Cybercrimes and Cybersecurity Regulations

• These notes cover cybercrimes and cybersecurity regulations, focusing on crime types, fraud, and related topics.

Introduction and Objectives

• Online fraud and crimes against honor are highly prevalent, but often go unreported due to low monetary value or businesses' reluctance to publicize the incidents.
• Spanish Penal Code distinguishes between frauds using the Internet as a facilitator (e.g., e-commerce fraud, Art. 248.1, CP) and those involving IT manipulations (Art. 248.2, CP).
• IT manipulations include unauthorized access to online bank accounts using stolen credentials.
• Using bank cards or their numbers to make charges to owners applies as a specific type of scam.
• Fraud involves deceit to cause error and financial harm to another person, which includes unauthorized asset transfers via IT manipulations and creating or providing software tools intended for fraud.
• Using credit/debit cards or their details incurs operations that harm the cardholder or a third party.
• Online scams range from simple schemes lacking planning to sophisticated operations requiring tech expertise and advanced tools.
• It is impossible to cover all online scam types, but the notes cover some representative ones based on their prevalence.

Other Types of Online Fraud

• Online scam techniques are limited only by the imagination of the criminal, social engineering is key to deceiving victims into making financial decisions.
• "Nigerian letters," also called "Nigerian fraud" or "scam 419," have existed for a long time and were originally sent by physical mail.
• The use of email has greatly boosted the efficiency and speed of these scams, while significantly lowering their cost.
• These emails often mention a large sum of money from inheritances or international grants and ask for the recipient's help to access it, promising a share of the money.
• Scammers may impersonate family members of deceased leaders or corrupt officials, using links to real news articles to appear genuine.

Lottery Scams

• It involves informing the recipient of having won a national lottery prizes (Spanish lottery most often.)
• The email includes attachments supposedly confirming the win and asks to contact a lawyer to withdraw the prize.
• To seem genuine, scammers send fake emails with counterfeit official documentation.

Vehicle Sales Through Internet

• Online sales and auction sites are common grounds for cyber scams because criminals posting fake ads is very easy.
• Scammers copy legitimate car ads and post them on other services using their own contact info.
• Scam ads are marked by prices below market value to attract many potential buyers.
• Scammers take precautions to hide the physical location from where the ad publishes.
• Payments for ads are made with fraudulently secured bank cards.
• Potential buyers receive an email from the "seller" explaining why the car is for sale and priced so low, claiming issues like relocation abroad.
• The seller claims to be in the UK and wants to sell a Spanish vehicle (steering wheel on left side) to buyers.

Relationship Scams (Romancescam)

• Online personal connections have evolved using websites to share interests and search for relationships.
• These platforms are goldmines of personal information, which malicious actors can exploit to personalize scams.
• Romance scammers must act with organization and patience to win money from victims.
• Contact is either initiated by the scammer, who sends emails, or by posting false profiles and waiting for contact.
• Scammer pay fees to post profiles to use stolen credit card info.
• Fake profiles use photos from the Internet (often from model or social media pages.)
• Photos of real people collaborating with criminal orgs are commonly used.
• Individuals make contact through such sites suspect requests for personalized photos is used as proof because trust is already low.
• Both male and female profiles are used to draw in victims, with men as bait seeking female partners.
• Future scam victims insist on phone or internet calls so scammers have people ready to engage in those communications while sticking to pre-established lines.
• After initial contact is made, alleged stories are shared, and scammers gain more pieces information to refine the scheme.
• Scams consist of tailoring methods to specific victims, using common tactics, like the "Russian bride" approach that target men.
• It's a scheme where a supposed young woman from Eastern/Western Europe wants to share experiences.
• Scammers engage the scam for months to build a romantic relationship, then plead for money based on the fake women's financial standing.

Fake Antivirus (Rogues)

• Fake antivirus programs are common and involve a malware installation to trigger pop-up messages claiming a virus infection.
• The prompt advertises the user to download "antivirus" software that supposedly removes the listed threat. After installation, the system confirms the infections leading to a product purchase page.
• Virus detection consists of a fake program and no antivirus is downloaded.

Physical Payment Method Fraud

• This scam involves credit/debit card use, travel cheques, or related data to perpetrate operations to another person's injury.
• Phishing: cybercriminals targeting online banking credentials (usernames, passwords) to make fraudulent transactions.
• Delinquents try to take: card numbers, expiration dates, and verification codes (CVC, CVC2, or CID) needed to make online/phone purchases.
• Hackers buy stolen data on illicit markets via certain websites, forums, chats etc.
• Criminals purchase items that are quickly sold (electronics, IT equipment, phones) or to buy plane or transport tickets.

Skimming

• Skimming involves copying account information that is not directly visible on bank cards.
• Card cloning occurs to purchase in physical stores and ATMs.
• Requires awareness of electronic parts, information, and membership in global organization.
• Card skimmers get PINs with the help of a reader to clone a card.
• Cloned fraud costs $4-8K and goes to other fraudulent activities. This method is effective in skimming.
• Cloned credit cards cause fraudulent purchases in foreign countries.
• Counterfeit cards include holograms/logos unique to the card type/ are difficult to copy/ easy to buy online.
• Skimmers need to encode traces of magnetic strips in software.

Skimming Cycle

• To avoid skimming, ATMs increasingly use elements that are harder to exploit.
• Skimmers obtain two data types: that included from magnetic stripe and the PIN
• ISO standards (7810, 7811 and 7813) detail the standards for magnetic strips.
• Scammers steal credit cards by installing copying systems or hiring disloyal employees.
• Counterfeit card bodies are plastics made with identical designs but oversized ones fit the face.
• A reading head installed within the mouth then copies track data.
• The authentic ATM system gets data and functions as-is.
• A minicamera placed in a panel of the atm watches the pin pad to capture pin numbers.
• A secondary fake keypad can be installed to log the pin number.

Peru Penal Code

• Peru Penal Code addresses internet fraud including skimming/ card cloning.
• Code cites design or alteration of digital information with fines.
• Code mentions collaboration in any of the actions mentioned.
• Scamming is punishable with 1-6 years of prison.
• Peru is intensifying efforts to fight fraud through constant operations.