fraud – Terence Eden’s Blog

Who can tell you what to do with your money?

@edent — Sun, 19 Mar 2023 12:34:15 +0000

There's an incredibly distressing story in the BBC about a vulnerable elderly man who was conned out of his life savings.

Fraud victim gets surprise £153,000 refund despite rules BBC News

In the story, the heartless bank refused to refund the fraud victim due to an absurd technicality - the money was sent to a foreign account rather than a UK account. Once again, big business bending the rules in order to protect their profits from a defenceless pensioner. Only after protests did they reimburse him. What a disgrace!

Except, of course, that's not what happened.

Let's scoot down the article, past the sensationalism, and see what we find:

It emerged that, in this case, Lloyds had done a really good job of not only spotting the potential fraud but alerting James to it. The bank blocked a number of transactions, it spoke to James on the phone to warn him and even called him into a branch to speak to him face-to-face.

Ah.

The bank kept his money as safe as possible but, ultimately, it was his money. He can choose to do whatever he wants with it. If he'd decided to blow his life savings on fast cars and loose women should he have been stopped?

Ultimately, this man was scammed, and the fault lies with the crooks who swindled him. But, realistically, what more could the bank have done to protect him? I suppose they could have dropped him as a customer. If they'd said he was too risky for them and told him to find a new bank, we'd see headlines of "Fury as cold-hearted bank tells pensioner to piss off".

I'm sure we've all had a friend who has driven themselves into drink, drugs, or gambling. You can intervene. You can counsel them. You can beg, plead, and threaten. But people are entitled to make their own choices in life. And sometimes they make bad choices which end up hurting them.

Perhaps this victim's family should have been more proactive in setting up a Power of Attorney. Perhaps the media consumed by older people should be flooded with scam warnings. Perhaps the victim should have heeded the bank's repeated warnings. Perhaps scammers should reconsider their life choices. Perhaps the bank should have forced him to take his business elsewhere.

Do we want banks to safeguard or money, or to gatekeep it?

This is a sad story with no happy ending and no easy answers.

Why do scammers love NameCheap?

@edent — Wed, 19 May 2021 11:33:19 +0000

The UK is facing an epidemic of SMS fraud. Scammers know that we're all at home eagerly waiting for deliveries. So they send out phishing messages saying "Sorry we missed you" or "You need to pay a delivery fee". If you click on the link they send, you'll go to a very convincing website which looks identical to the courier's page.

Whereupon the fraudsters will ask for your bank details, credit card number, mother's maiden name, and inside leg measurement.

There are many complex reasons why this fraud proliferates. But one thing underpins these scams - a domain name and hosting. Over the last few months, the vast majority of the fraud I've seen has come from domains registered by NameCheap.

OK, but that's anecdotal evidence. Is there anything more robust?

My friends in the UK's National Cyber Security Centre have released a report looking at phishing - amongst other things. Here's what they have to say about NameCheap:

Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020.By December 2020 we found that it hosted in excess of 60% of phishing in this category.

NameCheap appear to be the preferred supplier of domains and hosting to the criminal community.

OK, they can't easily control who registers domains. But I'm sure that they take reports of abuse seriously. Right?

Looking specifically at the number of campaigns hosted by NameCheap against its monthly median attack availability, we see that by mid-year the median takedown times were consistently in excess of 60 hours. This undoubtedly made NameCheap an attractive proposition to host phishing and may explain the rise in monthly hosted campaigns that followed for UK government-themed phishing.

Oh...

The problem is, these domains are designed to be "hit-and-run". The spammer sends as many phishing messages as possible, in as short a time as possible. They're expecting the domain to be taken down. Every minute counts.

The CEO of NameCheap is, unsurprisingly, defensive of his company's handling of the situation.

What can be done?

There are some proposals to restrict access to new domains - but I don't think that's effective. A spammer can register a domain, wait a month, then blast it out.

NameCheap could make it harder for people to register domains with them. They accept anonymous registration using crypto-currency. I want to live in a world where people can anonymously register web services - but I also don't want to be bombarded with spam.

Given that NameCheap want anonymous customers, and given the prices for hosting are cheap, perhaps they should be taking "good behaviour" deposits from anonymous customers? Take, say, a hundred pounds and refund it only if the account isn't suspended.

Perhaps Nominet could insist that its members take swifter action against spammers - and then remove the ability to resell domains for those that don't?

Maybe NameCheap should increase its prices so that it can afford to pay for the abuse staff that it so desperately needs?

There are no easy answers here. But NameCheap are obviously doing something to attract - and profit from - scammers. What can be done to make them take more responsibility?

Questions to ask before launching a crypto-payments feature

@edent — Thu, 08 Apr 2021 11:23:39 +0000

Messaging app Signal is launching a payment service in the UK. This will allow users to send each other ~~money~~ cryptocurrency. Many people have written about why this is a daft idea. But they've mostly talked about why cryptocoins corrupt everything they touch. I want to talk about why this is a shitty idea from a product perspective.

It all comes down to user needs. What pain point are you removing? Uber made taxis mildly less irritating, for example. But the UK already has a fairly mature mobile money market, so what does Signal add? Here are a few obvious questions I asked them:

The UK already has faster payments in all major banks. I can send and receive money instantly from app or Web. Will Signal be as fast as that?
The UK has a problem with authorised push payment fraud. Banks can recover funds which have been sent as a result of phishing / fraud. How can someone reverse a payment on Signal if it was fraudulent?
The UK also has receiver verification. If I try to send to an account and it doesn't match the name I'm sending to, my bank will warn me. How does Signal stop impersonation?
There's no cost to sending payments on most mainstream banks. How much does Signal charge?
Most banks let the user block receiving payments from specific accounts. Can Signal stop harassers sending unwanted money?

Those were the questions I immediately thought of with my "product" hat on. I'm sure you can think of more.

The responses were... not well thought through. I'll respond to each one.

A: MobileCoin is as fast (or faster in some cases) than a bank payment in the UK with greater privacy. As far as settling back to Fiat, if that's what you're asking about, the velocity of that depends on on-ramp and off-ramp integrations which will come over time (but it looks like there's no reason MobileCoin can't help developers deliver payments at the same speed as banks).

I've yet to see a settled crypto transaction which is as fast as a UK bank transfer. We'll come back to "privacy" later. In terms of getting real money out of the system, the answer seems to be "variable" - which doesn't sound like a great customer experience.

Payments on MobileCoin cannot be reversed at the protocol level. If you want escrow and reversibility, you should use a wallet or payment service that supports those primitives. We believe that developers will build such services on top of the foundation of the MobileCoin protocol.

So, no. If you get scammed, tough. Neither a bank, nor a regulator, nor a court can reverse a dodgy transaction. Where's the user need for that?

Signal relies on phone numbers for identities. Other apps that integrate MobileCoin may have a higher threshold for identification.

So, again, if someone pretends to be your mate and cons you out of money, there's no independent verification. I bet users just love sending money and not knowing who it is going to.

Fees are set by the foundation (which has a stated goal of keeping transaction fees to around $.04 when the network isn't congested). Currently fees are higher as they need to be adjusted by a foundation vote.

That's pretty high! People in the UK literally use their banking apps to message each other - sending penny payments to get someone's attention. What is the user getting for this proposed transaction fee?

Signal doesn't allow people you haven't keypaired with to send you funds. If you have accepted a message request from someone, they can send you money.

If you can't block people - even after accepting them - that's a vector for harassment, or worse. Your psycho-ex can bombard you with micropayments. Your dodgy mate can offload his illegitimate gains into your account. It sounds like a nightmare.

So, I ask again, what is the use-case for this feature? It isn't faster, it costs more, it is in a volatile cryptocurrency, it has no fraud protection, and it facilitates abuse.

The one thing it has going for it is that it is "anonymous".

Except, of course, it isn't anonymous in any real sense. You need the user's phone number - which means law enforcement can track their activity. While the ledger may be anonymous, if you send a unique amount of money, and it gets received instantly, it's going to be pretty easy to work out who is at either end of the transaction.

Perhaps there is a huge untapped desire to send expensive pseudonymous payments. Perhaps people want to pay for stuff using a speculative instrument. Perhaps everything I thought I knew about people is wrong.

Or, perhaps this is another pump-and-dump cryptoscam?

I wonder who was "investing" in those coins before the big announcement? Nothing to see here...

More Phishers On Twitter

@edent — Fri, 21 Aug 2020 11:08:35 +0000

My mate Dom was moaning to his ISP on Twitter. They sent him a private message so they could look into his account.

Blimey! Thankfully, that was a pretty brazen and inept attempt at phishing. Anyone asking for all your card details like that should set the alarm bells ringing. Of course, phishers often target credulous people who don't understand that they're being scammed.

By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor. Cormac Herley - Microsoft Research

Investigating the account might not have given much of a clue about its dodgy nature.

Superficially, it looks identical to the official account. It even has a verified badge on its Tweets. How? Because all it does is retweet the official account it is spoofing!

Looking closer you should be able to spot that it is a fairly new account with zero followers. Oh, and the name is "Virgimendia"! The kerning of fonts on a small screen is likely to confuse lots of users.

They were quite clever in targetting people who had mentioned the official account. This is similar to a Twitter phishing attack I blogged about 5 years ago.

I tried my luck at baiting the scammer - to no avail!

Their use of language suggests they're a British English speaker. At least, I assume they're not thinking of me in cryptographic terms!

A bunch of us reported the account, and by the next morning it was gone.

The disturbing thing about this, is that the scammers had been operating for at least a week. Virgin Media had been alerted, but seemingly didn't take any action.

(Content Warning: The following Tweets contain racist language and encouraging suicide.)

https://twitter.com/julsbvby/status/1294702901835726854

Could automated tooling have stopped this? To a human it looks pretty obvious that this is a scam. But what heuristics would you use to train a model designed to stop this? And how many false positives would it detect?

Stay safe out there.

Support Dom in his quest to run 26 half-marathons in 26 silly costumes in aid of a children's hospice.

Scam calls threatening a lawsuit from HMRC

@edent — Mon, 16 Jul 2018 06:29:29 +0000

Another day, another scam caller.

Would you fall for this fraud?

🔊

💾 Download this audio file.

You'd probably realise that this was a (crap) text-to-voice system and that the tax authorities are more likely to send a letter than a phone call.

But not everyone is so switched-on. If you've not had many dealings with HMRC, would you know how they contact people? If you're on a noisy train and all you hear is "final warning.... legal action..."

You can learn how to stay safe online and report scams at https://www.gov.uk/topic/dealing-with-hmrc/phishing-scams

Protecting Against Credit Card Scams

@edent — Mon, 09 Jul 2012 12:26:24 +0000

I recently read about an innovative telephone call scam.

A scammer rings the mark and asks for her credit card details. If the mark refuses, the scammer tells her to hang up the phone, then dial 999 and ask for "Sergeant Scammer of the Fraud Squad".

The mark does so, and is connected to what they assume is the emergency services. However, because the scammer hasn't hung up at their end, the call is still active. So the mark isn't speaking to 999, but to the scammer.

Pretty devious. Luckily, it can't work on mobile. But it got me thinking - how could you get someone to give you credit card details over the phone? I'm inspired by both Bruce Schneier's "Movie Plot Threat" competitions and Kevin Mitnick's work on Social Engineering.

Trying to think like "the enemy" is a crucial part of understanding how nefarious people can exploit a situation. I think it should be considered the seventh "thinking hat".

The Goal

I want the victim to willingly give me her credit card details. I do not want her to be suspicious or report my activity to the police.

The Strategy

The victim receives a text on her phone.
"Your Barclay's credit card (starting 4304) was recently used to buy £2,103.54 worth of goods in China. If you wish to dispute this transaction, please call 0113 496 0123."
The victim checks her BarclayCard - it does start 4304. Damn! She rings the number.
"Welcome to the BarclayCard fraud line," says the voice at the other end.
"To protect your security, please type in your sixteen digit card number," says the automated voice. So that's what the victim does.
... after typing in several more details, the victim finally gets through to the scammer.
At this point, the scammer can attempt to get more information - such as home address - or simply assure the victim that the fraud has been reported.
"Unfortunately," the fraudster says, "the £2,103.54 will show up on your July statement. But you will see the refund on the August statement."

How It Works

There are a number of factors which go into making this a potentially successful scam.

People are quite used to receiving texts from their card issuer.
It's quite common to be asked to confirm a suspicious transaction.
Credit cards number have a predictable start sequence. That's why credit card receipts often show you only the last few digits. This tricks the victim into thinking that the scammer knowa two crucial pieces of information; the credit card issuer and the credit card number.
We're trained not to give details to strangers who ring us up. By contrast, we're expected to give details to people when we ring them!
You can't argue or otherwise interrogate an IVR. You either have to give that disembodied voice your details or hang up.
Again, we're quite used to typing in our credit card details and then pressing the hash key!
If we do get through to a real person, the standard Social Engineering tricks all apply. Only, in this case, not only is the victim worried about the potential fraud, she has also primed herself into thinking she's speaking with her credit card provider.
At this point, the scammer knows that they can use the card for a fraudulent purchase and the victim won't report it! It will only be after two statements have been received that the victim will notice that she hasn't been refunded.

Problems

Now, this fraud isn't without issue. The most notable being that you do not know who has a credit card issued by a specific provider. The scammer would either need some third party intelligence that their victims all use HSBC, or they could just go on a phishing expedition. Spam a few thousand numbers and there will bound to be a few which have the card which is being targeted.

How To Do It

Using services like Twilio and Tropo, it's quite easy to create a telephone menu. It can play back a recorded voice, save all the user's keypresses, then pass the call on to the scammer.

They can even handle the automated sending of the text messages, playing back different messages depending on the caller - "Welcome to HSBC", "Welcome to American Express", etc.

Defending Against This Scam

There are three main strategies for defending against this scam - and they all boil down to trust

Don't Trust An Unknown Phone Number

Save your credit card provider's phone number in your address book. That is the only number you should ring. If someone rings you - tell them that you will take their name and call them back on the official number. If you receive a text - call the official number to check it is legitimate.

Don't Trust Partial Information

The first few numbers of your credit card are fairly generic. Trusting someone who guesses your Visa Electron starts with "4197" is like trusting a psychic who says "You were a bit of a handful growing up, especially in your teens." It's such general information as to be worthless.

Don't Trust The Other Person

I sometimes act deviously. When asked to give my address, I'll give an incorrect house number or post code. If the person at the other end doesn't pick up on the mistake, I assume I'm talking to a scammer. Similarly, you don't have to trust interactive menus. You can input incorrect information, and see if it is accepted without complaint - a sure sign of a scam. Or see if it gets you through to a human.

Is This Scam Possible?

One hurdle is targeting enough people who have the "correct" credit card. The scam would work without the credit card info, but may be less effective.

The cost of sending out the texts is also a constraint. Although text bundles are relatively cheap now.

Shutting down the numbers - or tracing them - is perhaps the biggest issue. Buying a disposable pre-pay SIM is virtually anonymous. A landline number is probably fairly easy to trace - assuming the police have the time and staffing levels to investigate such a scam.

And that may be the deciding issue. If someone reports a suspicious text to the police or their credit card provider, how quickly can the number be shut down? If the scammer is sending out hundreds of fraudulent SMS an hour, it would only take a few responses to make the scheme worthwhile.

Disclaimer

Naturally, you should not attempt this. The penalties for credit card fraud a very serious. This is intended as a thought experiment.

If you want people to willingly give up their credit card information - take a look at the morons on Twitter posting photos of their cards!