If you use Instagram, you may have noticed several friends posting photos of what look like Ray-Ban offers this week – but don’t be fooled
If you use Instagram, you may have noticed several friends posting photos of what look like Ray-Ban offers this week.
The photos come in a range of forms, but tend to feature the Ray-Ban logo and sunglasses, alongside tempting offers, such as ’90% Off’ and ‘one day only.’
But before you think that your friends have taken up side jobs selling Ray-Bans, you should know that this is a scam.
Speaking to Mirror Online, Nick FitzGerald, Senior Research Fellow at ESET, said: “This appears to be the continuation of, or perhaps the resumption after a lull in, the long-established abuse of compromised social media accounts to post fakes ads, or ads for fake goods.
“Over the years we have seen Twitter , Facebook , Instagram and other online platforms abused to post ads for various footwear brands (notably Adidas and UGG), medications, and Ray-Bans, among many other things.”
This form of scam takes advantage of accounts that are already compromised, making it easy to gain access and post what look like legitimate photos.
Mr FitzGerald explained: “Perhaps the account owner was phished for their login credentials, either for Instagram or Facebook if they have linked their accounts, or for their credentials for some other account where they use the same credentials as for their Instagram account?
“Or, maybe they just happen to have chosen one of the very common passwords and this account was then quasi-randomly discovered by a credential stuffing attack.”
Regardless of how the hackers gain access to an account, once they do, they are effectively acting as the account owner. This leaves them free to post whatever they like – including the fake Ray-Ban offers.
Once the hackers have accessed an account, they can collect the user’s contact information, and even send direct messages and emails to contacts.
Mr FitzGerald added: “They may also find the account owner’s email address from their private profile information, and if that account uses the same password, then use that to send spam or other badness (such as ‘I am overseas and was mugged, send me money’ scam emails).”
Thankfully, there are a number of ways to protect your account, courtesy of David Emm, principal researcher at Kaspersky.
How to protect your Instagram account
1. Protect any device you use to access social networks using a reputable Internet security product.
2. Always use official apps, from Google Play or the App Store. And apply updates as soon as they are available, to avoid criminal exploiting vulnerabilities in old code.
3. Use unique, complex passwords for all your online accounts – otherwise, if one account is compromised, they all could be. If you believe anybody else has found out your password – even if they are a friend or part of your family – change it immediately.
4. Don’t use account login credentials for authentication on third-party services or apps.
5. Don’t click on suspicious links. Even if it has come from a friend, double-check with them to see if they really sent it to you.
6. Review your account security settings carefully, ideally restricting all sections to be viewed/shared to ‘friends only’. Set limits to what applications can do and remove applications once you no longer wish to use them.
7. Disable features unless you’re specifically using them.
8. Don’t think you have to be honest about personal information you declare (e.g. account verification data such as mother’s maiden name, date of birth, etc.) often don’t need to be real.
If the Ray-Ban scam images are posted to your account, you need to act quickly.
Log out of all sessions other than the one you’re currently using, before changing your password and setting up two-factor authentication.
It’s also a good idea to delete the images from your page to make sure they’re seen by as few people as possible – reducing the risk of anyone falling for it.
Source: Mirror
