By Kris McDowell
All too often there’s news about another scam trying to trick people into sending money or sharing personal information. Phishing attempts, malware, impersonators and online fraud are some of the many ways scammers attempt to defraud people near and far. Locally, the City of Portland has put together tips for knowing how scams work, spotting scams, how to verify a weird message, what to do if you do get scammed and basic precautions to protect yourself.
The City uses advanced technology and robust cybersecurity to protect information within their systems. But scammers sometimes obtain information that is publicly available by law. They may use this information to impersonate City employees and try to steal people’s money, obtain their personal information or install malware on systems. Scammers have targeted people who live or work in Portland; people who do business with the City, including vendors and suppliers; and people who have applied for licenses or permits.
Scammers use email, text or phone calls pretending to be from the City of Portland. These messages often look or sound official and can be very convincing. A lot of these scams have common themes, including convincing people to send them money by claiming that bills or fees owed to the City haven’t been paid; using an urgent tone or insisting people must act now to prevent consequences; tricking people into clicking on a link that installs malware on their system; and using fake forms that look official.
Scammers use messages that look or sound official with an immediate call to action. The email may contain a City logo or a text may use a person’s legal name. Red flags that should raise people’s suspicions include messages that are unexpected (outside of the routine notices or updates one receives); messages in a new or unexpected format (i.e. the water bill usually comes in the mail but a text or phone call comes in pretending to be someone from the City); payment is requested immediately; payment is requested through wire transfer, money transfer app or cryptocurrency; and the message asks for account or personal information. Scammers also use deceptive email addresses that look close to an official account (i.e. using “portland-or.com” instead of “portlandoregon.gov”).
If you receive a suspicious email, text or phone call claiming to be from the City of Portland, Multnomah County, the police, the sheriff or any local government, do not reply immediately. Rather, take a few minutes to stop and verify. One way to do that is to call 311. 311 call takers can help determine if the message is real or fake. Another way is to look up contact information on portland.gov to reach a City employee in the relevant department. Reach out to them and ask about the message that was received.
Suspicious messages should be handled with extreme caution. Do not open files or click on any links and do not reply.
If you have responded to a fraudulent message and gotten scammed, take action as soon as possible. The sooner action is taken, the better the chances of limiting its impact. If personal information has been provided or money paid, file a police report with the Portland Police Bureau by going to portland.gov/police/cor and scrolling to the bottom for “Get Started with Your Online Report.” Phishing, spam or fraud attempts can be reported to the FBI’s Internet Crime Complaint Center, ic3.gov.
Simple steps to limit exposure to scams include limiting the personal information shared online, using privacy settings, disabling location features and keeping apps and operating systems up to date. Passwords should be strong (not easy to guess and using a variety of characters), changed regularly and not be shared with others. Additionally, two-factor authentication (when available) and using a password manager are recommended.
Both at home and in public, use a secure internet connection and wi-fi network. Open/public wi-fi networks may lack strong encryption and security controls, meaning devices and data can be exposed to scammers. Encrypted connections will show a lock symbol or “https” in the address bar to the left of the website address.
Be careful with links and attachments. Hovering over a link (without clicking on it) will show the URL that the link leads to. Taking a minute to think before clicking on a link may save headaches down the road. If there is any doubt, do not click on it. Like with links, attachments should be regarded with caution and should not be opened from a suspicious message.
While scammers are always finding new ways to deceive people, you don’t have to fall victim to them. Pause and take a beat, even if the scammer is being tricky or intimidating. A bit of skepticism can go a long way.