3 ms·

I'm very familiar with the "you have a virus" pop-ups that trick helpless users into downloading bogus software, but I've never heard of a cold call version of

I'm very familiar with the "you have a virus" pop-ups that trick helpless users into downloading bogus software, but I've never heard of a cold call version of that scam. Am I misunderstanding something, or do these scammers literally call people's phones and tell them out of the blue that their computer is infected? What if they say "I don't have a computer"? What if they say "I have three computers, which one?" Seems like that would raise more flags more quickly than a pop-up showing on your actual computer, and manual phone calls can't scale like pop-ups... how is that still profitable or what am I missing? Edit: OK, number of computers is easy. Still surprised that it is profitable given (what I suspect as) the inability to scale. I guess the conversion rate just isn't that bad.

ceejayoz 15y ago
> What if they say "I don't have a computer"? click > What if they say "I have three computers, which one?" "We're going to need to check all of them."
- prawn 15y ago
  Exactly. Very low risk for them. If the call goes nowhere, they hang up and move on to the next target. The previous target thinks it a bit odd but what are they realistically going to do about it?
- ufo 15y ago
  It works the same as those "We are from bank X, give us you accound details" scam emails. They completely miss people that don't use bank X but it looks much more legitimate for those that do.
jbarham 15y ago
> Am I misunderstanding something, or do these scammers literally call people's phones and tell them out of the blue that their computer is infected? Incredible as it sounds, that is literally what they do. My wife got called by these scammers last week but she knew enough to be suspicious and respond that her computer expert husband would look into it. :) (FWIW we live in Melbourne, Australia.) This type of scam is one unfortunate side-effect of extremely cheap internet based telecommunications.
RossM 15y ago
Well, this actually happened to my Grandmother a few weeks ago (UK) who actually had them up to her bank login before my Grandfather stepped in. It quite disturbs me that scammers have better luck bluffing their way into someone's computer than hoping for a malicious script to catch a bite.
- g9a5 15y ago
  This, technically, isn't illegal. It's immoral and unethical but if you play it right (vague terminology, play to people's paranoia about Windows machines having viruses) then all you're doing is taking advantage of someone's gullibility. If you deliberately infect their machine with a script which transmits their data for profit then you're doing something stone cold illegal, and it may never acquire the data you're looking for. You then have to exploit it which means selling it on the deep web or (worse, time-wise) criminal black market, which is again illegal, and also a massive chore: you're doing something illegal but then making yourself highly visible/traceable and connecting with the wrong kind of people in order to profit from it illegally (sorry if this seems tautological, but it's worth repeating that it's two distinct acts to acquire the data and then to sell it). Yuck. You're far better off playing the odds: each employee can call 60 people per day. Even if 1/200 signs up what are these people making? $25 per day? If you've got 5 people in the call centre nailing 1 in 200 customers then you've got a business, provided your overheads are low enough and you're using signed-up customers as a platform to sell to (referrals & 'security' software). It's not going to make you rich quicker than a legitimate (and I use that word advisedly) botnet or key logger / zombie script, but you're pretty much on the right side of the law and there's very little downside if you're unscrupulous. (The massive moral downside is that you're an utter cunt, of course.) The thing which is strange to me here (or perhaps indicative of the fact that they're a useless outfit) is that they don't have the script nailed. We're all (presumably) relatively proficient with computers here. I don't think I'd have any trouble at all in convincing someone that there's a virus or malicious code on their computer, if I wanted to. There are enough confusingly named but benign processes on OS X and Windows and enough ways to dress up a script to turn them off at launch and "fix" the computer. How many times did that guy stumble over his story? Malicious code; Windows licence; you pay; you don't pay; can we call you back; let me speak to legal; I can see your screen; I can't see your screen. A more efficient scam would be a slicker script, a 10 minute process, and less deviation. The guy Troy spoke to sounded, to me, like an IT guy more than a sales guy, which is very weird. Kinda like in Armageddon when they train oil drillers to be astronauts rather than training astronauts to use a drill: you don't need IT expertise because the people you want to be speaking with are those who expressly do not have any IT expertise.

ceejayoz 15y ago

> What if they say "I don't have a computer"? click > What if they say "I have three computers, which one?" "We're going to need to check all of them."

prawn 15y ago
Exactly. Very low risk for them. If the call goes nowhere, they hang up and move on to the next target. The previous target thinks it a bit odd but what are they realistically going to do about it?
ufo 15y ago
It works the same as those "We are from bank X, give us you accound details" scam emails. They completely miss people that don't use bank X but it looks much more legitimate for those that do.

jbarham 15y ago

> Am I misunderstanding something, or do these scammers literally call people's phones and tell them out of the blue that their computer is infected? Incredible as it sounds, that is literally what they do. My wife got called by these scammers last week but she knew enough to be suspicious and respond that her computer expert husband would look into it. :) (FWIW we live in Melbourne, Australia.) This type of scam is one unfortunate side-effect of extremely cheap internet based telecommunications.

RossM 15y ago

Well, this actually happened to my Grandmother a few weeks ago (UK) who actually had them up to her bank login before my Grandfather stepped in. It quite disturbs me that scammers have better luck bluffing their way into someone's computer than hoping for a malicious script to catch a bite.

g9a5 15y ago
This, technically, isn't illegal. It's immoral and unethical but if you play it right (vague terminology, play to people's paranoia about Windows machines having viruses) then all you're doing is taking advantage of someone's gullibility. If you deliberately infect their machine with a script which transmits their data for profit then you're doing something stone cold illegal, and it may never acquire the data you're looking for. You then have to exploit it which means selling it on the deep web or (worse, time-wise) criminal black market, which is again illegal, and also a massive chore: you're doing something illegal but then making yourself highly visible/traceable and connecting with the wrong kind of people in order to profit from it illegally (sorry if this seems tautological, but it's worth repeating that it's two distinct acts to acquire the data and then to sell it). Yuck. You're far better off playing the odds: each employee can call 60 people per day. Even if 1/200 signs up what are these people making? $25 per day? If you've got 5 people in the call centre nailing 1 in 200 customers then you've got a business, provided your overheads are low enough and you're using signed-up customers as a platform to sell to (referrals & 'security' software). It's not going to make you rich quicker than a legitimate (and I use that word advisedly) botnet or key logger / zombie script, but you're pretty much on the right side of the law and there's very little downside if you're unscrupulous. (The massive moral downside is that you're an utter cunt, of course.) The thing which is strange to me here (or perhaps indicative of the fact that they're a useless outfit) is that they don't have the script nailed. We're all (presumably) relatively proficient with computers here. I don't think I'd have any trouble at all in convincing someone that there's a virus or malicious code on their computer, if I wanted to. There are enough confusingly named but benign processes on OS X and Windows and enough ways to dress up a script to turn them off at launch and "fix" the computer. How many times did that guy stumble over his story? Malicious code; Windows licence; you pay; you don't pay; can we call you back; let me speak to legal; I can see your screen; I can't see your screen. A more efficient scam would be a slicker script, a 10 minute process, and less deviation. The guy Troy spoke to sounded, to me, like an IT guy more than a sales guy, which is very weird. Kinda like in Armageddon when they train oil drillers to be astronauts rather than training astronauts to use a drill: you don't need IT expertise because the people you want to be speaking with are those who expressly do not have any IT expertise.