Politicians Are Making Things Easy for COVID-19 Scammers
Tags: Technology, Covid 19, Cybersecurity, Scam

No one knows what tomorrow may bring, but I can say with absolute confidence that we’re going to be inundated with COVID-19 scams, and that the fear, uncertainty and doubt being spread by politicians is making those scams harder to detect.

By Max Eddy

The Coronavirus outbreak has affected millions of Americans. Most of us are stuck at home, apparently watching porn and not walking very much. Others are on the front lines pushing back against the outbreak, or at least lending their unused computer power. It’s a time of enormous uncertainty, and it’s only helping the bad guys that our politicians are putting out contradictory, confusing, and sometimes misleading information.

Fear, Uncertainty, and Doubt

In security circles, the concept of using “fear, uncertainty, and doubt,” or FUD, is often leveled against unscrupulous companies. A company is spreading FUD when it makes urgent claims there are boogeymen around every corner, and its product is the only thing that can save you. The boogeymen are often exaggerated and sometimes completely imaginary. FUD doesn’t even need to be particularly convincing; it just needs to create doubt in otherwise evident truths. In that context, FUD distorts reality to sell you a product, but we’ve all experienced some intense FUD reality distortion as of late.

My subjective reality about the severity of the pandemic situation shifted many times. I vividly remember hearing about the coronavirus for the first time in my kitchen, listening to the NPR Up First podcast. Since then, I (perhaps foolishly) attended the international RSA security conference in San Francisco, which has since resulted in several confirmed COVID-19 infections, and I continued to commute in Manhattan by crowded subway until March 11th. Since then, I have been working from my couch, kitchen table, and “standing desk” made out of a box of wine. I haven’t been more than 17 blocks from my home in more than a month.

That’s the kind of reality-bending that’s the background noise of any major natural disaster. Unfortunately, my own shifting experience has been mirrored by FUD from elected officials in the form of uncertain, contradictory messaging. On February 10th, Donald Trump said the virus would “miraculously” go away, and he has since veered wildly between somber warnings and impatient pronouncements. The Surgeon General first advised us to “ STOP BUYING MASKS!” on the last day of February; then recently (although it seems like several months ago), Governor Andrew Cuomo of New York ordered that masks be worn in all public spaces when social distancing is not possible. The back and forth between New York City’s mayor and the state’s governor over whether or not to close schools, issue stay-at-home orders, and so on is a head-spinning timeline on its own. I could offer any number of examples since then, on everything from miracle drugs to bleach, but by the time you read this, those examples will be out of date.

The warped reality brought on by this absence of coherent advice and basic facts has created the perfect breeding ground for online criminals. When people think of cybercrime, an image of someone in a hoodie with fast-moving fingers and green text scrolling on a black screen probably comes to mind. But most cybercrime is more akin to a traditional con: It’s just easier to convince someone to give up their private information willingly than to try and steal the information from a server (where it should be encrypted anyway).

Cybercriminals thrive on emotion because it short-circuits our better judgment. Sporting events and holidays are popular targeting times for scammers, because people want to watch their favorite games and get free or cheap stuff. And rampant FUD makes scams harder to spot. You don’t need a well-made phishing site when a population is left confused and frightened from a natural disaster. We’ve already seen quite a few COVID-19-related scams pop up. With the dearth of testing in the US, some scammers claim to offer coronavirus testing. Google reports that it’s blocking 18 million COVID-19-related scam emails per day.

In one of his rare sensible moves, Attorney General William Barr sent a letter to US attorney offices encouraging the investigation and prosecution of coronavirus-related scams. In the letter, Barr called out ransomware posing as a COVID-19 tracker for Android devices, phony cures, and bogus calls for aide. Barr wrote, “The pandemic is dangerous enough without wrongdoers seeking to profit from public panic and this sort of conduct cannot be tolerated.”

That’s good, but reality is still dangerously warped.

And Now There’s Money

Tax season is another time that’s great for scammers. It’s a time when people are doing things they almost never do, like sending tons of personal information to organizations they almost never interact with, with the hope of a big financial reward in the form of a tax return. Money and fear are the key motivators for tax scams, along with a healthy dollop of confusion that comes anytime you have to deal with a faceless bureaucracy like the IRS.

Now that the Congress has freed up money for just about every American, which is being disseminated by the IRS, the FUD of coronavirus is colliding with the annual fears and desires of tax season.

Unlike the rest of our political apparatus, the IRS was quick off the mark to identify potential scams. The $2 trillion aid package, signed into law on March 27th, included provisions for payments to individual Americans. On April 2nd, the IRS had an exhaustive post warning of various scams that could arise.

The post has lots of information and is worth reading if only to gain insight into the mind of a scammer. For instance, the IRS says to avoid any messages that, “emphasize the words ‘stimulus check’ or ‘stimulus payment.’ The official term is economic impact payment.” Also, as always, the IRS tends to communicate by USPS and not by email, phone, text, or social media.

But while the IRS works to put out good, clear information, it’s hampered in its efforts. An official IRS site to help you find your payment is frequently unavailable. Payments have been delayed or sometimes made in incorrect amounts. I am certain that scammers are watching and adapting their tactics.

The Best Disinfectant

Sunshine, unfortunately, may not kill off the coronavirus. Clear, authoritative messaging and accurate information given to the public, however, can greatly combat online scams by cutting through the FUD reality distortion. That information needs to come from all levels of elected government, but especially the White House, which has a unique position of authority in American life. Weeks into this disaster, however, the highest office in the land seems more interested in finding scapegoats, fomenting confusion over the stay-at-home orders that appear to be saving lives, and denigrating the media organizations that can deliver information on the scale required to protect us from scams and illness.

The end result is that it’s difficult to know what is real and who is telling the truth. The lack of reliable information from elected officials, particularly the White House, has created an enormous opportunity for criminals to prey on us. I’ve often written advice on how to spot these scams, but that kind of cool-headed analysis isn’t possible when going to the grocery store for food needs to be weighed against the risks of getting sick. It’s hard to check the sources when the information changes hourly, and we’re all desperate for protection.

Whether this unimaginable suffering could have been prevented is a debate better left to historians. But America’s haphazard, uneven response to COVID-19 is visible everywhere. There aren’t enough tests. Hospitals are overwhelmed. My home of New York City has seen more than 12,000 deaths (as of this writing) since the outbreak began. Illness and death have already touched my family, and by the end of this, most people will say the same. The virus is with us now and is likely to stay. Beating back the coronavirus will likely require years of work, but if elected officials can agree on the facts for just a short time and lay off the FUD, it could protect the most vulnerable of our population from opportunistic criminals.

Until that day comes, give yourself the time to think critically about the claims you read and hear and the messages you receive. We’re in this for the long haul.