Scammers posing as buyers of items for sale online have mastered the art of spoofing PayPal emails to instruct sellers to send their items and get away with them for free.

With summer’s long-awaited arrival comes barbeques, vacations, and the long put-off tasks of cleaning out a garage or closet. If you are like millions of Americans that turn to websites like eBay, Craigslist, or your local classifieds section to help declutter your home and earn some extra cash, you may be at risk for the “check is in the mail” scam (also known as the “PayPal buyer payment scam.”)

In the last year, complaints to NCL’s Fraud.org from consumers who were victims of this scam have nearly doubled. In a typical scam, a consumer who has placed an item for sale on a website like Craigslist receives a reasonable offer from a scammer posing as a buyer. The scammer and the seller agree on the price, and the scammer claims to send their payment through PayPal.

However, unbeknownst to the seller, the scammer never sends their payment to PayPal. Instead, the scammer sends a spoofed PayPal email saying that the payment has been received, but that it will only be released to the seller once that item has been mailed by the buyer. Unfortunately for the seller, the buyer has no intention of ever sending the money, and will disappear as soon as they receive the item without ever paying for it.

The account one victim from Tennessee gave us is typical of the scam:

“I listed a diamond ring for $7,000 on eBay and received a purchase confirmation,” wrote the consumer. After accepting the offer, “I began to receive fake PayPal emails…informing me the payment had been sent but that the item needed to be shipped prior to the funds being deposited into my PayPal account.”

In this case, the scammer went to great lengths to appear legitimate by requesting additional photos of the item from the seller and providing confirmation after the seller sent the scammer the tracking number. The scammer even provided assurances that the money was on its way after the item had been shipped.

Fortunately, while getting ensnared in a “check is in the mail” scam can be costly, there are several tips that you can take to avoid becoming a victim:

1. Be on the lookout for spoofed emails. A legitimate email from PayPal will always address you by your first and last name. If the email begins with “Dear user,” or “Hello,” it is a fraudulent email.
2. Always confirm payment before sending an item. Never trust an email to determine if you have received payment. Instead, type www.paypal.com into your browser and log into your account to ensure that payment has been received.
3. Be wary of “accidental” overpayments. Many fraudsters will send out a spoofed email that says you were overpaid for an item, and then follow up with a request for you to send some of the money back. Fortunately, it is very easy to fact check the buyer’s story. Before sending money back, log into your PayPal account and check to see how much the buyer actually sent you. It is likely that the buyer didn’t send you any money and is instead trying to not only get your item for free but also to scam you into sending them additional money.

Identifying a “check is in the mail” scam is not always easy. If you suspect that you have become a victim, report it immediately. You can file a complaint at Fraud.org via our secure online complaint form. We’ll share your complaint with our network of law enforcement and consumer protection agency partners who can investigate and help put fraudsters behind bars.

Read our other Fraud Alerts here.

If you’re like most Americans, your cell phone is probably one of the first things you look at in the morning and one of the last things you look at at night. Imagine then, waking up to find that your phone suddenly doesn’t work, and it’s just constantly in emergency mode. For a growing number of consumers, this is the first sign that they are a victim of the port-out scam.

In the scam (also known as the “SIM-swap scam”), a fraudster tricks a cell phone carrier into transferring or porting a consumer’s legitimate phone number to a phone in a scammer’s controls. Once a number is ported, all calls and text messages that are sent to that number go to the scammer’s phone. With that power, scammers are able to get around security features, like two-factor authentication, that are in place to protect consumers’ sensitive email, banking, and social media account information.

In a typical port-out scam, the fraudster will first obtain key details about their victims, such as the last four digits of a Social Security number, a phone number, name on the account, and the victim’s address–all of which are widely available on online black markets thanks to years of data breaches.

Armed with this information, the scammer then calls the victim’s wireless provider and impersonates their victim. Once the scammer establishes contact with the cell phone company, if the victim did not establish a security pin, all the scammer needs to do is correctly confirm the last 4 digits of their victim’s Social Security number and mailing address. The scammer then asks the wireless company to port “their” number to a different phone. After the carrier switches the victims’ phone number to the fraudster’s phone, the victim’s phone will go dead, and the scammer will then use the phone in his possession to reset passwords or gain entry to accounts that use two-factor text authentication. The most common target for these scammers are bank accounts. Once a bank account is accessed, the scammer can quickly transfer funds to an account that the scammer controls.

This scam can be financially devastating to its victims, but there are several steps you can take to prevent the scam from happening in the first place:

• Contact your carrier and ask them to add a unique personal identification number (PIN) to your account. This PIN number will need to be provided any time you wish to make a change to your account, including upgrading your cell phone. This extra layer of security will help stem any would-be scammer from running the port-out scam on your phone. The process for adding a PIN depends on your provider. See below for details on how to add an account PIN for each of the four major national wireless providers:
• • AT&T –  Log into your ATT.com account, go to your profile by clicking your name, and under the wireless passcode drop down menu, click on “manage extra security.”
  • T-Mobile – Call 611 or (800) 937-8997 from your cell phone to speak with a customer service agent.
  • Sprint – Sprint automatically requires their customers to set up a PIN when an account is opened.
  • Verizon – Visit vzw.com/PIN or call (800) 922-0204.
• Always use good password hygiene. Regardless of account, choose a password that is unique, complex, and contains upper- and lower-case letters, numbers, and symbols. It is critical not to reuse passwords across multiple accounts. That way, if one account becomes compromised, then every account with that password can become compromised as well. For the best password security, use a password manager that creates and remembers random passwords.
• Consider alternatives to text two-factor authentication. For your most important accounts, like your online bank account, see if they allow other versions of two factor authentication such as a security key or or a third-party authenticator app like Authy.
• Be wary of suspicious emails or phone calls from people purporting to be from your bank. Remember, your bank will never ask you to enter confidential information in an email.

Even despite our best efforts, fraudsters will likely still be able to pull off the port-out scam. If this happens to you, and your phone stops working, you should:

1. 1. Immediately notify your cell phone provider, and report any fraud to your bank. Quick action on your part can minimize any damage the fraudster could inflict on you. Your cell phone provider can turn off your phone number and prevent scammers from using that number to bypass two-factor text authentication. Notifying your bank the moment you notice unauthorized charges or that you are at risk for fraudulent two-factor authentication can also minimize your liability.
   2. File a report at Fraud.org via our secure online complaint form. We’ll share your complaint with our network of law enforcement and consumer protection agency partners who can investigate and help put fraudsters behind bars.
   3. File a police report at your local police station.

Read our other Fraud Alerts here.

Many of America’s 33.5 million unbanked and underbanked households rely on prepaid debit cards to pay bills and make purchases. Cash reload packs–like Green Dot’s MoneyPaks–are used by these consumers to load money on their prepaid debit cards. While cash reload packs offer people without bank accounts critical access to the financial system, they are also a frequent target of scammers who see them as a quick way to get access to cash.

In the last few months, Fraud.org has received dozens of complaints about a disturbing new scam designed to prey on consumers using MoneyPaks as a payment method. While some of the details of the scam may differ, a consumer is typically tricked out of their money in the end.

A typical MoneyPak scam works like this:

A consumer will go to a retailer such as CVS or 7-Eleven to purchase a MoneyPak to add funds to their prepaid card. However, once the consumer purchases the card, instead of registering the card at the official MoneyPak.com website, the consumer goes to a fake website, sometimes designed to look like the official MoneyPak site. It’s unclear how exactly consumers are finding their way to these fake sites. However, we suspect consumers may find the fake website through an ad they see on a search engine, by mistyping the Web address of the real MoneyPak website, or by malware on their computer misdirecting the consumer’s browser to a fake site. Unfortunately for the consumer, many of these fake websites might look very convincing. Some even have fake customer service phone numbers as part of the ploy. While these sites are fake, the consequences for consumers who fall into this trap are all too real.

In the complaints Fraud.org has received, once the consumer enters a MoneyPak card number on the website or provides the number to a scammer impersonating a customer service representative (to “register” the card, for example), the funds are quickly transferred from their MoneyPak to an account the scammer controls. The consumer will  only become aware of the scam when they check their prepaid debit card’s balance and see that no funds have been transferred to their card. Unfortunately, once this occurs, it is almost impossible to stop the transaction, and the scammer will have already made off with the money he has stolen.

While the results of the MoneyPak scam can be devastating on consumers’ pocketbooks, there are several easy steps you can take to protect yourself from this fraud:

1. Always type in the www.moneypak.com web address on your browser. There are websites out there designed to mirror the actual MoneyPak website so as to trick consumers into giving up their MoneyPak account number. There are also links which appear to send you to the legitimate MoneyPak website, but it will in fact redirect to a lookalike site. The easiest way to steer clear of this scam is to type in the exact website found on the back of your MoneyPak (www.moneypak.com) and follow the directions carefully.

2. Never create a MoneyPak account or deposit your MoneyPak into a prepaid debit card over the phone. The only way to create an account or deposit your MoneyPak onto a prepaid card is on the MoneyPak website found on the back of your card. If someone over the phone offers to help you deposit your funds onto your card, it is a scam.

3. Treat your MoneyPak number and receipt as cash. Anyone who has your MoneyPak number has the ability to drain its funds. Safeguard this number as you would cash and do not give it to anyone who you do not want to have access to your funds.

4. Remember, no legitimate business or government agency will ever request a MoneyPak as a form of payment. Anyone who is asking you to pay by MoneyPak is most likely a perpetrator of one of the many other MoneyPak related scams.

While MoneyPak is used successfully every day to help consumers access e-commerce, it is important to remain vigilant to protect yourself from falling victim to fraud. If you suspect that you may have become a victim, or if you think you stumbled upon a fraudulent MoneyPak website or phone number, please report it immediately. You can file a complaint at Fraud.org via our secure online complaint form. We’ll share your complaint with our network of law enforcement and consumer protection agency partners who can put fraudsters behind bars. You can also fill out MoneyPak’s Victim Assistance Fraud form, to report fraudulent activity.

Read our other Fraud Alerts here.

Hurricanes in Texas and Florida. Earthquakes in Mexico. Wildfires in the western states. Devastating natural disasters have been making major headlines in recent weeks. While the human and financial toll these disasters take is bad enough, there’s a category of scam artists that aims to add insult to injury when events like these occur: disaster scammers.

At Fraud.org, we have heard a growing number of complaints regarding three scams in particular that affect consumers both in and outside of disaster zones.

The fraudulent contractor scam

In the aftermath of a major weather event like tornadoes and hurricanes, victims understandably want to fix their homes as quickly as possible. Taking advantage of this, scammers have been known to show up on a would-be victim’s doorstep and offer to start work right away. Here are some red flags to distinguish between a legitimate contractor and a scam artist looking to cause trouble:

• A “contractor” who asks to be paid in cash. Always pay with a credit card or check. If a contractor asks to be paid in cash, it is most likely a scam.

• A “contractor” who requests a large upfront payment. Many scammers will request to be paid upfront, and then disappear, never to be heard from again. To minimize your risk, you should try to keep your down payment to around 10 percent of the total cost.

• A “contractor” that asks you to sign an AOB (Assignment of Benefits). By signing this document, you are giving your contractor control over your insurance policy. This allows the contractor to inflate the cost of your repairs, and could cause a drawn-out legal dispute between you, the contractor, and your insurance company.

If you find yourself in a situation where you need a home repair, follow these tips to protect yourself:

• Verify that your contractor is properly licenced and insured to complete the work you are hiring them to do.

• Ask the contractor for references and check consumer review websites. Former client recommendations can offer peace of mind.

• Write down their driver’s license number and vehicle information (make, model, and license plate number) so that you are able to report them to the authorities if something goes wrong.

• Get a written estimate and sign a contract before work begins.

• If you are planning to have your insurance company cover the repairs, be sure to call your insurance agent and confirm that they will cover it.

The charity scam

In the aftermath of natural disasters, many “charities” run by scam artists pop up to take advantage of Americans’ willingness to help others. Follow these steps to steer clear of crooks looking to make a quick dollar off of your generosity:

• Avoid charities that seem to have sprung up overnight in response to a disaster. Instead, give to charities with a proven track record of helping natural disaster victims.

• Make sure the charity you are donating to is legitimate. You can do this by checking out websites like Charity Navigator,Charity Watch, orGuideStar. There you can find information like tax records that explain what the charity does, how long they’ve been doing it, and who their head employees are.

• Pay by credit or debit card. That way, if the charity turns out to be a scam, you can dispute the charge.

• If you receive a solicitation from a group fundraising on behalf of another organization, be sure to ask what percentage of a donation is kept by the fundraising organization. If the caller is unable or unwilling to provide that information, or if the fee seems unusually high, it could be a scam.

The storm-damaged used car scam

Vehicles damaged by floods and hurricanes are often cleaned up and shipped across the country to be re-sold by unscrupulous car salesmen. While these cars may look and run fine at first, flood-damaged vehicles often have malfunctioning airbags or hidden rust and mold problems, and may not run properly in the long term. To protect you and your family from this scam, follow these steps:

• Check the vehicle history report through a trusted source like the National Insurance Crime Bureau’s free database.

• Look for signs of flooding like water stains in the glovebox or fogging inside headlights and tail lights.

• Consider the smell of the vehicle. While a mildew smell is a definite red flag, a heavy disinfectant smell should also set off your alarm bells, as these heavy-aroma cleaners can be a sign that someone is trying to hide mold.

Natural disaster scams come in many forms and can be difficult to spot. If you think you may have come across a scam intended to take advantage of a natural disaster victim, let us know! Please file a report at Fraud.org via our secure online complaint form. We’ll share your complaint with our network of law enforcement and consumer protection agency partners who can investigate and help put fraudsters behind bars.

Read our other Fraud Alerts here.

At Fraud.org, a consumer from Kentucky recently shared her story with us:

“I was contacted by a friend of mine on Facebook, because she had recently won $70,000 and saw that I was on the list of winners as well. She put me in touch with a company that was handling the prize disbursement, and I was told I had to pay $830 to get my prize. This friend of mine lives in my town and is the apartment manager where my blind son lives, so I really thought this was true, and I sent the money. A few days later, the prize disbursement company reached back out to me and requested an additional $1,250 for taxes. I told my friend that I didn’t have it, but she told me she ‘wanted to help’ me out, so she paid the shipping company $500. That left me with a balance of $750 to pay, which I did. I eventually realized that there was no prize and that I had been scammed out of $1,330.”

Turns out our Kentucky consumer wasn’t the only scam victim. Her prize-winning friend had also been hacked. She wasn’t a part of the scam; she was a victim herself–of identity theft!

Over the past 18 months, NCL has received more than 100 complaints about scams committed via social media. The scam our friend from Kentucky fell victim to, which we’re calling the “Facebook friend scam,” is particularly convincing and lucrative for scammers who are able to pose as a friend of the victim.

The pitch is often that the fraudster has just won a prize or qualified for a federal grant, and that the friend they’re writing to will also qualify for the prize or grant. The scammer (still posing as a friend) will inform the victim that all they need to do is pay the tax for the prize, or pay a filing fee to a company in order to receive the winnings. In some cases, fraudsters have even been known to offer to “pay” a portion of the fee or tax as a favor for their friend because they just won the prize as well.

As data breaches continue to give scammers access to account and login credentials, experts predict that this kind of account hijacking is likely to increase and result in more money being stolen from consumers’ pockets as a consequence. Fortunately, consumers can take precautions to reduce the risk of falling prey to these scams and prevent their friends and family from becoming a victim of the Facebook friend scam.

Protect yourself and your social media contacts:

1. If a friend reaches out to you via email or social media with a deal that seems too good to be true, call them directly to see if they really sent the message.

2. Reduce the risk of your account from getting hacked. You can do this by:

   • Using complex passwords

   • Never reusing passwords

   • Turning on two-factor authentication

3. If your Facebook account is hacked, immediately report it and follow Facebook’s prompts to take the steps necessary to regain control of your account.

Identifying a hacked Facebook account is not always easy. If you suspect that you have become a victim, report it immediately. You can file a complaint at Fraud.org via our secure online complaint form. We’ll share your complaint with our network of law enforcement and consumer protection agency partners who can investigate and help put fraudsters behind bars.

Read our other Fraud Alerts here.