Beware fake gov't sites and spoofed email accounts

Duke Franklin had lost his Social Security card, so he applied for a replacement on the Social Security Administration (SSA) website. He clicked on the first link that came up in his search and followed the instructions to fill out the required forms to apply for a new card. The site asked for some personal information and a $150 fee. He was told to send his birth certificate and other personal items to a specified address. The site said the SSA would mail his new card within a few days to a few weeks. After waiting more than two months, he called the phone number listed on the website but it was "out of service." He realized he'd  been scammed.

We're the government (but not really)

Duke was a victim of a new government services website scam reported by the FBI on its Internet Crime Complaint (IC3) website on April 7. (See Criminals Host Fake Government Services Web Sites to Acquire Personally Identifiable Information and to Collect Fraudulent Fees.)

From the numerous complaints the IC3 received from May 2012 through March 2015, it determined that criminals were setting up fake government services websites (such as the SSA and the Internal Revenue Service) to trick potential victims into revealing their personally identifiable information (PII) and pay fraudulent fees.

The PII that criminals usually request includes a victim's name, address, email address, Social Security number and date of birth, among other things. The victims are willing to give up this information because they're fairly confident they're dealing with actual government service agencies.

When data-grabbing criminals compromise PII in any fraudulent activity, they can use it for many illegal purposes, including creating fake driver licenses, passports, documents to obtain loans or filing for fake federal income tax refunds on behalf of victims. Or they can sell or trade the stolen data in underground forums to other cybercriminals who can use it for similar purposes.