6 ms·

I've been curious about how to track down scammers -- just a few days ago I got a quite convincing call supposedly from Bank of America; they appreciate my reli

by jtheory 12y ago

I've been curious about how to track down scammers -- just a few days ago I got a quite convincing call supposedly from Bank of America; they appreciate my reliable payments and would like to lower my interest rate... they'd just need to verify a few bits of info, then pass me off to an account manager to handle the rate change. First, do I have the card with me? Can I confirm the expiration date, so they know this is the current card? Next, they just needed the card number, starting after the (here he listed the first 4 digits accurately). This was when I belatedly realized this was of course a scam attempt -- the initial digits of a credit card number just identify the bank, so he could pretend to be confirming that he was legit while at the same time collecting my entire credit card number. What if I hadn't known that? I know perfectly well I shouldn't trust an incoming caller's identity as a general rule... but he called in the middle of my workday, I was wrapped up in other things, and just thought "eh, I can take a minute and accept a lower rate" without even paying enough attention to realize he hadn't even addressed me by name. Embarrassing, really.... Once the game was up it didn't last much longer -- though I played it safe and pretended I didn't realize it was a scam. But what can I do now? The incoming number was reported as 703 237 2680; but I have no other info on who the caller was beyond that, and I believe caller-ID is fairly easily spoofed. I wish I'd had a honeypot credit card to give him; that would have been at least somewhat useful, though tricky to really use. From what I understand, stolen CCs are tested first (via a small purchase from any online service), then good ones are sold. A honeypot cc (generated by someone with the power to investigate its data) could be used to attempt to track down the people testing it, and whoever buys it, but the former use could be useless (if the scammer can cover their tracks), and the latter only gets the downstream bad guy, not the original scammer. And... the honeypot cc would need to pass the test to be sold, which would cost money. A chargeback (to that initial test) would of course be possible, but the whole testing process is already brutal for whatever merchant they're using for that. I'm curious about other ideas on the most useful action I can take in response to this kind of thing.

__david__ 12y ago
I've been getting phishing attempts to my cell phone in the past few months. They leave message that say, "to collect your $100 AT&T rebate, go to www.phishingwebsite.com", which looks like a standard phishing site. They always come from different phone numbers and list different variants of the web site. It's odd because I've seen plenty of phishing emails, but this is the first time I've gotten them via phone.
- us0r 12y ago
  I get the same thing. I knew it was not AT&T but I called anyway asked for a manger then another manager explained it to him and I haven't got one since. I'm sure AT&T can quickly figure out who is sending this stuff. I also get voicemails from my "Google Specialist" letting me know that my "first page ranking" is ready. I can't get rid of this one.
- smsm42 12y ago
  Getting the same calls lately. Not sure what to do about it - my experience with AT&T shows I'll probably waste about 10x to 100x more time just trying to explain to them what I want that it takes me to hang up. But if somebody knows a way to make AT&T aware of it and do something (provided there's somebody in AT&T that cares and can do something) please share.
e40 12y ago
The incoming number was reported as This will do you no good. They are using a hijacked PBX. There is no way possible they are going to make it that easy to find them. Here's my story: I kept getting calls from "credit card services" and every damn time I asked to be removed they would just hang up on me. So, after about the 20th time, I decided to play dumb. I strung them along for 10 minutes. Here's how I did that: the first person you talk with asks if you have more than $3000 in CC debt. The second person basically asks the same thing, but in a little more depth. The third guy is the smooth talker. He asks you to find your statement so he can verify information from it. I played dumb and said I needed to find it. He said "I'll wait" in a very patient voice. I kept him on the like for 10 minutes (while I worked). Then, I just hung up. He called back immediately and said we accidentally got disconnected. I told him "you wouldn't take me off your list, so fuck you." His revenge was next. The phone rang and someone was yelling at me. He was redirecting all complaints to my phone number. I had to unplug my phone. I called AT&T (who I had service with) and after about 30 minutes of run around, they said they couldn't do anything. I'd have to contact the fraud department, or some such. I did try, but it was a lot of paperwork and it looked very bureaucratic. So, I decided to google for "credit card services" (not exactly that, but that's what I started with). I found a TX state lawsuit against a company with this name from the early 2000's. The lawyer that prosecuted them was listed and had a phone number. So, I called it. An elderly gentleman picked up the phone and I told him my story. His first words, "so, they're back at it?" He told me to be very careful, and basically tried to dissuade me from doing anything. It amazed me that they seem to operate with impunity.
- nostromo 12y ago
  Phones need a "report spam" just like email. Phone companies or device manufacturers should use those reports to trace bad actors.
  - dredmorbius 12y ago
    Note that email doesn't have a "report spam" functionality designed into it (in the form of RFCs), though email providers often offer their own version to their users (most are far more opaque when it comes to reporting spam against their own systems). Reasons for this are diverse, but effectively, if you're a large email service provider, your users' satisfaction is a concern, spam is a large part of that, and the ability to leverage reports from many users to identify spam (and non-spam) sources is very useful. Telephony was designed in a far more innocent age, and was largely protected against the abuse which ran rampant in email (and Usenet) on account of the costs associated with network access and in actually making calls. Now that this is rapidly approaching email costs (effectively nil at the margin once you've got the infrastructure set up), this is changing. One consequence is that voice service is rapidly becoming useless due to abuse. I've rightgraded from a smartphone to a dumbphone for a number of reasons, but one feature I particularly miss from my Android device was the call screening app: deny access to unknown or blocked numbers, and allow priority access only to specifically whitelisted callers. Why should I allow myself to be interrupted by any one of the 7 billion people on this planet, or worse, programmed robots which call me without any regard for what I'm doing? I'm hoping for features such as this to make it into dumb phones soon. My other thought is that conventional telephony (both POTS and mobile) is going the way of the dodo -- VOIP over wireless broadband with only very occasional fallback to direct connections.
briancaw2 12y ago
If you google around there are government agencies and websites set up for all types of spamming/scamming. I got some scam phone calls awhile back and reported them; it could be a coincidence, but I stopped getting them. Here's a place to start: http://www.usa.gov/topics/consumer/scams-fraud/report-fraud.shtml http://www.usa.gov/topics/consumer/scams-fraud/report-fraud.... So I'd say, report, report, report. Scammers and spammers go on for too long because people brush it off. The worst thing you can do to an email spammer is take the time to mark it as spam. The worst thing you can do to a scammer is to report it to the government - some justice department and/or federal and state representatives. Articles like this make it seem like nobody is doing anything, but with a bit of digging you'd find that consumer protection agencies and state and federal legislatures have been passing laws regularly to combat scamming/spamming/predatory loans.
unclebucknasty 12y ago
It used to be that phishing emails were easily sniffed out due to the poor grammar. It was always immediately clear that they were coming from non-native speakers and, hence, obviously not the product of the major bank, etc. they claimed to represent. And, I always thought, "Good grief, if these guys would only hire native English speakers to write their crap (or simply copy a legit e-mail) and take a couple of other similarly easy steps, they'd be in business in a big way". It all pointed to the fact that there'd be a day when their increased sophistication, coupled with their boldness, would make it nearly impossible for the average person to sniff them out. And, beyond that, even seasoned tech folks would someday be vulnerable. That day is fast approaching. The good guys are losing and we need a completely new model for dealing with this stuff. "Protecting" access to information has long been an untenable goal, and any new model must make it such that everyone's personal information could be completely public without that fact exposing them to any risk. It's nuts that we all walk around with just a few bits of info which, if gleaned by a bad guy, could completely destroy us. It's also nuts that we walk around with a couple of numbers that we are routinely encouraged to give out to a myriad of people/systems, but if they ever once fell into the wrong hands, could be a gold mine for a scammer. We also need more international cooperation combined with super-stiff penalties, as there is currently no downside risk for these guys. The current model is esentially: Try. If it doesn't work or the fraudster is discovered, then try again.
- avoid3d 12y ago
  My understanding is that the bad grammar lets them filler out the non gullible earlier in the funnel.
  - tripzilch 12y ago
    This. The potential few extra victims they might profit from by using impeccable language/appearance probably doesn't compare favourably to the cost of extra time/effort dragging along smarter people for a longer time, that are probably just going to bail later on with high certainty at a stage where appearance is no longer the key factor for believability.
  - unclebucknasty 12y ago
wpietri 12y ago
Ooh, honeypot credit cards. If there is any law enforcement officer out there who would like to use me as a honeypot, get in touch. I get a half-dozen calls a week like this.
Intermernet 12y ago
I used to have a debit card that never had more than about $300 on it that I used for final testing of ecommerce sites. I wish I still had it for giving out to scammers. I'm wondering if it would stand up in court if one were to get a limited debit card, tell the police that you were keeping it purely for a honeypot card, and then hand over those valid, useable, but limited CC details to any would-be scammer while telling the police to start tracking transactions.
reitanqild 12y ago
There are some interesting stories out on the internet (google for "419 eater" or "scam baiting".) Unlike this story they are often well documented (and in some cases, funny, like tricking the scammer into providing a c64 carved out of hardwood.) Be sure to read their guidelines before trying anything similar as scambaiting can be dangerous.
- tripzilch 12y ago
  > and in some cases, funny, like tricking the scammer into extorting some innocent person into providing a c64 carved out of hardwood. Fixed, for what usually happens. If you think about it for a few moments, you'll come to the same conclusion: those "funny" pictures of supposed 419 scammers holding up silly signs with shoe-on-head and all that, no way the actual scammer criminals would let themselves be caught on camera like that. This one time I read a story about someone catching a 419 scammer on a specific 24/7 street webcam in Amsterdam as the location to hand over cash (all the while the trickster resided in the US, pretending to be a middle aged lady with a dog, that just happened to be visiting relatives in NL that weekend). This was in the early 2000s or so. I always used to think, that at least this time, it was the actual criminals they made a fool of. However, after reading this story, and about "Jennifer", maybe these guys were innocent victims as well. On the other hand, they did appear both quite big, muscular, leather jackets, not really the type you'd expect on the victim side of extortion. But I try to not make a habit judging people I don't know based on fuzzy 200X webcam photos ;-)
pavel_lishin 12y ago
Whenever someone calls me and asks me to confirm something - that is, reveal something - I always intentionally get it wrong the first time. If they carry on as if what I said was correct, I can be sure that it's a scam.
- lesterbuck 12y ago
  I like that idea. Whenever there is a form that asks for my social security number, and it's not some "under perjury" government statement, I always flip a bit somewhere in my number. With any luck, I have poisoned a lot of databases about me.

by jtheory 12y ago

__david__ 12y ago

I've been getting phishing attempts to my cell phone in the past few months. They leave message that say, "to collect your $100 AT&T rebate, go to www.phishingwebsite.com", which looks like a standard phishing site. They always come from different phone numbers and list different variants of the web site. It's odd because I've seen plenty of phishing emails, but this is the first time I've gotten them via phone.

us0r 12y ago
I get the same thing. I knew it was not AT&T but I called anyway asked for a manger then another manager explained it to him and I haven't got one since. I'm sure AT&T can quickly figure out who is sending this stuff. I also get voicemails from my "Google Specialist" letting me know that my "first page ranking" is ready. I can't get rid of this one.
smsm42 12y ago
Getting the same calls lately. Not sure what to do about it - my experience with AT&T shows I'll probably waste about 10x to 100x more time just trying to explain to them what I want that it takes me to hang up. But if somebody knows a way to make AT&T aware of it and do something (provided there's somebody in AT&T that cares and can do something) please share.

e40 12y ago

The incoming number was reported as This will do you no good. They are using a hijacked PBX. There is no way possible they are going to make it that easy to find them. Here's my story: I kept getting calls from "credit card services" and every damn time I asked to be removed they would just hang up on me. So, after about the 20th time, I decided to play dumb. I strung them along for 10 minutes. Here's how I did that: the first person you talk with asks if you have more than $3000 in CC debt. The second person basically asks the same thing, but in a little more depth. The third guy is the smooth talker. He asks you to find your statement so he can verify information from it. I played dumb and said I needed to find it. He said "I'll wait" in a very patient voice. I kept him on the like for 10 minutes (while I worked). Then, I just hung up. He called back immediately and said we accidentally got disconnected. I told him "you wouldn't take me off your list, so fuck you." His revenge was next. The phone rang and someone was yelling at me. He was redirecting all complaints to my phone number. I had to unplug my phone. I called AT&T (who I had service with) and after about 30 minutes of run around, they said they couldn't do anything. I'd have to contact the fraud department, or some such. I did try, but it was a lot of paperwork and it looked very bureaucratic. So, I decided to google for "credit card services" (not exactly that, but that's what I started with). I found a TX state lawsuit against a company with this name from the early 2000's. The lawyer that prosecuted them was listed and had a phone number. So, I called it. An elderly gentleman picked up the phone and I told him my story. His first words, "so, they're back at it?" He told me to be very careful, and basically tried to dissuade me from doing anything. It amazed me that they seem to operate with impunity.

nostromo 12y ago
Phones need a "report spam" just like email. Phone companies or device manufacturers should use those reports to trace bad actors.
- dredmorbius 12y ago
  Note that email doesn't have a "report spam" functionality designed into it (in the form of RFCs), though email providers often offer their own version to their users (most are far more opaque when it comes to reporting spam against their own systems). Reasons for this are diverse, but effectively, if you're a large email service provider, your users' satisfaction is a concern, spam is a large part of that, and the ability to leverage reports from many users to identify spam (and non-spam) sources is very useful. Telephony was designed in a far more innocent age, and was largely protected against the abuse which ran rampant in email (and Usenet) on account of the costs associated with network access and in actually making calls. Now that this is rapidly approaching email costs (effectively nil at the margin once you've got the infrastructure set up), this is changing. One consequence is that voice service is rapidly becoming useless due to abuse. I've rightgraded from a smartphone to a dumbphone for a number of reasons, but one feature I particularly miss from my Android device was the call screening app: deny access to unknown or blocked numbers, and allow priority access only to specifically whitelisted callers. Why should I allow myself to be interrupted by any one of the 7 billion people on this planet, or worse, programmed robots which call me without any regard for what I'm doing? I'm hoping for features such as this to make it into dumb phones soon. My other thought is that conventional telephony (both POTS and mobile) is going the way of the dodo -- VOIP over wireless broadband with only very occasional fallback to direct connections.

briancaw2 12y ago

If you google around there are government agencies and websites set up for all types of spamming/scamming. I got some scam phone calls awhile back and reported them; it could be a coincidence, but I stopped getting them. Here's a place to start: http://www.usa.gov/topics/consumer/scams-fraud/report-fraud.shtml http://www.usa.gov/topics/consumer/scams-fraud/report-fraud.... So I'd say, report, report, report. Scammers and spammers go on for too long because people brush it off. The worst thing you can do to an email spammer is take the time to mark it as spam. The worst thing you can do to a scammer is to report it to the government - some justice department and/or federal and state representatives. Articles like this make it seem like nobody is doing anything, but with a bit of digging you'd find that consumer protection agencies and state and federal legislatures have been passing laws regularly to combat scamming/spamming/predatory loans.

unclebucknasty 12y ago

It used to be that phishing emails were easily sniffed out due to the poor grammar. It was always immediately clear that they were coming from non-native speakers and, hence, obviously not the product of the major bank, etc. they claimed to represent. And, I always thought, "Good grief, if these guys would only hire native English speakers to write their crap (or simply copy a legit e-mail) and take a couple of other similarly easy steps, they'd be in business in a big way". It all pointed to the fact that there'd be a day when their increased sophistication, coupled with their boldness, would make it nearly impossible for the average person to sniff them out. And, beyond that, even seasoned tech folks would someday be vulnerable. That day is fast approaching. The good guys are losing and we need a completely new model for dealing with this stuff. "Protecting" access to information has long been an untenable goal, and any new model must make it such that everyone's personal information could be completely public without that fact exposing them to any risk. It's nuts that we all walk around with just a few bits of info which, if gleaned by a bad guy, could completely destroy us. It's also nuts that we walk around with a couple of numbers that we are routinely encouraged to give out to a myriad of people/systems, but if they ever once fell into the wrong hands, could be a gold mine for a scammer. We also need more international cooperation combined with super-stiff penalties, as there is currently no downside risk for these guys. The current model is esentially: Try. If it doesn't work or the fraudster is discovered, then try again.

avoid3d 12y ago
My understanding is that the bad grammar lets them filler out the non gullible earlier in the funnel.
- tripzilch 12y ago
  This. The potential few extra victims they might profit from by using impeccable language/appearance probably doesn't compare favourably to the cost of extra time/effort dragging along smarter people for a longer time, that are probably just going to bail later on with high certainty at a stage where appearance is no longer the key factor for believability.
- unclebucknasty 12y ago

wpietri 12y ago

Ooh, honeypot credit cards. If there is any law enforcement officer out there who would like to use me as a honeypot, get in touch. I get a half-dozen calls a week like this.

Intermernet 12y ago

I used to have a debit card that never had more than about $300 on it that I used for final testing of ecommerce sites. I wish I still had it for giving out to scammers. I'm wondering if it would stand up in court if one were to get a limited debit card, tell the police that you were keeping it purely for a honeypot card, and then hand over those valid, useable, but limited CC details to any would-be scammer while telling the police to start tracking transactions.

reitanqild 12y ago

There are some interesting stories out on the internet (google for "419 eater" or "scam baiting".) Unlike this story they are often well documented (and in some cases, funny, like tricking the scammer into providing a c64 carved out of hardwood.) Be sure to read their guidelines before trying anything similar as scambaiting can be dangerous.

tripzilch 12y ago
> and in some cases, funny, like tricking the scammer into extorting some innocent person into providing a c64 carved out of hardwood. Fixed, for what usually happens. If you think about it for a few moments, you'll come to the same conclusion: those "funny" pictures of supposed 419 scammers holding up silly signs with shoe-on-head and all that, no way the actual scammer criminals would let themselves be caught on camera like that. This one time I read a story about someone catching a 419 scammer on a specific 24/7 street webcam in Amsterdam as the location to hand over cash (all the while the trickster resided in the US, pretending to be a middle aged lady with a dog, that just happened to be visiting relatives in NL that weekend). This was in the early 2000s or so. I always used to think, that at least this time, it was the actual criminals they made a fool of. However, after reading this story, and about "Jennifer", maybe these guys were innocent victims as well. On the other hand, they did appear both quite big, muscular, leather jackets, not really the type you'd expect on the victim side of extortion. But I try to not make a habit judging people I don't know based on fuzzy 200X webcam photos ;-)

pavel_lishin 12y ago

Whenever someone calls me and asks me to confirm something - that is, reveal something - I always intentionally get it wrong the first time. If they carry on as if what I said was correct, I can be sure that it's a scam.

lesterbuck 12y ago
I like that idea. Whenever there is a form that asks for my social security number, and it's not some "under perjury" government statement, I always flip a bit somewhere in my number. With any luck, I have poisoned a lot of databases about me.