Blog Dis

Twelve-digit passwords have arrived, so I learned this week when updating my password to log into a server. The new standard is a longer password, to ensure better protection, which requires that your password incorporate capital and lowercase letters, special characters, and numbers.

Oh my lawd! Can my brain handle the overload?

I hear stories pretty much every week of individuals being duped by phony texts, emails, telephone calls — scammers and hackers posing as someone else, to get access to your bank accounts, online social networks, anything and everything that'll give them an edge to hijack your identity and to achieve their end game, to run away with your money or your peace of mind.

And so, for your convenience, I'm going to share some tips I've learned along the way, some gleaned from my web-designer whose profession is writing code, and remaining up-to-speed on new algorithms. Writing code requires a streamlined mind that thinks in terms of the process, to make code work efficiently, even though to a lay person like me, code looks like a foreign language. It's a digital world and code writers are comfortable working within this abstract realm. Some of these are also tips that I've learned from the mandatory risk management training I am obligated to take annually, with a passing grade of 80%.

1. Browser cache: Some persons rarely, if ever, empty their cache, while others clear out their history regularly. Many will pay for their own Virtual Private Network (VPN) which means their browsing history is hidden. They first connect to a VPN before accessing a site using their browser. Technical support in banks are less likely to recommend a VPN when it comes to logging into your account online bcus they're of the opinion that VPN companies shouldn't be trusted, and to a degree I agree. However, and on the occasions when I work from home, I'm required to connect my laptop using my WiFi before connecting to their VPN, after which I have no choice but to log-in twice: once when I boot up my laptop, and a second time when I log into the VPN. A third layer has been added to most VPN connections used by corporations, and it requires you to enter a code that is texted to you, after you've logged in the VPN. The goal is to ensure your laptop is secure. This is a good thing, unless you've been duped by logging into a website that isn't the actual website.

2. Two-step authentication: This story hit the local news where I live about one month back. An employee wasn't able to access her work laptop right away, so she jumped onto a nearby laptop, at another desk, and searched for the name of her bank but had failed to notice it was a fake site, made to look like the real thing. The lock symbol was absent in the website URL, what is commonly used now: two symbols that look like two short single lines, each with a dot at the end, that are pointing in opposite directions, to signify the connection is encrypted. Sad story short: she thought she had logged into her bank, only to find out that she had logged into a dummy site. Her account and all its monies were cleaned out in less than one minute. Her bank refused to take responsibility for her error.

When we access regular sites, like banks, our home laptop or mobile will handshake with the bank's site, and our IP address will be synced, because the bank's site recognizes a returning customer. If, however, you have unintentionally logged into a hacking site, this IP handshake won't occur. This is the reason why banking institutions are recommending to activate two-step authentication. I'll give you an example of the additional layer of security: I'll log into my bank APP via my mobile, and if I simultaneously open a new browser page to also log into my bank via my Desktop, it'll automatically initiate two-step authentication, and the bank will send me a message vis-a-vis my mobile banking APP, asking "Is this you?", after which I'll reply with yes, and then it'll ask me to unlock my mobile with my fingerprint, before giving me access to my account from my Desktop.

This is a fail-safe procedure because if you as the bank's client were not logged into your mobile APP, and a hacker tried to access your account from their mobile or Desktop, the 2-step authentication code ping wouldn't reach them. Does this sound annoying and laborious? Why yes it does because it is! I can't speak for banks in the USA. I can only speak for the banks I deal with in Canada. They write-off from their books hundreds of millions of dollars every year in fraud, but only after they've determined you're not at fault.

3. Text messages: Thieves are sophisticated, and if you were to ask police and security authorities, they'll be loathe to admit they learn from thieves, rather than the other way around. Thieves educate themselves on how to work around security methods, and they work hard at too, just like full-time legitimate workers. Text messages that come into you whose number you don't recognize shouldn't be opened, much less for you to click on the link to follow their instructions. There was yet another story of a woman who did just this; she received a text about her VISA information needing to be re-entered because of a so-called security breach. She followed the instructions that gave the thieves access to her accounts, and sadly again her accounts were drained. It's no joke. If ever you receive an email or text, and there's a sense of urgency or a link is provided, don't ever click on the link - ever! Go to your laptop or open a browser on your mobile, and log into your account the way you normally would to check if your account is all up-to-date. This way, you'll bypass their link, and then afterward be sure to block the number. I recently received such a message about my Google Wallet, asking for me to re-verify my credit card details. I don't carry identification on me, just my mobile phone but because I've had cycle issues in the past, breaking down on the road, I had to pop into a shop to buy a replacement part, and it was handy to be able to use my Google Wallet to pay for the expense.

4. Amazon: I've received emails from hackers who replicate the look of Amazon emails perfectly, asking me to re-input tax document information or to re-verify my account details, and I'm amazed at how authentic these emails look. I've learned that any time anyone reaches out to me, when I haven't initiated the communication, I know to become suspicious. I'll go to my account through my personal browser, log-in, and check that the integrity of my account information is accurate, and then return to the email to create a rule that the sender will be re-directed to my SPAM folder going forward. This old switch-a-roo happened to an author friend whose Amazon KDP account information was updated to a different account number because he'd been hacked, only for him to log-in and find out that the monies Amazon had sent him for books sold were deposited into another account. The reason why he'd been notified was because Amazon generates emails to clients advising of a payment to come. If it wasn't for this email, he'd have never known that his Amazon KDP account had been hacked.

5. Images: There is a new method now too of hacking into your mobile phone, whereby a text is generated to your mobile with no greeting or explanation, just a notification that an image has been attached. Don't be fooled. Don't click on the image and don't be tempted to open the text, for when you do, it'll download software to your mobile, installed in the background that'll begin to collect info on your password log-ins, and once you've clicked on the image, it's too late. We are brainwashed, to a degree, when it comes to our devices, that have in effect changed how our impulses function, and we often act out of habit and impulse before we've thought about what we're doing.

6. Saving passwords: I haven't once clicked on the prompt to save my passwords in the Google cloud, not once, nor will I ever. I remember my passwords, the old fashion way, using my brain, to avoid this information from being stored in a virtual place (a server in another country) where I have no control over the platform, nor do I have control over the site being hacked, or if my information is being monitored or shared. If you recall, Google Incognito was sold to the public that it was a secure method to surf the Internet without your activity or identity being tracked, only for this falsehood to be exposed down the road that Google was in fact tracking your Internet activity all along. I use Google, as do we all but I wouldn't trust them as far as I can throw them, any more than you should. Google is the most intrusive search engine going.

7. AI impersonations: Just when you think it's safe to answer your phone, you'll discover that you've been fooled. This happened to me. A friend called and left a voice mail. The number showed up as 'Unknown Number', which is the reason why I never answered the call in the first place. My friend left me a voice mail, advising that he wasn't using his regular phone, and that he'd call me right back, which he did. I had a conversation with him, only to figure out many months later that I never spoke to my actual friend, because it was another individual posing as my friend. The AI generated voice had matched. So, at the time when this phony call took place, I had to interrupt our phony conversation to make a visit to the ladies room, and when I called my friend back, by dialing his regular mobile number, it went straight to voice mail, which meant he was more than likely sleeping, given that my call went straight to voicemail vs the Unknown Number he had supposedly called me on, which couldn't be displayed on my phone. Long story short, when we had another call down the road, one that I initiated, I explained how it had occurred to me what happened, and my friend acknowledged that their phone is registered, as are the phones in their household. This is what I would call an AI-slamming technique, part devious, part clever. I like clever. I learn more from clever. Regardless it's a form of subtle manipulation and nothing short of alarming. It's similar to scammers who pose as grandsons or nephews, then call their elderly family member to ask for fast cash because they're being held in prison, and the only way they can be released is by their grandparent sending money to them as soon as possible.

I don't profess to being the sharpest pencil in the box, and sometimes my intuition when something is off can be delayed but this realization came to me in an epiphany of sorts. Fool me once, shame on you. Fool me twice, shame on me. Lesson learned. I fear we will see more of these AI-simulation scams, close family and friends whose voices will be imitated to lure you into believing a false narrative, a scam to part us with our money, or someone merely pushing a narrative out to us.

8. eTransfers: A variation on this scam is happening when individuals purchase your possessions that you're selling on commercial merchant sites (Facebook's market site is a prime example). The buyer offers to pay for the item, using a bank draft. This variation on scamming was covered on our local news insofar that farmers were selling expensive second-hand farm equipment, in the $100,000 range or more, and when the seller went to the bank to deposit the draft, a week later the bank determined it was a phony bank draft. The deposit was declined but the scammer had walked away with your possession for nothing. So, the solution is to set up automatic deposits with your bank, and to receive payments via eTransfer only. In short, if you're buying or selling anything, the safest route is to send or receive payment using automatic deposit. Remember, however, if you don't have the option for automatic deposit going direct into your account, do not send a security question with the password in the same communication message, or by using Snap Chat or the WhatsAPP bcus these mobile APPs are some of the most hacked sites in the world.

9. Password managers: I'm not a fan of using digital password mangers, like Google as I had previously mentioned, because I don't trust them. I realize at the same time, too, that when I take the time to count the number of different passwords I have to remember, it requires sincere effort for me to keep them all straight but the more I create, and remember, the better my memory grows. Memory is a muscle. Use or lose it. I've got passwords for my social networks, banking APPs, writing accounts, work accounts, charitable donation accounts, point-of-sale APPs like Square, to name a few. Pretty much any organization that has a presence online will ask you to create an account and password. It's enough to drive an individual bonkers but as you see from this chart (below), a 12-letter password provides a better layer of security than say a 4-letter password, so train your brain to remember. And if you can't remember, then bite the bullet and re-create a new password. When it comes to logging into my bank accounts, each bank has its own unique password, and these passwords now exceed fifteen digits - hard to memorize but worth the security. These are my bank accounts after all so I change them regularly too!

10. RFID wallets: Radio Frequency Identification are wallets that block a mobile phone from being able to read your credit cards, merely by standing next to you while waiting for a light to change, before you cross the street. When I last traveled to the Middle East, which was back in 2022, I bought my first RFID wallet. They are most definitely the way to go. But still to this day, when I travel I carry expired, dummy credit cards in a fake wallet, that are kept in an obvious place and the real credit card is secured in an RFID or in a money-belt for safekeeping. This means if someone were to rob you, they'll steal an expired credit card, rather than your active one. I used this method as well whenever I have to walk from home into work in the dark, whether early in the morning or late at night. Sadly, and this shouldn't come as a surprise, that women are often an obvious choice for being robbed.

11. Credit cards: I am careful with my credit cards, in terms of the outstanding balances. I generally keep mine paid off, to avoid paying interest. I learned the hard way to use one credit for online purchases that has a credit limit purposely set to $500. It happened to me only once that I made a donation online to support the Cancer Society, and the next day my bank called, asking if it was me in Arizona purchasing $5,000 worth of Apple products. I assured them I was in my city in Ottawa, and the bank immediately cancelled the card, and absorbed the fraudulent charges. The link had been circulated within my work using their network, so I had worked on the basis that it was safe. A new card was issued, after I had asked them to set the credit limit to less than $1,000. I use another credit card for larger purchases because I earn travel points whenever I make purchases.

Our credit card PIN numbers typically have four digits, and for the most part they're safe but I don't ever use my bank cash card to withdraw from an ATM because there've been too many instances of thieves setting up a dummy front-face, to fit over top the real machine, and this way they're able to utilize a card reader built into the faceplate to collect the details of your card. 🤬 Many Executives with Platinum credit cards have an additional layer of security, so that a code is texted to the card owners mobile, before large purchases will be processed online, such as airline tickets, as one example.

Is life supposed to be easy? Hell no, at least not in my experience. But life is a beautiful thing while you're breathing, and being equipped with a few tips isn't such a bad thing. Hope this info helps some of you.