Avoiding COVID-19 Contact Tracing Scams

Contact tracing is an integral part of the fight against COVID-19.  It speeds response, identifies potential hot spots, and focuses testing efforts.  Unfortunately, it also creates an opportunity for scammers to deploy two of their most powerful tools, impersonating authority and a sense of urgency.

A North Carolina news station conducted an information test by calling a producer's friends and using a script based on CDC recommendations.  

After the initial greeting and confirmation of the subject's name and birth date, the script abandoned the CDC guidelines and started asking for the subject's Social Security number, home address and other personal information.  These questions are presented as necessary to 'confirm' the subject's identity.  In fact, they are the basic elements of identity theft.  Several of the attempts were successful in getting a complete picture of the subject's personal information.

In another part of the same segment, the station interviewed an IT Security professional who demonstrated how a simple, professionally-worded message (from a fictitious contact tracing company) could get recipients to click on a link that could install malware on their computer.  The malware could be leveraged to give  an attacker complete access to all information on the system.

Contact tracing gives scammers a chance to represent themselves as providing a legitimate and authoritative service in combating a pandemic, and to take advantage of the stress their victim may feel on being informed that they have been identified as at-risk for infection.

If you get a text message or email telling you that you will be called by a contact tracer, then just wait for the call.  If you get a message telling you to click a link, DO NOT CLICK THE LINK!

If you live in Maryland, please visit https://coronavirus.maryland.gov/pages/contact-tracing .  If you are called by a legitimate contact tracer, your caller ID will tag the call as MD COVID.  If you do not have caller ID, the calling number should be (240) 466-4488.  You can also call back on (240) 466-4488 if you receive voice mail.  A legitimate contact tracer will not ask you for your Social Security number, bank account number or credit card information, nor will they ask for money.

References:

Rossen Reports: Feds warn of new contact tracing scam

https://www.wxii12.com/article/rossen-reports-scammers-posing-as-contract-tracers/33251285

Notification of Exposure: A Contact Tracer's Guide for COVID-19

https://www.cdc.gov/coronavirus/2019-ncov/php/notification-of-exposure.html

Welcome to covidLINK - Maryland,giv

https://coronavirus.maryland.gov/pages/contact-tracing

Maryland COVID Contact Tracing

https://www.norc.org/Research/Projects/Pages/maryland-covid-contact-tracing-.aspx