The IT Nerd

A couple of years ago, I wrote about a pretty sophisticated parking fine scam that was making the rounds in Ottawa. At the time it got a fair amount of attention. But then it disappeared. And I forgot about it. But last night a reader sent me this screenshot:

It appears that this scam is back. Or at least a threat actor is trying to bring it back. You’ll understand why I say that in a moment. Right now, let’s look at the text message. The redacted section is your cell phone number goes. That’s the only thing that comes close to identifying you. Seeing as it is likely that any city would have access to your name and address via your license plate number, logic would say that your name or license plate number should appear. That’s a departure from the Ottawa version of this scam which actually referred to you by name, which made it more convincing. Or put another way, the threat actors behind this are far less sophisticated than the ones behind the Ottawa scam.

All of the above ignores the fact that no city would ever contact you regarding an unpaid parking ticket in this manner.

The text message also piles on the pressure by saying that if you don’t pay this parking ticket, you’ll have to go to court, your license and vehicle registration will be suspended, and you’ll have to pay a lot of money. That’s to get you to suspend your critical thinking and just react to the text message rather than think this through and conclude that this is a scam.

Now the website that you’re supposed to go to has been taken down as I type this which is a good thing. But it only means that the threat actors behind this will find someplace else on the Internet to set up shop to try and execute this scam. That in turn means that you need to look at any text message or email that you get with a critical eye to make sure that it is legitimate. And if it’s not, you should never engage with it.

UPDATE: It seems that the website is back online. Which means that I can actually tell you what these threat actors are up to.

There’s a fake Cloudflare page that pops up when you go to this site. That’s meant to make sure that you believe that it’s real.

Then you’re taken to this page. Fun fact: The Government of Canada or provinces are not involved in collecting parking fines. That’s up to individual cities. But the threat actors are clearly hoping that you will not know that and click on the province that you live in. I must say that this website is pretty well done. But you know it’s fake because one look at the address bar at the top right shows that this isn’t a Government of Canada website as it doesn’t end in “gc.ca”.

The individual provinces websites are well done as the match the theme that each province uses in their website. But the information that these scumbags want to collect is exactly the same. Starting with your license plate number.

Then they want your details. Specifically your date of birth, along with your name and address. All of that is great for stealing your identity.

Finally they want your credit card details. Which on top of helping the threat actors steal your identity, they’ll likely go on a shopping spree.

Now to be clear, you should not do what I have done here because clicking on links from unsolicited parties is a risky thing to do. But I take precautions when I do this sort of thing because I want to illustrate what threat actors like this one are up to so that you can see how dangerous these scams are. And also why you should never click on links or do anything else with any email or text message that you get.

This entry was posted on October 8, 2024 at 9:13 am and is filed under Commentary with tags Scam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.