Scams: Responding to Personal Fraud or Identity Theft

Account compromise is when a cyber criminal gains unauthorized access to your online account, whether by discovering your credentials in a data breach or tricking you into providing passwords or verification codes. 

Recovery Steps:

• Change your password to something long (15+ characters) and unique.
• If you reused the same credentials on any other accounts, update them with new, unique passwords immediately.
• Enable multi-factor authentication (MFA) on the account.
• Sign out of other active sessions or devices.
• Review account recovery email addresses, phone numbers, forwarding rules, and other security settings for unauthorized changes.

You can check if credentials involving your personal or work email address is in a data breach by using Have I Been Pwned? Visit Pwned FAQ for more information.

Device compromise is when an unauthorized individual physically or remotely gains access to the information on your computer, smartphone, or other mobile device. This can happen by infecting a device through a malicious email attachment, gaining remote control by impersonating the UTS Service Desk, or accessing an unlocked and unattended device left in public.

Recovery Steps:

• Disconnect the device from the internet if the scammer still has access.
• Remove unfamiliar remote-access applications or browser extensions.
• Update the operating system and security software.
• Scan the device for malware or viruses
• Change passwords using a different, trusted device.
• If a University-owned device was involved, report the incident to Information Security

Review our Device Security Checklist for tips to proactively protect yourself.

Financial fraud ranges from cyber criminals manipulating you into sending them money or revealing sensitive financial information to gaining direct access to your financial accounts or cards. Contact the appropriate institution as soon as you discover fraud by using a trusted phone number or details found on an official website.  

• Bank transfer, ACH, or Zelle: Contact your bank or credit union and ask whether the transfer can be stopped or reversed.
• Credit or debit card: Contact the card issuer, report the fraudulent transaction, and request a replacement card if necessary.
• Payment application (e.g., Venmo, PayPal, CashApp): Report the transaction through the payment provider and request that it be reversed.
• Wire transfer: Contact the bank or wire-transfer company immediately and request a recall.
• Gift card: Contact the gift card issuer, provide the card and receipt information, and ask whether the remaining balance can be frozen or refunded.
• Cryptocurrency: Contact the cryptocurrency exchange or ATM operator and provide the wallet address and transaction details.

Continue monitoring the affected accounts and promptly report any additional unauthorized activity.

If the fraud involves your Villanova procurement card, notify the University Procurement Card Administrator in addition to the credit card company.

Identity theft is when someone uses your personal or financial information without your permission. They might steal your name and address, credit card or bank account numbers, Social Security number, or medical insurance account numbers. They then use those details to apply for a loan, steal your tax refund, or even apply for a job. 

The Federal Trade Commission (FTC) offers a number of resources on how to protect against or report and recover from identity theft. Visit IdentityTheft.gov for more information, including checklists, sample letters, and personal recovery plans.

1. Report the incident at IdentityTheft.gov and file a local police report.
    
2. Place a credit freeze for free at all major credit bureaus (Equifax, Experian, TransUnion and Innovis) to prevent malicious users from establishing new lines of credit with your identity.
    
3. Go to http://www.irs.gov/uac/Identity-Protection for Identity Theft assistance from the IRS. You may also call 800-908-4490 and will likely be asked to complete and print Form 14039 (Identity Theft Affidavit) available at http://www.irs.gov/pub/irs-pdf/f14039.pdf and mail or fax to the appropriate office using the options listed on page 2 of the form. In addition, the IRS provides a transcript of your tax account transactions. You can get a transcript online or by mail to view your tax account transactions, line-by-line tax return information or wage and income reported to the IRS for a specific tax year. Go to http://www.irs.gov/Individuals/Get-Transcript/ and follow the instructions to setup an account and review the transcript online, or to request a transcript by mail.
    
4. Continue to monitor your existing lines of credit for signs of account fraud.
    
5. Keep a record of and close any fraudulent account opened using your SSN immediately. Then report it to the fraud department of the credit card company or bank involved, as well as the major credit bureaus.

Note: Villanova University employees may enroll in the Identity Theft protection. This is a full service plan that will not only prevent but also handle all aspects of restoring and recovering the credit and identity of a victim of ID Theft. Employees receive a group discount and payments can be taken through payroll deductions. More information about this program and the cost for enrollment is available at Villanova University's Additional Benefits page.

SIM swap is a type of fraud where a cyber criminal tricks a mobile carrier into transferring your phone number to a SIM card they control. Once they have access to the number, the criminal can intercept calls and text messages—including multi-factor authentication codes—allowing them to access sensitive accounts such as email, banking, and social media.

Visit our article Tips: Phone Number Protection for information on recovering from a SIM Swap Attack.

The Internet Crime Complaint Center (IC3), run by the FBI, is the central hub for reporting cyber-enabled crime, ranging from financial fraud, account takeover, investment or cryptocurrency scams, identity theft, extortion, impersonation, and more. Report crimes as soon as possible, following these steps:

1. Go directly to www.ic3.gov and verify that the address ends in .gov.
2. Provide a clear, chronological description of what happened.
3. Include available contact information used by the cyber criminal, financial transaction details, websites, usernames, email headers, etc.
4. Save or print the completed complaint before leaving the confirmation page. IC3 will not email you a copy.
5. Keep all original evidence securely stored. IC3 does not accept attachments, but law enforcement may request the evidence later.

Cyber criminals frequently target previous victims by claiming they can recover lost money for an upfront fee. Be cautious of anyone who contacts you unexpectedly and promises guaranteed recovery. IC3:

• Does not charge a fee to file a complaint
• Does not request payment to recover funds
• Does not recommend paid recovery companies
• Does not operate social media accounts
• Will never instruct you to transfer money through cryptocurrency, gift cards, wire transfers, or prepaid cards

The Federal Trade Commission (FTC) accepts reports of anything you believe may be a fraud or scam, even if you did not lose money. Report crimes as soon as possible, following these steps:

1. Go directly to www.reportfraud.ftc.gov and verify that the address ends in .gov OR call the FTC's Consumer Response Center at 877-382-4357.
2. Select the appropriate category, or choose "Something else" if you are not sure
3. Provide a clear, chronological description of what happened.
4. Include available contact information used by the cyber criminal, financial transaction details, websites, usernames, email headers, etc.
5. Keep all original evidence securely stored. The FTC does not accept attachments, but law enforcement may request the evidence later.

Cyber criminals frequently target previous victims by claiming they can recover lost money for an upfront fee. Be cautious of anyone who contacts you unexpectedly and promises guaranteed recovery. The FTC:

• Does not charge a fee to file a complaint
• Does not request payment to recover funds
• Does not recommend paid recovery companies
• Will never instruct you to transfer money through cryptocurrency, gift cards, wire transfers, or prepaid cards

Find more resource on the FTC's Consumer Advice website at www.consumer.ftc.gov.