You will become familiar with strategies for protecting yourself from the consequences of fraudulent or hostile online activity, such as identity theft, phishing, malware and payment fraud. You will also reflect on the potential of the Web for rapid dissemination of false information, particularly in light of the availability of fast-moving social media sites such as Twitter, Facebook and discussion forums, where news items—both true and false—can go viral in a matter of minutes.

In this chapter, you will:

What is your understanding of the term viral? Although it obviously sounds health-related, in recent years another meaning has become attached to the word, and it is now included in the Oxford Dictionary. It is defined there as ‘an image, video, piece of information, etc. that is circulated rapidly and widely on the Internet’ (Oxford Dictionaries, 2015). No doubt you have heard of pictures, videos or memes ‘going viral’. Perhaps you also are aware of the recent phenomenon of ‘viral marketing’. The phenomenon of going viral is a testament to the unique power of Internet sharing and social media in spreading a message rapidly and globally, with unprecedented efficiency, reaching staggering numbers of Internet users. For example, the video that has become the most ‘viral’ in history is the Kony 2012 video by Invisible Children, which received 34 million views on the day it was uploaded in 2012 and reached 100 million views within 6 days. Another very famous example, although not as rapidly spreading, is Psy’s ‘Gangnam Style’ music video, which has become YouTube’s most-watched video of all time, with more than 2 billion views since it was released in 2012.

The speed at which information on the Internet can now travel around the globe is unprecedented. Thanks to social media sites such as Facebook, Twitter, Snapchat, WhatsApp, Reddit, YouTube and many more, articles, pictures and videos can pass from person to person at an astonishing rate, and simple hashtag phrases can spread awareness of an issue like few other media. This can be an undoubtedly positive phenomenon; if you think of the role played by social media in raising awareness and spreading the message for social movements such as the Arab Spring (from 2010 to 2012) and Occupy Wall Street (from 2011), you will understand how going viral can be harnessed as a force for good. More recent examples include the #BringBackOurGirls Twitter campaign, when 300 Nigerian schoolgirls were kidnapped by the Boko Haram terrorist group in 2014, and the Ice Bucket Challenge of summer 2014, which raised millions in donations for charities supporting those afflicted with motor neurone disease.

However, there is also a downside to ‘going viral’. The absence of checks and balances with regard to information on the Web means that the videos, photos and articles that are circulated so rapidly from person to person might not be what they seem. Social media has also made it possible for false or inaccurate information to reach all parts of the globe before it has been properly verified. The ease with which information can be deliberately altered or falsified underscores the need for extra vigilance when engaging with social media sites:

The ‘Twitter hoax’ is a good example of the role played by social media in perpetrating false information; in particular, the celebrity death hoax is one that you have probably witnessed. Flegenheimer pointed out in 2012: ‘Just about every day, and often more frequently, Twitter kills a public figure’. Celebrities whose deaths have been prematurely reported on Twitter include Miley Cyrus, Axl Rose, Macaulay Culkin, Betty White and Bill Cosby. In October 2014 the agent of American actor Judd Nelson was forced to circulate a photo of the actor holding up the day’s newspaper with the date clearly visible to prove that he was still alive after the rumour that he had passed away spread on Twitter (Colker & Raab, 2014).

The serious issues raised by the risk of false information circulating on social media were underscored in 2014 by the publication of the online ‘Verification Handbook’, developed by the European Journalism Centre to provide journalists with ‘step-by-step guidelines for using user-generated content during emergencies’ (Silverman, 2014). While the aim of the handbook is to assist journalists in ensuring that accurate information is reported in what could be life-or-death scenarios, the developers also emphasize that the principles and strategies discussed can—and should—be used by any person, including the ‘citizen reporter, relief responder, volunteer, journalism school student, emergency communication specialist, or […] academic researching social media’ (Silverman, 2014). Nowadays, newsworthy events can be recorded in real time by anyone who is standing by with a digital camera or smartphone. Frequently, these eyewitness videos are uploaded directly to YouTube, or circulated on Twitter or other social media sites, without any context or any editorial control, as would be the case with a trusted news network. Separating that which is important and genuine from that which is trivial or fabricated is increasingly difficult because amateur videos and images often display a professional gloss or slickness, thanks to the media and filtering tools available to all. The need for intelligent evaluation is greater than ever so that we can untangle fact from fiction.

The digital detective never takes information at face value—especially information that reaches him or her through social media or is generated by ‘the crowd’. In Chapter 5 we discussed the importance of carefully evaluating digital information and seeking out the clues that tell you whether information can be trusted. However, greater challenges arise when there has been a calculated effort to deliberately mislead, influence or, more seriously, defraud Internet users through the spread of false information, or when scams are implemented that have been designed to trick users into performing an action that will lead to some sort of negative consequence, frequently financial in nature. This chapter considers how you can recognize—and, more importantly, protect yourself against—fraudulent Internet activity.

In general, some evidence suggests that there is a growing lack of trust in the security of online information among Internet users in the past few years. In 2014, a Pew Research Center report on public perceptions of privacy and security in the United States found that, ‘across the board, there is a universal lack of confidence among adults in the security of everyday communications channels—particularly when it comes to the use of online tools’ (Madden, 2014). Participants in that study indicated that they felt insecure in a variety of situations, including using social media sites to share private information with another trusted person or organization, using chat or instant messages to share private information, sending private information via text messages and email and using their mobile phone when they want to share private information. Furthermore, in the wake of the explosive information leaked by whistle-blower Edward Snowden in 2013 about the activities of the National Security Administration in accessing the phone records and Internet search logs of US citizens, a very high percentage of participants expressed concern about the government’s monitoring of phone calls and Internet communications. Most of the people surveyed felt that they should be doing more than they already were to protect their privacy online. However, it was also clear from the study that people frequently view the posting of personal information online as a kind of trade-off between their security concerns about what might happen to that information and the benefits they perceive will accrue from it, such as improved online services, personalized content or gaining free access to other services.

Once you download the version of the tool that you require, you are invited to answer a series of questions about the nature and frequency of your online interactions. Your answers to these questions are used to calculate your online identity risk. Each individual answer generates ‘identity risk scores’, which are compiled to indicate an overall risk level. Questions include the following:

Your overall risk is calculated as low, medium or high, depending on your interactions. Although far from scientific, it is interesting to complete this exercise to reflect on your digital online behaviour and how open to cybercrime it might leave you. So, how safe do you feel? How much information are you willing to share online? The following sections consider the different scams that are perpetrated on the Internet and the measures you can put in place to protect yourself in online spaces.

In Europe, the European Cybercrime Centre (EC3) at Europol was launched in January 2013 to ‘build operational and analytical capacity for investigations and cooperation with international partners in the pursuit of an EU free from cybercrime’ (European Cybercrime Centre, 2015). Its first report, the Internet Organized Crime Threat Assessment (IOCTA), was published in 2014 to raise awareness among ‘decision-makers at strategic, policy and tactical levels’ of the different types of cybercrimes that are typically perpetrated online, and to advise on the measures that should be taken to protect citizens, businesses, and so on (European Cybercrime Centre, 2014). The US version, the Internet Crime Complaint Center (IC3; originally the Internet Fraud Complaint Center), was established in 2000 as a partnership between the National White Collar Crime Centre, the FBI and the Bureau of Justice Assistance to provide a means for members of the public to report online crime. Since then, its annual reports on Internet crime provide a revealing insight into the different types of fraudulent online activity that affect US citizens. However, although the IC3 reports are thorough, because of the difficulty in monitoring online crimes, the report’s authors note that ‘the true volume and scope of cybercrime is unknown’ (Internet Crime Complaint Center, 2014, p. 8). Furthermore, the ‘borderless’ nature of cybercrime makes it difficult to implement cohesive or collaborative frameworks for handling investigative procedures and sanctions to deal with the ramifications of these activities.

The EC3 report broadly classifies cybercrimes into a number of different categories:

Here we focus on three of these categories: malware, payment fraud and crimes related to social engineering. How are they defined?

Exploring how some of these scams work will offer us insight into the factors that trick or frighten people into complying with the instructions that appear on their screen or over their phone—even if they seem to be outrageous or far-fetched.

To ensure that visitors arrive at their official website, large established companies such as Amazon, Google and Apple, as well as banks and other businesses, use the SSL (Secure Sockets Layer) protocol. That means that you will see https in the URL address bar, rather than http://, and there may be some other differences in the address bar, such as a locked padlock icon at the start of the URL.

However, while this is a sensible approach to take, it does mean that we can end up juggling numerous different passwords, and eventually it may seem impossible to manage them all. This is especially true for sites that you use only sporadically. How are you supposed to remember all of them? As a result of this, many people choose to use the same password repeatedly, for different sites. While this might help you, it also renders you more vulnerable in terms of online privacy. Reusing the same password exposes you to the possible consequences of a ‘password leak’, which can occur when sites are attacked by cybercriminals. According to Hoffman (2013), ‘When your password leaks, malicious individuals have an email address, username, and password combination they can try on other websites. If you use the same login information everywhere, a leak at one website could give people access to all your accounts’. So, using the same password for every account is risky. Another option people sometimes take is to enable the ‘autofill’ function on their browsers, which means that login information is automatically entered when you load different sites; as we know, however, this is also not advisable, since anyone who uses the same browser will also have access to your accounts. How can you protect your security online and effectively manage the multiple passwords you require?