Some of the voices are reasonable facsimiles of human voices (like the above) and some are just garbage.

The voice clip plays and the call immediately terminates.

What I can't understand is how this can possibly be effective from the scammers' point of view. On receiving the call the victim must…

1. Decided to answer from an unknown number.
2. Listen to the message and decide it is legitimate.
3. Go the their phone's dialler app.
4. Copy the caller's phone number.
5. Open WhatsApp.
   • Install WhatsApp if they don't have it already
6. Create a new contact - giving a name - and pasting the number.
7. Engage with the contact.

That's a lot of effort based on… what? A vague offer? There's a little bit of a curiosity gap but not much. It's hardly "add me on WhatsApp or we'll release the photos we have of you" or "you've won the lottery, add me on WhatsApp to get the funds", or "This is the CEO of your company, urgently add me…".

I guess that if a spammer is able to send out thousands of these messages then they might be able to attract a couple of people to engage with them. There's no easy way to report a spam account to WhatsApp unless you've engaged with it.

I also assume that WhatsApp will see that you were the person who initiated WhatsApp contact - which makes them less likely to think the scammer is the problem.

I am just fascinated to see if this scam can possibly be effective. Generating fake voices is free, as is placing short calls. WhatsApp accounts are also free and easy to automate. But are there really that many people willing to go to the effort of adding a new contact based on so little information?

Obviously, all spam is a numbers game. If the message reaches someone receptive to a robocall, they're less likely to query the scam. And, yes, I know that you're a very clever boy and don't answer unknown numbers - but in the real world people get calls from hospitals, recruiters, and friends with new numbers.

If you're a spammer and have found this approach effective - please leave a comment!

Update! July 2025. A new variant. Same basic message, but a much more natural sounding voice. I wonder if they're using real people now?

"Yeah, right!" You think. Obvious scam, isn't it? You tell the caller to do unmentionable things to a goat. They sigh.

"I can assure you I'm calling from Chase bank. I understand you're sceptical. I'll send a push notification through the app so you can see this is a genuine call."

Your phone buzzes. You tap the notification and this pops up on screen:

This is obviously a genuine caller! This is a genuine pop-up, from the genuine app, which is protected by your genuine fingerprint. You tap the "Yes" button.

Why wouldn't you? The caller knows your name and bank and they have sent you an in-app notification. Surely that can only be done by the bank. Right?

Right!

This is a genuine notification. It was sent by the bank.

You proceed to do as the fraud department asks. You give them more details. You move your money into a safe account. You're told you'll hear from them in the morning.

Congratulations. You just got played. Scammers have stolen your life savings.

How the scam works

This is reasonably sophisticated, and it is easy to see why people fall for it.

1. The scammer calls you up. They keep you on the phone while...
2. The scammer's accomplice calls your bank. They pretend to be you. So...
3. The bank sends you an in-app alert.
4. You confirm the alert.
5. The scammer on the phone to your bank now has control of your account.

Look closer at what that pop is actually asking you to confirm.

We need to check it is you on the phone to us.

It isn't saying "This is us calling you - it is quite the opposite!

This pop-up is a security disaster. It should say something like:

Did you call us?

If someone has called you claiming to be from us hang up now

Yes, I am calling Chase - No, someone called me

I dare say most people would fall for this. Oh, not you! You're far too clever and sceptical. You'd hang up and call the number on your card. You'd spend a terrifying 30 minute wait on hold to the fraud department, while hoping fraudsters haven't already drained your account.

But even if you were constantly packet sniffing the Internet connection on your phone, you'd see that this was a genuine pop-up from your genuine app. Would that bypass your defences? I reckon so.

Criminals are getting increasingly good at this. Banks are letting down customers by having vaguely worded security pop-up which they know their customers don't read properly.

And, yes, customers can sometimes be a little gullible. But it is hard to be constantly on the defensive.

Further reading

You can read the original story from the victim on Reddit. See more comments on Mastodon.

But, before you can access it, you need to log in. So the website redirects you to:

https://example.com/login?on_success=/page/1234

If you get the password right, you go to the original page you requested. Nice!

But what happens if someone manipulates that query string? Suppose an adversary sends you a link like this:

https://example.com/login?on_success=https://evil.com

A sensible redirection system should say "Hang on a minute! Only internal redirections are allowed. I'd better stop this tomfoolery."

Sadly, that's not always the case. Take, for example, arXiv.org - a website for academics and researchers to share papers.

I discovered that a URl like this - https://arxiv.org/login?next_page=https://example.com/ - would redirect a logged in user to any external site.

A malicious user could redirect users to a phishing page https://arxiv.org/login?next_page=http://arxiv-login-info.xyz/ - and steal their credentials. Or send them to a site with malware etc.

The fix is pretty simple. Any redirection logic should ensure that users can only be redirected to an internal page not an external site.

Timeline

• 2023-04-18 - discovered. Opened a bug on GitHub asking for a way to privately disclose. Shortly afterwards, I received an email address and sent my findings.
• 2023-04-19 - Sent a screencast showing the open redirect. Issue confirmed by the developer.
• 2023-04-24 - a fix was proposed which solved some of the issues but not all of them.
• 2023-05-02 - final fix pushed
• 2023-05-19 - this post automatically published.

Let's take a look at all the ways we can tell it is a scam.

Firstly, and most obviously, I am not a customer of Lloyds Bank! But these scammers send out to multiple people hoping to catch victims.

Secondly, I've not made a complaint to Lloyds! But, again, scammers know that plenty of people have. So this adds a touch of authenticity. If you were a Lloyds customer who had recently complained - you're now primed to accept the scammer's call and treat it as legitimate.

Thirdly, that phone number. If you call it, a recorded voice says "Welcome to customer services..." Whose customer services? It doesn't say "Welcome to Lloyds". This is likely a number that scammers put on texts claiming to be from HSBC, Lloyds, NatWest. Cheaper for them to have a single phone number.

Fourthly, the reference number. It is just my phone number! That's an unusual reference number for a bank.

There's some weird spacing between "Mr" and "Eden" - not what I'd expect from a professional message.

What do you think of the SMS? Would you flag it as spam? I asked my Twitter followers and their responses were unanimous.

Terence Eden is on Mastodon

@edent

I received this unsolicited SMS earlier today.
I don't bank with Lloyds.
What do you think of it? (Poll in next tweet.) pic.x.com/yh4OrBwfM6

---

Terence Eden is on Mastodon

@edent

Do you think that SMS from Lloyds is…
📊

---

⚠ Definitely a scam: (195)
195
😕 Probably a scam: (126)
126
🤔 Probably legitimate: (34)
34
😇 Absolutely fine: (13)
13

---

A few minutes after receiving the SMS, I got a call from a Peterborough number - not the 0800 number. The phone number was flagged as suspicious (read the number's reviews).

After the customary pleasantries, the voice at the end of the phone said "Can you just confirm your name and address for me please?"

I replied that I didn't give that information out to cold callers.

"Completely understandable sir. If you check your messages, you'll see an SMS from us scheduling the call. Did you receive that?"

I replied that I get lots of spam texts and that I couldn't be sure it was legitimate.

We reached an impasse.

With a little subtle social engineering on my part, I found out the nature of the complaint. And then I realised... it was a legitimate call!

A few months ago, I'd complained to Halifax Bank that they were sending letters to someone who didn't live at my address.

The 0800 phone number is owned by Halifax

Lorraine Underwood

@LMcUnderwood

@edent Did Halifax bank turn into Lloyds… ??
Tweet from 2015 mentions that number

---

Halifax are part of Lloyds Bankings Group.

The geographic number I received a call from is the Lloyds outbound number.

In my defence - this did have most of the Hallmarks of a scam! Lloyds have tried to do the right thing by alerting me that the call is coming. They've provided a trusted phone number for me to call if I am concerned. They've given me the name of the caller, and a reference number.

But these are all things a scammer can do as well!

Lloyds could have made this better. Does the average user know that Halifax is part of Lloyds? I didn't. Why didn't the call come from the number that they'd sent in their text? Would a link to a simple URl like lloyds.com/contact have reassured me? How about lloyds.com/complaint/ref/123...?

Instead, several silly mistakes and my unhealthy paranoia collided and convinced me it was a scam.

What's the solution here? Sure, Lloyds can up their game - but a canny scammer can just tweak the wording and send out a convincing forgery. We can all abandon SMS and move to some cryptographically signed service which no one can use properly. We can hope that mobile networks crack down on SMS spam and only let legitimate messages through. Or users can dial down their paranoia - and hope for the best.

But, sadly, it seems that trusting messages from financial services are all but impossible right now.

Whereupon the fraudsters will ask for your bank details, credit card number, mother's maiden name, and inside leg measurement.

There are many complex reasons why this fraud proliferates. But one thing underpins these scams - a domain name and hosting. Over the last few months, the vast majority of the fraud I've seen has come from domains registered by NameCheap.

OK, but that's anecdotal evidence. Is there anything more robust?

My friends in the UK's National Cyber Security Centre have released a report looking at phishing - amongst other things. Here's what they have to say about NameCheap:

Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020.By December 2020 we found that it hosted in excess of 60% of phishing in this category.

NameCheap appear to be the preferred supplier of domains and hosting to the criminal community.

OK, they can't easily control who registers domains. But I'm sure that they take reports of abuse seriously. Right?

Looking specifically at the number of campaigns hosted by NameCheap against its monthly median attack availability, we see that by mid-year the median takedown times were consistently in excess of 60 hours. This undoubtedly made NameCheap an attractive proposition to host phishing and may explain the rise in monthly hosted campaigns that followed for UK government-themed phishing.

Oh...

The problem is, these domains are designed to be "hit-and-run". The spammer sends as many phishing messages as possible, in as short a time as possible. They're expecting the domain to be taken down. Every minute counts.

The CEO of NameCheap is, unsurprisingly, defensive of his company's handling of the situation.

Richard Kirkendall

@NamecheapCEO
Namecheap.com

@CenturyAvocado @carlheaton @alexbloor @cybergibbons @Namecheap For example, there is 1 criminal gang that we've been fighting against targeting UK delivery services and banks. You live in your own bubble and that's all you care about and are exposed to.

---

Ross Henderson-McKillop 

@rsmck

@Namecheap @NamecheapCEO All the information you need is in that tweet. If you need to raise a ticket in Kayako to keep track of it, you can do that yourself using the handy "New Ticket" function and assign it to the relevant department.

Or, you can ignore a fraud report, and be complicit in it.

---

Richard Kirkendall

@NamecheapCEO
Namecheap.com

Replying to @rsmck@rsmck @Namecheap More than 9 out of 10 abuse reports submitted to us are false or incorrect. We processed/investigated 1.1 million abuse claims/reports in 2020 and only 100k of them were actually found to be linked to abuse. Less than 1 percent of domains registered with us. Submit a ticket.

---

What can be done?

There are some proposals to restrict access to new domains - but I don't think that's effective. A spammer can register a domain, wait a month, then blast it out.

NameCheap could make it harder for people to register domains with them. They accept anonymous registration using crypto-currency. I want to live in a world where people can anonymously register web services - but I also don't want to be bombarded with spam.

Given that NameCheap want anonymous customers, and given the prices for hosting are cheap, perhaps they should be taking "good behaviour" deposits from anonymous customers? Take, say, a hundred pounds and refund it only if the account isn't suspended.

Perhaps Nominet could insist that its members take swifter action against spammers - and then remove the ability to resell domains for those that don't?

Maybe NameCheap should increase its prices so that it can afford to pay for the abuse staff that it so desperately needs?

There are no easy answers here. But NameCheap are obviously doing something to attract - and profit from - scammers. What can be done to make them take more responsibility?

Blimey! Thankfully, that was a pretty brazen and inept attempt at phishing. Anyone asking for all your card details like that should set the alarm bells ringing. Of course, phishers often target credulous people who don't understand that they're being scammed.

By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor. Cormac Herley - Microsoft Research

Investigating the account might not have given much of a clue about its dodgy nature.

Superficially, it looks identical to the official account. It even has a verified badge on its Tweets. How? Because all it does is retweet the official account it is spoofing!

Looking closer you should be able to spot that it is a fairly new account with zero followers. Oh, and the name is "Virgimendia"! The kerning of fonts on a small screen is likely to confuse lots of users.

They were quite clever in targetting people who had mentioned the official account. This is similar to a Twitter phishing attack I blogged about 5 years ago.

I tried my luck at baiting the scammer - to no avail!

Their use of language suggests they're a British English speaker. At least, I assume they're not thinking of me in cryptographic terms!

A bunch of us reported the account, and by the next morning it was gone.

The disturbing thing about this, is that the scammers had been operating for at least a week. Virgin Media had been alerted, but seemingly didn't take any action.

(Content Warning: The following Tweets contain racist language and encouraging suicide.)

Sharon Field

@SharonField3

Blocked and unblocked me just to send that last bloody message! 🤣🤣🤣 @virgimendia says you sitting at home in your mums basement have fun with that one pic.x.com/8RIm648hi7

Sharon Field

@SharonField3

Replying to @DeniseHodg19@DeniseHodg19 @Mchughhugh @virginmedia @richardbranson I’ve just had a scam page DM me as well. I have reported it. Let’s hope the OP didn’t give them any card details as that’s what the last lot were asking for! Note the very slight spelling discrepancy on the @ name. Otherwise their page is identical pic.x.com/bAhonL1VLT

---

---

Adelle King

@Blackrose_uk

,@virgimendia THIS ACCOUNT IS GOING TO MESSAGE YOU PRETENDING TO BE VM AND ASKING FOR YOUR BANK DETAILS. IF LIKE ME YOU CATCH THEM OUT THEY ACT LIKE THIS.. pic.x.com/oSPTNVbWfm

---

https://twitter.com/julsbvby/status/1294702901835726854

poke681.bsky.social

@Poke681YT

Almost had me there @virgimendia pic.x.com/tb0AkLnUqv

---

Virgin Media ❤️

@virginmedia

@misslisa811 Sorry you've received this fraudulent DM Lisa. By now I am sure you're aware it was not from Virgin Media as firstly we'd never ask those questions and secondly we do not offer a DM option. Please can you you forward the twitter handle of the sender so we can investigate? ^LS

---

Lisa Jones

@misslisa811

@virginmedia @virginmedia it came for your twitter handle.... last night. I have also reported this to your customer services but they didn’t seem to concerned... told me to opt out of text message notifications :/ pic.x.com/HJvm9R4Wz4

---

Could automated tooling have stopped this? To a human it looks pretty obvious that this is a scam. But what heuristics would you use to train a model designed to stop this? And how many false positives would it detect?

Stay safe out there.

Support Dom in his quest to run 26 half-marathons in 26 silly costumes in aid of a children's hospice.

Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date.

If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? A quick look at the URl shows a trusted domain at the start - followed by today's date.

It starts with https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain?

Scammers know these domains get blocked pretty quickly - so there's no point registering a generic name like billing-pdf.biz only to have it burned within a day. By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious.

Is there any way to stop this? No, not really. Domain names are cheap - you can buy a new .info for a couple of quid. The https:// certificate was freely provided by Let's Encrypt. The site was probably hosted somewhere cheap, and whose support staff are asleep when abuse reports come in from the UK.

And that's the price we pay for anyone being able to buy their own domain and run their own secure site.

Money and technical expertise used to be strong barriers to prevent people from registering scam domains. But those days are long gone. There are no technical gatekeepers to keep us safe. We have to rely on our own wits.

There's been a worrying rise in the number of fake accounts which attempt to trick people into handing over their banking details. Let's take a look at one of them.

Here we see what looks like a genuine account from one of the UK's biggest banks - NatWest. This account belongs to a phisher - someone who wants to grab your banking details. In this example, the fake account is searching for people complaining to their bank - it replies and asks them to click onto a phony website.

Here, the user has been chatting with the real customer service team - as noted by the blue verified tick. The fake account continues the conversation!

How sure are you that you wouldn't fall for this?

I was able to see most of the replies to this account before it was shut down. Some people were easily mislead.

That's worrying. But it gets worse.

Suppose you were fooled and clicked on the link. You'll be taken to a realistic looking website which asks for all your details.

This looks identical to the real NatWest site. You've probably not noticed that this isn't the real NatWest domain, and that it isn't on HTTPS. Your mobile browser probably hasn't warned you that this is a scam - so you enter your real number.

That's where things get dark quickly.

Dark Phishing Patterns

Everyone knows that you shouldn't give away your full PIN. So the website only asks for the 1st, 2nd, and 4th digit. As soon as I hit submit, it gave me an error. Can you see what it has done?

Now it is asking for the 1st, 3rd, and 4th digits! They now have your customer number, full PIN, and password.

Now they want more.

I'm just surprised that they didn't ask for my mother's maiden name and my first school!

With the above information, the criminals have everything they need to phone up your bank and impersonate you. Or to ring you up and impersonate your bank.

This sort of attack on customers isn't new - but as more people get online, there will be more criminals waiting to defraud the unwary.

Convenience seems to take priority most of the time. This forces companies to get their customers to risk their own security.

In this example, we see Verizon Wireless asking their customers to type their passwords into Twitter for everyone to see!

This is dangerous. It is likely that many of their customers recycle their passwords. Does the average customer know that their "billing" password is different from their account password?

Is it safe for people to post their phone numbers in public like that?

All a scammer has to do is ring the number, say "Hello Mrs Example, I'm calling from Verizon about your billing problem - let me take you through security..."

Some companies ask for the information via Direct Message. This is also problematic.

This trains customers to input their password into a 3rd party site. That's a security risk - the password is now shared with Twitter.

If the company's Twitter account is ever broken into, all those passwords are available in the DM history.

There is also the risk that users will accidentally paste their details for the world to see.

I know what you're thinking - surely no one is actually dumb enough to type their password into Twitter?

*sigh*

But what else do we expect? Customers are trained to phish themselves in the name of convenience.

These basic security security practices should be obvious - but they clearly aren't. Companies which ask you to breach your own security are dangerous and should be avoided.

I'm going to walk you, step-by-step, through a scam that targetted me today. Along the way we'll see how to avoid falling prey to these monsters.

It starts with a text

I was sent this SMS from a number that I didn't recognise.

Let's count the mistakes!

1. In the UK, we place the currency symbol before the number.
2. British English spells "authorise" with an S rather than a Z.
3. Amazon don't send out links using the bitly shortening service.

These phishers are hoping that you're too stupid to notice the mistakes. They are also betting that you're too busy to think for a minute about whether Amazon are likely to contact you via SMS rather than email or app notification.

Let's say you're tired enough to click through, what do you find?

Stealing Beauty

At first glance, this looks identical to the regular Amazon mobile sign in page.

But! Look closely. There are three obvious mistakes.

1. No https - you should know by now that you never enter your password unless the website is protected with those magic letters.
2. The web address is not amazon.co.uk! It is some other site. Again, you should never enter a password unless you are sure that the site is legitimate.
3. Finally - what is that � character doing at the bottom of the site? It should be a © symbol. Far too sloppy for Amazon.

Surely you wouldn't fall for this? Sadly, not everyone in the world is as bright as you.

Tell me more, tell me more

So, you unwisely entered your password. The scammers are already riffling through your Amazon account with the stolen password. They're buying themselves toys using your credit card. But they ain't done with you yet!

They want everything! Once they have your home address and phone number, they can bombard you with scams. Scroll down, and it gets worse.

Your bank details! Your mother's maiden name! Are these details enough for them to fool your bank? With all the information you're giving them, they'll be able to take over your entire life!

Fool me once

Because the scammers use bitly, we can take a look at how many people are clicking through this link.

By the time Bitly had flagged the link as malicious, over 250 people had clicked on it.

Would you have fallen for it? These scammers are betting that you're not paying attention. That you'll blindly trust any link you see.

Phone companies are powerless to stop this sort of spam - SIM cards can be purchased anonymously, and computers can pump out thousands of texts before their suspicious behaviour is noticed.

Bitly knows it is a vector for phishing attacks, but can't check every link before it goes live.

The only solid defence is you! It is up to you to keep your wits up, to examine every message you receive, and every link you click. You have to stay safe all the time - the scammers only need to get lucky once.

If you want to harden your defences, you need to take action now.

1. Activate Two-Factor Authentication for Amazon - even if someone steals your password, they'll also need your phone in order to log in.
2. Use LastPass to generate strong and unique passwords for every site you use. If you use the same password on multiple sites - it is only a matter of time before one is lost, and then all are lost.

Stay safe out there!

Early one morning, I received this email from someone I know (details redacted by me).

It came from his email, it has his signature at the bottom. This doesn't look like someone hijacking his email so far.

I don't put much stock by "Protected by Antivirus" claims - because they provide no proof that scanning has taken place.

I know you shouldn't open attachments. But it's a PDF and Google is showing a plausible looking preview. It was early in the morning, and I clicked on it.

*sigh* Last night I had factory reset my phone. I was slowly logging back in to all my services. So this screen wasn't unexpected for me. And, to be honest, I've got a bunch of Google accounts and always have to log in and out of them. OK, let's type in my email.... WAIT! WHAT?

A look at the URL bar shows accounts.googledrive.com.adge.gq. That's not a Google URl. Had they used something like login.accounts.googledrive.com... it would have been long enough for me not to see the phony adge.gq at the end. I'd almost certainly have clicked through.

The rest of the page is a pixel perfect recreation of the Google login page. With the exception of the "email provider" choice. If I'd have been less awake, I'm fairly sure I'd have fallen for this.

I put in a fake email just to see what would happen.

Asking for a password - thankfully, the scammers didn't use Gravatar to show the user a picture of themselves.

I put in a fake password - and got this extraordinary attempt to phish my details.

ARGH! Trying to steal yet more information. That's a realistic error message. I'm used to seeing asterisks blocking out my sensitive details.

If you fell for this, you've given up your email and password - no doubt used to send more spam - and opened yourself up to a barrage of scam phone calls claiming to be from your "email provider". If you reused your password with any other service - like your phone provider - your entire online identity is at risk of compromise.

I know what you're thinking. I should never have clicked on that link in the first place. I am usually quite security minded. In fact, before clicking on it, I long-pressed on the link so that Google could show me its destination.

Even a vigilant user gets no protection here from Gmail.

Today these criminals were unlucky. But they only have to be lucky once. Users will have to be lucky always.