Results tagged “Scam” from SpywareGuide Greynets Blog

419 Scammer On Skype

|
[5:51:48 PM] smith kabila says: GOOD DAY   
       FIRST AND FOREMOST,I MUST SOLICIT YOUR STRICTNESS CONFIDENCE IN THIS TRANSACTION AND I PRAY THAT MY DECISION TO CONTACT YOU WILL BE GIVEN GENUINE APPROVAL CONSIDERING THE FACTS WE HAVE NOT KNOWN EACH OTHER BEFORE, I WISH TO USE THIS OPPORTUNITY TO INTRODUCE MYSELF TO YOU.
 
      I AM SMITH KABILA FROM DR CONGO,   AFRICA. I WRITE TO INFORM YOU MY DESIRE TO INVEST,AND TO BUY A LIVING HOUSE IN YOUR COUNTRY. I AM THE FIRST  SON OF MR.BRIGHT KABILA, HE WAS A DIAMOND/GOLD MERCHANT IN MY COUNTRY.MY FATHER HAD A BULLET SHOT BY THE REBELS ON HIS WAY TRAVELLING OUT OF MY COUNTRY WITH TWO OF MY YOUNGER SISTER'S DUE TO PRESENT CRISIS THAT IS OCCURRING IN MY COUNTRY(DR CONGO).MY SISTER'S DIED ON THE SPOT WHILE THE U.N.PEACE KEEPING FORCE RESCUED MY FATHER,HE WAS TAKEN TO HOSPITAL FOR MEDICAL TREATMENT WHICH HE LATER DIED. BEFORE HE DIED HE REVEALED TO ME AND MY MOTHER ABOUT THE BOXES CONTAINING $7 MILLION US DOLLARS.WHICH HE DEPOSITED WITH A SECURITY COMPANY IN GHANA FOR SAFE KEEPING. MY FATHER DID NOT DISCLOSE THE CONTENT OF THE BOXES TO THE SECURITY COMPANY.TO AVOID THE OFFICIALS FROM RAISING EYE BROWS TO THE FUNDS.
 
       PRESENTLY MYSELF AND MY MOTHER ARE HERE IN GHANA TO NOTIFY THE SECURITY COMPANY FOR THE CLAIMS,AND WE ARE STAYING IN THE REFUGEE CAMP. THEREFORE I WANT YOU TO LECTURE ME ON HOW BEST WE CAN INVEST THIS MONEY,BECAUSE MY FATHER TOLD ME THAT IT IS DANGEROUS TO INVEST THIS MONEY IN AFRICA TO AVOID SUSPICIONS, AND DUE TO MARKET INSTABILITY COUPLED WITH ECONOMIC AND POLITICAL INSTABILITY FACING AFRICA COUNTRIES,THAT IS WHY WE WANT TO INVEST IN ABROAD. FOR YOUR MUTUAL ASSISTANCE, MYSELF AND MY MOTHER HAVE AGREED TO OFFER YOU 20%OF THE TOTAL AMOUNT OF THE MONEY AND ALSO 3% FOR ANY EXPENSES.
 
    WE HAVE ALL THE VITAL DOCUMENTS COVERING THE DEPOSIT AND THE OWNERSHIP WHICH I CAN SEND TO YOU THROUGH FAX ON REQUEST. NOTE:I HAVE NEVER DISCLOSED THIS TO ANY PERSON APART FROM YOU,SO YOU HAVE TO KEEP THIS TRANSACTION AS A TOP SECRET TO YOURSELF ALONE.WHICH I WILL WANT YOU TO FORWARD ACROSS TO ME YOUR DIRECT TEL/FAX NUMBER FOR MORE INFORMATION'S ABOUT THIS TRANSACTION.

contact through this contact
this is my direct line, 233 247890536
email contact : smithkabila29@yahoo.com
 
BEST REGARDS,
 
SMITH KABILA. (FOR THE ENTIRE FAMILY)


....quite a long one, isn't it?

He then spent a lot of time trying to convince me to "work together", claiming he would show me everything he knows about webscams.

Doh.

smithkabila100 is the Skype account to block.
If you see this message appear on your phone:

phone1.jpg


phone2.jpg


You may want to ignore it. The reason? It convinces the victim they have a parcel "awaiting delivery", then encourages them to ring an Austrian number. Once connected, an automated system asks the victim to enter their number, but then repeats it back to the victim with numbers intentionally incorrect. At that point, the victim wastes time and effort going round in circles with a system designed to beat them every time.

As you can imagine, that's going to make someone a fair amount of money.

Currently being sent to random people via a long list of disposable mobile phones (that always go to voicemail or an engaged tone if you ring them), this text message says:

!!Urgent!! Large Parcel Awaiting Delivery Please Call Now on +43820899510 For Delivery Tomorrow Regards International Parcel Deliveries

There's not too much information online about this yet, but what we do know is

1) Victim is sent the text message from a disposable mobile phone.
2) The victim is presented with an Austrian phone number to call with regards "delivery".
3) The victim then phones the number and bad things apparently happen to their bill.

Let's take a look at some quotes from people who called the number - I'm going to bold a few sections that confirm the system pretends to get the victims number wrong, and that this could cost you some serious money:

"Coincidentally I was expecting a delivery. I called it but hung up after a couple of minutes. An automated answering service will prompt for you to enter your phone number after that it will repeat it back to you but get the number wrong (usually one of the number wrong i.e '5' instead of '7'), I just hope I hadn't given anything away to this very dubious SMS."

"Got exactly the same text message 4th Oct 19.45pm to ring this Austrian number.  Tried ringing it and it takes you through an automated recording to giving you delivery numbers and taking your mobile number to arrange delivery in the next two days.  Asks for preferred delivery times."

"I stupidly called the number and followed a series of voice prompts to arrange delivery. Cost me almost ?15.00 ($26) on my mobile. I just pray nothing else happens to me or my family because of this. I am normally very aware re scams but my main focus has been on emails, didn't realise you could get scammed via text messages too. Should have known better cos wasn't really expecting any parcels, but as I have a lot of family all over the world thought maybe it was a surprise gift..talk about being had big time!!!"

"I've been had. I called it several times. It asks you to put your mobile number in and then repeats the number incorrectly. I was waiting for a delivery."


A clever tactic, I'm sure you'll agree. Remember, if you're expecting a delivery - never trust random messages sent to your phone, especially if they don't share the name of the company that's delivering your parcel.

Of course, most delivery companies don't use "!!" at the start of their text messages either (though I am told that this is a method used to scroll messages on the front of clam-shell phones, but that's another gimmick altogether...)
Hot on the heels of this writeup comes another example of a particular technique favoured by 419 Scammers at the moment. It follows a familiar pattern - someone has their EMail account hijacked, and then all of their contacts will find this in their Inbox shortly afterwards:

Hello,
I am sorry I didn't inform you about my traveling to Africa for a program called Empowering Youth to Fight Racism,HIV/AIDS,and Lack of Education,the program is taking place in three major countries in Africa which are Ghana,Togoland and Nigeria,I am presently in Lagos Nigeria.
 
I misplaced my wallet on my way to the hotel where i lodged my wallet which contains my money,and other valuable things were kept.I will like you to assist me with a soft loan urgently with the sum of $3,400 US Dollars to sort-out my hotel bills and get myself back home.
 
I will appreciate whatever you can afford, i 'll pay you back as soon as i return.
Kindly look for any western union and use this informations below to send me whatever you can afford.

Name : <Redacted>
Address : <Redacted>
Zip code: <Redacted>
State :Lagos
Country :Nigeria
Test Question :To who?
Answer :
Amount send $:?

Once you have it sent, please send me the money transfer control number,with details used in sending it. I await to read from you.


The EMail content is practically identical to the last one with only a few minor alterations. The recipient was naturally suspicious (especially over the fact that their skills with the English language had suddenly taken a turn for the worse) and asked if it was really their contact sending them this mail. The reply was as follows:

Thanks for geting back to me i really appreciate your mail this massage is from me.what i need you to do for me is that just lend me some money when i get back i will pay you back and explain everythings to you ok

Perhaps given the concern over their contact losing all grasp of their native tongue, sending back a missive lacking in spelling, punctuation and basic sentence structure wasn't the smartest of moves.

Happily, our intepid investigator was able to confirm with the victim that yes, they had been hacked and as far as I'm aware nobody lost any money to these scammers. Thanks to Jeanette at Mother Hen Productions for sending this over!
This is a particularly disturbing scam that's been passed my way, courtesy of reader MTGarden.

The scammers in question hacked a colleagues EMail account, then sent out a request for money to the people on the hacked accounts contact list, claiming they were overseas and without cash. The EMail looked like this:

Hi,
I am sorry I didn't inform you about my traveling to Europe for a
program called Empowering Youth to Fight Racism,HIV/AIDS,and Lack of
Education,the program is taking place in three major countries in Europe
which are Czech Republic,Scotland and England,I am presently in
England,London.

I misplaced my wallet on my way to the hotel where my money,and other
valuable things were kept.I will like you to assist me with a soft loan
urgently with the sum of ?2000 British Pounds to sort-out my hotel bills
and get myself back home.
I will appreciate whatever you can afford, I'II pay you back as soon as
i return.Kindly look for any western union and use this informations
below to send me whatever you can afford.

Name : <redacted>
Address :<redacted>
Zip code: <redacted>
State : <redacted>
Country :<redacted>
Test Question :To who?
Answer :<name removed>
Amount send ?:2000

Once you have it sent, please send me the money transfer control
number,with details used in sending it.
I await to read from you.


....yikes. All you'd need is one or two non-tech savvy people (relatives would obviously work best here) on the contact list and you'd quickly have a large problem on your hands. If you have anyone like that on your contact list - and most of us do - it might be worth letting them know about this scam. As a sidenote, I should add that the person in question regained control of their EMail account and no money was sent to the scammers.

Be on your guard...

419 Scammer Via Skype

|
Well that's typical, I go on holiday and the moment I switch a PC on to check something, this appears in Skype:

stephanie kidkhyan says: how are u i hope good, my name is stephanie napapon am from thailand but live london i contant u for my late fahter consingment in afirca pls if u can help me u will take 30% of the money pls the money in the box is 5.2mioll euro.i have all the document and my passport pls i need u help ok this is my email addr stephanienapapon@yahoo.com

This person then tried their hardest to get me to ring a UK based mobile phone number. Let's think about that for a second...someone in Thailand, a father with a "consignment" in Africa and a phone number located in an entirely different continent.

Yeah, doesn't sound too convincing does it? Do yourself a favour and block this Skype address:

napapon4love

In the meantime, we've reported the Username involved.
If you have an XBox Live account, be on the lookout for this.

In every case I've ever seen, when someone offers you "free" goodies for something related to XBox live you should give it a very wide berth unless it's something official from Microsoft. I personally don't even bother with official third-party offers - I go straight to Microsoft for anything, and if they don't have the particular amazing offer that I happen to see available directly from them, well, too bad for me.

Here's an example of something you should avoid entirely unless you want your account details stolen.

Called the "Microsoft Point Generator", the end-user is fooled into thinking they can create their own Microsoft Points by simply entering their Windows Live ID and Password into the sections provided:

xbox1.jpg

Hit "Generator Points" (I'm assuming they meant to say "Generate"...) and your details are sent via EMail to those responsible for the scam:

xbox2.jpg

That's the EMail and password of the victim at the bottom, there.

We detect this as PWS.XBpoint.

Additional Research: Chris Mannon, Senior Threat Researcher

Dreamcast Hoaxes

|
I've always been fascinated by how many net hoaxes and scams have revolved around the Dreamcast console and related games (in particular, Shenmue). I thought it might be interesting to have a look at some of the most memorable ones, though this list is by no means exhaustive so please feel free to add to the list if I've missed any.

Fake Shenmue Passport, February 2006: Back in 2006, gamers were amazed to find the Shenmue Passport spring back to life. For those of you who don't know what the Shenmue Passport is, click here. Everyone else can just skip to the "good stuff", which would be seeing this appear on your TV if you'd had the brainwave to go online with your long-dead Dreamcast in February 2006:

ppupdate.jpg
Click to Enlarge

A message proclaiming that downloadable content for Shenmue was back online, and that more would be "coming soon". Forums everywhere started to look like this. All of a sudden, downloads were available from the seemingly official (and freshly reborn) website and messages saying "We'll be back soon" were plentiful, sparking rumours  of a Shenmue 3  announcement (or even something related to the  limbo-ridden Shenmue Online).

However, something didn't seem quite right about all this and the truth eventually came out thanks to a fantastic bit of detective work here. Someone had bought the domain once it had expired, and decided to "give fans hope" with a bunch of uploads and fake messages. As you might expect, this did not go down very well (in fact, you can see the process of SEGA reclaiming the domain from the culprit here thanks to someone who was copied in on the EMail conversations).

Shenmue 3 Youtube Trailer, January 2007: This is a fairly crummy hoax, but did seem to sucker a lot of people. Take some CGI footage from the canceled "Shenmue Online" game, stick "Shenmue 3" over the top of it:

shentrailer.jpg

Place the whole mess onto Youtube then sit back and laugh. Even though the video was placed online in 2007, it's still fooling people a year on.

Dreamcast Phish, March 2008: This one was particularly nasty, and was similar in execution to the way the Shenmue.com domain was swiped for the above scam. Someone grabbed the Dreamcast.com domain, then used it to phish for email logins and caused an awful lot of LET'S KILL THE PERSON RESPONSIBLE IMMEDIATELY type comments across the Net. This is what the previously dormant website suddenly looked like after being offline for all those years:

dreamphish.JPG


Seeing that sent quite a few Dreamcast fans insane (myself included) which made it all the more horrible when it was revealed to be nothing more than yet-another-Dreamcast-hoax.

Luring you in with the promise of an official @dreamcast.com Email address, they asked for your serial number, desired username, password and a current Email address. Once registered, you would end up with a seemingly valid yourserialnumber@user.dreamcast.com address.

The only problem, of course, was that it wasn't SEGA sending out your details, it was the scammer who had grabbed the domain name. The theory is that people would likely use the same password for their desired Dreamcast address as the alternate Email address they provided when signing up to the "service". Thus, you would have spam lists and hijacked email addresses galore.

It didn't take long before SEGA denounced the site, and it was pulled offline shortly after. In retrospect, a dead giveaway should have been the fact that the site had Google Ads and a few other things on it (check out the rather small screenshot) that probably wouldn't have been there if SEGA had actually been in charge. SEGA almost certainly wouldn't have had a Play-Asia affiliate code embedded in the page, for that matter:

affcodedc.gif


Messing around with one particular videogame is one thing, but whipping fans of the Dreamcast console into a frenzy with the promise of an out-of-the-blue Dreamcast revival was never going to end well. Sadly, the culprit was never found but hopefully they'll drop a really heavy plantpot stuffed with bricks on their foot at some point in the near future.

Shenmue "Believe" Advert, July 2008: Oh dear. EDGE magazine usually post up a cryptic, arty image as a substitute for a regular "Next Month" page. For the September issue, someone started a thread on the NEOGAF forum previewing said issue. In this case, the Next Month page looked like a notepad - and one of the more iconic images of Shenmue was the Notepad the main character used to store notes, items and the like.

A quick photo manipulation later and...

notepad1.jpg
Click to Enlarge

If you can't see it, in the middle of the pad the original poster has placed "Shenmue 3: Believe" in very faint text.

This spread across the net like wildfire for a few days, until of course people started to get their hands on the issue in question and realised the whole thing was....yet again.....a hoax. I believe the EDGE preview turned out to be for an article about videogame instruction manuals.

Shenmue 3 Disc Hoax, August 2008: Sometimes innocent bloggers (who really should check the source material...) are sent images and post them up. Bad idea. Not so long ago, SEGA unveiled a room containing every single game they'd ever made. One of the images contained a pile of GD-Rom discs which SEGA used to store prototypes and early build versions of Dreamcast games on. Despite the blogger in question actually linking to the original, they were suckered in by a photoshop alteration where someone had placed "Shenmue 3" over the top:

shenmuegdr.jpg
Click to Enlarge

As SEGA themselves said,

"Ha, that's too funny, they've totally photoshopped the image. I wonder how long it is before we see this getting picked up as fact."

As it turns out, it wasn't too long - I did see this pop up on a couple of forums, but this one was caught pretty early. It's still surprising that the blogger didn't just check the original image more closely though.

This ends our tragic roundup of scams related to the Dreamcast console. I have a feeling we'll be seeing more soon enough...