Clicking the link takes users to a spoof website that looks like YouTube. Users are tricked into agreeing to 'Like' the page on Facebook, which spreads the scam even further on Facebook.

But misdirection to online surveys and likejacking, as Cluley describes above, can be the least of a deceived user's problems. A user who activates a clickjacking link is taken to a drive-by website that might (or might not) look legitimate but that automatically downloads malware onto the user's machines. The most frequently downloaded type of malware is rogue security software, often also called rogue antivirus software (or rogue AV).

Rogue security software masquerades as legitimate security software. Sometimes it even imitates legitimate security software interfaces, such as Microsoft Update. After it's installed on your machine, antivirus malware might simply pretend to detect viruses and then entice you into paying for a subscription to have your machine cleaned.

Or it might install more malicious software — keyloggers, password recorders, or rootkits — that can go undetected while stealing your data. This software might lie dormant until it detects a specific event, such as when you enter a bank account number. Then it comes to life and starts collecting your keystrokes: recording your passwords, social security number, date of birth, and other personal data.

The scammers resell your credit card numbers or passwords to other criminals. Then they change their company name, change the credit agency they're using to bill you for your "malware subscription," and vanish before they can be identified. Rogue security software costs the banking industry billions of dollars a year, a cost borne by consumers.

Figure 1 shows an example of rogue security software that's disguised as a Microsoft alert.


Figure 1. Fake security alert

How can you avoid clickjacking scams and drive-by websites? It's simple, but in the heat of a disaster, it can be harder than it sounds. Sophos's Cluley wrote, "Remember to always get your news from legitimate news websites, and if you're hunting for a video, make sure that you go to the real YouTube website rather than a replica set up by scammers."

Meanwhile, old-fashioned donation fraud, featuring spoofed charity sites and phishing e-mails, has not gone away. ScamWarners has reported detecting a fake Salvation Army site. FBI spokeswoman Jenny Shearer told MarketWatch.com that a fraudulent e-mail, purportedly from the British Red Cross, is soliciting wired donations.

How to keep yourself safe in disastrous times

Here are tips to help you protect yourself from donation fraud: