The IT Nerd

If you are in a citizen of Ottawa Ontario, you need to be aware of a parking ticket scam that is making the rounds. And this one is good from a scam research standpoint. Here’s how the scam works:

• You receive at text message that addresses you by your full name, telling you that you have an overdue parking infraction and provided a URL to “ottawa-parking.ca” or “nfractionottawa.ca”, both of which have been taken down as I type this.
• This is where it gets good. While it was still live, it was an exact replication of Ottawa.ca and even links back to the legitimate website for paying “parking tickets”. That shows that the threat actors spent a lot of time and a lot of effort to pull this scam off. This screenshot was captured from the scam site before it was taken down.

The goal of this scam is to get your credit card details. And the threat actor behind this appears to be someone that based on my research, they have tried similar scams in Toronto and Vancouver. It just seems to be Ottawa’s turn. And the fact that it’s been taken down twice and has reappeared means that the threat actor isn’t done with Ottawa yet. Not to mention that they will move on to other cities.

The good news, Ottawa is getting the word out to warn residents about this scam. Thanks to a reader for sending this over:

My advice is a follows: If you get a text message that claims that you owe some money for a parking infraction, you should ignore it. Full stop.

A reader sent me a scam email that he received which uses courier company UPS as a lure to suck you in. Here’s the email in question:

So unlike the last UPS scam email that I covered here, the threat actor behind this trying harder to make this more convincing. Though the lack of proper punctuation, missing capital letters in sentences, and only marginal grammar make it clear that this is a scam email. And there’s the fact that the logo in the top left says “ips” and not UPS. Plus the email address indicates that it didn’t come from UPS. The net result is that all of this should make you delete this email the second you get it. But the threat actor has an interesting setup if you click “Check Here” which by the way, you should never, ever do.

You get taken to a website that if you look in the address bar, isn’t UPS. That’s a red flag. The use of the same colorus as UPS is meant to make you more likely to get sucked into this scam. It kind of falls apart with the words at the top “[1] Reward Pending – Shipping Survey – We Want Your Opinion!”. That suggests to me that they’ve used this website in another scam.

For giggles, lets click confirm and see what happens.

Well, it claims that I have to schedule my delivery, and it gives a tracking number that isn’t a UPS tracking number. So I’m going to schedule this mythical delivery.

Apparently I owe some money for customs. The fee that is being quoted is way under what UPS charges for anything customs related, which is another red flag. But I am guessing that the threat actor is expecting you not to know that. Lets continue down the rabbit hole:

Now this is a sign that this threat actor is really trying as they created this whole menu map to have you select your delivery preferences. That’s clever.

So according to this, I’ll get my mythical package in three days. Let’s see what happens when I enter my delivery information.

Okay… This is a bit weird. I’m not trying to claim my offer. I’m trying to get a package delivered. This underscores that this threat actor has likely recycled parts of this website to pull this scam off. I decided to have a bit of fun with them:

I wonder if the threat actor will understand that the phone number is a song from the 20th century? Anyway, let’s move on.

Ah! So now we know what the endgame is. They want you credit card details. That possibly ties into the previous screen as having your name and phone number along with possibly your email address would help the threat actors go to town at your expense. Let’s enter some bogus info and see if they do any validity checking in terms of if the card is valid:

And the answer is yes they do as this webpage rejected my bogus credit card info. I’ll give this threat actor credit as they tried hard in the right places to pull this scam off. Specifically in the area to get your credit card details. That makes this threat actor kind of dangerous.

So what’s my bottom line on this specific scam? Avoid it by deleting the email the moment you get it. Because if you get sucked in, it won’t end well for you.