The IT Nerd

A couple of days ago I was working on site with a client when I get an email saying that a home client of mine had been “seriously” hacked. I dropped what I was doing and tried to phone them. But there was no response. I also responded to the email with some contact info. No response. An hour later, my client called me back in a complete panic. But by that point, I had already made arrangements to return to Toronto as I was out of town to assist with this.

When I arrived later that day she handed me her MacBook Pro, and I saw this:

Now if you’re wondering why I left the IP address visible, Bell rotates those IP addresses so often, that it simply doesn’t matter if it’s displayed or not. In any case the client told me that she was surfing the Internet and this screen appeared. It was making lots of noise and she couldn’t close it. So in a panic she phoned the number. That response isn’t a surprise because this is a pop up scam. The pop up makes you think you have some sort of critical issue with your computer, and they often play noises like sirens which when added to the text on the screen makes you more likely to call the number. And if you’re wondering how the pop up gets onto someone’s computer, scammers plant these all over the Internet using a variety of means that I won’t get into here. From there it’s just the law of averages in terms of if you hit one of these by browsing to a legitimate website that has for lack of a better word been “boobytrapped” with a pop up like this one.

Pro Tip: The way you deal with this is to try and close the pop up. If you can’t close it, press and hold the power button to turn off the computer. Then turn it on again. If the pop up returns after that, call a computer professional for assistance. But under no circumstances should you call the number that’s on the screen.

Unfortunately in this client’s case, she called the number. And according to her, the scammers at the other end of the line who were pretending to be Apple Support convinced her that her bank account and “all her personal information” had been hacked as he could see it right on his screen. They asked her what kind of computer she had, and when she replied that she had a Mac, they surprisingly didn’t try to connect to it (I confirmed that this was the case when I examined the computer). But instead launched into executing the scam. The fake Apple Support rep then got another person on the line who pretended to be her bank to help her to “secure her account.”

Now there’s three things about this interaction that I should point out. First, Apple would never, ever connect you to your bank because they don’t have the ability to do that. Second, at no point was she asked about which bank she dealt with. Which means that it would have been impossible for this fake Apple Support rep to again connect her to the right bank even if they did have the ability to do that. Nor would it have been possible for them to see on their screens that her bank account was hacked. But the reason why she was falling for it was that they were weaving a story that was convincing to someone who was under a lot of stress. And the stress was created by them via the pop up and what they have said to this point. Scammers do that because it stops you from critically thinking. Which means you’re more likely to make less rational decisions and fall for the scam.

Now let me cover the part about the scammers not connecting to her computer as that was unusual. The typical scammer behaviour is that they want to connect to your computer using a tool like AnyDesk or TeamViewer. But once connected they will often use a piece of software called ConnectWise Control which operates in the background without your knowledge and allows the scammers to come and go from your computer as they please. Which put another way means that they are always watching you and can steal personal information at will. The other reason why they do this is that they will use this to watch you while you log into your bank account so that they can steal money right from your bank account if they can, or figure out how much they can get you to withdraw from it so that you can send it to them. My only thought as to why they did not connect to her computer is that they either didn’t know how to do all of that with a Mac (which is ironic as they were pretending to be Apple Support), or they didn’t want to deal with trying to talk her into installing the software that they would need to pull this off as that would have requires an admin password that she may or may not know. Thus they went right to executing the scam.

At this point the fake bank employee started to add to this story that someone at the bank branch that she went to was stealing money from people’s accounts, and they needed her to “secure her account” so that she could avoid being the next victim. Thus they needed her to take out as much money as possible and then put them into “secure encrypted cards” in order to protect her funds. Now I am going to assume the scammers were using the term “secure encrypted cards” to cover up the fact that she was going to be told to buy gift cards so that the scammers could get the money easily.

Let’s dissect this. Major banks don’t need your help to hunt down bad actors who work for them. So if you hear this sort of thing from anyone claiming to be a bank employee, they are lying. Next, no bank on this planet would ever require you to “secure your account”. If there was some sort of fraud issue caused by a bad actor inside a bank, it would be dealt with by the bank. And no bank, government agency, law enforcement, etc. would require you to buy gift cards for any reason.

The final part of this scam was that she was also told that her entire network was hacked and she shouldn’t tell anyone about what was going on. And any attempt by anyone to do things like email for help or make a phone call would be seen by the hackers that they claim were hacking her. This is an attempt by the scammers to stop the victim from calling for help as that would disrupt the scam and result in the scammers not getting paid.

Back to the scam, all of this would have worked out for the scammers as this client had completely bought in. But unfortunately for the scammers, the client’s daughter in law came home and upon hearing what was going on, quickly put an end to the scam by making the client hang up the phone. So the client didn’t lose any money. But even though she got lucky and had a good outcome, if there is any such thing in a situation like this, she was really freaked out. Which is understandable.

By the time that I arrived, she had gone to her bank who confirmed that she had not lost any money. Thus all I had to do was examine her computer to make sure that it was not compromised and reassure her that everything would be fine. And that’s the thing that really bothers me about what these scumbags do. They leave people in a state where they are shaken, upset, and not trusting of anything and anyone. That is part of the reason why I turned over all the information about these scumbag scammers, and the story behind it to the Scambaiting community. Essentially Scambaiters are digital vigilantes who take this sort of information and use it to collect intelligence about scammers that are passed on to others in the community, and they use that intelligence to disrupt the scammers operations. Because I want the scumbags behind this to pay some sort of price. Ideally that price should be jail, but since the Indian authorities (The scammers had significant Indian accents, so it’s a safe bet that they are Indian), are known for not seriously going after scammers unless forced to, then vigilante justice is the next best thing.

I have it in my calendar to follow up next week to make sure all is well with this client. But frankly, we should not be living in a world where scammers can operate as freely as they do. Scammers should be treated like cockroaches, and exterminated from the face of the Earth. And I will do my part to make sure that they get what’s coming to them.