The IT Nerd

If you’re in Ontario, you should be on the look out for scammers using an Ontario RCMP number to intimidate and threaten victims in order to scam them. The warning came out on Friday, and the scam uses the phone number 519-948-5287 to run the scam. Thus if you see this number, it’s likely a scam.

The RCMP also provided these facts in order to help you to avoid being scammed by people claiming to be the police:

Be aware that the police:

• Will never ask you to make payments using bitcoin or gift cards,
• Will not show up to your residence to collect money for a child in jail 
• Will not ask for your personal information such as your Social Insurance Number (SIN), your date of birth (DOB) or phone number

On top of that, the RCMP doesn’t provide policing services in Ontario. Finally, they offer this good advice:

If you suspect that you are being scammed, hang up, wait ten minutes and call your local police service.

Waiting ten minutes before calling police is a good idea as scammers can sometimes hijack phones and continue the scam by pretending to be the police. A better piece of advice is to call the police from another phone.

If you’re in the rest of Canada, be prepared for this scam to go another province now that this is out there.

A reader of this blog tipped me off to this Canada Post scam that seems to be making the rounds. It starts with a text message:

Now the threat actor is hoping that your critical thinking won’t kick in because we’re in that time of year where everybody is having stuff shipped to them. Thus you will be more likely to click on the URL in the message instead of clicking on “Report Junk”. Thus let’s dive in by clicking on the URL which for the record you should never, ever do:

Now this is a very good replication of the Canada Post website. Except for the fact that the URL is not https://www.canadapost-postescanada.ca. But the threat actors are hoping that you won’t notice that. There’s also no tracking number listed. That’s a #fail as well as any sort of package that Canada Post or any courier handles would have a tracking number. Now if you click on “Reschedule Delivery”, here’s what you get (click to enlarge):

And here’s where it begins to become clear what the threat actors are up to. First they want to snag your personal info. And I know that because Canada Post would have no reason to ask you for your date of birth. When I entered fake info, I encountered logic that made you fill out certain items that reinforced the fact that the threat actors want your personal info. Likely to do some form of identity theft. But they’re not done yet.

The threat actors want your credit card info as well. Likely to use it to buy a ton of stuff on someone else’s dime. But also to reinforce any attempt to steal your identity. I say that because a lot of places want your birthdate and your credit card along with a home address to run a quick credit check on you. So this threat actor could in theory use this info to take out anything from a cell phone to a loan. That’s pretty crafty.

Now if you’re wondering how Canada Post would contact you, here’s a quick primer. Legitimate Canada Post email notifications will only come from the email addresses below and only if you’ve opted into receiving tracking notifications or communications from Canada Post:

• donotreply-nepasrepondre@notifications.canadapost-postescanada.ca
• donotreply-nepasrepondre@communications.canadapost-postescanada.ca
• bounce-renvoi@communications.canadapost-postescanada.ca
• bounce-renvoi@notifications.canadapost-postescanada.ca

They will never send you a text message. Thus if you get something that isn’t from one of the email addresses above, and you haven’t signed up for tracking notifications, it’s likely a scam. Legitimate Canada Post SMS tracking or mail notifications and marketing communications will only show the sender as 272727 or 55555, and you will only get them if you have signed up to receive those notifications. Thus if you haven’t opted into getting these texts, it’s a scam.

The holiday season is a prime time for scammers to operate. Thus you need to make sure that you check any email or text twice to make sure that you don’t fall victim to a scam.

I came across a new scam that is pretty crafty. I say that because it targets people who have already been scammed. Now, how did I come across this scam? I noted this banner ad while browsing the Internet:

If you click the banner, you go to this website:

So this website claims to get your money back if you’ve been scammed. And to make themselves look legitimate, they have these logos on their website:

I am certain that if you reach out to these companies, they will say that they don’t work with this company. But there’s more:

This is how this company claims to get money back from scammers. To be frank, if it were as easy as is stated above, people would not lose money from scammers. Thus I call BS on this.

I want you to focus on the quality of the English in the screenshot above. It’s bad. That’s the hallmark of scammers who are based overseas and not native English speakers. So that alone should be a red flag. That’s on top of the fact that the figures quoted in terms of money recovered are bogus. Because if they were true, everyone from government to police would be singing their praises.

Finally, this customer testimonial and the others on this website are likely fake. But it’s meant to make you think that this is a legitimate service. Which to be clear, it isn’t.

Other notes:

• None of the bottom links on this website work. That’s a red flag.
• The company claims to be at 4223 MacLaren Street, Ottawa, Ontario, Canada. But that address doesn’t exist in Ottawa. But it does exist in Oshawa Ontario as highlighted by the picture below. That’s another red flag.

But here’s why a threat actor has set up this website. People who have been scammed often look for ways to get their money back somehow no matter how unlikely it will be that the victim would be able to get their money back. Thus if they trip over a website like this, they are likely to fall for this scam out of desperation. In effect, these scammers are re-victimizing people who have already been scammed. And it is a good strategy if you’re a scammer as anecdotal evidence suggests that if someone has falling for a scam before, they are likely to fall for another scam in the future.

I’ve turned this info over to the scam baiter community so that they can have some fun with the person or people behind this. And I’ve reported the ad to Google. Because it’s bad enough that we have people who have been victimized by scams. But to re-victimize them is not acceptable. Thus it is entirely possible that the site might be down by the time you read this as once scam baiters get involved, the scammers fold up shop pretty quickly. Though I will note that early feedback from scam baiters indicate that once you type in your phone number, someone will call you back from either a German number or a United Kingdom number. This is inconsistent with the claims that this company is located in Canada and highlights the fact that this is a scam.

Finally, I want to illustrate what you should do if you get scammed. You need to report it to your local police who can then give you additional directions. Beyond that, the U.S. Federal Trade Commission has a website for scam reporting, while the Canadian Anti-Fraud Center is the place to go if you’re in Canada. Other counties have similar organizations for reporting scams. But these clowns who claim to be able to get your money back aren’t someone you should deal with. And the expectation of getting your money back should be zero. That’s harsh to say. But it’s the truth.

There’s a new scam that I have to admit I didn’t see coming. This one involves porn site YouPorn and it claims via an email that you have uploaded a video of yourself and you have to pay to get it removed. Here’s the email that you get:

Now there one thing that is different about this scam:

It actually comes from a youporn.com email address to make you think that it is legitimate. But it’s likely been spoofed so it’s not legitimate. The email then claims to allow you to remove the video for free, but when you click on the link it opens up the home page of your browser. Then it offered several paid options to remove said video. Otherwise, the video will go live onto the site in seven days. Clearly this scam email isn’t convincing as when I checked the Bitcoin address that is used for this scam hasn’t received any money. But as I have always said, scams don’t have to be successful in volume to be successful. Thus don’t help these threat actors to be successful.

Having just returned from vacation, I see that a number of scams have entered my inbox. The one that I will speak about today is a Spotify scam that claims that they can’t bill you for using Spotify:

As usual the quality of the English in this email is suspect. Which should be the first hint that this is a scam. The second sign that this is a scam is this:

This isn’t sent from Spotify as the email domain is “app.mail.com” rather than Spotify.com.

But if you take those two things out of the mix, the look of the email mostly fits the style that Spotify uses in their communications. Thus I can see how someone might fall for it.

Now, if you don’t have a Spotify account, and you get this email, the correct response should be to delete it and move on with your day. And even if you do use Spotify, those two things that I pointed out should make you delete this email anyway. But what do the threat actors want? I’m betting that this is a phishing email to steal your personal information or financial details. So let’s find out if that’s true (which by the way you should never, ever do).

This is a pretty good copy of the Spotify page. There are some errors but I can see if someone isn’t looking closely enough that they could fall for this. And by closely enough, I mean this:

This should be Spotify.com. But it isn’t. Which means that this is a phishing page.

And as I expected, here’s where the threat actors try to steal your credit card details. I typed in a bogus credit card number and it let me get to this page:

This makes you think that it’s doing something. But it’s not. If you’ve typed in your actual credit card details, you’ve been pwned. I believe that this and the next page are just for show to keep you on the hook:

You’re supposed to get a text message via the “Verified By Visa” service that Visa has. And this is where things get interesting. I entered a bogus credit card number earlier in this process which the website identified as being a Visa card. And that would be correct as the number that I entered was a Visa card. But I found it interesting that they didn’t validate that the credit card number was valid up front. I am guessing that they are doing the validation on the back end of this scam by using the “Verified By Visa” service to do that. I assume that they has similar checks for MasterCard, Discover, and AMEX.

Crafty.

So now that we know what the threat actors in this scam are up to, my usual advice applies. If you see this email or one like it, look for the things that I pointed out earlier in this article to confirm that it’s a scam, and then delete the email and move on with your day.

UPDATE: The same threat actor has put out a new version of this email. It looks like this:

They also made one other change to the email. Which is the email address that it was sent from:

Clearly they made that adjustment to make the scam more convincing. The rest of the scam remains the same.