- Welcome to "Black Issues Forum."

I'm Kenia Thompson.

It's the holiday season and a lot of us are shopping online.

But before you start buying or selling, there are some things to look out for.

We've invited our cybersecurity and tech experts to help sort it through.

Let's welcome to the show De'Von Carter, founder of CarTek Consulting, an information security consulting firm that specializes in business security and solutions, and April Dawson, associate dean of technology and innovation as well as a professor of law at North Carolina Central University.

Welcome to the show.

- Happy to be here.

- Thank you for having me.

- Well, I wanted to start off talking or taking a look at some images that I pulled.

I've experienced some of these situations myself.

My mom has experienced some, our friends and family has, but these are screenshots, emails, text messages that some people get, right?

So this first one, this is a real email that was sent to a Facebook Marketplace seller.

This happened after a buyer expressed interest in an item that they were selling and quote, unquote attempted to send the money via Zelle, but encountered an issue.

So what I was told is what they actually did was try to deposit more money than the actual price of the product and then asked the seller to send back the excess, when in reality they never received anything.

I'd love to get your feedback.

Let's pull up that image again.

And I wanna start off by you guys just telling me, De'Von, starting first.

What are some red flags that you're seeing in this email that people should be looking out for?

- [De'Von] Well, the initial red flag for me would be the domain name of the email address, right?

Zelle, and for that matter, Cash App or Venmo, they're not gonna send any type of support emails from any free email services or anything like that.

So that's the first red flag for me.

- [Kenia] Yeah.

April, what are you seeing in this?

- [April] So, certainly a sense of urgency.

So whenever you see, you know, an email or something that's saying, this is an important matter, you need to act very quickly, that's a sign as well that you need to just kind of slow down.

So most of these scams happen very quickly and the scammers know that they want people to be very emotional in how they react.

- Yeah, good point.

De'Von, would Zelle send an email like this?

So let's say it was actually from Zelle, we saw that domain.

Would they send an email like this though?

- Likely not.

Most of these companies, they're not gonna send any type of email that is requesting you to do any type of financial transaction or request any type of sensitive information.

That's just not how they operate.

- And so some people may not use Zelle, though.

They may use Cash App, they may use Venmo.

Are those the same kind of thought process that they, a piece of communication like this would not be sent from them?

- No, it's the same for all of those companies.

They're very, very careful about what they send out.

They want to be ensure that they can't or can avoid liability if they give wrong instructions or anything like that.

So they're not gonna request that type of information through email.

- And how safe is it to use these services?

'Cause a lot of people, I'm assuming, are using them.

- Well, for me, I think they're pretty safe.

They do a great job from, you know, encryption, being careful of how they're sending data back and forth between the companies.

They vetted out their processes for a very long time and so they're pretty safe with that.

- Yeah, well that's good to know.

'cause I used them too.

[Kenia and De'Von laugh] April, the person who received this email said that in their Zelle account, it did look like there was a pending deposit of $500.

How is that possible?

And does that trap people sometimes?

- Oh, it absolutely traps people, because as you use it, so many of us use it.

Zelle, you know, Venmo, they're very convenient.

As De'Von mentioned, they are fairly safe.

The issue is of course, user error.

And we know how they work, they work for the most part instantaneously.

And so if you see in your account that you've got these pending funds, your assumption is that the funds will be there, you know, very soon.

But what the scammers do is they will send the funds from a either fake account or an account that doesn't have sufficient funds, so it shows up as pending.

And people seeing that don't necessarily realize that.

So then you have people who are, you know, sending the reimbursement and those pending funds can be reversed.

- And that's so sad.

And a lot of times people don't even want to admit that this has happened, because there's a shame associated there.

- Yeah, the embarrassment and shame is one of the things that scammers count on, right?

The more people that don't report, and actually the vast majority of scams are not reported, it means that they're able to be more and more successful with these scams.

And we have to make sure that when we're dealing with our family, particularly our elderly community and the young community, that we let them know that everyone has been a victim of a scam or identity theft at some point.

And there's no shame associated with it, but the only way that we can combat it is if we're open and honest about it.

- Exactly.

Let's take a look at the second image.

It's a screen grab of a voicemail.

And in this voice message, the caller alleges that they are from a tax and debt financial service looking to assist in eliminating debt and to give them a call back.

De'Von, what are your thoughts on this one?

- Honestly, we know these types of services do actually exist in real life.

However, most of them aren't cold calling for these types of things.

When they leave these messages, their goal is to get you to call back and then try to quote, unquote verify your information, which is when they will actually take your information.

So my recommendation would be, you know, if you happen to find yourself in this situation, go online, search out and find reputable businesses to use these services and that'll save you a lot of trouble, but I would stay away from the cold call-type situation.

- Yeah, and that's a little confusing to me, though, right?

Because a lot of folks say, "Don't take the call, but you can call back, right?"

And so us calling back and verifying information almost feels like, "Well, I initiated this," and so that's a bit confusing sometimes.

April, when folks like this are calling, they're likely targeting folks that actually do have debt.

And so how are they getting this information and is that legal?

And is that one of the ways that people fall prey to it because they're likely already dealing with debt?

- Yeah, so, you know, if you think about different demographics, so if you are targeting college students, for example, most college students have incurred some type of debt.

And in fact, most, you know, Americans do have some type of debt.

So even if you're just playing the odds and you're sending these communications to everyone, the odds are, that you're going to get, you know, quite a few hits.

The other things that scammers do is they will hunt through people's discarded mail.

And so if you've got some mail and you're not shredding, information that you receive, you know, your credit card statements could be in there.

So people have to be really cautious about information that they don't secure themselves.

- Indeed, I wanna pull up this next image.

It's one that I personally have received a few times.

It appears to be a text message from a postal service about a package delivery with an incorrect address.

So delivery has been suspended, and I don't know about you, but in the days of Amazon ordering and delivery, it's fair to assume that a lot of people, especially right now, are getting a lot of packages on a daily basis.

And for me, it's alarming to think that I might not get my package.

So why are they doing this?

I'm still like trying to figure out how are they getting, what is the point?

What's the actual scam here in these postal text messages?

April, I'll go to you first.

- Mm-hmm, yes, so, and to your point, right?

We're all ordering online, we're all receiving packages.

And again, it's about playing the odds.

And if they have a number and that number's been verified as being an actual working number, it is, you know, when we're thinking about computer technology and AI, it is so easy to have these bots run and send these text messages.

And again, they are just playing the odds.

And if you click on the links, then oftentimes, there will be malware that's downloaded on your phone and they're able to capture additional information.

So these scammers, the more information they have, the more successful the scams will be.

- Yeah, De'Von, what is the safest way to follow up on this if you're not quite sure if it's fake or real?

- Well, in this particular instance, it's just kind of understand how life works, right?

We'll, the post office is typically not gonna contact you in this way, in fact, that they're not, it's generally gonna be through one of those little post-it messages they put on your mailbox, on your door, and things like that.

So basically, when you see these types of messages, just take a deep breath, think about it for a second, and I think you'll come to the right decision there.

- Yeah, and I think it's very important to emphasize not to click the "Okay" or to the "Resolve This" or not to click anything, I tell my mom that all the time, "Do not touch it."

So, just close it out.

All right, let's pull up this next image.

It's an email screenshot, it's from my personal email.

I received it literally just the other day and it's thanking me for my order.

And it has an attachment that I'm assuming that, it's supposed to be my confirmation or my receipt.

I knew that this was a fake, I knew not to open the attachment, but what are some things that alerts someone that this might be a fraudulent email, De'Von?

- Again, check that domain name, right?

Official businesses are not using the free email services like Gmail or Yahoo or Hotmail, and what have you.

So really look at that domain.

Also, again, if you're seeing anything where it's trying to force you to do something quickly or act with any level of urgency, that should be a red flag, right?

Because there's no need for that at this point.

So, yeah, tho those are the big things that I would look at first.

- Yeah, April, anything to add with that email?

Yeah, so, you know, oftentimes with these emails, the grammar's not quite right, the punctuation isn't quite right, and those have been red flags to alert people if you're, you know, reading carefully.

Yeah, I will say because of AI, generative AI, and the ability to have, you know, text written very well with punctuation correct.

Some of the like grammar and punctuation issues we have been seeing, we probably won't be seeing as much of them, so we still need to look, but, you know, that won't always be a sign of a fraudulent email.

- Yeah, yeah, in that email, I noticed the spacing was off, so that was an indicator to me.

Last image here, my mom's called me with this one a few times.

iPhone or any phone really that pops up, this message claiming that, "The phone has been infected with the virus."

Six to be specific in this one, and prompts the user, "To follow instructions for removal."

De'Von, can viruses be downloaded onto your phone this way?

What are we dealing with?

- Oh, absolutely, it's a pretty old trick at this point, trying to get you to click on the message to send to a website to either, you know, download additional malware or try to force you into purchasing something to a so-called remove the malware.

That's a pretty normal occurrence at this point.

The thing you wanna remember is when you see these things, don't click on it, right?

Try to get off of that screen, close the tab, reboot your device, remove any new types of technology that you've added to the device.

- Indeed, well, before we move on to the next block, I wanted to share a funny, but very real clip.

It's a phone call scammer who unknowingly called a police officer.

Take a listen.

- [Scammer] Can you verify me your home address?

- No, I will not.

- [Scammer] I'm sorry.

- No, I'm not going to give you my address.

If you have my file on me, you should know what my address is.

- [Scammer] Ms. Stephens, you need to understand one thing over here, that I'm trying to cooperate with you on the recorded line, and even you need to cooperate with me.

Please send me your mailing address.

- My current address is 205 - [Scammer] Mm-hmm.

Saunders, S-A-U-N-D-E-R-S Street, in Apex, North Carolina.

- [Scammer] Want me to read out the complete information to you about the allegations from which you can.

[Scammer] Now there are legal enforcement agencies involved in this case.

So, before we go ahead and give all the complete information to you, I need you to verify me with the last four digits numbers of your Social Security, so I can confirm that the details are given to the right person.

- I'm not gonna confirm my Social Security number with you.

- [Person On Phone] Ms. Stephens, I'm not asking you to confirm your social security number.

What I'm asking you just to verify me with the last four digits of your Social Security, so I can confirm that details are given to the right person.

- I'm not gonna do that.

- [Person On Phone] The Social Security Administration and law enforcement agencies has found 25 fraudulent bank accounts open and used fraudulently using your social security number to commit a fraud of more than $10 million.

This account- - $10 million.

[laughing softly] So that was, again, the caller did not realize they were calling Apex Police Department.

Devon, I'd love to hear your feedback.

25 fraudulent cases, trying to get her information.

Do people fall prey to this?

- Unfortunately, some people do.

The thing to remember is, you know, the tone, the calling with urgency.

I think the police officer, obviously she's trained and skilled in this.

She understands to, you know, not give out that type of information.

So, that's the lesson that we need to learn.

You know, if they're asking you to provide information to verify, no, you ask them, "You give me what you have, and we'll see if you're on target," so.

- Yeah, well, you know, I think that this first segment just show that there are a lot of things that can look to be deceiving, but make sure that you check the spellings, check all the domains, and don't click on anything, I think is what we've learned in that, right?

- Absolutely.

- Yeah.