Stay Safe in Our Community: Latest Scams to Watch Out For and How to Protect Yourself

Community Alert: New Fraud Tactics & How to Stay Safe

Criminals are constantly updating their tactics to exploit trust, using artificial intelligence, deceptive phone calls, and high-pressure situations to catch people off guard. To help keep our neighbourhood safe, we have put together a summary of the latest scams circulating across the UK and the simple steps you can take to protect yourself, your family, and your neighbours.

1. AI Voice Cloning & Deepfake Emergency Scams

• How it works: Scammers use short audio clips or video snippets taken from social media to replicate the voice or appearance of a loved one or authority figure using artificial intelligence. They then contact you claiming there is an urgent emergency — such as a relative being arrested, involved in an accident, or needing immediate bail money.

• Red Flag: High pressure to transfer funds straight away using untraceable methods like gift vouchers, wire transfers, or cryptocurrency.

2. "Digital Arrest" & Government Imposter Frauds

• How it works: Criminals pose as police officers, HMRC officials, or UK Border Force agents over video or telephone calls. They claim that you or a family member are linked to a crime and force you to stay on the call (a simulated "digital arrest") until you pay a fine or move money into a fake "safe account".

• Red Flag: Threats of immediate arrest, being told you must stay on a video call, or demands to transfer money to "protect" your bank accounts.

3. Remote Work & Fake Job Recruitment

• How it works: Posing as recruitment agencies or tech employers, fraudsters advertise high-paying work-from-home jobs (such as data entry or testing AI systems). After a brief online interview, they ask for money upfront for office equipment or request sensitive bank details under the guise of setting up payroll.

• Red Flag: Job offers made without a proper face-to-face or official video interview, or requests to buy equipment upfront.

4. Fraud Recovery Scams

• How it works: Fraudsters specifically target individuals who have previously lost money to a scam. Posing as police officers, legal representatives, or recovery agents, they claim they have recovered the stolen funds and can return them — provided you pay an upfront administrative fee.

• Red Flag: Any request to pay money in advance to recover previously stolen funds.

5. One-Time Passcode (OTP) Interception Bots

• How it works: A fraudster attempts to log into your online banking, triggering your bank to text a real security code to your phone. At the exact same time, an automated phone call (a "bot") contacts you pretending to be your bank warning of a security breach, asking you to type that security code into your telephone keypad.

• Red Flag: Unexpected automated calls asking you to enter security codes you have just received on your mobile phone.

Key Rules to Stay Safe

• Agree on a Family Password: Set up a memorable, secret word or phrase with relatives to easily verify genuine emergency calls.

• Take Five & Challenge: If you receive an unexpected call claiming to be from your bank, HMRC, or the police, hang up immediately. Wait five minutes for the line to clear, then call the organisation back using an official number from a bill or website.

• Never Share Passcodes: Legitimate banks and police officers will never call or text asking for your one-time passcodes, PINs, or banking passwords.

• Report It: If you suspect a scam or have lost money, report it to Action Fraud online or by calling 0300 123 2040 (or Police Scotland on 101), and inform your bank immediately.

Please share this advice with elderly neighbours, relatives, and friends who may not be online.

N E I G H B O U R H O O D WAT C H C O M M U N I T Y A D V I S O RY (pdf) 

🚨 UK Cyber Alert: Don't Fall for the 'rn' Microsoft Password Scam! 📧

The festive season is upon us, and while we're busy buying presents and planning holidays, cybercriminals are busy too. They're getting smarter, and a new, incredibly subtle phishing scam targeting Microsoft users is making the rounds.

A video we've reviewed highlights a highly deceptive email that looks like a legitimate Microsoft password reset notification. Everything—the logo, the layout, the tone—is designed to trick you into clicking. But the giveaway is tiny, and it's something your brain is programmed to miss: the sender's email domain.

The Deceptive 'rn' Trick

The scam operates on a concept called typosquatting or a homograph attack, which is designed to exploit how quickly we scan text.

• The Fake Domain: The sender's address uses the domain rnicrosoft.com.

• The Real Domain: The legitimate domain is, of course, microsoft.com.

Take a closer look: the letters 'r' and 'n' placed next to each other (rn) can look almost identical to the letter 'm' in many fonts, especially when viewed quickly, on a mobile screen, or in a truncated email address bar.

By swapping one letter for two that visually mimic it, the criminals create a perfect, blink-and-you-miss-it trap. If you click the link in that email, you'll be taken to a fake login page where your password and other credentials will be harvested instantly.

---

🛡️ Your Essential UK Cyber Security Checklist

Don't let a tiny typo lead to a total account takeover. Here’s how you can protect yourself and your business accounts:

• 🔍 Scrutinise the Sender Address: Always check the email address of the sender, not just the display name. If it's a security or password-related email from Microsoft, the official domains are typically:

  • @microsoft.com

  • @accountprotection.microsoft.com

  • Any slight deviation, like rnicrosoft.com, is a massive red flag.

• 🛑 Did You Request It? If you receive a password reset notification but you did not initiate a password reset yourself, assume it's a scam. Legitimate services will not send you an unsolicited password reset link.

• 🖱️ Hover Before You Click (Desktop): If you're on a computer, hover your mouse cursor over any link in the email. The true destination URL will appear in the bottom corner of your browser. If it doesn't lead to a proper, official Microsoft domain, do not click it.

• 📱 Don't Trust Your Phone's Screen: Be extra cautious when viewing emails on a small mobile screen, as the full sender address is often shortened or obscured, making the 'rn' trick even harder to spot.

• 🔑 Enable Multi-Factor Authentication (MFA): This is your strongest defence. If you have MFA enabled, a scammer who steals your password still won't be able to access your account without the second code sent to your phone or authenticator app. Set it up on your Microsoft, Google, bank, and all other sensitive accounts right now.

• 🙅‍♀️ Report and Delete: If you suspect an email is a scam, report it to your email provider (e.g., as 'phishing') and then delete it immediately. Never forward it to anyone except your IT support if you're at work.

Stay alert and stay safe this holiday season. A quick check can save you a world of trouble.

🔒 How to Set Up Multi-Factor Authentication (MFA)

MFA adds a crucial second layer of security, so even if a criminal gets your password (like in the 'rnicrosoft' scam), they can't log in without the code from your phone.

1. Microsoft Accounts (Outlook, Hotmail, Office 365)

Microsoft calls this Two-Step Verification.

Step	Action	Description
1.	Go to Security Settings	Sign in to your Microsoft account's security basics page. (Search Google for "Microsoft security basics" if you don't have the link.)
2.	Find Verification	Under the Advanced security options tile, look for Two-step verification.
3.	Turn It On	Select Turn on Two-step verification. You will be asked to verify your identity.
4.	Choose Your Method	Microsoft will ask you how you want to receive your second code. The most secure methods are:
	Best: Authenticator App	Use the official Microsoft Authenticator app (or Google Authenticator, etc.). This generates a code on your phone without needing a text message or email, which is faster and more secure.
	Good: Text Message	You can opt to receive a code via SMS to your mobile number.
5.	Set Up Recovery	Make sure you have one or two recovery methods (like a secondary email or a backup code) in case you lose your phone.

---

2. Google Accounts (Gmail, Workspace)

Google calls this 2-Step Verification.

Step	Action	Description
1.	Go to Google Security	Sign in to your Google Account and navigate to the Security tab. (Search Google for "Google Security Checkup").
2.	Find 2-Step Verification	Under the "Signing in to Google" panel, click on 2-Step Verification.
3.	Get Started	Click Get Started and follow the on-screen prompts. You will need to re-enter your password.
4.	Primary Method: Google Prompts	Google will first suggest using Google Prompts (a simple "Yes, it's me" notification that pops up on your logged-in phone). This is very convenient.
5.	Set Up Backups	It will then prompt you to set up backup methods, such as:
	Backup Option 1: Text Message or Voice Call	You can enter a phone number to receive a backup code via SMS.
	Backup Option 2: Backup Codes	Google will give you a list of 10 single-use codes. Print these out and store them in a secure, physical location (like a safe or locked drawer) in case you lose access to your phone.

---

🔥 Pro-Tip for Maximum Security:

Always choose the Authenticator App method (like Microsoft Authenticator or Google Authenticator) over SMS text messages if possible. SMS codes can sometimes be intercepted by very sophisticated hackers, but codes generated inside an authenticator app on your phone are much safer.

Lock Down Your Digital Life: Free Forever Password Management with Bitwarden and Aegis

Are you tired of juggling countless passwords and worrying about cyber threats? It's time to take control of your online security without breaking the bank. This guide will show you how to create an impenetrable digital fortress using two free, powerful tools: Bitwarden and Aegis OTP.

Why Bitwarden and Aegis?

• Bitwarden: This open-source password manager offers unlimited password storage, secure sharing, and cross-platform compatibility. Best of all, it's completely free!
• Aegis OTP: A simple, effective app that generates six-digit one-time passcodes (OTP) for added security. Also free.

Together, they form a formidable duo that can protect your sensitive information from prying eyes.

How it Works:

1. Create a Strong Bitwarden Master Password: This is the key to your digital kingdom. Make it long, complex, and unique.
2. Store All Your Passwords in Bitwarden: From email to banking, every account deserves a strong, unique password. Let Bitwarden generate and store them securely.
3. Enable Two-Factor Authentication (2FA): For an extra layer of protection, use Aegis to generate OTPs for your accounts that support 2FA.
4. Sync Bitwarden Across Devices: Access your passwords effortlessly on your computer, smartphone, and tablet.

Going Premium: When to Consider Paying

While the free versions of Bitwarden and Aegis are excellent, you might consider upgrading to Bitwarden Premium for these additional benefits:

• Advanced Security Features: Password health reports, breach monitoring, and emergency access.
• Enhanced Convenience: Biometric authentication, one-click password filling, and family sharing.

If you decide to pay for Bitwarden Premium, you no longer need Aegis, as Bitwarden's built-in authenticator provides similar functionality.

Tips for Maximum Security:

• Regular Password Audits: Use Bitwarden's features to identify weak or reused passwords.
• Enable Dark Web Monitoring: Stay informed about potential data breaches.
• Keep Your Software Updated: Ensure both Bitwarden and Aegis have the latest security patches.
• Beware of Phishing Attacks: Be cautious of suspicious emails and links.

By combining the power of Bitwarden and Aegis, you can significantly enhance your online security without spending a dime. Take control of your digital life today and enjoy peace of mind knowing your valuable information is protected.

Keywords: Bitwarden, Aegis OTP, password manager, two-factor authentication, online security, data protection, free tools, cyber security.

(GDPR) Visit https://bitwarden.com/pricing/, https://getaegis.app/ (Android only)

[Bitwarden] How I Manage All My Passwords (for FREE!) (video) 👍

Bitwarden Tutorial | The Full Beginners Guide (video)

Bitwarden 101: How to use the Bitwarden Password Manager (video)

Aegis 2FA App (video) 👍

The Best Authenticator Apps for iPhone and Android

Check if your email address is in a data breach > https://haveibeenpwned.com/