The IT Nerd

I came across a new scam that is pretty crafty. I say that because it targets people who have already been scammed. Now, how did I come across this scam? I noted this banner ad while browsing the Internet:

If you click the banner, you go to this website:

So this website claims to get your money back if you’ve been scammed. And to make themselves look legitimate, they have these logos on their website:

I am certain that if you reach out to these companies, they will say that they don’t work with this company. But there’s more:

This is how this company claims to get money back from scammers. To be frank, if it were as easy as is stated above, people would not lose money from scammers. Thus I call BS on this.

I want you to focus on the quality of the English in the screenshot above. It’s bad. That’s the hallmark of scammers who are based overseas and not native English speakers. So that alone should be a red flag. That’s on top of the fact that the figures quoted in terms of money recovered are bogus. Because if they were true, everyone from government to police would be singing their praises.

Finally, this customer testimonial and the others on this website are likely fake. But it’s meant to make you think that this is a legitimate service. Which to be clear, it isn’t.

Other notes:

• None of the bottom links on this website work. That’s a red flag.
• The company claims to be at 4223 MacLaren Street, Ottawa, Ontario, Canada. But that address doesn’t exist in Ottawa. But it does exist in Oshawa Ontario as highlighted by the picture below. That’s another red flag.

But here’s why a threat actor has set up this website. People who have been scammed often look for ways to get their money back somehow no matter how unlikely it will be that the victim would be able to get their money back. Thus if they trip over a website like this, they are likely to fall for this scam out of desperation. In effect, these scammers are re-victimizing people who have already been scammed. And it is a good strategy if you’re a scammer as anecdotal evidence suggests that if someone has falling for a scam before, they are likely to fall for another scam in the future.

I’ve turned this info over to the scam baiter community so that they can have some fun with the person or people behind this. And I’ve reported the ad to Google. Because it’s bad enough that we have people who have been victimized by scams. But to re-victimize them is not acceptable. Thus it is entirely possible that the site might be down by the time you read this as once scam baiters get involved, the scammers fold up shop pretty quickly. Though I will note that early feedback from scam baiters indicate that once you type in your phone number, someone will call you back from either a German number or a United Kingdom number. This is inconsistent with the claims that this company is located in Canada and highlights the fact that this is a scam.

Finally, I want to illustrate what you should do if you get scammed. You need to report it to your local police who can then give you additional directions. Beyond that, the U.S. Federal Trade Commission has a website for scam reporting, while the Canadian Anti-Fraud Center is the place to go if you’re in Canada. Other counties have similar organizations for reporting scams. But these clowns who claim to be able to get your money back aren’t someone you should deal with. And the expectation of getting your money back should be zero. That’s harsh to say. But it’s the truth.

There’s a new scam that I have to admit I didn’t see coming. This one involves porn site YouPorn and it claims via an email that you have uploaded a video of yourself and you have to pay to get it removed. Here’s the email that you get:

Now there one thing that is different about this scam:

It actually comes from a youporn.com email address to make you think that it is legitimate. But it’s likely been spoofed so it’s not legitimate. The email then claims to allow you to remove the video for free, but when you click on the link it opens up the home page of your browser. Then it offered several paid options to remove said video. Otherwise, the video will go live onto the site in seven days. Clearly this scam email isn’t convincing as when I checked the Bitcoin address that is used for this scam hasn’t received any money. But as I have always said, scams don’t have to be successful in volume to be successful. Thus don’t help these threat actors to be successful.

Having just returned from vacation, I see that a number of scams have entered my inbox. The one that I will speak about today is a Spotify scam that claims that they can’t bill you for using Spotify:

As usual the quality of the English in this email is suspect. Which should be the first hint that this is a scam. The second sign that this is a scam is this:

This isn’t sent from Spotify as the email domain is “app.mail.com” rather than Spotify.com.

But if you take those two things out of the mix, the look of the email mostly fits the style that Spotify uses in their communications. Thus I can see how someone might fall for it.

Now, if you don’t have a Spotify account, and you get this email, the correct response should be to delete it and move on with your day. And even if you do use Spotify, those two things that I pointed out should make you delete this email anyway. But what do the threat actors want? I’m betting that this is a phishing email to steal your personal information or financial details. So let’s find out if that’s true (which by the way you should never, ever do).

This is a pretty good copy of the Spotify page. There are some errors but I can see if someone isn’t looking closely enough that they could fall for this. And by closely enough, I mean this:

This should be Spotify.com. But it isn’t. Which means that this is a phishing page.

And as I expected, here’s where the threat actors try to steal your credit card details. I typed in a bogus credit card number and it let me get to this page:

This makes you think that it’s doing something. But it’s not. If you’ve typed in your actual credit card details, you’ve been pwned. I believe that this and the next page are just for show to keep you on the hook:

You’re supposed to get a text message via the “Verified By Visa” service that Visa has. And this is where things get interesting. I entered a bogus credit card number earlier in this process which the website identified as being a Visa card. And that would be correct as the number that I entered was a Visa card. But I found it interesting that they didn’t validate that the credit card number was valid up front. I am guessing that they are doing the validation on the back end of this scam by using the “Verified By Visa” service to do that. I assume that they has similar checks for MasterCard, Discover, and AMEX.

Crafty.

So now that we know what the threat actors in this scam are up to, my usual advice applies. If you see this email or one like it, look for the things that I pointed out earlier in this article to confirm that it’s a scam, and then delete the email and move on with your day.

UPDATE: The same threat actor has put out a new version of this email. It looks like this:

They also made one other change to the email. Which is the email address that it was sent from:

Clearly they made that adjustment to make the scam more convincing. The rest of the scam remains the same.

I have come across an iCloud storage scam via a client of mine who called me because she was getting emails from “Apple” claiming that her iCloud storage was running out. When I had a look at the emails, I could tell immediately that they were fake. Here’s why I was able to figure that out so quickly:

First of all, it’s not addressed to the recipient. Instead it’s addressed to “manti70ch”. Second, there’s a strange character in the second sentence. Third, there’s some sort of “limited time”giveaway which Apple would never, ever, do. Finally, at the bottom of the email it says “Apple Distribution International”, which is not an Apple company.

Then there’s this:

This was clearly not sent by Apple as the email domain is not an Apple owned domain.

So, what’s the scam? It’s meant to grab your personal and credit card details. How do I know this? I walked through the website that you go to when you click on any of the hyperlinks:

First you get to enter your details. Which means that the scammers behind this get to use those details to do an identity theft attack. But the threat actor behind this isn’t done yet:

Here’s where they steal your credit card details. And it does some verification to make sure that you enter a valid credit card number. That illustrates that the threat actors have some skill. Which means that this upgrade which requires a $2 “authentication fee” may cost you a whole lot more if you fall for this scam.

By the way, none of this fits the design language of Apple. Another hint that this is a scam.

For the record, you will get a notification on your Apple device if your iCloud storage is running out. For example, this is the one that you will get on your iPhone or iPad:

And this document from Apple can help you to manage your iCloud storage if you need to do so. Thus use that document rather than falling for this scam email.

I haven’t done a scam email examination in a while, so here’s one that is pretty interesting. It’s an email scam which claims that you’ve bought cryptocurrency via PayPal. Here’s an image of the email that delivers the scam:

This scam email actually had decent English. Except for the words “sale receipt”. Then there’s the email ends with the words “United State” which is a total #fail. The other thing that jumps out at me is the phone number and how it is formatted. Though if you’re not looking for these sort of details, and others that I didn’t mention, I can see how someone might fall of this.

The other thing that I will point out is the email address that this scam email was sent from:

This email was clearly not sent from PayPal.

As for what this scam is all about, I can only guess as when I dialled the number, I couldn’t get through. But this has the smell of a refund scam which works like this:

• You get an email in your inbox saying that services that you know that you don’t have are being renewed or you made a purchase, and the money has been debited from your bank account. 
• You then call the phone number provided in the email to dispute this.
• The scammer talks you into getting remote access to your computer where they have you fill out some sort of form to get a refund for this purchase that you never made. 
• The scammer will then have you check your bank account using your bank’s online services to see if you got your refund. But the scammer will use some sleight of hand to make it look like that they massively overpaid you. And then the scammer will blame you for that.
• You will then be bullied into “refunding” the overpayment by buying cryptocurrency or gift cards to send to them electronically. Assuming that they just don’t steal your money straight from your bank account themselves, or have you go to your bank to transfer the money to them, or withdraw it in cash and have you send it to an accomplice via a courier. 

Thus if you get one of these emails, you know what to do. Delete it and move on with your life.