The IT Nerd

Just this morning after taking a look at this scam, I came across a text message scam that is in Canada. It starts with this text message:

Some random observations here:

• This was sent as an iMessage. That means the sender can potentially see if you’ve read this or not. Though they want you to reply with a “Y” so that they are sure that the number that they sent it to is live or not.
• The fact that this is an iMessage also makes it very easy to deal with. Simply click “Report Junk” and you’re done with it as it will delete it from the messages app on iPhone and Apple will presumably handle everything else. I recommend that this is the course of action that anyone who gets this message should take.
• It’s being sent a country code which is +63 which is the Philippines. Which means that this message was not being sent by “Canadian Customs.” Which by the way is called the Canada Border Services Agency. Clearly the threat actor isn’t aware of that.
• Canada doesn’t have ZIP codes. We have postal codes. Another sign that this is a scam. And another sign that the threat actors don’t have a clue about Canada.

Now unlike the scam that I covered earlier today which went away and came back, I wasn’t able to investigate this one as it appears that someone has redirected it to the real Canada Post website. So nobody who gets this message will fall for this scam. But the thing is, this scam is operating in other places. While researching this, I came across a Reddit thread that has this:

Different phone number. Slightly different text. But it comes from the same country and it’s clearly the same scam. Just with a US spin to it. The person who posted this to Reddit replied with an insult that I will not translate. But that was a dumb move as the threat actors now know that this number is live. Which means even if Apple blocks the number that this message was sent from, the threat actors will simply send stuff from another number. But what this illustrates is the fact that these threat actors are acting on a large scale to see if they can get a payday. Thus regardless of where you are, you need to keep your wits about you so that you don’t become a victim of a scam like this.

A couple of years ago, I wrote about a pretty sophisticated parking fine scam that was making the rounds in Ottawa. At the time it got a fair amount of attention. But then it disappeared. And I forgot about it. But last night a reader sent me this screenshot:

It appears that this scam is back. Or at least a threat actor is trying to bring it back. You’ll understand why I say that in a moment. Right now, let’s look at the text message. The redacted section is your cell phone number goes. That’s the only thing that comes close to identifying you. Seeing as it is likely that any city would have access to your name and address via your license plate number, logic would say that your name or license plate number should appear. That’s a departure from the Ottawa version of this scam which actually referred to you by name, which made it more convincing. Or put another way, the threat actors behind this are far less sophisticated than the ones behind the Ottawa scam.

All of the above ignores the fact that no city would ever contact you regarding an unpaid parking ticket in this manner.

The text message also piles on the pressure by saying that if you don’t pay this parking ticket, you’ll have to go to court, your license and vehicle registration will be suspended, and you’ll have to pay a lot of money. That’s to get you to suspend your critical thinking and just react to the text message rather than think this through and conclude that this is a scam.

Now the website that you’re supposed to go to has been taken down as I type this which is a good thing. But it only means that the threat actors behind this will find someplace else on the Internet to set up shop to try and execute this scam. That in turn means that you need to look at any text message or email that you get with a critical eye to make sure that it is legitimate. And if it’s not, you should never engage with it.

UPDATE: It seems that the website is back online. Which means that I can actually tell you what these threat actors are up to.

There’s a fake Cloudflare page that pops up when you go to this site. That’s meant to make sure that you believe that it’s real.

Then you’re taken to this page. Fun fact: The Government of Canada or provinces are not involved in collecting parking fines. That’s up to individual cities. But the threat actors are clearly hoping that you will not know that and click on the province that you live in. I must say that this website is pretty well done. But you know it’s fake because one look at the address bar at the top right shows that this isn’t a Government of Canada website as it doesn’t end in “gc.ca”.

The individual provinces websites are well done as the match the theme that each province uses in their website. But the information that these scumbags want to collect is exactly the same. Starting with your license plate number.

Then they want your details. Specifically your date of birth, along with your name and address. All of that is great for stealing your identity.

Finally they want your credit card details. Which on top of helping the threat actors steal your identity, they’ll likely go on a shopping spree.

Now to be clear, you should not do what I have done here because clicking on links from unsolicited parties is a risky thing to do. But I take precautions when I do this sort of thing because I want to illustrate what threat actors like this one are up to so that you can see how dangerous these scams are. And also why you should never click on links or do anything else with any email or text message that you get.