14 ms·

I am going to eradicate the inbound Windows Support scam

331 points by hourislate 10y ago

verroq 10y ago
What about the scammers that just cold call and don't have an inbound number?
- rblatz 10y ago
  Or ones that provide a fake number. Sounds like an easy way to DDoS a bank, charity, political, call center.
  - deleted 10y ago
    [deleted]
  - Sunset 10y ago
    What kind of shoddy phone infrastructure allows "faking" the caller ID. There should be laws to fix this.
    - brianwawok 10y ago
      What kind of shoddy network infrastructure allows faking an IP? There should be laws against this.
      - Sunset 10y ago
        Well, there's already a technical solution for that. You can drop packets which are coming from inside your network but which have ips which don't belong to your ranges. If there was a law that you need to have equipment capable of that and be using it that would be a step in the right direction. Same for telcos. Make it mandatory and watch them scramble to fix their shitty infrastructure. Instead of fining them money when they fail to implement the law's requirements make them have to cut everyone's subscription charges in half until they do follow the law to the letter or face the SWAT teams.
- cyberferret 10y ago
  Most of the ones that I have heard of here in Australia don't provide a number - they just call you direct and say that they are reacting to a 'virus log' on their system, apparently. I have had several family members and colleagues being called by them over the years - some multiple time, but so far I've never received a call from them. I actually can't wait for one of them to call me. My intent is to string them along on the phone for as long as I can with the reasoning that every minute he is wasting with me is a minute that he can't scam an unsuspecting person...
  - empressplay 10y ago
    If you make up some reason that you have to call them back (and seem earnest about wanting their "help") they will (often) give you a number (although they may stop doing that if they get blasted enough)
  - acbabis 10y ago
    My wife does this. One time a support scammer called trying to get her to install malware. It went something like this: "Ok. Please press the Windows key" "Ok (long pause)" "Did you press it?" "Yes" "What happened?" "Nothing happened" "Try again." "Ok... Nothing. Does it matter that I don't have a windows?" "Oh you have Mac?" "No, I have Ubuntu" "Ok, what version?" "I don't know!? You're the computer person. Why don't you know?!" The best part is that she was sitting on the couch the whole time.
    - cyberferret 10y ago
      That's exactly the sort of thing I want to do with them. I have another colleague who managed to string a guy along for nearly half an hour. Always managing to convince him that he was a noob struggling to get around. He said you've got to give those guys 10/10 for patience. Just imagine if they had real support jobs - they could probably do well at it.
      - brianwawok 10y ago
        Maybe they quit their Dell support job for this for the better pay?
fjarlq 10y ago
Reminds me of Lenny, the bot that tricks telemarketers: https://www.toao.net/595-lenny https://www.toao.net/595-lenny
- cyberferret 10y ago
  I've only recently heard of Lenny (late to the party), but think some of the videos I've heard are hilarious. I know "he's" been around for a while, and runs on a purely manual random delay system, but I wonder if Lenny could be updated with modern technology, to do a bit of rudimentary voice recognition for better interaction with the scam caller? I know that his existing script is very cleverly generic and timed to work in with most telemarketing scripts, but I think if it was improved just a bit more, we could end up with quite a convincing respondee that would burn up more scammer time, and hopefully make a small dent in the enthusiasm of these con artists...
  - RubyPinch 10y ago
    from what I've read, it is meant to wait for a pause (It uses Asterisk, which in turn has some basic detection for pauses and the such, which the script uses)
  - geon 10y ago
    I believe it (or some other bot) detects silence on the other end of the line to trigger playing samples. So it can insert "u-huh" whenever the salesman is done talking.
- pbhjpbhj 10y ago
  Is that the one with the ducks? I'm pretty sure there's a more recent version too, where the guy gets accused of being a robot?
  - deleted 10y ago
    [deleted]
  - aembleton 10y ago
    They all have Ducks. That's the end of the script, then it goes around and starts again. Yes, there was one when the caller realised that he is a recording.
ryandamm 10y ago
I don't think this is going to DDoS the scammers by calling them back; I think the point is you just transfer the inbound call to his bot -- the success rate on these things is so low, if he's got good enough penetration the false positives will overwhelm the true positives. I think, anyway. Spent five minutes reading the post and other parts of the blog, and dimly recall seeing something from this project posted previously. Happy to be proven wrong.
- rconti 10y ago
  "As fast as you can report fake “you have a virus call this number now” messages to me, I will be able to hit them with thousands of calls from bots. It’s like when the pirate ship turns “broadside” on an enemy in order to attack with all cannons simultaneously." But it's late, and I'm too tired to read the rest of his blog posts.
zamalek 10y ago
I wonder if a sprinkling of ML could be used here.
- frozenport 10y ago
  Nah, I think AI would be a more suitable candidate.
  - rhaps0dy 10y ago
    Standard ML is probably a safe bet.
    - frozenport 10y ago
      Are you sure the client's needs would not have been better met with over fitting? I heard it has superb performance!
- casiotone 10y ago
  The science of Marxism-Leninism is always relevant.
ikeboy 10y ago
Please have someone manually call reported numbers once to confirm it's actually a scam so this can't be exploited.
aerovistae 10y ago
This is brilliant. Can't say whether it would work, but if you listen to the pre-recorded calls he's using to tie up the operators, they're ingenius in a comical way. The second one features this woman who starts arguing with her teenage daughter in the background at length, then says to the guy "Oh my god I'm so distracted, I didn't hear anything you said, I'm really sorry, you're going to have to repeat all that." What a brilliant strategy to tie them up.
- konceptz 10y ago
  This will absolutely work. Or at least should work based on a study by Microsoft researchers stating that the business model is very fragile. https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/WhyFromNigeria.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
  - tr1ck5t3r 10y ago
    All the advice MS gives out just makes Bill Gates richer. When will the world wake up, Bill Gates is tricking people?
- 13of40 10y ago
  I called one of these things back after a few beers one night, and before I could get connected to an "operator" I had to go to a web site and get a support code, which I had to dial into their answering system. Seems like that would thwart this robo-dialing scheme, at least to some extent.
  - brazzledazzle 10y ago
    Was it captcha'd? Probably wouldn't be hard to adapt to and as long as you're quick enough to adapt. Cat and mouse will end up costing them more and more as they reduce conversions and change business processes until ultimately they'll have to give up.
- sandworm101 10y ago
  Young female voices. Flustered and looking for help. Apparantly no males in the area, certainly no male voices in earshot. These recordings tap into some base instincts within the mostly male scammers. I suspect that a recording of my voice wouldnt keep them on the line nearly as long. But for these scammers i'd go with something more targeted: old people. Thier prefered prey is flustered old people who dont understand computers. Give them an old woman with bad hearing who mumbles about her internet not working. Then toss in a few "do you take visa" and some random numbers. That will keep them on the hook.
eridius 10y ago
What happens once someone sends you a fake report in order to trick you into harassing a real person with fake calls?
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
- daeken 10y ago
  I'd hope that he gives the number one call to validate that it is, in fact, a scammer before putting it on blast. If he does, I really have no problem with this approach (and have considered it myself, frankly); if he doesn't, then this is just downright irresponsible. But I'd hope no one would be stupid enough to just trust random data from internet users, in this regard ...
  - viraptor 10y ago
    You could wait for multiple verifications. For example wait until 3 reports of the same number from different IP blocks. It needs Tor and public VPNs filtering, but that should be enough for most cases.
    - iopq 10y ago
      What about someone using one of the hundreds of thousands of proxies to submit reports? IPs are easy to get.
      - nommm-nommm 10y ago
        Easy, use a handful of pre-vetted volunteers, not anonymous IPs. Like all the internet communities that require some form of vetting by mods before a user can do some action.
hive_mind 10y ago
I'm Indian myself and it concerns me that so many of these scams emerge from what appears to be India (based on the Indian accents). Does anyone know if any scammers have ever been "brought to justice" in India. Ever? Seems like something that should be a high priority for the Indian Govt. if they want to help with India's image abroad, especially with the tech sector.
- mihaifm 10y ago
  A lot of the major corporations have tech support based in India, so this makes these scammers even more credible.
- downandout 10y ago
  I correspond with someone from India that is heavily into marketing this stuff (he does legitimate things as well, and is one of the most knowledgable paid Facebook advertising specialists on earth, which is how I came to know him). He has been pushing it for years and the Indian government has never come close to bothering either him or the people that actually own the services that pay him for each phone call his advertising generates. It's not just the Indian government that is lackadaisical about this either. He is able to run ads for tech these support scams through Facebook and get ROI above 500%. Facebook eventually stops his ads, then he buys another ad account. In fact, he claims a single aged Facebook account is worth roughly $10,000 to him (aged accounts have an easier time getting ads through). He spends well into the six figures each year on these types of ads through Facebook alone. Ad platforms share some of the blame for the proliferation of these scams because they simply do not police their platforms well - the tactics he uses to get these ads through their review process are truly elementary but are good enough to foil a company full of PhD's. Clearly they aren't trying very hard.
  - i336_ 10y ago
    Everything you just wrote is extremely interesting to me. > he ... is one of the most knowledgable paid Facebook advertising specialists on earth, which is how I came to know him > ... > the tactics he uses to get these ads through their review process are truly elementary I'm not a marketer or advertiser myself, but I'm always interested in learning more about these aspects of the Facebook "scene" just to better mentally map the state of things. Sounds like a lot (if not most) of the things this person has learned are the kind that only keep working if you're quiet about them, but I'm still very curious to hear what could be shared.
rdl 10y ago
Seems like it would be better to go through with the calls and destroy them at the payments gateway/payments provider level, same as was done with online pharma spam. https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/mccoy https://www.usenix.org/conference/usenixsecurity12/technical...
- daeken 10y ago
  In my experience with counter-scamming, these guys generally don't actually use any kind of payment processor -- they ask people to go get gift cards and tell them the numbers. It's a clever way of going about it, which essentially guarantees that they can't be shut down directly. The only way to beat them is to waste so much of their time that it's no longer profitable.
  - a_t48 10y ago
    That or install ransomware on your pc.
Animats 10y ago
There's an inbound version of this? I've gotten calls from the outbound version, but those I hang up on in the first four seconds.
- viraptor 10y ago
  Turn off the adblocker and go to some popular TV streaming sites. You'll find a few of them.
  - Animats 10y ago
    Right. I have so much ad-blocking that I never see this crap.
ryandrake 10y ago
This is neat, but at the end of the day, only user education will eradicate scams. As long as there are people willing to call strangers and give them access to their computers or buy iTunes gift cards for them, there will be scammers ready to be those strangers. Somehow people learn to not get into strangers' cars. They need to also learn to not trust uninvited solicitations, especially coming from the internet.
biot 10y ago
A good start, but needs a lot of work. If it's targeting a Windows Support scam, why not tailor the audio to that? Mention one of various viruses. If the "tech" asks you to do something, say your Windows just bluescreened and have them wait 30 seconds while it reboots, all the while saying "hang on, it's almost there", "this thing's been really slow lately", etc. and then play the Windows startup sound. Pretend to have typed your password incorrectly a few times. Occasionally ignore whatever they say and start telling them you're running this program your nephew told you about. And so on. If you call them yourself and actually follow their instructions, installing something from some site into an isolated, disposable VM and then running it, you can record what happens and then build that into a better script. Trigger these instructions by asking them what they can do to fix your computer, and time their response. Bonus points if you can detect them saying "http" which kicks off that part of the script.
- swang 10y ago
  the 4th one has mention of "these viruses on my computer"
- dkersten 10y ago
  If the "tech" asks you to do something, say your Windows just bluescreened My brother did something like this once. Every time the guy told him to do something he just said it was reeeeeeallllyyyy slow. He also started with "hang on, I have to turn it on, its a bit slow starting...". He kept the guy on the phone for about 30 minutes before telling him he had a mac :-P
- radiorental 10y ago
  When Dell was breeched a few years back my details made their way to India. I get a call from them about once a month. I've learned the script and various vectors they try to get the software onto my computer. The longest I've had them on the phone is 20 minutes. He's one of my favourite recordings though https://soundcloud.com/radiorental1/dellsupport2 https://soundcloud.com/radiorental1/dellsupport2 It's funny, someone pointed me at this thread because I sort of sound similar to the OP's site.
  - 10y ago
teknologist 10y ago
It's rather funny that all it takes to defeat UAC in Windows is for a complete stranger with a foreign accent to call you up and tell you in broken English to "push the 'Yes' button on that popup called 'Run as Administrator'".
- kalleboo 10y ago
  In Japan they have problems with scammers calling up pensioners claiming to be their sons in a bind, and directing them to go to an ATM and set up a wire transfer to drain their savings. One solution was to install cell jammers inside of the ATMs. https://www.engadget.com/2008/12/10/japan-installs-cellphone-jammers-near-atms-to-prevent-fraud/ https://www.engadget.com/2008/12/10/japan-installs-cellphone... Time to put cell jammers inside of PCs that get activated with UAC is up?
  - pavel_lishin 10y ago
    The problem exists in America as well; my elderly father was hit by it. Luckily my mom overheard his end of the conversation and put a stop to it. (Turns out, the scammer is very good at crying, but not very good at proving their alleged identity by knowing my mother's name. Hurray impromptu two-factor authentication!) But I believe that it's illegal to operate cell phone jammers, unless you're the government. And for good reason; it's wonderful that you prevent someone from being scammed, but if I'm attacked by a mugger near an ATM, I'd rather like to call 911.
    - kalleboo 10y ago
      The initiatives in Japan were in cooperation with the police, so I'm sure it's not impossible for them to get the proper permits. And many Japanese ATMs already have a "panic button", I'm sure the ones in question would too. Mugging isn't a huge crime here so I guess that's more of a problem implementing it in the US....
- RugnirViking 10y ago
  What solution do you propose that doesn't interfere with normal operation of the computer? Its a very difficult question.
i336_ 10y ago
An alternative I thought of the other day while watching one of the hundreds of YouTube videos of this was to simply batch-dial thousands of numbers all at once then randomly route them to each other. For bonus points, record everything and make it available live. The next level up would be a trusted-user system where you could go to a website, hit a button and immediately be connected with an actual scammer; or you could listen in on other people currently in calls and suggest things they should do next. And maybe there could be a pool of VMs available to play with... Regardless of technique - fake recordings or various types of routing - I would advise making friends with all the high-level VoIP gateways. That way you won't have any problems batch-establishing hundreds of calls at once (for example if you know all the numbers for a call center and you know what time the, er, staff get in), getting a new number block, or even getting general caller ID override (which I understand is sometimes unavailable?). My thinking here is that if you can win over a bunch of providers (with money and inspiration/sentiment), you could VoIP-DDoS the gateway providers the scammers are using. Would tie up the scammers' time moving to a new VoIP provider.
- lighttower 10y ago
  This. Great idea. I love the idea of being able to be connected to an actual scammer via website and have a little pop-up window with others suggesting fun things to do to the scammer. The recordings can then be made into loops to autodial them.
dandare 10y ago
This post could be greatly improved by clearly stating what is the Windows Support scam. I read half the page and I am still not sure.
- chrisan 10y ago
  You get called by these people where they tell you that you have a virus on your computer and they are going to help you fix it. http://www.makeuseof.com/tag/anatomy-scam-windows-tech-support-con-examined/ http://www.makeuseof.com/tag/anatomy-scam-windows-tech-suppo...
  - nashashmi 10y ago
    I came across one of these a couple of weeks ago. I knew it immediately it was a scam because the guy had an indian accent. I played along just to see what he would do. He directed me to site support95 .com. Apparently, there is a similar site called support18 .com. From there he told me to download an exe file. That was where I stopped. I did not know what would further happen. If anyone wants to try it: Call 18005589204. Tell him you got a voicemail of someone from Microsoft saying something about license expired. I would love to know what ultimately happens.
- nommm-nommm 10y ago
  You get a phone call with a pre-recorded message "Hi, this is Microsoft calling, we have received notification you have a virus on your computer, please call 888-888-8888 for assistance removing it." You call and they either charge you for "support," when they instruct you to delete some files from your event log or something benign or they direct you to install a program that gives them remote access to your computer so they call install malware or ransomware or steal all your files. After the Dell breach they got even more convincing "This message is for John Doe, this is Dell, we are calling in regards to your Dell Inspiration 1234 with serial number XXXXXXXX." https://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/ https://krebsonsecurity.com/2016/02/dell-to-customers-report... Sometimes it's a person on the other end instead of a recording but I can't imagine a cold call that requires computer access would be very effective because how many people are going to be sitting in front of their computer at that time? They will almost always instruct you to call back. An very old pre-internet scam is "you've won a free vacation call 888-888-8888 to claim it." When you call they ask you to pay taxes on your vacation then they run away with the money you paid in "taxes."
m00dy 10y ago
I found this on soundcloud. https://soundcloud.com/user-486592840/scam-recording https://soundcloud.com/user-486592840/scam-recording
kefka 10y ago
Alhough I shouldn't derive my enjoyment from others' suffering, I do on this capture. https://www.youtube.com/watch?v=Du6acZ-PZQ8 https://www.youtube.com/watch?v=Du6acZ-PZQ8 The long and short of it, the Indian scammer ends up setting a SysKey password and a bios password on his machine. He's using his bosses' machine, and it appears to be the domain controller. The scammer ends up crying and screaming at the guy and out of terror and rage, ends up hanging up. Normally, I would be like "I feel bad for this guy". Nope not at all. Bloody scammer got what he deserved - a taste of his own medicine.
- kjjw 10y ago
  Maybe in the US it is not considered racist to mock an Indian accent but elsewhere it is.
  - kefka 10y ago
    I agree. The mocking because of being Indian is not cool. But harming scammers; I have a hard time not deriving enjoyment out of that. It's probably wrong.. But these people are extra-legal. The US can't touch them. The Indian government doesn't care... and they bring in US money to their country along with tax revenue.
    - kjjw 10y ago
      It is great to see this problem highlighted but herein we have found a line that some people find hard to walk. Real shame this person [whose voice is in the video] has created such a distraction.
      - kefka 10y ago
        True that. And that dead (and removed) comment was by "Asooka".. Seems like a slur to Maurya Ashoka. Some times, things like that will also catch me.. was just wrong, but couldn't put my finger on it until now.
- rogual 10y ago
Asooka 10y ago
Nowhere in OP's comment did OP mock the call centre person's accent. Please go back to tumblr until you develop the required reading skills to participate on HN.
- kefka 10y ago
  No, kjjw is indeed correct. They know the video. The video, the guy mocks the Indian scammer with repeated lines like "Not goot, not goot at all" in a very Midwestern->faux Indian accent. Think Apu on "The Simpsons". And no, making fun of someone because of their nationality and origin language just isn't cool. Maybe it was 60 years ago, with killing Commies and Japs and Niggers. I'd like to think that most of us are past that brutish "ideal".. Then again, with commentary of 'Please go back to tumblr until you develop the required reading skills to participate on HN.', they certainly have demonstrated more skills in understanding content than you have. Perhaps it ought to be you who "goes back wherever someone else thinks you came from?, no?
- dang 10y ago
  > Please go back to tumblr until you You can't attack other people like that on HN, regardless of whether they also broke the rules. You owe better to the community here. We detached this subthread from https://news.ycombinator.com/item?id=13597588 https://news.ycombinator.com/item?id=13597588 and marked it off-topic.
laumars 10y ago
A word of warning for the author: phone numbers can be easily spoofed (like you can spoof the sender email address or the originating IP in a UDP packet). What's more, many scam calls do use spoofed phone numbers. Thus the number you might be flooding may not be the originating caller. This could turn your utility into something far more malicious than was originally intended.
- Nursie 10y ago
  I think this is aimed at viruses/scam popups etc that say "You have a virus! Call Windows support at this number now!" In that case we can be pretty sure the number is correct.
  - laumars 10y ago
    Ahh I missed that part. Appologies.
- diamondo25 10y ago
  Yes, but also get the ball rolling to also improve this system in the world. Companies do not care that systems are vurnable until it really affects them. Just look at the botnets from vilnerable IoT devices waking up parties so they start to protect them. Same with phones and their support periods...
  - laumars 10y ago
    Blackhats don't tend to publish their work in a way that is traceable back to their person. If this system gets abused then the OP becomes liable. This was why I raised my warning to the author specifically - albeit I couldn't have made my point about the legal consequences of abuse clearer in my previous post.
  - zeure 10y ago
    Were a lot of those insecure IoT companies attacked by those botnets? If not, I still don't think much will change.
- 10y ago
sundvor 10y ago
~~ Yes. Yes. Hello? Sorry, you're going to have to start again. Yes? Go on. Ahum. ~~ Absolutely love this guy. Can't say it enough.
StavrosK 10y ago
I made an email equivalent of this: https://spa.mnesty.com/ https://spa.mnesty.com/ The problem is when people send you numbers or emails of legitimate people, because now you're basically DDoSing their phone number for free. How is this service planning to vet these numbers?
- martinml 10y ago
  You seem to have some loop there with the real Uber support? https://spa.mnesty.com/conversations/bmazjsnh/ https://spa.mnesty.com/conversations/bmazjsnh/ And in one case the spammer was aware of your site! https://spa.mnesty.com/conversations/gywanvsb/ https://spa.mnesty.com/conversations/gywanvsb/ Maybe you can hide from Google with the appropiate robots.txt so the last one doesn't happen.
  - StavrosK 10y ago
    Thanks for that, I've deleted the first one. I have safeguards in place to prevent legitimate senders from being hassled, but I have to add them first. That second one is hilarious, though :P
    - Doctor_Fegg 10y ago
      "She is a Monkey climbing trees " Brilliant!
- Retr0spectrum 10y ago
  In this case, you just need a human to call them up once to verify.
al2o3cr 10y ago
While this seems satisfying, it would be more effective to figure out how these companies are still able to access the credit card networks and block the shit out of them. I used to work at one of the smaller international CC processors, and we specifically rejected merchants offering "remote technical support" (i.e., THIS EXACT SCAM) and the entire rest of the 5967 MCC (inbound teleservices). I recall reading that the "fake IRS" crew had started working around this by telling people to buy iTunes gift cards, but it would be a start.
problems 10y ago
I'm assuming you're using a VoIP provider to do this - just be careful, they might have rules against this. Definitely don't do it on an account you have a personal number you value or something. That said, I fire attacks at script kiddies in the clear from big server providers including DigitalOcean and OVH, so I suppose as long as the attackee can't really complain legally, you might be okay.
brazzledazzle 10y ago
This reminds me of stuff we used to do with 96 line dialers way back in the day. It was a pretty solid tactic for dealing with anyone that scammed us. Difficult number portability, a lack of ubiquitous capability to cost effectively deal with a phone DoS, their lack of knowledge about various telecommunications laws (what with search engines not being what they are today) and most importantly the fact that they were almost universally uninterested in engaging law enforcement (what with the scamming or fraud) it was a pretty effective way to get bad people to stop being bad. But it was a long time ago and I wouldn't do it again given the chance. I was really young, it was definitely an ethically gray area and we were breaking at least one law. I also came to understand over time that the reason we kept having run ins with scammers was because we were running a shady ISP/hosting and telemarketing business that had a significant portion of customers who were scamming their own customers. If it always smells like shit there might be some on your shoe. It was an important lesson and now I pay a lot more attention to how my employer gets money and who they get it from. On a lighter note we won tickets a couple times calling radio stations. We felt pretty bad about cheating like that so we never did it again but it was pretty effective as long as you had a couple butts in seats to deal with the "sorry you're not the 9th caller" pickups.
athenot 10y ago
The problem is that scammers can fake the CallerID. Yes it's illegal but they are already engaging in dubious activities. So this bot would just dial back at innocent victims whose numbers were unknowingly used by the scammers.
JacenRKohler 10y ago
I look forward to hearing more in the future.
jlebrech 10y ago
this is generic to hassle any kind of call centre: PPI claims, accident claims etc..
jlebrech 10y ago
you could add voice recognition to cue up responses and also launch a vm for them to take control of.
bediger4000 10y ago
What percentage of people doing this (or the "This is Lenny!" thing) would it take to make the scam unprofitable? Is there any work on that topic, like "what percentage of honeypots makes scammers quit"? I don't get many "Windows Support" scam calls, the two I have gotten I was unable to play them for long, as I am a poor Linux user, not Windows knowledgeable at all, but I generally keep the "Card Services" people on the line for a few minutes.
- TheCowboy 10y ago
  A small percentage could hurt their profits a lot, but it's not like they are without counters to this. They could slap on a max length at which point they know they're wasting their time, and also start to blacklist numbers that waste their time. They could use audio recognition to avoid known automated honeytraps, but even humans would adapt after enough calls. I still think it would be difficult to even reach that target %. As much as I would like to waste their time, I'm strapped for time myself. There would need to be a way to receive a call on your phone and send it to the honeytrap in two 'clicks', where it plays scripted responses in the background. If we reached that magic percentage, I think they could have a counter. They could discourage this by using targeted harassment. Someone screws with them, they send a mass of random calls over the course of a day.
  - bediger4000 10y ago
    After a few years of monkeying with the "Cardholder Services" calls, I'm convinced there's two layers of crooks involved. The first layer is the autodialers, they just run through series of phone numbers, and play a recording. I'm pretty sure these bastards don't screen numbers, because I can at least get through to the (Indian) boiler room almost 100% of calls. I think the boiler rooms are actually seperate organizations/crime clans. The boiler rooms do screen, but not universally. After years of being "Edward Snowden" and giving out fake card numbers that pass the Luhn checksum, only maybe 25% of the boiler rooms cut me off. A few days ago, the "service rep" had a bad headset and I could hear a recorded voice telling him to hang up, which he did. Even Trump's FCC would have to deal with targeted harassment. That's the kind of crap that nobody puts up with. Besides that, harassment calls probably ruin the NSA's data retention practices, so that just can't happen.

331 points by hourislate 10y ago

verroq 10y ago

What about the scammers that just cold call and don't have an inbound number?

rblatz 10y ago
Or ones that provide a fake number. Sounds like an easy way to DDoS a bank, charity, political, call center.
- deleted 10y ago
  [deleted]
- Sunset 10y ago
  What kind of shoddy phone infrastructure allows "faking" the caller ID. There should be laws to fix this.
  - brianwawok 10y ago
    What kind of shoddy network infrastructure allows faking an IP? There should be laws against this.
    - Sunset 10y ago
      Well, there's already a technical solution for that. You can drop packets which are coming from inside your network but which have ips which don't belong to your ranges. If there was a law that you need to have equipment capable of that and be using it that would be a step in the right direction. Same for telcos. Make it mandatory and watch them scramble to fix their shitty infrastructure. Instead of fining them money when they fail to implement the law's requirements make them have to cut everyone's subscription charges in half until they do follow the law to the letter or face the SWAT teams.
cyberferret 10y ago
Most of the ones that I have heard of here in Australia don't provide a number - they just call you direct and say that they are reacting to a 'virus log' on their system, apparently. I have had several family members and colleagues being called by them over the years - some multiple time, but so far I've never received a call from them. I actually can't wait for one of them to call me. My intent is to string them along on the phone for as long as I can with the reasoning that every minute he is wasting with me is a minute that he can't scam an unsuspecting person...
- empressplay 10y ago
  If you make up some reason that you have to call them back (and seem earnest about wanting their "help") they will (often) give you a number (although they may stop doing that if they get blasted enough)
- acbabis 10y ago
  My wife does this. One time a support scammer called trying to get her to install malware. It went something like this: "Ok. Please press the Windows key" "Ok (long pause)" "Did you press it?" "Yes" "What happened?" "Nothing happened" "Try again." "Ok... Nothing. Does it matter that I don't have a windows?" "Oh you have Mac?" "No, I have Ubuntu" "Ok, what version?" "I don't know!? You're the computer person. Why don't you know?!" The best part is that she was sitting on the couch the whole time.
  - cyberferret 10y ago
    That's exactly the sort of thing I want to do with them. I have another colleague who managed to string a guy along for nearly half an hour. Always managing to convince him that he was a noob struggling to get around. He said you've got to give those guys 10/10 for patience. Just imagine if they had real support jobs - they could probably do well at it.
    - brianwawok 10y ago
      Maybe they quit their Dell support job for this for the better pay?

fjarlq 10y ago

Reminds me of Lenny, the bot that tricks telemarketers: https://www.toao.net/595-lenny https://www.toao.net/595-lenny

cyberferret 10y ago
I've only recently heard of Lenny (late to the party), but think some of the videos I've heard are hilarious. I know "he's" been around for a while, and runs on a purely manual random delay system, but I wonder if Lenny could be updated with modern technology, to do a bit of rudimentary voice recognition for better interaction with the scam caller? I know that his existing script is very cleverly generic and timed to work in with most telemarketing scripts, but I think if it was improved just a bit more, we could end up with quite a convincing respondee that would burn up more scammer time, and hopefully make a small dent in the enthusiasm of these con artists...
- RubyPinch 10y ago
  from what I've read, it is meant to wait for a pause (It uses Asterisk, which in turn has some basic detection for pauses and the such, which the script uses)
- geon 10y ago
  I believe it (or some other bot) detects silence on the other end of the line to trigger playing samples. So it can insert "u-huh" whenever the salesman is done talking.
pbhjpbhj 10y ago
Is that the one with the ducks? I'm pretty sure there's a more recent version too, where the guy gets accused of being a robot?
- deleted 10y ago
  [deleted]
- aembleton 10y ago
  They all have Ducks. That's the end of the script, then it goes around and starts again. Yes, there was one when the caller realised that he is a recording.

ryandamm 10y ago

I don't think this is going to DDoS the scammers by calling them back; I think the point is you just transfer the inbound call to his bot -- the success rate on these things is so low, if he's got good enough penetration the false positives will overwhelm the true positives. I think, anyway. Spent five minutes reading the post and other parts of the blog, and dimly recall seeing something from this project posted previously. Happy to be proven wrong.

rconti 10y ago
"As fast as you can report fake “you have a virus call this number now” messages to me, I will be able to hit them with thousands of calls from bots. It’s like when the pirate ship turns “broadside” on an enemy in order to attack with all cannons simultaneously." But it's late, and I'm too tired to read the rest of his blog posts.

zamalek 10y ago

I wonder if a sprinkling of ML could be used here.

frozenport 10y ago
Nah, I think AI would be a more suitable candidate.
- rhaps0dy 10y ago
  Standard ML is probably a safe bet.
  - frozenport 10y ago
    Are you sure the client's needs would not have been better met with over fitting? I heard it has superb performance!
casiotone 10y ago
The science of Marxism-Leninism is always relevant.

ikeboy 10y ago

Please have someone manually call reported numbers once to confirm it's actually a scam so this can't be exploited.

aerovistae 10y ago

This is brilliant. Can't say whether it would work, but if you listen to the pre-recorded calls he's using to tie up the operators, they're ingenius in a comical way. The second one features this woman who starts arguing with her teenage daughter in the background at length, then says to the guy "Oh my god I'm so distracted, I didn't hear anything you said, I'm really sorry, you're going to have to repeat all that." What a brilliant strategy to tie them up.

konceptz 10y ago
This will absolutely work. Or at least should work based on a study by Microsoft researchers stating that the business model is very fragile. https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/WhyFromNigeria.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
- tr1ck5t3r 10y ago
  All the advice MS gives out just makes Bill Gates richer. When will the world wake up, Bill Gates is tricking people?
13of40 10y ago
I called one of these things back after a few beers one night, and before I could get connected to an "operator" I had to go to a web site and get a support code, which I had to dial into their answering system. Seems like that would thwart this robo-dialing scheme, at least to some extent.
- brazzledazzle 10y ago
  Was it captcha'd? Probably wouldn't be hard to adapt to and as long as you're quick enough to adapt. Cat and mouse will end up costing them more and more as they reduce conversions and change business processes until ultimately they'll have to give up.
sandworm101 10y ago
Young female voices. Flustered and looking for help. Apparantly no males in the area, certainly no male voices in earshot. These recordings tap into some base instincts within the mostly male scammers. I suspect that a recording of my voice wouldnt keep them on the line nearly as long. But for these scammers i'd go with something more targeted: old people. Thier prefered prey is flustered old people who dont understand computers. Give them an old woman with bad hearing who mumbles about her internet not working. Then toss in a few "do you take visa" and some random numbers. That will keep them on the hook.

eridius 10y ago

What happens once someone sends you a fake report in order to trick you into harassing a real person with fake calls?

deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
daeken 10y ago
I'd hope that he gives the number one call to validate that it is, in fact, a scammer before putting it on blast. If he does, I really have no problem with this approach (and have considered it myself, frankly); if he doesn't, then this is just downright irresponsible. But I'd hope no one would be stupid enough to just trust random data from internet users, in this regard ...
- viraptor 10y ago
  You could wait for multiple verifications. For example wait until 3 reports of the same number from different IP blocks. It needs Tor and public VPNs filtering, but that should be enough for most cases.
  - iopq 10y ago
    What about someone using one of the hundreds of thousands of proxies to submit reports? IPs are easy to get.
    - nommm-nommm 10y ago
      Easy, use a handful of pre-vetted volunteers, not anonymous IPs. Like all the internet communities that require some form of vetting by mods before a user can do some action.

hive_mind 10y ago

I'm Indian myself and it concerns me that so many of these scams emerge from what appears to be India (based on the Indian accents). Does anyone know if any scammers have ever been "brought to justice" in India. Ever? Seems like something that should be a high priority for the Indian Govt. if they want to help with India's image abroad, especially with the tech sector.

mihaifm 10y ago
A lot of the major corporations have tech support based in India, so this makes these scammers even more credible.
downandout 10y ago
I correspond with someone from India that is heavily into marketing this stuff (he does legitimate things as well, and is one of the most knowledgable paid Facebook advertising specialists on earth, which is how I came to know him). He has been pushing it for years and the Indian government has never come close to bothering either him or the people that actually own the services that pay him for each phone call his advertising generates. It's not just the Indian government that is lackadaisical about this either. He is able to run ads for tech these support scams through Facebook and get ROI above 500%. Facebook eventually stops his ads, then he buys another ad account. In fact, he claims a single aged Facebook account is worth roughly $10,000 to him (aged accounts have an easier time getting ads through). He spends well into the six figures each year on these types of ads through Facebook alone. Ad platforms share some of the blame for the proliferation of these scams because they simply do not police their platforms well - the tactics he uses to get these ads through their review process are truly elementary but are good enough to foil a company full of PhD's. Clearly they aren't trying very hard.
- i336_ 10y ago
  Everything you just wrote is extremely interesting to me. > he ... is one of the most knowledgable paid Facebook advertising specialists on earth, which is how I came to know him > ... > the tactics he uses to get these ads through their review process are truly elementary I'm not a marketer or advertiser myself, but I'm always interested in learning more about these aspects of the Facebook "scene" just to better mentally map the state of things. Sounds like a lot (if not most) of the things this person has learned are the kind that only keep working if you're quiet about them, but I'm still very curious to hear what could be shared.

rdl 10y ago

Seems like it would be better to go through with the calls and destroy them at the payments gateway/payments provider level, same as was done with online pharma spam. https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/mccoy https://www.usenix.org/conference/usenixsecurity12/technical...

daeken 10y ago
In my experience with counter-scamming, these guys generally don't actually use any kind of payment processor -- they ask people to go get gift cards and tell them the numbers. It's a clever way of going about it, which essentially guarantees that they can't be shut down directly. The only way to beat them is to waste so much of their time that it's no longer profitable.
- a_t48 10y ago
  That or install ransomware on your pc.

Animats 10y ago

There's an inbound version of this? I've gotten calls from the outbound version, but those I hang up on in the first four seconds.

viraptor 10y ago
Turn off the adblocker and go to some popular TV streaming sites. You'll find a few of them.
- Animats 10y ago
  Right. I have so much ad-blocking that I never see this crap.

ryandrake 10y ago

This is neat, but at the end of the day, only user education will eradicate scams. As long as there are people willing to call strangers and give them access to their computers or buy iTunes gift cards for them, there will be scammers ready to be those strangers. Somehow people learn to not get into strangers' cars. They need to also learn to not trust uninvited solicitations, especially coming from the internet.

biot 10y ago

A good start, but needs a lot of work. If it's targeting a Windows Support scam, why not tailor the audio to that? Mention one of various viruses. If the "tech" asks you to do something, say your Windows just bluescreened and have them wait 30 seconds while it reboots, all the while saying "hang on, it's almost there", "this thing's been really slow lately", etc. and then play the Windows startup sound. Pretend to have typed your password incorrectly a few times. Occasionally ignore whatever they say and start telling them you're running this program your nephew told you about. And so on. If you call them yourself and actually follow their instructions, installing something from some site into an isolated, disposable VM and then running it, you can record what happens and then build that into a better script. Trigger these instructions by asking them what they can do to fix your computer, and time their response. Bonus points if you can detect them saying "http" which kicks off that part of the script.

swang 10y ago
the 4th one has mention of "these viruses on my computer"
dkersten 10y ago
If the "tech" asks you to do something, say your Windows just bluescreened My brother did something like this once. Every time the guy told him to do something he just said it was reeeeeeallllyyyy slow. He also started with "hang on, I have to turn it on, its a bit slow starting...". He kept the guy on the phone for about 30 minutes before telling him he had a mac :-P
radiorental 10y ago
When Dell was breeched a few years back my details made their way to India. I get a call from them about once a month. I've learned the script and various vectors they try to get the software onto my computer. The longest I've had them on the phone is 20 minutes. He's one of my favourite recordings though https://soundcloud.com/radiorental1/dellsupport2 https://soundcloud.com/radiorental1/dellsupport2 It's funny, someone pointed me at this thread because I sort of sound similar to the OP's site.
- 10y ago

teknologist 10y ago

It's rather funny that all it takes to defeat UAC in Windows is for a complete stranger with a foreign accent to call you up and tell you in broken English to "push the 'Yes' button on that popup called 'Run as Administrator'".

kalleboo 10y ago
In Japan they have problems with scammers calling up pensioners claiming to be their sons in a bind, and directing them to go to an ATM and set up a wire transfer to drain their savings. One solution was to install cell jammers inside of the ATMs. https://www.engadget.com/2008/12/10/japan-installs-cellphone-jammers-near-atms-to-prevent-fraud/ https://www.engadget.com/2008/12/10/japan-installs-cellphone... Time to put cell jammers inside of PCs that get activated with UAC is up?
- pavel_lishin 10y ago
  The problem exists in America as well; my elderly father was hit by it. Luckily my mom overheard his end of the conversation and put a stop to it. (Turns out, the scammer is very good at crying, but not very good at proving their alleged identity by knowing my mother's name. Hurray impromptu two-factor authentication!) But I believe that it's illegal to operate cell phone jammers, unless you're the government. And for good reason; it's wonderful that you prevent someone from being scammed, but if I'm attacked by a mugger near an ATM, I'd rather like to call 911.
  - kalleboo 10y ago
    The initiatives in Japan were in cooperation with the police, so I'm sure it's not impossible for them to get the proper permits. And many Japanese ATMs already have a "panic button", I'm sure the ones in question would too. Mugging isn't a huge crime here so I guess that's more of a problem implementing it in the US....
RugnirViking 10y ago
What solution do you propose that doesn't interfere with normal operation of the computer? Its a very difficult question.

i336_ 10y ago

An alternative I thought of the other day while watching one of the hundreds of YouTube videos of this was to simply batch-dial thousands of numbers all at once then randomly route them to each other. For bonus points, record everything and make it available live. The next level up would be a trusted-user system where you could go to a website, hit a button and immediately be connected with an actual scammer; or you could listen in on other people currently in calls and suggest things they should do next. And maybe there could be a pool of VMs available to play with... Regardless of technique - fake recordings or various types of routing - I would advise making friends with all the high-level VoIP gateways. That way you won't have any problems batch-establishing hundreds of calls at once (for example if you know all the numbers for a call center and you know what time the, er, staff get in), getting a new number block, or even getting general caller ID override (which I understand is sometimes unavailable?). My thinking here is that if you can win over a bunch of providers (with money and inspiration/sentiment), you could VoIP-DDoS the gateway providers the scammers are using. Would tie up the scammers' time moving to a new VoIP provider.

lighttower 10y ago
This. Great idea. I love the idea of being able to be connected to an actual scammer via website and have a little pop-up window with others suggesting fun things to do to the scammer. The recordings can then be made into loops to autodial them.

dandare 10y ago

This post could be greatly improved by clearly stating what is the Windows Support scam. I read half the page and I am still not sure.

chrisan 10y ago
You get called by these people where they tell you that you have a virus on your computer and they are going to help you fix it. http://www.makeuseof.com/tag/anatomy-scam-windows-tech-support-con-examined/ http://www.makeuseof.com/tag/anatomy-scam-windows-tech-suppo...
- nashashmi 10y ago
  I came across one of these a couple of weeks ago. I knew it immediately it was a scam because the guy had an indian accent. I played along just to see what he would do. He directed me to site support95 .com. Apparently, there is a similar site called support18 .com. From there he told me to download an exe file. That was where I stopped. I did not know what would further happen. If anyone wants to try it: Call 18005589204. Tell him you got a voicemail of someone from Microsoft saying something about license expired. I would love to know what ultimately happens.
nommm-nommm 10y ago
You get a phone call with a pre-recorded message "Hi, this is Microsoft calling, we have received notification you have a virus on your computer, please call 888-888-8888 for assistance removing it." You call and they either charge you for "support," when they instruct you to delete some files from your event log or something benign or they direct you to install a program that gives them remote access to your computer so they call install malware or ransomware or steal all your files. After the Dell breach they got even more convincing "This message is for John Doe, this is Dell, we are calling in regards to your Dell Inspiration 1234 with serial number XXXXXXXX." https://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/ https://krebsonsecurity.com/2016/02/dell-to-customers-report... Sometimes it's a person on the other end instead of a recording but I can't imagine a cold call that requires computer access would be very effective because how many people are going to be sitting in front of their computer at that time? They will almost always instruct you to call back. An very old pre-internet scam is "you've won a free vacation call 888-888-8888 to claim it." When you call they ask you to pay taxes on your vacation then they run away with the money you paid in "taxes."

m00dy 10y ago

I found this on soundcloud. https://soundcloud.com/user-486592840/scam-recording https://soundcloud.com/user-486592840/scam-recording

kefka 10y ago

Alhough I shouldn't derive my enjoyment from others' suffering, I do on this capture. https://www.youtube.com/watch?v=Du6acZ-PZQ8 https://www.youtube.com/watch?v=Du6acZ-PZQ8 The long and short of it, the Indian scammer ends up setting a SysKey password and a bios password on his machine. He's using his bosses' machine, and it appears to be the domain controller. The scammer ends up crying and screaming at the guy and out of terror and rage, ends up hanging up. Normally, I would be like "I feel bad for this guy". Nope not at all. Bloody scammer got what he deserved - a taste of his own medicine.

kjjw 10y ago
Maybe in the US it is not considered racist to mock an Indian accent but elsewhere it is.
- kefka 10y ago
  I agree. The mocking because of being Indian is not cool. But harming scammers; I have a hard time not deriving enjoyment out of that. It's probably wrong.. But these people are extra-legal. The US can't touch them. The Indian government doesn't care... and they bring in US money to their country along with tax revenue.
  - kjjw 10y ago
    It is great to see this problem highlighted but herein we have found a line that some people find hard to walk. Real shame this person [whose voice is in the video] has created such a distraction.
    - kefka 10y ago
      True that. And that dead (and removed) comment was by "Asooka".. Seems like a slur to Maurya Ashoka. Some times, things like that will also catch me.. was just wrong, but couldn't put my finger on it until now.
rogual 10y ago

Asooka 10y ago

Nowhere in OP's comment did OP mock the call centre person's accent. Please go back to tumblr until you develop the required reading skills to participate on HN.

kefka 10y ago
No, kjjw is indeed correct. They know the video. The video, the guy mocks the Indian scammer with repeated lines like "Not goot, not goot at all" in a very Midwestern->faux Indian accent. Think Apu on "The Simpsons". And no, making fun of someone because of their nationality and origin language just isn't cool. Maybe it was 60 years ago, with killing Commies and Japs and Niggers. I'd like to think that most of us are past that brutish "ideal".. Then again, with commentary of 'Please go back to tumblr until you develop the required reading skills to participate on HN.', they certainly have demonstrated more skills in understanding content than you have. Perhaps it ought to be you who "goes back wherever someone else thinks you came from?, no?
dang 10y ago
> Please go back to tumblr until you You can't attack other people like that on HN, regardless of whether they also broke the rules. You owe better to the community here. We detached this subthread from https://news.ycombinator.com/item?id=13597588 https://news.ycombinator.com/item?id=13597588 and marked it off-topic.

laumars 10y ago

A word of warning for the author: phone numbers can be easily spoofed (like you can spoof the sender email address or the originating IP in a UDP packet). What's more, many scam calls do use spoofed phone numbers. Thus the number you might be flooding may not be the originating caller. This could turn your utility into something far more malicious than was originally intended.

Nursie 10y ago
I think this is aimed at viruses/scam popups etc that say "You have a virus! Call Windows support at this number now!" In that case we can be pretty sure the number is correct.
- laumars 10y ago
  Ahh I missed that part. Appologies.
diamondo25 10y ago
Yes, but also get the ball rolling to also improve this system in the world. Companies do not care that systems are vurnable until it really affects them. Just look at the botnets from vilnerable IoT devices waking up parties so they start to protect them. Same with phones and their support periods...
- laumars 10y ago
  Blackhats don't tend to publish their work in a way that is traceable back to their person. If this system gets abused then the OP becomes liable. This was why I raised my warning to the author specifically - albeit I couldn't have made my point about the legal consequences of abuse clearer in my previous post.
- zeure 10y ago
  Were a lot of those insecure IoT companies attacked by those botnets? If not, I still don't think much will change.
10y ago

sundvor 10y ago

~~ Yes. Yes. Hello? Sorry, you're going to have to start again. Yes? Go on. Ahum. ~~ Absolutely love this guy. Can't say it enough.

StavrosK 10y ago

I made an email equivalent of this: https://spa.mnesty.com/ https://spa.mnesty.com/ The problem is when people send you numbers or emails of legitimate people, because now you're basically DDoSing their phone number for free. How is this service planning to vet these numbers?

martinml 10y ago
You seem to have some loop there with the real Uber support? https://spa.mnesty.com/conversations/bmazjsnh/ https://spa.mnesty.com/conversations/bmazjsnh/ And in one case the spammer was aware of your site! https://spa.mnesty.com/conversations/gywanvsb/ https://spa.mnesty.com/conversations/gywanvsb/ Maybe you can hide from Google with the appropiate robots.txt so the last one doesn't happen.
- StavrosK 10y ago
  Thanks for that, I've deleted the first one. I have safeguards in place to prevent legitimate senders from being hassled, but I have to add them first. That second one is hilarious, though :P
  - Doctor_Fegg 10y ago
    "She is a Monkey climbing trees " Brilliant!
Retr0spectrum 10y ago
In this case, you just need a human to call them up once to verify.

al2o3cr 10y ago

While this seems satisfying, it would be more effective to figure out how these companies are still able to access the credit card networks and block the shit out of them. I used to work at one of the smaller international CC processors, and we specifically rejected merchants offering "remote technical support" (i.e., THIS EXACT SCAM) and the entire rest of the 5967 MCC (inbound teleservices). I recall reading that the "fake IRS" crew had started working around this by telling people to buy iTunes gift cards, but it would be a start.

problems 10y ago

I'm assuming you're using a VoIP provider to do this - just be careful, they might have rules against this. Definitely don't do it on an account you have a personal number you value or something. That said, I fire attacks at script kiddies in the clear from big server providers including DigitalOcean and OVH, so I suppose as long as the attackee can't really complain legally, you might be okay.

brazzledazzle 10y ago

This reminds me of stuff we used to do with 96 line dialers way back in the day. It was a pretty solid tactic for dealing with anyone that scammed us. Difficult number portability, a lack of ubiquitous capability to cost effectively deal with a phone DoS, their lack of knowledge about various telecommunications laws (what with search engines not being what they are today) and most importantly the fact that they were almost universally uninterested in engaging law enforcement (what with the scamming or fraud) it was a pretty effective way to get bad people to stop being bad. But it was a long time ago and I wouldn't do it again given the chance. I was really young, it was definitely an ethically gray area and we were breaking at least one law. I also came to understand over time that the reason we kept having run ins with scammers was because we were running a shady ISP/hosting and telemarketing business that had a significant portion of customers who were scamming their own customers. If it always smells like shit there might be some on your shoe. It was an important lesson and now I pay a lot more attention to how my employer gets money and who they get it from. On a lighter note we won tickets a couple times calling radio stations. We felt pretty bad about cheating like that so we never did it again but it was pretty effective as long as you had a couple butts in seats to deal with the "sorry you're not the 9th caller" pickups.

athenot 10y ago

The problem is that scammers can fake the CallerID. Yes it's illegal but they are already engaging in dubious activities. So this bot would just dial back at innocent victims whose numbers were unknowingly used by the scammers.

JacenRKohler 10y ago

I look forward to hearing more in the future.

jlebrech 10y ago

this is generic to hassle any kind of call centre: PPI claims, accident claims etc..

jlebrech 10y ago

you could add voice recognition to cue up responses and also launch a vm for them to take control of.

bediger4000 10y ago

What percentage of people doing this (or the "This is Lenny!" thing) would it take to make the scam unprofitable? Is there any work on that topic, like "what percentage of honeypots makes scammers quit"? I don't get many "Windows Support" scam calls, the two I have gotten I was unable to play them for long, as I am a poor Linux user, not Windows knowledgeable at all, but I generally keep the "Card Services" people on the line for a few minutes.

TheCowboy 10y ago
A small percentage could hurt their profits a lot, but it's not like they are without counters to this. They could slap on a max length at which point they know they're wasting their time, and also start to blacklist numbers that waste their time. They could use audio recognition to avoid known automated honeytraps, but even humans would adapt after enough calls. I still think it would be difficult to even reach that target %. As much as I would like to waste their time, I'm strapped for time myself. There would need to be a way to receive a call on your phone and send it to the honeytrap in two 'clicks', where it plays scripted responses in the background. If we reached that magic percentage, I think they could have a counter. They could discourage this by using targeted harassment. Someone screws with them, they send a mass of random calls over the course of a day.
- bediger4000 10y ago
  After a few years of monkeying with the "Cardholder Services" calls, I'm convinced there's two layers of crooks involved. The first layer is the autodialers, they just run through series of phone numbers, and play a recording. I'm pretty sure these bastards don't screen numbers, because I can at least get through to the (Indian) boiler room almost 100% of calls. I think the boiler rooms are actually seperate organizations/crime clans. The boiler rooms do screen, but not universally. After years of being "Edward Snowden" and giving out fake card numbers that pass the Luhn checksum, only maybe 25% of the boiler rooms cut me off. A few days ago, the "service rep" had a bad headset and I could hear a recorded voice telling him to hang up, which he did. Even Trump's FCC would have to deal with targeted harassment. That's the kind of crap that nobody puts up with. Besides that, harassment calls probably ruin the NSA's data retention practices, so that just can't happen.