Hoaxes & Scams

As we mentioned in our Computer Security and Web scams reports, there are always "con artist" scams to be wary of. Here are some notable scams.

2003:
Jan. 4: Canadian, Web page designer named in Net fraud
A 40-year-old Web designer now languishing in a Sacramento jail with his Canadian employer says he is a "dupe" as the pair face a 24-count  indictment in what authorities are calling one of the largest online investment fraud schemes ever. Fake testimonials and a professional-looking web site helped bilk investors out of $60 million dollars over two years. The scam, say prosecutors, was essentially a giant Ponzi scheme, which promised 120 percent annual returns on the principal investment, plus huge referral fees amounting to 15 percent of investments those referrals generated.

The pair were arrested in Costa Rica, where funds from the scheme, reports the Mercury News, paid for a $2.3 million Costa Rica compound known as Rancho Marquis and a $1.5 million Bell helicopter, housed on the property's helipad. Other purchases included several more properties in Costa Rica and Mexico, a 50-foot yacht valued at $630,000, more than a dozen late-model vehicles including Toyota Land Cruisers and Lincoln Navigators, and millions of dollars in bank accounts in three countries. Read more....

2002:
Dec. 18: Newest Scam: Fake Escrow Accounts
MImeKillEr writes on Slashdot: “MSNBC is running an article warning about the latest auction site scam: Fake escrow accounts. The article claims scam artists are tricking Net users into wiring thousands of dollars to fraudulent bank accounts. The criminals do this by setting up a trap auction and when the winner asks how to make a payment, the criminal tells them to pay into an escrow account. One legit escrow account who had a criminal mimic their site said that as many as 50 users had lost and average of $10,000 with at least one being conned out of $30,000 in such a way. There are reportedly at least 150 fake escrow accounts. The FBI is currently investigating the matter.”  Read more....

Sos4auctions.com has technical details about the scam.
Here's another article on the topic.
Premier-Escrow.com is the company alleged to be running the scam.

In a related story, an apparent escrow scam site known as golden-escrow.co.uk has apparently gone so far as to register a domain name similar to that of Golden Escrow Inc., a legitimate escrow company, and used the legit company's address in its domain registration record. It's only when you visit the real company's website, that you discover that they are proactively warning people about the scammers. Yeesh.

Dec. 17: The BBC notes the latest in a rash of EBay Sucker Sites, conning users out of account info, passwords and more....

Dec. 16: Wired reports an elaborate scam, dubbed "Nigerian Net Scam, Version 3.0." It takes advantage of a little-known loophole in the U.S. banking system. Many people don't realize that when a bank says funds have cleared, it doesn't mean the cheque is good. PC Buyer's Guide has confirmed that this loophole also applies to Canadian banks. A representative from Royal Bank claims that the only way to be assured that the funds are available are to take the cheque to the issuing bank listed on the cheque. If this is not practical (as, for example, it would not be if the issuing bank is in another province or country), the bank-recommended workaround is to have the money wired to you. Says Wired: "the bottom line is this: No legitimate company will offer to pay you by arranging to send you a check and asking you to wire some of the money back. If that's the pitch, it's a scam."

May 30: Readers offer tips, experiences and notes about online fraud in the latest report at macintouch.com

May 29: The FTC has a great page on Avoiding Office Supply Scams, detailing variations on the scam, your rights, and possible remedies.

2001
Aug. 23: The Get Rich Quick Scam is a time-tested lure for the gullible. One such pitch goes something like this (names and places may change):

July 22, 2001: Canada warns of domain registration scam, notes ComputerUser.

In April, 1999, a series of scams began showing up in the e-mailboxes of some America Online users. Apparently, the ploy was designed to steal AOL user passwords and credit card info. One such bogus solicitation purported to "store" your password for "faster surfing," while another reportedly said the user's VISA password was invalid and asked for private account information to be forwarded to correct it. Surfers beware.

In Aug. 2000, The FTC filed a suit against Playgirl.com, Highsociety.com and dozens of other adult content Web sites after discovering that online porn purveyors asked for credit card numbers, allegedly to confirm that consumers are 18 or over, then billed the cards -- under obscure names like "Hoot Owl, Inc." or "Knock Knee, Inc." -- for services that were supposed to be free. A CNET story quotes a director of the Federal Trade Commission as noting, "It says specifically on that screen your card will not be billed, but if you click through their tour they deem you a member and bill you anyway." The suit also claims that the smut sites rarely provided telephone numbers that consumers could call to question the charges. When a company listed numbers, the line would typically be busy or no one would answer.

Other net scams abound. For example, you may receive "SPAM" (junk email) that says "To immediately be removed from future mailings please call 1-473-408-xxxx (This is a remove line only!)" This number is in the Caribbean island of Grenada, and you'll be liable for a hefty charge. Other ploys involve 1-800, 888 or 877 numbers, or calls to areas outside the U.S. that have "kickback exchanges."

From the SPAMFAQ:

Be very careful when dialing a 1-800 or any "toll free" number you are not familiar with. It may end up being a very expensive mistake. Remember to dial these numbers from a phone booth so that your home phone will never be charged. Another reason to call from a pay phone is so that the spammer cannot get your home phone number. Even if you are "Unlisted" when you call a toll free number the spammer gets your phone number.

All 1-800, 888 or 877 numbers are *not* free. You may be charged for the phone call. You can tell if the number charges by calling from a phone booth. If you cannot get through then it charges. See below.

Likewise, numbers that may "look" like they are United States long distance phone numbers may in fact be out of country and may cost you $25 or more for a couple of minutes call. These calls are not refundable. A scam artist trying to get money from the phone calls (he gets a skim off the top) was dialing random beepers with an out of country number.

Some area codes to look for (some may not be active for another year or two):

(Also see http://www.nanpa.com/number_resource_info/assignments.html )

242 Bahamas

246 Barbados

264 Anguilla

268 Antigua

284 British Virgin Islands

340 U.S. Virgin Islands

345 Cayman Islands

441 Bermuda

473 Grenada

649 Turks and Caicos

664 Monserrat

670 CNMI (Commonwealth of the Northern Mariana Islands?)

671 Guam

758 St. Lucia

767 Dominica

784 St. Vincent and Grenadines

787 Puerto Rico

809 Dominican Republic (see below)

868 Trinidad and Tobago

869 St. Kitts and Nevis

876 Jamaica

Terrance Berscheid of Compututor (250-479-3165) adds:

I was sent a warning about the 809 area code and as is my custom, I contacted Telus Corporate Security (for those of you who are not in the Telus Phone System area, it is the phone company for BC and Alberta, Canada) to verify the e-mail claims.

Deb at Corporate Security advises that the actual country to which 809 refers is the Dominican Republic, not the British Virgin Islands. This scam and resulting e-mails have been circulating for about 3 years. The initial portions of the message below are correct in that a voice mail (advising that a family emergency, “You have won…” or a serious accident has occurred) urgently requests the recipient call an 809 number. Yes, you will be charged long distance charges for the call. Typically, the party at the other end will attempt to keep you on the line as long as possible.

But, Telus phone subscribers will not be charged those high rates referred to in the message below. The reason is that Telus is governed by tariff schedules, and a call from Edmonton AB to that exchange would be $1.59 per minute.  The costs referred to below might occur on other telephone company exchanges, but not on Telus exchanges. To find out about your telephone company polices, contact their corporate security department.

As to how many complaints Telus has received: a handful of enquiries (such as mine) about the e-mail; only one or two complaints by someone who has actually dialed the number.

Best Advice: If you receive a similar voice message, and want to check to make sure it is legitimate CALL COLLECT! If it is legitimate, surely someone will accept the charges; but if not…  

This is some additional background information on the topic of scans and scams, which might be useful:

• The topic of Area code 809-type continues to be topical. Russ Francis, in Monday Magazine, quotes a Telus toll fraud analyst Lesley Cooks as calling this one of the “urban legends”. Francis editorializes:  “Meanwhile, the urban legend has done wonders to boost useless e-mail traffic. Just what the internet needed.” Huh? It comes as a surprise to me that the ‘net’ needs a boost!
• Every week I encounter 50+/seniors who are concerned that they will be ‘scammed’ or ‘spammed’.  I try to assure them that the likelihood of their being hurt by such attempts is remote, provided they practice “safe surfing”. The appropriate vaccine is being aware of what scams and spams are, and exercising precautions.
• I’m not convinced the (original) Area Code 809 message isn’t a ‘spam email’ As we know, a spam is an email sent out to many persons indiscriminately.  The difference here is that the original was sent to me by a colleague with a cautionary note that it may not be true, or was it?
  • I sent it out to my clients with added information obtained from Telus.
  • In ‘forwarding’ the original cautionary warning, I attempted to focus on what information was factual, and what was erroneous.
  • I also stripped the original of all previous recipient addresses;
  • I ensured that, with the exception of the recipient’s email address, all other email addresses to which I sent the corrected message were hidden. This is possible with BCC
  • Sometimes these e-mail ‘spams’ are eventually routed back to the sender. If the addresses of everyone to whom the message was sent are included in that ‘final’ message, the original sender suddenly has a huge database of email addresses. This outcome can be avoided: use BCC.
• Telus’ advice is what is most relevant here: "If in doubt when receiving such a voicemail, call collect."

Avoiding Infection from a Nasty Website

• Internet versions of the same scams, exist; as you note, “dot scam” websites in addition to the aforementioned email spams.
  • The appropriate action to avoid damage when you arrive at a website you suspect is a scam is to close your browser immediately
  • If on a dial-up connection, hang-up immediately. The possibility of someone accessing your computer in ways you do not wish are eliminated by disconnection. You can safely reconnect to your ISP, as the original connection to that webpage has been severed.
  • If on a continuous “DSL” or Cable connection, you should have previously installed a firewall; If you haven’t yet, now is the time to do so. One website offering a free firewall is www.zonealarm.com

Blind Carbon Copy (BCC)

• The best way of avoiding sending out a ‘spam’ is to use the BCC feature available in both Outlook and Outlook Express. BCC stands for Blind Carbon Copy. When several email addresses are added to a BCC, each recipient receives a copy of the email, but the recipient’s own email address is the only one shown is her/his copy; i.e. it appears to the recipient that the email was only sent to that address.
• Many Express users don’t know that BCC an available feature. To turn on the feature.

1. Open Outlook Express
2. Select New Mail from the toolbar at the top; a mail composition form will open in a separate window (you must be in the mail composition form; the instructions below will not work while in your ‘inbox’)
3. Select view from the Menu Bar at the top of the composition form
4. If there is no ‘checkmark’ next to all headers, click on that button to place a checkmark next to the words “all headers”.
5. BCC will now be below the “To” and “CC” fields in the message composition form, and will remain available until the checkmark next to “all headers” is removed.

One website that has information on similar scams (be aware that some of the information on that site is not necessarily accurate) is: www.scambusters.com

In Canada, the RCMP has published a number of bulletins on various frauds, Internet-based crimes and other scams.

http://www.rcmp-grc.gc.ca/html/commerc.htm
A separate Bulletin page deals specifically with Technological Crime. Another deals with Computer and Telecommunications Crime.

Here are some links to other good sources of information.

• Get that spammer! - A tool for tracking down junk e-mailers, junk news posters and their internet service providers.
• Psycho - Web Psychos, Stalkers, and Pranksters: How to Protect Yourself in Cyberspace
• Hoaxes & Scams - This info is intended to help prevent your losses.
• Better Business Bureau
• Internet Fraud - This page contains Internet Fraud Information and related links.
• Internet Hoaxes
• Net Scams - Introduction to Net Scams and Hoaxes v1.0
• Scambusters - "The Premier Publication On Internet Fraud"
• Scams - SCAMS: On the Net (700)
• Antispam - MegaDog's Anti-Spam Zone
• Macintouch - Spam, Scams and Relevant Resources
• Credit card fraud is widespread, says John Faughnan, who shows how credit card numbers are harvested and sold.

For Further Reading:

• The Register: Web porn credit card scam "biggest ever."
• See also: Web scams
• PCWorld.com: Beware of “Dot Cons!” [Nov. 18, 2000]

---

Spammers Beware
Canadian Internet service provider I.D. Internet Direct Ltd. has won a court injunction against a spammer who was using its systems to send junk email.

In what it calls the first successful lawsuit of its kind in Canada, Internet Direct on April 5th announced that the court has ruled in its favour in its recent application for an injunction against junk emailer Cory Altelaar. The ruling grants an injunction preventing Altelaar from delivering junk email through its systems and awards the ISP a reimbursement of its legal costs.

In a prepared statement, John Nemanic, President of Internet Direct said the ground-breaking ruling sends junk emailers a serious message: this activity is not legally acceptable in Canada. You can try to hide, said Nemanic, but you will be caught and risk prosecution if you abuse the Internet.