additional research as well. Make sure they're on that financial service providers register. And those things will go a little bit further to keep you nice and safe.

[Slide change] Okay, so there's a few things that came out of all these different types of scams, trends that we can see across them and the biggest one being often cases these come out of unsolicited contacts.

Now, romance and dating scams that's a little bit different you know you're probably on a website you're on a certain platform looking to build that kind of relationship with someone but in the case of the phishing emails and text messages in the case of the remote access scam calls or scam calls in general, in the case of the investment scams, a lot of the time, these come out of unsolicited contacts. So we've been completely contacted out of the blue, we haven't done anything to initiate that contact. We've just received that text message or that email or that phone call completely out of the blue, that's definitely something to be, to be wary of.

And the the other trend that we can see across all these things is with is that really strong sense of urgency created.

So that text message claiming to be from our bank where our account has been locked down. That a remote access scam with is with is a really major issue with our internet connection or our computer, that dating a romance scam where they've got a really serious personal emergency and they need help they need some money to help with that situation or even those investment scams where you know it's a limited time offer and it's going to expire really soon. You've got to get involved now otherwise you're going to miss out.

All of these things are trying to create that sense of urgency, trying to get us to click on those links, provide that information, provide our credit card details without really thinking the situation through. So if we get contacted out of the blue and there's a really strong sense of urgency, those are a couple of good things to keep in mind that may suggest we're dealing with a scam.

And I just want to reiterate those key points for each one. So with the phishing emails and text messages, we're looking at the email address it's been sent from or the phone number it's been sent from.

 

With the remote access scam. Whenever we get a call out of the blue asking us to download software, that's a really good indication it's probably a scam.

When we're dealing with those dating and romance scams and the relationship moves very fast and then quickly shifts to request of money or financial aid.

It's a good indication of a scam as well. And then lastly, that investment scam with the offer is too good to be true, really high returns, really low risk, limited time offer.

Contacted out of the blue. These are all good indications that it's probably a scam that we're dealing with. And again.

[Audio: Host/Hadyn]  In some ways, would, you say it's just said it's a little bit like, when you get the, people selling stuff at your door, you know, it's a call out of it's a knock on your door out of the blue and you're like, this doesn't seem this doesn't seem right. Doesn't seem, I don't feel comfortable giving you my credit card details. Similar kind of vibe?

[Audio: Speaker/Sam] Yeah. Yeah, absolutely. And I think you've highlighted something really important there again, is that if there's anything that that makes us suspicious or makes us concerned that we might be that a scammer has approached us, the best thing to do is simply to step away from that contact. No longer engage with that phone call, no longer engaged with that text message, no longer engaged with the email, even if you've had a bit of a conversation back and forth, you're completely within your rights to step away from that contact, step away from that conversation if you have any reason to be concerned.

And if you are in their situation, then you can reach out to organisations like, CERT New Zealand.

And all you need to do is go to cert.govt.nz You can report any kind of cyber incident to us. We can give you a little bit of additional advice that may help you determine whether or not you're dealing with something genuine or if you're dealing with a scam.

[Slide change] Okay, there was a lot of really scary stuff. A lot of big bad things out there, but the good news is additional to the keys that we've already talked about to spot these types of things, there's some additional steps that we can take to keep ourselves nice and safe. Now, They're all going to be five tips on screen.

I'm going to jump through the first four pretty quickly. If you do want any additional information on any of these things that we're talking about you can find that information on OwnYourOnline.govt.nz. But I do want to reiterate that we're going to make all this information available after today's webinar.

So you don't have to take notes on everything. You are looking for additional information it is available to you.

[Slide change] The first one is passwords.

[Audio: Host/Hadyn] Yeah, actually, sorry, Sam before you get into that. Yes. Once again, we, this, the, we'll make all the slides available, all the links will be available. And so will this presentation because we're recording this, this is going to be available to watch on demand online.

So if you've got it we've noticed earlier that some people were having problems with the audio so this will be on again and you'll be able to crank the audio up as loud as you need and yeah you'll be good to go.

Sorry, Sam, carry on.

[Audio: Speaker/Sam] No, no worries at all. A very good interjection. Okay, so the first things with passwords, knowing passwords can be a little bit tricky, but there's a few keys with passwords. And all I really want you to do when it comes to passwords and making sure you have good passwords is focused on your most important accounts.

So we're thinking about things like our bank account here. That controls all our money, thinking about things like our email accounts that's usually associated to all our other accounts and then maybe things like our social media accounts.

A long strong and unique password is what's going to keep us nice and safe and often the easiest way to come up with a long and strong password is to think of something like a passphrase.

So four or more random words put together that can often create a really long password and it can still be nice and strong but it's also easier to remember than a totally random password of 15 characters or more.

The biggest key when it comes to creating our passwords is just to make sure that we're not using information that can be easily found online. So where we use our pets name, but we have a whole gallery of of our pit on our Facebook account and it's got the name of the pet there.

Where that personal information is easily accessible online and can often make those passwords a lot easier to sort of guess and crack by the bad, by the bad guys.

The longer it is, the stronger it is. A passphrase can help you to create a nice long strong password and using a unique password on those really important accounts, there's a great step to take. Again, just start with those important accounts though. Start with your bank account, start with your email account.

You get really good passwords there, that's going to go a long way to keep you nice and safe.

[Slide change] Two-factor authentication sounds very long and confusing. All it is is additional layer of protection as well as our password. Again, all I want you to worry about is those really important critical accounts for things like your bank account. Things like your email account. Two-factor authentication is essentially enrolling a mobile number to that account so that when you log in you'll get text a code.

You need to enter that code in order to log in. And this just gives you an additional layer of protection on top of that password. There's a few different ways that you can do two-factor authentication and it's often called a lot of different things.

Two-factor authentication, multi-factor authentication, two-step verification, the list goes on and on. It is all referring to the same stuff and usually it's that text message that contains a code that you need to enter in order to be able to log in. It's a little bit confusing if you do want a bit more information on two-factor authentication, I do encourage you to check out OwnYourOnline.govt.nz.

[Slide change] Updates. So this is just keeping our software updated. Now if you use a computer or a phone, you probably get little pop-ups saying, hey, there's a new update that you should install tonight. And we've all probably had remind me later, remind me in seven days, remind me down the line.

I'm too busy right now.

Updates are just often addressing security vulnerabilities that pop up. So installing those updates as soon as you can, will keep you nice and safe from any of those vulnerabilities.

[Slide change]

[Audio: Host/Hadyn] And if you can find the sitting to do them automatically because it does it in the middle of the night when you're asleep and you don't have to worry about it at all.

Fantastic service.

[Audio: Speaker/Sam] Yeah, nice and easy. We've already talked about privacy a little bit just in the sense of that personal information that can be found on your social media accounts being used against you.

Being mindful of our privacy is a good way to keep that personal information nice and safe. So if we do use things like social media, switching those privacy settings to either fully private or so that only our friends can see our information is a really good step to just keep that personal information nice and secure.

[Slide change] But the one that I want to talk about mostly today is stopping and thinking. And this is just about taking a moment to think when we do receive these types of things. When that text message comes through that claims is an issue with our bank account rather than clicking on that link and following the instructions out of any kind of panic sense of urgency, I just want you to take a moment, stop and think about it. Think about things like does the mobile number it's come from look right does the link it's asking me to click on look right hang on I know that banks aren't sending text messages with links anymore.

This doesn't make sense. Taking that moment and thinking through the situation and if there's anything that pops up as you're thinking through it that gives you calls for concern that raises itself as a red flag.

They need a disengaging with that completely or looking at additional resources like CERT New Zealand and like Own Your Online to try and help you determine whether or not you're dealing with a scam, is really important. And the reality is, it's better to take a moment, stop, think, disengage, even if it turns out that that contact is genuine, then it is to click on that link out of any kind of panic, provide that information, follow those instructions.

It's far better to step back, disengage, and think about it, get a little bit more information.

It's better for your bank to call you two times or text you two times than it is to click and engage and end up being a scam. And just a couple of things to remember here when we are taking that moment. Is it unsolicited contact?

Has it come totally out of the blue? Does it try to create that sense of urgency, that sense of fear or that sense of panic?

Is whatever contained in their message too good to be true as it an offer that doesn't seem quite right that investment opportunity has way too high returns with way too low risk, these are the kinds of things that we want to think about as we're looking at those.

[Slide change] And then the last thing that we really want to get across today is where you can get some additional help. Some additional support either with the incident itself or with some learning for additional things. We're going to talk through a few different resources today.

 

[Slide change] The first the most important one is that you can report any of these incidents any of these scams any kind of cyber security concerns to, CERT New Zealand.

Again, just head to cert.govt.nz, if you're on Own Your Online if you're on that website there's also easy links to the CERT website to report any kind of incidents you may be going through there.

You can report anything to us even if it's just an email. That you are suspicious about and you're looking for additional information. We can we can look at a few different things. We can investigate a little bit further to help you determine if you're dealing with a scam and it's getting far better to reach out before something goes wrong and get additional information to help you figure it out. If you have clicked on that link if you have followed the instructions then it's also really important to reach out for some help too.

There are some actions that can be taken and maybe your report actually helps to keep the next person safe as well.

Now, can be really hard to know where to report all these different things to. So as Hadyn said at the start, if you report it to, CERT New Zealand and it doesn't belong with us we will do our very best to make sure it does end up with the most appropriate organisation.

One thing I want to call out specifically is that if you've had any kind of cyber security incident, any kind of scam occur and you think you've lost money, the most important thing to do is let your bank know as soon as possible. So again, it's really important that even if you do feel some embarrassment, not to let that prevent you from reporting.

[Slide change] The sooner you let your bank know that there may have been some financial loss, the more likely they're going to be able to help you recover those funds and prevent any additional losses. So what we've done is just collected a bit of information around all the major banks here in New Zealand.

So the phone numbers that you can call if you think you might be telling with a scam where you may have lost some money and then links to their online, websites where you can also report these kinds of things. The other thing that I'd encourage you to do is with your particular bank, have a look at their website, navigate the sort of online security area a little bit. What they often do is collect really common instances of scams that they see. That affects their customers. So you may be able to even see specific examples to help you spot them if they ever come through to you.

Let your bank know as soon as possible so that they have the best chance to help you recover those funds and prevent any further losses.

[Audio: Host/Hadyn]  So, I'm just a little bit conscious of time. We've got 10 min left and we've got some really good questions. So I think, we'll go to the question answer section.

[Audio: Speaker/Sam] Yeah. Oh, of course. Just one thing I'll add very quickly

[Audio: Host/Hadyn] one more, one more thing

[Slide Change]

[Audio: Speaker/Sam] Check out check out your local Age Concern.

[Audio: Host/Hadyn] Oh of course!

[Audio: Speaker/Sam] They have a lot of really great resources and a lot of courses a lot of one on one sessions for things like digital literacy just helping you to use your mobile phone, use your computer, navigate the internet, all these kinds of things, check them out. They have some really great programs and resources that may help you learn a little bit more.

Now we can go to the questions.

[Audio: Host/Hadyn] And now we'll go to the questions, thank you.

[Slide Change]

[Slide Change]

[Slide Change]

[Slide Change]

[Slide Change]

[Slide Change]

So we've had a couple of questions about antivirus. So antivirus and on your computer and and is that safe? Against scams and viruses.

[Audio: Speaker/Sam] Yep, so that can actually help you prevent your devices from being infected with scams, with viruses. So one of the common things that we also see is that when you get one of those dodgy emails rather than asking you to click on a link rather than asking you to email a certain address, they may ask you to click on an attachment.

And an often cases what that's trying to do is install some kind of malicious software to your device. So, having, excuse me, having some kind of antivirus software can help prevent that from happening and also give you a tool if you think it may have happened.

You can do a scan on your computer to see if there's anything malicious or there. But the good news is that a lot of devices these days come pre-installed with some kind of software.

So if you have a Windows device for example, that actually has what's called Windows Defender on it, already built and good to go. And in most cases you don't need to go out and buy additional pieces of software to help keep yourself nice and safe.

If you're looking at buying a device, maybe check out if they come with something pre-installed so that you can save yourself a little bit of extra money having to go out and buy that additional software. Okay.

[Audio: Host/Hadyn] And I guess on your mobile, make sure that you only get apps and things from the official stores and and so forth.

[Audio: Speaker/Sam] That's right. Yep, absolutely.

[Audio: Host/Hadyn] Yeah. We've had two questions which are kind of connected with which essentially, where are these scams coming from around the world and do we work with law enforcement agencies to try and get get these scammers.

[Audio: Speaker/Sam] Really good questions and the truth is that they can come from anywhere around the world. That's the unfortunate nature of the internet is that there is no clear jurisdiction when it comes to the internet there are no boundaries.

There are no borders so we see these things coming from all over the world. There's no particular place that we can point to but the good news is that we work really closely with the New Zealand Police cybercrime unit and we also work really closely with similar organisations all around the world.

So we're the CERT for New Zealand, but there are a lot of different CERTs all around the globe, CERTs for different countries, different companies, and we're part of that network of CERTs so if something we see is actually coming from another area and there's a CERT there we can get in touch with them we can provide them that information we can get in touch with the New Zealand Police and they can work with the Account Depart law enforcement's wherever necessary.

And that's another reason why it's so important to report these types of things because we can share that information and it can go a lot wider even into those international networks.

[Audio: Host/Hadyn] Yeah, we I remember a few years ago we had some reports of scams coming out of I think it was Australia, but it had made its way around the world and they were like, well, New Zealand's going to be next and so we sort of had a bit of an early warning system and that meant that we were able to help the next country along the line and so forth. So all of that stuff is very, very useful and again reporting it is incredibly helpful to everyone in the country.

So there's someone who's posted a very sad thing. They received an email from their deceased daughter. So how do they go about like blocking or reporting that sort of thing?

[Audio: Speaker/Sam] That is a very sad situation to hear about. You can obviously report that through to CERT New Zealand and we can give you a bit of direct advice but the most the probably the easiest thing there is within your email client if you click on the email address it's come from typically this may be a

[Audio: Host/Hadyn] Sorry, sorry, Sam, when you say email client, do you mean like Gmail in your browser?

[Audio: Speaker/Sam] That's right, yep!

[Audio: Host/Hadyn] Okay, cool.

[Audio: Speaker/Sam] Yeah. Whatever kind of email you use that may be Gmail, maybe Outlook, few different ones out there.Look at that email. Navigate to the email address itself. Typically this will look like a right-click. That should bring up an additional menu and then somewhere in that menu should be an option to block that sender specifically.

That's probably the best thing to do in that case, but again, if you report that through to CERT New Zealand, we can give you a bit of specific direct advice on how to do that.

[Audio: Host/Hadyn] Yeah, especially if you think that that person maybe has somehow gained access to their, to their email account. That that that is something that we can also potentially help with.

The question, I've, I've read that text in regard to 2FA, I've read that text with codes can be intercepted by the scammers.

Is this true?

[Audio: Speaker/Sam] Typically, yeah, intercepted it is maybe the wrong term here. Typically what we see happening in the space is that actually 2FA, two-factor authentication, has such a strong control that it prevents access of the scammers or of the attackers and so what they now need to do is somehow get a hold of that code.

Typically, the way we see them do this most often is by way of social engineering. So it's probably a phone call in most cases where they claim to be from a reputable organisation, they claim to have sent you a code directly and that you just need to provide that code to them so that they can unlock your account, put that transaction through whatever the narrative may be.

What we often don't realise is that when we give them that code, that code was actually for something else entirely, and we've just given them our two-factor identification code.

So this is a common thing that they try to do because 2FA is so powerful. And the most important thing here is to take, take note of what the message says when it contains that code.

So usually the message should say something like this is your two-factor authentication code for your Facebook account, for your Microsoft account, whatever it may be.

And then making sure that if we get any calls out of the blue asking for codes, actually they shouldn't be doing that in most cases.

So if you get a call of the blue, someone's asking you for a code that you've just been sent, the best thing to do is probably not to provide that code at all. But take note of what they're asking for, what they're saying the code is for and what the text message is saying that the code is for and if those things don't line up, it's best not to provide that code at all.

Now there are some technical things that can go on in the background, but that's usually where our device has some kind of malicious software installed and in those cases it may be able to actually intercept that code but it's a lot more common and we see a lot more frequently those social engineering tactics to try and capture those codes.

[Audio: Host/Hadyn] And we go a couple of questions about password managers. So I'll just password managers for those of you who don't know. A piece of software that you can have on your phone or on your computer that's essentially a digital vault.

So you have one password to get into that digital vault and inside that is all your other passwords and logins and it's a it's a nice useful way to go about remembering all these incredibly difficult passwords.

So, One of the questions was simply what about password managers should we use them?

And the other question was the suggested strong passwords that that get put in by these password managers. Are they safe? Are they are they good to use?

[Audio: Speaker/Sam] Yeah, that's really good question. Now, password managers are amazing. And if you're, if you're looking at that, if that's something you're considering, I do encourage you to to look down that route.

I personally use a password manager. And it's made my life a lot easier. Because yes, the generated passwords, the suggested passwords that those things create typically they're about 30 characters long. Totally random. Random uppercase, lowercase numbers, symbols, those passwords are really, really strong and it would take a computer.

Trillions upon trillions of years to try and crack those passwords. And that's why password managers are so powerful. Essentially all we have to do is remember our one master password for that password manager. And in that password manager is going to create and save all our other passwords for all our online accounts.

Now when we have like a hundred, 150 online accounts that makes things a lot easier. But it is really important that you make sure that the master password you use, that password that you use for your password manager is really long, really strong and it's completely unique. So it's not a password you used anywhere else it's not built from that personal information that may be able to be found online. It doesn't use any really common passwords that we see used all the time.

We need to make sure that that password is long, strong and unique so that it keeps all our other passwords nice and safe.

[Audio: Host/Hadyn] And yes, and you make sure not to forget that password as well, because that's a, that's a problem if you forget their main password.

And I, I don't know what your thoughts are on the Sam, but I find you can write that password down. Keep it in a locked draw in your house. As long as you don't say what it's for, if you just keep that password somewhere, what do you recon about that? Please don't go through my draws.

[Audio: Speaker/Sam] Yeah, that's a good point. And often this is the question that gets asked, well, okay, how am I supposed to remember all these different passwords? What if I write it all in a book and then I've got a book that keeps on my passwords nice and safe?

And you pointed out something really important there Hadyn, if you do choose to go down that route, look, it's not the most secure way to story or passwords, if you choose to go down that route and the best thing to do is make sure that you're keeping that book, that piece of paper, whatever it is, you keep that nice and safe.

So that might look like putting it in a locked drawer, a safe box, maybe even a full blown safe. Anything that you have to make sure that only you can access that book or where you're storing those passwords.

As long as you're taking that step and making sure that it's kept nice and secure, nice and safe and only you can access it. Then that's still going to go a decent way to keep those passwords nice and secure. If you have anyone coming over, make sure you put it away, make sure you lock it up.

And then that will, make sure that those passwords are kept nice and secure as well.

[Audio: Host/Hadyn] Cool, we've hit our time limit, but we do just have one more question that I think that you can probably answer very very quickly.

And that is, are those four digit phone numbers that you get text messages from? Are they always safe?

[Audio: Speaker/Sam] That's a good point. Not always the case. And again, it kind of goes back, goes back and forth.

So not always when you get a text message from four, a three or four digit number is it going to be absolutely genuine and not always when you get a text message from an individual mobile number as it always going to be suspicious.

This is just a good red flag to look for. Take that into consideration with the other things that we've discussed if there's a couple things that add up that make you a little bit suspicious.

It's a really good indication. I'd say the vast majority of cases. Big organisation, reputable organisation is probably going to use those short codes and if it's not come from a short code that's a really good indication it's a scam but it is not necessarily a catch all.

[Audio: Host/Hadyn] Excellent. Well, thank you so much, everyone, for joining us today. There's a couple more questions, but we'll try and address those maybe, maybe online maybe on our Facebook page.

Thank you again for coming along. We're hoping to do a few more of these over the year and we will again have this available for you to watch on demand and we will send out the links and all the and all the slides and stuff so once again thank you very much and hope you have a wonderful rest of your day.

[Audio: Speaker/Sam] Thanks everyone. Have a good day.

[Recording ends].