{"id":11321,"date":"2019-07-31T13:26:44","date_gmt":"2019-07-31T17:26:44","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11321"},"modified":"2019-07-31T13:27:43","modified_gmt":"2019-07-31T17:27:43","slug":"equifax-settlement-dont-get-phished-by-scammers","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/equifax-settlement-dont-get-phished-by-scammers\/","title":{"rendered":"Equifax Settlement: Don\u2019t get phished by scammers"},"content":{"rendered":"\n

The Equifax Settlement Website is easily spoofed, and it’s already happening.<\/h2>\n\n\n\n

The Equifax Data Breach<\/a> resulted in the credit bureau agreeing to a $650-700-million settlement. Those affected had a choice between free credit monitoring or a $125 payment. <\/p>\n\n\n\n

Unfortunately, the internet is full of cretins, some of whom have decided to re-target the victims of the Equifax data breach by creating phishing sites that dupe Equifax\u2019s settlement page. And while that\u2019s incredibly repugnant, it\u2019s also \u2013 unfortunately \u2013 going to be pretty effective, too. <\/p>\n\n\n\n

Not that the real website made it too difficult. <\/p>\n\n\n\n

So, today we\u2019re going to talk a little bit about the Equifax settlement, how to file your claim and what to look out for. <\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

Pony up, Equifax<\/h2>\n\n\n\n

This data breach has been disastrous for Equifax<\/a>. Not only was it breached, but an expired certificate prevented Equifax from discovering the attack for 76 days<\/a>. It\u2019s already cost hundreds of millions of dollars \u2013 and that figure could balloon into the billions \u2013 in addition to causing Equifax to have its credit rating reduced. There\u2019s an irony to that, but the time for dunking on Equifax is probably over. It\u2019s paying handsomely for its mistakes now.<\/p>\n\n\n\n

\"Equifax<\/figure><\/div>\n\n\n\n

Case in point, that massive settlement Equifax agreed to a\ncouple weeks ago. Customers were given a choice between free credit monitoring\nor $125. And considering what Equifax does, and who it keeps the closest tabs\non, a lot of the victims already know their credit is messed up so that $125\nsounds pretty good. Frankly, if my information was ever used for financial\nfraud my credit score would probably actually improve \u2013 so, gimme that check. <\/p>\n\n\n\n

Anyway, Equifax has set up a website where people can file their claims and enterprising criminals have already spoofed it, attempting to re-victimize these people. And here\u2019s the problem, people are going to come out of the woodwork to claim their part of this settlement \u2013 many of whom are not especially adept at the internet<\/a>. I\u2019m speaking specifically about the elderly (and troglodytes \u2013 there\u2019s likely some overlap there). These people make great marks. And that\u2019s exactly what these criminals are looking for. <\/p>\n\n\n\n

Yesterday Indiana Attorney General Curtis Hill warned the Hoosier state<\/a> about this exact thing:<\/p>\n\n\n\n

\u201cAnyone seeking to file claims at the new settlement website must absolutely make certain they are on the correct site,\u201d Attorney General Hill said. \u201cVerify that you have received the proper website address from a trusted source such as the FTC. If you are typing the URL manually, be careful to enter the website address correctly.\u201d<\/p><\/blockquote>\n\n\n\n

How to avoid getting phished when filing your Equifax claim<\/h2>\n\n\n\n

Let\u2019s start with first things first. Equifax is making all\nof its notifications via snail mail. Which is quaint, but also fairly\nconvenient because it means any email you receive from \u201cEquifax\u201d is a phishing\nscam. Period. <\/p>\n\n\n\n

EQUIFAX WILL NOT EMAIL YOU ABOUT THIS.<\/strong><\/p>\n\n\n\n

So if you get an email that looks like this (courtesy\nof the San Diego Consumer Action Network<\/a>): <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

It\u2019s fake. <\/p>\n\n\n\n

Do not fall for this. Now let\u2019s talk about the page itself,\nbecause this is the epitome of how NOT to assert the proper identity \u2013 and it\ncouldn\u2019t happen in a more critical situation. <\/p>\n\n\n\n

This is what the Equifax settlement page looks like:<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Let\u2019s start with the URL, which is descriptive but also\nfeels a little phishy. It really wouldn\u2019t be all that hard to register a\nsimilar domain name and fool people. I\u2019m not sure why this wasn\u2019t hosted on\nEquifax\u2019s actual site or on the FTC website, both of which would assert\nsufficient identity. Instead, this website is run by the settlement\nadministrator. That might be standard practice (excuse me, I left my JD at\nhome), but it also serves as a potential point of confusion. Who is JND? How do\nI know they\u2019re ACTUALLY the settlement administrator? <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Considering the people visiting this website have just had\ntheir data stolen, you\u2019d think they\u2019d put more effort into making sure those\npeople know they\u2019re on the right website.<\/p>\n\n\n\n

This would have been a perfect place for Extended Validation\nSSL<\/h2>\n\n\n\n

Extended Validation SSL certificates were designed explicitly to assert the maximum amount of identity. Using one adds a layer of assurance. When internet users arrive at a website they see the name of the organization running the website displayed prominently next to their browser\u2019s address bar. <\/p>\n\n\n\n

This would have been a perfect place for an EV SSL certificate.<\/p>\n\n\n\n

Now, I know you may be saying, \u201cEquifax isn\u2019t running this\nsite, what good would EV do?\u201d <\/p>\n\n\n\n

Just by virtue of its presence it adds an air of legitimacy\nto a website. No phishing website is going to be able to slap an EV certificate\non itself. And if someone has questions about who this entity is, EV provides a\nstarting point for that investigation \u2013 that\u2019s far easier than being forced to\ntry and find information in the footer or click through a privacy policy. This\nis information as verified by a CA. That inspires confidence.<\/p>\n\n\n\n

This does not:<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

In fact, this does the opposite of inspiring confidence, it\ninspires doubt. This website \u2013 of all websites \u2013 needs to take every possible\nmeasure to assert its identity and inspire confidence in a group of people that\nshould already be skeptical after having their data stolen.<\/p>\n\n\n\n

So, while there are criminals actively making spoof websites\nand phishing Equifax victims, the actual Equifax settlement site is making next\nto zero effort to make the endeavor more difficult for said criminals. <\/p>\n\n\n\n

That\u2019s why we\u2019re going to take a minute to show you how you\ncan SAFELY file your Equifax claim.<\/p>\n\n\n\n

How to file your Equifax claim and not get phished<\/h2>\n\n\n\n

Let\u2019s start out with the best way to get to the website,\nnormally they say to just type the URL in yourself, but with a URL like this\nthere\u2019s always the possibility of typo squatters, so let\u2019s go through the FTC:<\/p>\n\n\n\n

Step One: Head to the FTC\nwebsite<\/a>. Click on the link that says: File a Claim.<\/h3>\n\n\n\n

The website will warn you on the way out that you\u2019re heading\nto a new domain, nothing to worry about, it will redirect you in a few seconds.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Step Two: Check your eligibility<\/h3>\n\n\n\n

Not everyone is eligible to file a claim. As much as you may\nwant to, if you\u2019re not eligible it means your information wasn\u2019t compromised,\nwhich is ultimately a good thing. In the header, click on \u201cI would like to\u2026\u201d\nand select the top option, \u201cSee if my information was impacted by the 2017 data\nbreach.\u201d Once there, enter your information. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Step Three: Start your Equifax claim<\/h3>\n\n\n\n

If you\u2019re eligible, the page will indicate it and display a\nbutton that lets you start filing your claim. It will take you to a page where\nyou\u2019ll need to supply:<\/p>\n\n\n\n