The IT Nerd

I get all sorts of emails and calls from people who have been scammed that are in need of my help. A lot of these scams are ones that I have seen before. But one that I came across recently was really different. And because of that, I want to tell you about it so that you’re aware that scam exists, and as a result you can protect yourself accordingly.

The client out of the blue got an Interac deposit into their bank account. The client had auto deposit turned on, meaning that there doesn’t need to be any human intervention to have the money go straight into someone’s bank account. Thus $700 in this case, just magically appeared in their bank account. The client didn’t recognize the email address that sent the money and found that to be odd. But things escalated from there when less than 24 hours later, the client gets a request for $700 to be withdrawn from her bank account from the same email address that sent the $700 in the first place. There was a note saying that there was a deposit the day before and that was a mistake. As a result the person who sent the money wanted the sender to send the money back to them. One thing that was interesting was that the sender claimed that they were 1 letter off in terms of the email address. Another thing that was interesting was that the sender claimed to have talked to a relative who is a CFO at TD Bank which is one of the “big five” banks in Canada and that CFO directed them to do this. The client was highly suspicious so they called me for help.

Now there’s a bunch of things that I immediately spotted as red flags. Here’s the list:

• The client had this all happen by email. And the client had an email address that had no relation to their name or anything like that. In fact the email address is a Hebrew word that isn’t commonly known to most of you reading this unless you’re part of the Israeli or Jewish diaspora. And to be sure that the client isn’t a target for anything else, I won’t disclose what that word is. In any case, to be one letter off on this sort of email address would be impossible given the circumstances. What’s more likely to be the case is that they were targeted for this scam somehow.
• I find it impossible to believe that the sender would happen to have a relative who is a CFO of TD Bank who would direct them to take this course of action. What’s more probable is that this was a means to gain the client’s confidence so that the scam would be more likely to succeed.

So, what is the actual scam? Based on some research, here’s what is likely going on:

• Someone’s bank account either via phishing or some other means gets hacked.
• Once inside that bank account, the threat actor uses Interac to transfer money from that hacked bank account to a victim that unwittingly accepts the money into their bank account.
• Some time later the threat actor asks for the money back claiming that it was a mistake. And the victim sends the money believing that this was a mistake.
• Unknown to the victim, there’s a fraud investigation going on in relation to the hacked bank account. And when the money is tracked down days, weeks, or months later to the victim’s bank account, the bank will withdraw the stolen money from the victim’s bank account to return it to the rightful owner. Except that the victim has already sent money to the threat actor under the assumption that this was a mistake. So the victim is out the money and the threat actor wins.

I advised the client to call their bank and explain the situation. The client instead asked me to join her at her local bank branch. After having a conversation with first a client service rep, followed by the branch manager, the bank opened a fraud investigation and froze the client’s bank account. The client then filled out a form that said that said that the client didn’t know who this person was who sent them this money. As I type this, the client’s bank account is still frozen. And at the same time, the threat actor keeps pestering them to return “their” money via email. I created a rule in their email client that automatically sent those emails to the trash. But not before telling the threat actor via email that there’s a fraud investigation open and the bank account had been frozen.

Now I am sure that there are many cases where there isn’t a positive ending and that people have lost money due to this scam. Which means that you need to protect yourself from being a victim. The best way to protect yourself is to make sure that you turn off autodeposit. It shouldn’t be on by default. But if you turned it on, I strongly suggest that you turn it off. That way it makes it more difficult for a threat actor to execute this scam as you would have to manually accept the deposit. That brings me to the second means to protect yourself. Which is that if you don’t know the person who is sending you money, you should become suspicious and not accept the deposit. And what will likely happen is that the deposit attempt will expire after a certain amount of time. The end result is that the scam will not be able to be executed and you will be safe. Finally, in the event that a situation like this is actually a mistake. The sender of the funds can escalate with their bank to get the transfer reversed. But to be clear, I am 99% sure that this is not a mistake but a scam.

I’m monitoring this situation as I want to see how this turns out, which is another way of saying that I want to see how long it takes for my client’s life to return to normal. I’ll post an update once I have one. But my advice is to be careful out there because scams are everywhere, and they can hit you at any time.