5 ms·
FBI warns “phantom” hacker scams are emptying financial accounts
- schemescape 3y agoActual warning: https://www.ic3.gov/Media/Y2023/PSA230929 https://www.ic3.gov/Media/Y2023/PSA230929
- jt2190 3y agoThis is very clear and has no ads
- schemescape 3y agoI was wondering if this was some tricky new scam, but after reading the notice it's probably nothing new for people on here--the infographic's first phase of the scam is: "Tech Support Imposter: Pretends to be technical support; Directs you to install software on your computer to allow them remote access". I sure hope no one on here would install software requested by unsolicited tech support!
- kevin_thibedeau 3y ago> I sure hope no one on here would install software requested by unsolicited tech support! All it takes is one browser 0-day that gets distributed on an ad network. A large segment of the HN crowd is still executing untrusted JS on their computers and opposed to blocking their source of income.
- derefr 3y agoThe people who run these scams build them around evergreen money-extraction strategies; buying a 0day just to hack some people they could already socially-engineer their way into the pockets of anyway, would just be a waste of money. Especially since the 0day would only be useful for a couple of days/weeks, and they don't have the in-house technical talent to automate any of what they're doing to run it faster.
- mschuster91 3y ago> buying a 0day just to hack some people they could already socially-engineer their way into the pockets of anyway, would just be a waste of money. At least back in the day when Flash was still a thing, it was a common issue for "enterprising" people to buy advertising slots, even on reputable media, and spread all kinds of malware via them.
- derefr 3y agoYes, but those are separate groups with separate capabilities and motives. Scammers are not hackers, though both can and will steal your money.
- TylerE 3y agoA huge part of this is target selection. They don’t want to waste time with anyone who isn’t going to buy it whole hog.
- supriyo-biswas 3y agoThese days I’d be worried about something like the libwebp 0-day; JS execution is well protected these days. Also, 0-days are generally hard to come by in browsers these days, the libwebp one was initially developed by NSO for example; and tech support scams are not that profitable.
- k310 3y agoMy ex needed printer support. The person on the other end had her install remote access software. I forgot how she cleaned up the mess. It's too simple. People don't know who's trustworthy. And I don't make house calls hundreds of miles away. Business opportunity for a "Local Trustworthy Techs"? Heck, the Goon Guys will search your drive for illicit material, and if they don't find any, they'll install some (If I recall some horror stories correctly).
- SoftTalker 3y agoIf your ex called the tech support number that came with the printer, that's a bit of a different matter. Still not great to install the remote access but I can see how that's practical for the printer support person. Have you ever tried to talk a non-technical person through a multi-step task on the computer when you can't even see their screen? Hopefully they uninstalled the software once the printer was working.
- polalavik 3y agosame. very confused how this made it to the front page - it sounds like just a classic run of the mill scam. nothing particularly novel here. nothing remotely more sophisticated or harder to detect.
- jamiek88 3y agoJust Sunday things on here. Different vibe on the weekends!
- ta8645 3y agoI had an older family member who fell victim to a very similar scam. Once she installed their remote software, they connected and used her browser to transfer a large sum, from one of her bank accounts into her main bank account. They then convinced her that they had "deposited" the money into her account by mistake. She could clearly see the extra money in her main account and so believed them. The person pleaded with her to return the money via transfer, and keep it secret, or he would lose his job. Being a good person, she wanted to help him and not cause a problem. Fortunately, the teller at the bank recognized it as a scam, but it was a close call.
- Racing0461 3y agotaken straight out of a kitboga vid. can't believe this stuff actually works.
- filoleg 3y agoTo be frank, it is all extremely believable to me that a normal person who had never encountered that type of scam or doesn’t someone who had (which is a massive number of people) would fall for it. I am just happy my mother fell into the pattern of messaging me instantly when she has an even slight suspicion. Had a few false positives, but overall i am very happy with how well this approach has been working out for her. Saved a ton of trouble down the road for both of us.
- jayrot 3y agoJust wait a moment
- blisterpeanuts 3y agoA friend of my wife’s fell for this exact thing, and lost her life’s savings. She’s not a stupid person; has a masters degree and writes children’s books. Kitboga, Harvey Denttt, Scam Sandwich and numerous other youtubers seek out these scammers and use virtual machines, elderly voice filters and other special effects to lead them on, sometimes for hours. It’s very satisfying.
- chaostheory 3y ago
- nilram 3y agoMy sister got bit by one of these when she googled a name brand PC support company that she had used before. The search results included a phone number that connected her to these hackers. From there, they pretty much followed the steps outlined. She lost pretty much a full month's income. Because she withdrew the money herself (to transfer to bitcoin), the bank fraud department wouldn't get involved. (No idea if she contacted the state agencies I recommended.)
- squeaky-clean 3y agoI almost listened to someone scam my mom in realtime when he had a flight delay issue. She was calling American Airlines support, but apparently she googled something like "American Airlines delay support" and clicked on the first ad. I overheard her begin reading her credit card information and stopped her and took the phone. They probably would have done the whole remote access scam thing but we were at the airport without any computers.
- hotnfresh 3y agoThis is why in-line search ads are simply evil. They get their click through rate from fooling people, not from convincing them to click an ad on purpose. Which, aside from that being evil already, also makes them super-useful to scammers, since a high percentage of clicks are from people who think they clicked an organic search result.
- dools 3y agoYeah fraudulent ads are a huge issue for scams, I had my entire family install ad blockers not to stop advertising but to stop scams!
- m3kw9 3y agoBy default when you receive any calls involving money you need to hang up and call the bank directly to re-initiate the issue.
- deleted 3y ago[deleted]
- domador 3y agoSo many of these scams start the same way: when the victim is contacted by a random person. Phones, email, social media, and postal mail tend to allow this by default (being contacted by a rando anywhere in the world). But maybe the default should be that users' inboxes and incoming "ports" on such services are locked down for the average user, such that only a few trusted senders, to whom the user has previously given access (maybe with a per-sender access code) can contact that user. Marketing and customer service departments, security researchers with honeypots, and adventurous individuals may want to leave such incoming "ports" open, but the average person probably doesn't need or want to have their communication network accessed or unwittingly expanded by others. They probably only want to communicate with their existing, trusted contacts and to be able to add new contacts organically, but don't really want or need to allow anyone to "slide into their DMs" without prior authorization from the recipient's end. (Special emergency protocols may be needed to allow verified, vetted incoming communication in the case of true emergencies, in order to give people the reassurance that they're not missing out by locking down their incoming "ports".) Communication technologies have made the world small and flat, but maybe we need to enlarge it and unflatten it unidirectionally, on the sender's (and scammer's) side. Some people already do this manually on their phones, by refusing to answer calls from random, unknown numbers. Maybe such defense measures should be enabled by default for the public at large, with the option of carefully and partially disabling them, if desired.
- artursapek 3y agoI like this line of thinking, but I think education is the key. Even with good filters you have to be able to smell bullshit. I enabled iOS “silence unknown callers” option as soon as they added it, but found I miss important calls sometimes. I rely on voicemail for those. There’s no way to completely whitelist your personal communications in this world. I do get scam voicemails and emails sometimes, but am good at detecting them.
- fortran77 3y ago> I like this line of thinking, but I think education is the key. My 90 year old mother gets less and less able to think clearly each passing month. She always is calling me telling me that "her computer is completely dead" and it takes my 10 minutes to realize it's just her mouse that's not working becasue she forgot to charge it. No amount of education will save her. Fortunately, she has no on-line bank or credit card accounts.
- unfocused 3y agoIs there also any truth to scammers calling you but not saying anything, in the hopes of recording your voice as you talk to train AI bots for future scams that use your voice? Or is that some urban legend/myth. They are getting more and more creative.
- hyeonwho22 3y agoI've gotten a few phone calls like that. A few years ago living abroad it seemed to be a targeted sales pitch for one gender (ex. makeup). Would hang up as soon as I answered, or pretend that they needed the number of my wife (I wasn't married). More recently in the US I got a call where the other side didn't say anything and hung up after exactly one minute. Suspicious indeed.
- PlunderBunny 3y agoIsn't it more likely that it's a call centre where each operator has multiple outgoing calls on the assumption that they will be on one call (on average) at any given time, but sometimes more than one call might be answered (e.g. they're still talking to another victim when you pick up the phone)?
- shyn3 3y ago[flagged]
- zerbinxx 3y agoSadly people are and do. I got a text earlier saying that my bank (and they, by random chance or something more nefarious) named the bank in the communication AND they got lucky because I was just traveling nearby, AND before leaving home I had just opened a piece of mail that informed me that some piece of shit company that I got concert tickets through just had a data breach AND that a bunch of my stuff, including my credit card info, had been leaked. So I definitely had that moment of “oh shit, I should probably look into this” - and if I didn’t have my bank app on my phone I may have just fallen into the process. Scammers operate a simple sales funnel - they cast a wide net and hope they get someone in the same headspace as me but slightly more dumb. The only people who fall for this are, sadly, really dumb, but also really unlucky because they might not have fallen for it if the other coincidences didn’t align.
- shyn3 3y ago[flagged]
- lsedgwick 3y agoReminder that our regulatory apparatus allows these people to have phone numbers and make and receive phone calls without being able to be held accountable.
- chaostheory 3y agoThis is just a symptom of a bigger problem. Once you get to a certain age, you essentially become mentally disabled to varying degrees. Society at large is still pretending that this isn’t a problem
- deepfriedrice 3y agoCrazy idea. 2 factor authentication for the elderly where the second factor is, where applicable, a younger family member. It's socially irresponsible to allow the tech-illiterate to move their live savings around on the internet by themselves.
- skymast 3y ago[dead]
- tap-snap-or-nap 3y agoWhy don't banks have a list of verifiable phone numbers ?
- MilnerRoute 3y agoSometimes I'll try to waste the time of the tech support scammer, just to keep them from calling someone else. ("Okay, I've got my credit card out now. Say, what city are you calling me from? Really? How's the weather there...")
- domador 3y agoThank you for your service!
- userbinator 3y agoI find that answering tech support scams with "I don't have a computer" tends to make them shut up pretty quickly.
- dgudkov 3y agoWhy don't banks/police track down where the money went to? It's a wire transfer after all, not a crypto transaction. All account details are well known to both sending and receiving banks.
- popcalc 3y agoBecause the receiving account was either opened with a stolen identity (darks) or was simply compromised itself. Once the funds hit, the clock is ticking and the fraudster needs to quickly extract as much value as possible before the account is frozen. This is often achieved by using a connected debit card to buy crypto [1]. The "merchants" who take debit cards typically use merchant accounts opened under stolen identities as well, and make up for the fact the accounts get hammered to death with chargebacks by taking huge volumes at very bad exchange rates for the time they're able to. Another method is selling macbooks/iPhones ordered online to be delivered to local fences, who then pawn them off on Craigslist or eBay and take the risk. [1] https://paxful.com/sell-bitcoin/with-any-payment-method/?paymentMethod=with-any-payment-method&group=debitcredit-cards&countryIso=HU&hasScroll=true https://paxful.com/sell-bitcoin/with-any-payment-method/?pay...
- DueDilligence 3y ago[dead]