Cybersecurity Scams: MGM Attack, FBI Impersonation, and Nigerian Prince Fraud

MGM Cyberattack and Social Engineering

• 🎯 The MGM Resorts cyberattack, resulting in a $100 million event, originated from a social engineering phone call.
• 📞 Attackers researched targets on social networks, impersonated an employee, and called another individual to gain access, ultimately compromising the organization's Okta system and resetting MFA.
• 🧠 The use of AI to generate realistic voices makes it harder to distinguish legitimate calls from scams, emphasizing the need for skepticism and verification.
• 💡 A key defense is to hang up and call back using a known, trusted number, rather than trusting the caller-provided callback information.

FBI IC3 Impersonation Scam

• ⚠️ The FBI's Internet Crime Complaint Center (IC3) has issued a warning about scammers impersonating the IC3 itself.
• 🎣 These scammers contact victims who have already lost money, claiming they can help recover funds, which is a common follow-on scam tactic.
• 🚫 The IC3 will never directly communicate with individuals via phone, email, or social media for fund recovery; official contact comes through FBI field offices or law enforcement.
• 💰 There are no fees associated with the IC3 for victims to recover lost funds.
• 📈 The IC3's 2024 report indicates a 33% increase in reported losses, totaling $16.6 billion, with an average loss of $19,000.

"Nigerian Prince" Scam and Money Laundering

• 👑 A 67-year-old man from Louisiana was arrested and faces charges for his role in a "Nigerian prince" scam, funneling hundreds of thousands of dollars to co-conspirators in Nigeria.
• 💰 The scam involved promising victims inheritance from a will and then requesting personal information and money transfers.
• 🏦 The man acted as the U.S.-based facilitator, likely to make international money transfers appear more legitimate.
• ⚠️ This case highlights the risks of money laundering and the expendability of facilitators in international criminal enterprises.

Catch of the Day: DHS Impersonation

• 🚨 A scam message, allegedly from the Department of Homeland Security (DHS) Investigations, claims to identify recipients as victims of financial scams.
• 📧 The message advises changing passwords and states that government officials will not ask for PII or money, but paradoxically asks the recipient to respond to the email to confirm they believe they are a victim.
• ⚠️ This is a follow-on scam designed to identify and re-victimize individuals who have already lost money, often attempting to move communication to platforms like Telegram or WhatsApp.
• 🧐 The presence of awkward phrasing and the offer to disregard if not a victim are red flags, alongside the attempt to solicit a response that confirms victim status.