CIPA Digital Identity & Online Security Flashcards

What is 'smishing' in the context of identity theft?

Answer: A phishing attack delivered via SMS text messages

Smishing is a form of phishing that uses deceptive SMS text messages to trick recipients into revealing sensitive information or clicking malicious links.

Which security feature should a CIPA advisor recommend to protect a client's email account from unauthorized access?

Answer: Enabling multi-factor authentication (MFA)

Enabling MFA on email accounts adds a critical layer of protection, since email is often used to reset passwords for other accounts.

What is 'SIM swapping' and why is it a threat to digital identity?

Answer: A fraud where attackers convince a carrier to transfer a victim's phone number to an attacker-controlled SIM

SIM swapping allows attackers to take over a victim's phone number, intercepting SMS-based authentication codes and gaining access to accounts protected by SMS MFA.

Which of the following best describes 'pharming' as an online identity threat?

Answer: Redirecting users from legitimate websites to fraudulent ones to steal credentials

Pharming attacks redirect users to fraudulent websites by corrupting DNS settings or host files, allowing attackers to capture login credentials without a suspicious-looking email.

A CIPA advisor recommends that a client enable login alerts on their financial accounts. What is the primary benefit of this practice?

Answer: It provides early notification of suspicious access so the client can respond quickly

Login alerts notify the account holder of access attempts, enabling rapid detection and response to unauthorized activity before significant damage occurs.

What is the risk of oversharing location data through mobile apps in terms of identity protection?

Answer: It can reveal behavioral patterns and physical whereabouts, enabling targeted fraud or stalking

Persistent location tracking through apps can expose a person's routines and whereabouts, which criminals may exploit for physical theft, fraud, or targeted social engineering.