Zeroday 01100100011010010

“The FBI Reports A Break In Every 15 Seconds” Scam

Tuesday, February 25, 2014

“The FBI reports a break-in every 15 seconds” is how each call begins. The recorded message goes on to say “Let us place a small sign in your yard and we will install a new security system for free.” There has been a little coverage on this scam from smaller local news outlets. [1] The scammers always call from different numbers [2] and with an irregular frequency. Almost every post I’ve read about these calls says that they, like me, are on the Do Not Call list. This post is an attempt at catharsis. How much can I find out about this company and what resources will I need?

I’m starting with some basic sleuthing and complaint filing. I phoned my cell phone carrier and reported the numbers. The customer service representative said she’d forward all of the information I provided to their “Scam Department”. I’m not sure if there is such a thing at cell phone providers but I do hope it’s real.

What was different about this phone call was that when I pressed “1” for more information I didn’t get an immediate rep. I was disconnected and received a phone call a few minutes later [2]. I wasted my time with the scammer today just trolling her but next time I’m going to pump her for information. So I tried looking up the second number that called me and the area code matches Colorado Springs, Colorado. I called Sprint and TMobile to see if the number matched one of their customer records. Each customer service agent denied that the numbers belonged to any of their customers and one gave me a clue on what to look for next. “This number belongs to a landline with SMS capabilities.”

When I searched for landline providers in Colorado Springs I found Century Link is the largest provider. I called their residential customer service center and after speaking with a few different agents was told that the number didn’t match a residents number but it doesn’t mean that the person with that number isn’t a customer. It could be that the phone number belongs to a batch of numbers that are part of a small business account. She was nice enough to give me the number of their small business accounts but they were closed for the night.

I’ll keep at this in my spare time because now I’m curious if I can uncover these scammers without the resources used of law enforcement or the government. My guess is they are using a call center’s ability to mask ANI so each of the numbers in the second footnote are fake however the number that called me back today seems real enough. My guess is this person is a sales rep working for the scammer and if anyone presses “1” during the initial robocall they get a notification and call back.

[1] http://wtkr.com/2013/02/28/woman-says-sc…

[2] 719-355-6263

Filed in fraud | Comments (0) | Permalink

Modern Internet Fraud

Saturday, December 6, 2008

I once heard a story about a scheme to defraud people out of money. The scheme worked on the principle of embarassment and went something like this.

“Start a company with an innocuous name which places ads for something no one wants to be known for buying. When an order comes in reply that you are out of stock. When the customer demands their money back issue a check from a different company with a really embarrassing name printed in bold. The customer will never cash the check because they don’t want people at the bank knowing they tried to order from such an embarrassing company.”

I’ve toned down the retelling but you get the idea. While investigating some other leads today I came upon a newer version of this scam which adds the element of fear via destroyed credit rating. It is an interesting twist to this old theme.

People who are searching for popular downloads online will end up with search results from various torrent trackers. Somehow, likely through SEO manipulation, sites such as DownloadNova dot com are returned as valid search results. When a user clicks on the link they will be presented with a series of servers to download from. All of the links will say that you need to provide an email address to join the site. Once a user has submitted an email then the site will direct them to pay some nominal fee for full membership. According to various reports [1,2,3,4,5] the range is somewhere between $3-$5. Buried in the fine print are details of the actual membership.

It now said that I had activated three day trial memberships to three sites. One called ‘MegaDownloadPass dot com’ another called ‘Vipbookmark dot com’ and one called ‘DiscountVideoPass.’

[source]

Other versions of this scam exist like baydownloads dot com. According to the same source once your trial membership expires you graduate to full membership for all three sites and billed for $30 per month. Most of the reports I read showed people who cancelled their memberships by using the chargeback mechanism of their credit card company. This is the obvious way to go. Here is where it gets interesting though. I researched the phone number listed for support:
1-800-934-1875
I called this number posing as a web site owner who was looking to add support to my own websites. The support rep informed me that they had about 100 people working there and that they handled multiple websites. After a while he decided that he couldn’t answer my questions and should get the manager on the line. While I patiently waited he explained the situation to his superior. As it turns out the manager wasn’t willing to talk with me and instead directed me to email the company with any questions I might have. This was good enough for me as it gave me a central website to work from. The website findsupportonline dot com has this dire warning on its front page

A billing chargeback will place your name, address, zip code, and credit card number into an Internet fraud database. ALL INTERNET CREDIT CARD COMPANIES USE THIS DATABASE. We DO NOT have any control over this fraud database.

If you chargeback your membership, the billing company WILL add your information to the ban database. If you get into this database you will not be able to use that billing company again. It is impossible to get off the ban lists.

BE SMART! DON’T DESTROY YOUR INTERNET CREDIT BY BEING ADDED TO THIS LIST AND INVESTIGATED FOR FRAUD!

I doubt the veracity of this last statement. It is amusing to see this twist though. Get the user to pay a nominal fee and then spring new fees justified by fine print. Then assault them with a warning that their online credit will be ruined before they can even think about using the appropriate mechanism to stop the fraud. I really have to wonder how well this company is doing.

The support rep was not very talkative when he came back from his manager. Maybe it was because I called from a payphone. Maybe it was the questions I was asking. He did admit to servicing Megadownloadpass dot com but claimed they “stopped supporting them … two or three days ago”.

I also doubt the veracity of this statement however I don’t think the two companies are related at all. findsupportonline’s whois information points to an address in New York. Unfortunately novadownload hides their true registry information but megadownload and vipbookmark uses a false Delaware address in their whois registration. The email address in the registrations list marketingx dot com which has an address in Cyprus. This listing has an email address for prolastlimited dot com which points to the same address as does customersupporthelp dot com. So the update to this age old scam is to entice the user with warez downloads and then bill them for pornography. Then make sure that the support representatives are trained to intimidate anyone who tries to cancel their membership.

Zeroday 01100100011010010

follow me on Twitter @zeroday

“The FBI Reports A Break In Every 15 Seconds” Scam

Tuesday, February 25, 2014

Filed in fraud | Comments (0) | Permalink

Modern Internet Fraud

Saturday, December 6, 2008

Filed in fraud | Comments (0) | Permalink

Recent Posts

Archives