Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess.

Google has recently announced that Android users will only be able to install apps which have been digitally signed by developers who have registered their name and other legal details with Google. To many people, this signals the death of "sideloading" - the ability to install apps which don't originate on the official store⁰.

I'm a fully paid-up member of the Cory Doctorow fanclub. Back in 2011, he gave a speech called "The Coming War on General Computation". In it, he rails against the idea that our computers could become traitorous; serving the needs of someone other than their owner. Do we want to live in a future where our computers refuse to obey our commands? No! Neither law nor technology should conspire to reduce our freedom to compute.

There are, I think, two small cracks in that argument.

The first is that a user has no right to run anyone else's code, if the code owner doesn't want to make it available to them. Consider a bank which has an app. When customers are scammed, the bank is often liable. The bank wants to reduce its liability so it says "you can't run our app on a rooted phone".

Is that fair? Probably not. Rooting allows a user to fully control and customise their device. But rooting also allows malware to intercept communications, send commands, and perform unwanted actions. I think the bank has the right to say "your machine is too risky - we don't want our code to run on it."

The same is true of video games with strong "anti-cheat" protection. It is disruptive to other players - and to the business model - if untrustworthy clients can disrupt the game. Again, it probably isn't fair to ban users who run on permissive software, but it is a rational choice by the manufacturer. And, yet again, I think software authors probably should be able to restrict things which cause them harm.

So, from their point of view it is pragmatic to insist that their software can only be loaded from a trustworthy location.

But that's not the only thing Google is proposing. Let's look at their announcement:

We’ve seen how malicious actors hide behind anonymity to harm users by impersonating developers and using their brand image to create convincing fake apps. The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play.

Back in the early days of Android, you could just install any app and it would run, no questions asked. That was a touchingly naïve approach to security - extremely easy to use but left users vulnerable.

A few years later, Android changed to show user the permissions an app was requesting. Here's a genuine screenshot from an app which I tried to sideload in 2013:

No rational user would install a purported battery app with that scary list of permissions, right? Wrong!

We know that users don't read and they especially don't read security warnings.

There is no UI tweak you can do to prevent users bypassing these scary warnings. There is no amount of education you can provide to reliably make people stop and think.

Here's the story of a bank literally telling a man he was being scammed and he still proceeded to transfer funds to a fraudster.

It emerged that, in this case, Lloyds had done a really good job of not only spotting the potential fraud but alerting James to it. The bank blocked a number of transactions, it spoke to James on the phone to warn him and even called him into a branch to speak to him face-to-face.

Here's another one where a victim deliberately lied to their bank even after acknowledging that they had been told it was a scam.

Android now requires you to deliberately turn on the ability to side-load. It will give you prompts and warnings, force you to take specific actions, give you pop-ups and all sorts of confirmation steps.

And people still click on.

Let's go back to Google announcement. This change isn't being rolled out worldwide immediately. They say:

This change will start in a few select countries specifically impacted by these forms of fraudulent app scams, often from repeat perpetrators.

…

September 2026: These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer.

The police in Singapore have a page warning about the prevalence of these scams. They describe how victims are tricked or coerced into turning off all their phone's security features.

Similarly, there are estimates that Brazil lost US$54 billion to scams in 2024 (albeit not all through apps).

There are anecdotal reports from Indonesia which show how easily people fall for these fake apps.

Thailand is also under an ongoing onslaught of malicious apps with some apps raking in huge amounts of money.

It is absolutely rational that government, police, and civic society groups want to find ways to stop these scams.

Google is afraid that if Android's reputation is tarnished as the "Scam OS" then users will move to more secure devices.

Financial institutions might stop providing functionality to Android devices as a way to protect their customers. Which would lead to those users seeking alternate phones.

Society as a whole wants to protect vulnerable people. We all bear the cost of dealing with criminal activity like this.

Given that sideloaded Android apps are clearly a massive vector for fraud, it obviously behoves Google to find a way to secure their platform as much as possible.

And Yet…

This is quite obviously a bullshit powerplay by Google to ensnare the commons. Not content with closing down parts of the Android Open Source Project, stuffing more and more vital software behind its proprietary services, and freezing out small manufacturers - now it wants the name and shoe-size of every developer!

Fuck that!

I want to use my phone to run the code that I write. I want to run my friends' code. I want to play with cool open source projects by people in far-away lands.

I remember The Day Google Deleted Me - we cannot have these lumbering monsters gatekeeping what we do on our machines.

Back in the days when I was a BlackBerry developer, we had to wait ages for RIM's code-signing server to become available. I'm pretty sure the same problem affected Symbian - if Nokia was down that day, you couldn't release any code.

Going back to their statement:

To be clear, developers will have the same freedom to distribute their apps directly to users through sideloading or to use any app store they prefer.

This is a lie. I can only distribute a sideloaded app if Google doesn't nuke my account. If I piss off someone there, or they click the wrong button, or they change the requirements so I'm no longer eligible - my content disappears.

They promise that Android will still be open to student and hobbyist developers - but would you believe anything those monkey-punchers say? Oh, and what a fricking insult to call a legion of Open Source developers "hobbyists"!

I hate it.

I also don't see how this is going to help. I guess if scammers all use the same ID, then it'll be easy for Android to super-nuke all the scam apps.

Perhaps when you install a sideloaded app you'll see "This app was made by John Smith - not a company. Here's his photo. Got any complaints? Call his number."

But what's going to happen is that people will get their IDs stolen, or be induced to register as a developer and then sign some malware. They'll also be victims.

So What's The Solution?

I've tried to be pragmatic, but there's something of a dilemma here.

0. Users should be free to run whatever code they like.
1. Vulnerable members of society should be protected from scams.

Do we accept that a megacorporation should keep everyone safe at the expense of a few pesky nerds wanting to run some janky code?

Do we say that the right to run free software is more important than granny being protected from scammers?

Do we pour billions into educating users not to click "yes" to every prompt they see?

Do we try and build a super-secure Operating System which, somehow, gives users complete freedom without exposing them to risk?

Do we hope that Google won't suddenly start extorting developers, users, and society as a whole?

Do we chase down and punish everyone who releases a scam app?

Do we stick an AI on every phone to detect scam apps and refuse to run them if they're dodgy?

I don't know the answers to any of these questions and - if I'm honest - I don't like asking them.

Some of the voices are reasonable facsimiles of human voices (like the above) and some are just garbage.

The voice clip plays and the call immediately terminates.

What I can't understand is how this can possibly be effective from the scammers' point of view. On receiving the call the victim must…

1. Decided to answer from an unknown number.
2. Listen to the message and decide it is legitimate.
3. Go the their phone's dialler app.
4. Copy the caller's phone number.
5. Open WhatsApp.
   • Install WhatsApp if they don't have it already
6. Create a new contact - giving a name - and pasting the number.
7. Engage with the contact.

That's a lot of effort based on… what? A vague offer? There's a little bit of a curiosity gap but not much. It's hardly "add me on WhatsApp or we'll release the photos we have of you" or "you've won the lottery, add me on WhatsApp to get the funds", or "This is the CEO of your company, urgently add me…".

I guess that if a spammer is able to send out thousands of these messages then they might be able to attract a couple of people to engage with them. There's no easy way to report a spam account to WhatsApp unless you've engaged with it.

I also assume that WhatsApp will see that you were the person who initiated WhatsApp contact - which makes them less likely to think the scammer is the problem.

I am just fascinated to see if this scam can possibly be effective. Generating fake voices is free, as is placing short calls. WhatsApp accounts are also free and easy to automate. But are there really that many people willing to go to the effort of adding a new contact based on so little information?

Obviously, all spam is a numbers game. If the message reaches someone receptive to a robocall, they're less likely to query the scam. And, yes, I know that you're a very clever boy and don't answer unknown numbers - but in the real world people get calls from hospitals, recruiters, and friends with new numbers.

If you're a spammer and have found this approach effective - please leave a comment!

Update! July 2025. A new variant. Same basic message, but a much more natural sounding voice. I wonder if they're using real people now?

"Yeah, right!" You think. Obvious scam, isn't it? You tell the caller to do unmentionable things to a goat. They sigh.

"I can assure you I'm calling from Chase bank. I understand you're sceptical. I'll send a push notification through the app so you can see this is a genuine call."

Your phone buzzes. You tap the notification and this pops up on screen:

This is obviously a genuine caller! This is a genuine pop-up, from the genuine app, which is protected by your genuine fingerprint. You tap the "Yes" button.

Why wouldn't you? The caller knows your name and bank and they have sent you an in-app notification. Surely that can only be done by the bank. Right?

Right!

This is a genuine notification. It was sent by the bank.

You proceed to do as the fraud department asks. You give them more details. You move your money into a safe account. You're told you'll hear from them in the morning.

Congratulations. You just got played. Scammers have stolen your life savings.

How the scam works

This is reasonably sophisticated, and it is easy to see why people fall for it.

1. The scammer calls you up. They keep you on the phone while...
2. The scammer's accomplice calls your bank. They pretend to be you. So...
3. The bank sends you an in-app alert.
4. You confirm the alert.
5. The scammer on the phone to your bank now has control of your account.

Look closer at what that pop is actually asking you to confirm.

We need to check it is you on the phone to us.

It isn't saying "This is us calling you - it is quite the opposite!

This pop-up is a security disaster. It should say something like:

Did you call us?

If someone has called you claiming to be from us hang up now

Yes, I am calling Chase - No, someone called me

I dare say most people would fall for this. Oh, not you! You're far too clever and sceptical. You'd hang up and call the number on your card. You'd spend a terrifying 30 minute wait on hold to the fraud department, while hoping fraudsters haven't already drained your account.

But even if you were constantly packet sniffing the Internet connection on your phone, you'd see that this was a genuine pop-up from your genuine app. Would that bypass your defences? I reckon so.

Criminals are getting increasingly good at this. Banks are letting down customers by having vaguely worded security pop-up which they know their customers don't read properly.

And, yes, customers can sometimes be a little gullible. But it is hard to be constantly on the defensive.

Further reading

You can read the original story from the victim on Reddit. See more comments on Mastodon.

Fraud victim gets surprise £153,000 refund despite rules BBC News

In the story, the heartless bank refused to refund the fraud victim due to an absurd technicality - the money was sent to a foreign account rather than a UK account. Once again, big business bending the rules in order to protect their profits from a defenceless pensioner. Only after protests did they reimburse him. What a disgrace!

Except, of course, that's not what happened.

Terence Eden is on Mastodon

@edent

I can't remember who told me this, but it is a truism.
Ignore the headline and read the *penultimate* paragraph. That's where the real story is.

---

Let's scoot down the article, past the sensationalism, and see what we find:

It emerged that, in this case, Lloyds had done a really good job of not only spotting the potential fraud but alerting James to it. The bank blocked a number of transactions, it spoke to James on the phone to warn him and even called him into a branch to speak to him face-to-face.

Ah.

The bank kept his money as safe as possible but, ultimately, it was his money. He can choose to do whatever he wants with it. If he'd decided to blow his life savings on fast cars and loose women should he have been stopped?

Ultimately, this man was scammed, and the fault lies with the crooks who swindled him. But, realistically, what more could the bank have done to protect him? I suppose they could have dropped him as a customer. If they'd said he was too risky for them and told him to find a new bank, we'd see headlines of "Fury as cold-hearted bank tells pensioner to piss off".

I'm sure we've all had a friend who has driven themselves into drink, drugs, or gambling. You can intervene. You can counsel them. You can beg, plead, and threaten. But people are entitled to make their own choices in life. And sometimes they make bad choices which end up hurting them.

Perhaps this victim's family should have been more proactive in setting up a Power of Attorney. Perhaps the media consumed by older people should be flooded with scam warnings. Perhaps the victim should have heeded the bank's repeated warnings. Perhaps scammers should reconsider their life choices. Perhaps the bank should have forced him to take his business elsewhere.

Do we want banks to safeguard or money, or to gatekeep it?

This is a sad story with no happy ending and no easy answers.

It tells the story of a group of people who were conned into working for a "fake" company. You can read the news article - it's pretty depressing stuff. In the middle of a pandemic, people were asked to work for what looked like an established media agency, for people who appeared to have a long history in the sector. The pay was commission only, with the promise of decent salaries in a few months. But several members of the senior team were imaginary. The client list was fictional. And the owner of the company appeared to be a fantasist - casually lying about their background and achievements. The whole thing collapsed in a pile of lies.

I have enormous sympathy for the victims. Mostly because I'm pretty sure that I wouldn't be able to detect this scam!

Think about it - how could anyone detect this sort of scam? The company was legitimately registered at Companies House. It hadn't been registered for long - but that's expected at a startup, right?

The website looked slick and professional. It wasn't a generic WordPress template. This isn't like a 419 scam where the scammers target people who don't notice mistakes.

The employee photos were not of real employees - they were ripped off Getty Images and various other websites. OK, I know how to do a reverse image search - but they don't always work with cropped and/or recoloured images.

The founder had an extensive LinkedIn profile. In a large industry, I might know someone who knows them. It's a slightly awkward conversation to say "Hey, I'm applying for a job at X, I understand you know Y. What do you think of them?" - but it's doable. The only problem is that so many of the people I've added on LinkedIn are people I've met one time at a conference. I suspect that's true for lots of people. So what's the answer going to be? "Yeah, they seemed fine when I met them a decade ago."

Apparently lots of the text on the website was copied from other sites. Again, it's fairly easy to send a few text snippets to Google and see what that throws up. But what would possess you to do that?

When people turned up for an all-staff Zoom meeting, there were lots of people on there. That adds to the social pressure. How could all these people be fooled?

I have to stress, there seemed nothing obviously wrong with the Jobfishing offer. People weren't being offered too-good-to-be-true salaries. They weren't being asked to invest. They weren't part of a pyramid scam. What should have tipped them off? The fact that the founder gave them a bit of an ego flattering?

What should any normal person have done to check that this wasn't a scam?

Most people aren't trying to rip you off. It seem ridiculous that you'd go full Sherlock Holmes on every job offer you see. Right?

I'm also trying to think how this could have been worse.

This was all conducted online. But it's easy to rent a office - or co-working space - for a couple of days. If you turned up to a fancy office in the business district, would you think to question whether it was the company's permanent home or merely rented by the hour?

What if the scam company was masquerading as an established company? If you answered a job advert for, say, IBM - would it bother you if all the recruitment emails came from a domain like @ibm-recruitment.com?

What can you do? What can anyone do?

This isn't a problem which can be solved with technology. Putting everyone's CV on the BlockChain isn't going to stop grifters and scammers. I think - and it is only my opinion - that there's no way to protect ourselves from determined scammers. We just have to trust that most people aren't out to get us.  

You should take a couple of hours to watch The Producers. Either the 1967 classic movie, or the 2005 remake will do. The pivotal moment in the film is when Leo Bloom has this stunning realisation:

"Amazing. It's absolutely amazing. That under the right circumstances, a Producer could make more money with a flop than he could with a hit. Hmm... Yes, it's quite possible! If he were certain that the show would fail, a man could make a fortune!"

The scheme is simple - if your venture is a success, all your financial backers want a share of the profits. If the venture is a failure, the backers accept their losses. You walk away with the unspent investment.

A related scam can be found in Lock, Stock, and Two Smoking Barrels (warning for homophobic language):

Nowadays, I suspect, most people wouldn't care that their bank knew about their sexual proclivities. But the essence of the scam remains - make claiming the refund too difficult or expensive to be worth it.

Which, of course, brings me to the latest "venture" from the Cryptocurrency pillocks.

‘Buy the Constitution’ Aftermath: Everyone Very Mad, Confused, Losing Lots of Money, Fighting, Crying, Etc. ConstitutionDAO tried to buy the Constitution. Now it has a $40 million mess on its hands and entire refunds are being wiped out by high fees.

…

Of the initial $200 we bought in ETH, $90 was eaten up in fees simply to donate to ConstitutionDAO.

…

to get our ETH back from Juicebox, we would have to pay gas fees again, meaning essentially the entirety of the amount invested would be wiped out. Vice

You "buy" a token - the seller profits from the fees you pay¹. The seller offers to refund you - if you accept, they get another fee, if you refuse, they keep your money. They make money either way. Genius!

In most of the civilised world, money transfers are free. I can send boring fiat money to anyone in the UK and it arrives instantly, for free. Faster Payments work for up to £250,000. There's no cost to the sender or receiver. Not even a monthly bank account fee! There's no middle-man taking a cut. The sort of infrastructure that American cryptobores can only dream of.

If I want to send money internationally, most UK banks will charge a flat £20 fee. Or something like Wise transfers will cost as little as a quid, and up to 0.65% of the transfer amount. Sure, there might also be some exchange rate fees and fluctuations, but they're generally tiny.

If there's a problem with my transaction, I usually have strong consumer protection laws to help me get a refund. Either automatically through my payment provider, or through a well established court process.

I'm sure that the people behind ConstitutionDAO truly believed their own hype. And they probably didn't set out to steal money from gullible people. But all the cryptocurrency and DAO projects I've seen so far are barely concealed get-rich-quick pump-and-dump schemes.

There is nothing "democratising" about conning people out of money. There's nothing decentralised about deceiving a large group of ill-informed speculators. There's nothing innovative about these trite scams.

Let's take a look at all the ways we can tell it is a scam.

Firstly, and most obviously, I am not a customer of Lloyds Bank! But these scammers send out to multiple people hoping to catch victims.

Secondly, I've not made a complaint to Lloyds! But, again, scammers know that plenty of people have. So this adds a touch of authenticity. If you were a Lloyds customer who had recently complained - you're now primed to accept the scammer's call and treat it as legitimate.

Thirdly, that phone number. If you call it, a recorded voice says "Welcome to customer services..." Whose customer services? It doesn't say "Welcome to Lloyds". This is likely a number that scammers put on texts claiming to be from HSBC, Lloyds, NatWest. Cheaper for them to have a single phone number.

Fourthly, the reference number. It is just my phone number! That's an unusual reference number for a bank.

There's some weird spacing between "Mr" and "Eden" - not what I'd expect from a professional message.

What do you think of the SMS? Would you flag it as spam? I asked my Twitter followers and their responses were unanimous.

Terence Eden is on Mastodon

@edent

I received this unsolicited SMS earlier today.
I don't bank with Lloyds.
What do you think of it? (Poll in next tweet.) pic.x.com/yh4OrBwfM6

---

Terence Eden is on Mastodon

@edent

Do you think that SMS from Lloyds is…
📊

---

⚠ Definitely a scam: (195)
195
😕 Probably a scam: (126)
126
🤔 Probably legitimate: (34)
34
😇 Absolutely fine: (13)
13

---

A few minutes after receiving the SMS, I got a call from a Peterborough number - not the 0800 number. The phone number was flagged as suspicious (read the number's reviews).

After the customary pleasantries, the voice at the end of the phone said "Can you just confirm your name and address for me please?"

I replied that I didn't give that information out to cold callers.

"Completely understandable sir. If you check your messages, you'll see an SMS from us scheduling the call. Did you receive that?"

I replied that I get lots of spam texts and that I couldn't be sure it was legitimate.

We reached an impasse.

With a little subtle social engineering on my part, I found out the nature of the complaint. And then I realised... it was a legitimate call!

A few months ago, I'd complained to Halifax Bank that they were sending letters to someone who didn't live at my address.

The 0800 phone number is owned by Halifax

Lorraine Underwood

@LMcUnderwood

@edent Did Halifax bank turn into Lloyds… ??
Tweet from 2015 mentions that number

---

Halifax are part of Lloyds Bankings Group.

The geographic number I received a call from is the Lloyds outbound number.

In my defence - this did have most of the Hallmarks of a scam! Lloyds have tried to do the right thing by alerting me that the call is coming. They've provided a trusted phone number for me to call if I am concerned. They've given me the name of the caller, and a reference number.

But these are all things a scammer can do as well!

Lloyds could have made this better. Does the average user know that Halifax is part of Lloyds? I didn't. Why didn't the call come from the number that they'd sent in their text? Would a link to a simple URl like lloyds.com/contact have reassured me? How about lloyds.com/complaint/ref/123...?

Instead, several silly mistakes and my unhealthy paranoia collided and convinced me it was a scam.

What's the solution here? Sure, Lloyds can up their game - but a canny scammer can just tweak the wording and send out a convincing forgery. We can all abandon SMS and move to some cryptographically signed service which no one can use properly. We can hope that mobile networks crack down on SMS spam and only let legitimate messages through. Or users can dial down their paranoia - and hope for the best.

But, sadly, it seems that trusting messages from financial services are all but impossible right now.

London was in full bloom of tech-startups. I was running my own consultancy. Dashing from business to business, trying to pick up work as an expert in this new-fangled "Mobile Internet" thing. Some of the companies I worked with were great. Some of them went bust. And some were... just... ew!

Digging through a box of files the other day, I discovered an old NDA that I'd signed. The company has long since dissolved, and the NDA expired a few years ago - so I reckon I'm in the clear to talk about this.

A company - let's call them "Fronk" - asked me to come in for a consultation about a Developer Advocacy programme they were starting. You must remember, these were the early days of such initiatives. DevRel (as it now seems to be called) used to consist of product managers speaking to other managers at conferences. There was very little targetting of individual developers, outside of the occasional pizza-powered hackathon.

This was their pitch - I promise I am not exaggerating. I present it to you in Socratic dialogue.

"We want to hire people like you to go and interview at other companies."

You want to pay me actual money to go and take job interviews? Why?

"During the interview, you'll evangelise our clients' products."

Your clients?

"Suppose that AWS wants to sell more InfiniDash licences. They pay us to get the word out to big companies and start-ups."

How?

"Let's say in the interview you're asked for a time when you handled a difficult situation. We want you to talk about how using InfiniDash made life easier for your team."

OK...

"Or if they ask for an example of convincing senior leadership of something - say that you pitched InfiniDash, how easy it was to work with, how all the executives loved it. That sort of thing."

Right. But I'm not experienced with InfiniDash. Isn't that going to be a problem?

"We're only going to get you interviews in companies which don't already use our clients' products. So they're not going to test you. We'll also pay for you to get certified on the products."

How are you going to get me these interviews?

"Oh, we work with loads of recruitment consultants. They get paid for every decent candidate who gets interviewed, so they give us a cut of their commission. And we get paid by our tech clients. It's win-win!"

Ummm... What if they offer me the job?

"On no account are you to accept. Just tell them that you've taken another role elsewhere."

Is this... what's the word... ethical?

"Our investors think so! You're not going to lie on your CV. You're not going to take a job you're not qualified for. You're not going to get paid a commission. We'll pay you a flat fee per interview. You can even fit it around your other contracts if you like?"

I did not take the job. I had serious concerns about the ethics and legality of their business model. I also didn't think that it would work. Evidently, neither did their investors. Fronk bumbled along for a few months - and I'd occasionally meet them at conferences - but then they seemed to disappear.

And yet...

Every once in a while, I'll be interviewing a candidate who starts waxing lyrical about how rewriting everything in today's flavour of JavaScript really helped their last company. Or how their bosses were impressed with what this cool new bit of tech can do. Or why they could never work anywhere which didn't use this specific code editor.

And it makes me wonder if Fronk is still out there...?

It all comes down to user needs. What pain point are you removing? Uber made taxis mildly less irritating, for example. But the UK already has a fairly mature mobile money market, so what does Signal add? Here are a few obvious questions I asked them:

• The UK already has faster payments in all major banks. I can send and receive money instantly from app or Web. Will Signal be as fast as that?
• The UK has a problem with authorised push payment fraud. Banks can recover funds which have been sent as a result of phishing / fraud. How can someone reverse a payment on Signal if it was fraudulent?
• The UK also has receiver verification. If I try to send to an account and it doesn't match the name I'm sending to, my bank will warn me. How does Signal stop impersonation?
• There's no cost to sending payments on most mainstream banks. How much does Signal charge?
• Most banks let the user block receiving payments from specific accounts. Can Signal stop harassers sending unwanted money?

Those were the questions I immediately thought of with my "product" hat on. I'm sure you can think of more.

The responses were... not well thought through. I'll respond to each one.

A: MobileCoin is as fast (or faster in some cases) than a bank payment in the UK with greater privacy. As far as settling back to Fiat, if that's what you're asking about, the velocity of that depends on on-ramp and off-ramp integrations which will come over time (but it looks like there's no reason MobileCoin can't help developers deliver payments at the same speed as banks).

I've yet to see a settled crypto transaction which is as fast as a UK bank transfer. We'll come back to "privacy" later. In terms of getting real money out of the system, the answer seems to be "variable" - which doesn't sound like a great customer experience.

Payments on MobileCoin cannot be reversed at the protocol level. If you want escrow and reversibility, you should use a wallet or payment service that supports those primitives. We believe that developers will build such services on top of the foundation of the MobileCoin protocol.

So, no. If you get scammed, tough. Neither a bank, nor a regulator, nor a court can reverse a dodgy transaction. Where's the user need for that?

Signal relies on phone numbers for identities. Other apps that integrate MobileCoin may have a higher threshold for identification.

So, again, if someone pretends to be your mate and cons you out of money, there's no independent verification. I bet users just love sending money and not knowing who it is going to.

Fees are set by the foundation (which has a stated goal of keeping transaction fees to around $.04 when the network isn't congested). Currently fees are higher as they need to be adjusted by a foundation vote.

That's pretty high! People in the UK literally use their banking apps to message each other - sending penny payments to get someone's attention. What is the user getting for this proposed transaction fee?

Signal doesn't allow people you haven't keypaired with to send you funds. If you have accepted a message request from someone, they can send you money.

If you can't block people - even after accepting them - that's a vector for harassment, or worse. Your psycho-ex can bombard you with micropayments. Your dodgy mate can offload his illegitimate gains into your account. It sounds like a nightmare.

So, I ask again, what is the use-case for this feature? It isn't faster, it costs more, it is in a volatile cryptocurrency, it has no fraud protection, and it facilitates abuse.

The one thing it has going for it is that it is "anonymous".

Except, of course, it isn't anonymous in any real sense. You need the user's phone number - which means law enforcement can track their activity. While the ledger may be anonymous, if you send a unique amount of money, and it gets received instantly, it's going to be pretty easy to work out who is at either end of the transaction.

Perhaps there is a huge untapped desire to send expensive pseudonymous payments. Perhaps people want to pay for stuff using a speculative instrument. Perhaps everything I thought I knew about people is wrong.

Or, perhaps this is another pump-and-dump cryptoscam?

I wonder who was "investing" in those coins before the big announcement? Nothing to see here...

Another day, another Blockchain Bullshit project.

Someone "claimed" one of my Tweets and added it to the Blockchain. I'm not particularly happy about that. Nor am I happy with the hoops I had to jump through to contact the company and remove my work. You can read the whole sorry thread on Twitter. But, mostly, I'm unhappy with this whole scammy "industry".

Now my Tweet is an "NFT" - Non-Fungible Token - tradeable with other people for cold-hard-cash.

This is nonsense. Let's ignore the fact that some random company has taken my copyright and indelibly stored it on a 'chain. Let's ignore that someone else is claiming my content as their own. Heck, let's even ignore that someone else is monetising my content without permission or recompense.

Why can't these people see that digital ownership is a con? The only value these tokens have is in their scarcity. Digital tokens cannot ever be scarce.

What do you get if you "buy" my Tweet? You didn't write it - so you don't have copyright. You don't get an exclusive use of it. And anyone can make their own copy of it!

There are four great big problems with trying to assert ownership of a digital token.

1. Which Chain?

The first is that it is only ownership on that specific chain. What stops someone from starting a new crypto-chain and adding the tokens to that? Just like banks can print money, anyone can spin up a new blockchain project and start minting "ownership" of digital assets. It doesn't mean anything.

Anyone can start a Blockchain-of-tweets. So what's special about this one?

There are dozens of competing "Art Chains". Which one should I register my work to? All of them? One of them? My own private chain?

2. Whose Chain?

The second is that the ownership of an NFT is often tied to a specific provider. One of the examples given in the NFT Bible is that of in-game items. Magic swords and such-like.

At the moment, NFT fanatics claim, you can't sell in-game items. And, even if you could, nothing prevents the game publisher from destabilising prices by flooding the market with millions of "rare" items.

OK, fine. But what happens if the publisher one day shuts off the game? Or refuses to accept your ownership of the token? They are a central publisher. You may be free to trade items - but they are free to refuse to accept your ownership. You're sharecropping with a hostile land-owner.

3. DRM

The third problem is that's not how digital files work! Digital files can be copied. It is intrinsic to their nature. We've had a couple of decades of DRM being defeated within 5 minutes of its release. Every Netflix show is available on dodgy sites in 4K. Trying to make digital files non-fungible is like trying to make water not wet.

Whether it is art, or text, or code, or anything - digital files are copyable. Sure, you may have bought the NFT for a fabulous piece of art - but I have a screenshot of it and it is displayed on my wall. We both get exactly the same utility from it.

If you had the original physical painting of van Gogh's Starry Night - you have something unique! But if you have a JPG of a digital artwork, and I have a JPG of it, what's the difference? Yours is signed on a chain? So what!

4. What does it even mean to own a digital file?

If you own a physical thing, like a CD, you can sell it. Maybe it is an ultra-rare pressing and the price goes up and you make loads of money. Nice.

What does it mean to own an MP3? Nothing! Sure, you could sell it - but you'd also be able to keep a copy. And anyone who has a copy can distribute it for zero cost.

What does it mean to own the publishing rights to the music? Aha! The law will probably grant you a monopoly on being able to monetise the music. But as soon as you restrict supply, users will just start illegally republishing digital copies.

What does it mean to own art on the blockchain? Less than nothing. At best, it is a weak claim that the person adding it to the chain is the original creator. That's nice from a provenance point of view. But so what?

Look - I've been down on this nonsense since a blockchain certified that I painted the Mona Lisa.

In conclusion

I'm tired of this. We know that the allure of vast riches attracts scammers to any industry. But I see no utility in NFTs whatsoever.

I guess if people really want to waste their money on digital Beanie Babies, go ahead. Just know that like GameStop shares, the market is rigged and those pushing this grift are the only ones likely to profit - not you.

Alberto Brandolini

@ziobrando

The bullshit asimmetry: the amount of energy needed to refute bullshit is an order of magnitude bigger than to produce it.

---

Blimey! Thankfully, that was a pretty brazen and inept attempt at phishing. Anyone asking for all your card details like that should set the alarm bells ringing. Of course, phishers often target credulous people who don't understand that they're being scammed.

By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor. Cormac Herley - Microsoft Research

Investigating the account might not have given much of a clue about its dodgy nature.

Superficially, it looks identical to the official account. It even has a verified badge on its Tweets. How? Because all it does is retweet the official account it is spoofing!

Looking closer you should be able to spot that it is a fairly new account with zero followers. Oh, and the name is "Virgimendia"! The kerning of fonts on a small screen is likely to confuse lots of users.

They were quite clever in targetting people who had mentioned the official account. This is similar to a Twitter phishing attack I blogged about 5 years ago.

I tried my luck at baiting the scammer - to no avail!

Their use of language suggests they're a British English speaker. At least, I assume they're not thinking of me in cryptographic terms!

A bunch of us reported the account, and by the next morning it was gone.

The disturbing thing about this, is that the scammers had been operating for at least a week. Virgin Media had been alerted, but seemingly didn't take any action.

(Content Warning: The following Tweets contain racist language and encouraging suicide.)

Sharon Field

@SharonField3

Blocked and unblocked me just to send that last bloody message! 🤣🤣🤣 @virgimendia says you sitting at home in your mums basement have fun with that one pic.x.com/8RIm648hi7

Sharon Field

@SharonField3

Replying to @DeniseHodg19@DeniseHodg19 @Mchughhugh @virginmedia @richardbranson I’ve just had a scam page DM me as well. I have reported it. Let’s hope the OP didn’t give them any card details as that’s what the last lot were asking for! Note the very slight spelling discrepancy on the @ name. Otherwise their page is identical pic.x.com/bAhonL1VLT

---

---

Adelle King

@Blackrose_uk

,@virgimendia THIS ACCOUNT IS GOING TO MESSAGE YOU PRETENDING TO BE VM AND ASKING FOR YOUR BANK DETAILS. IF LIKE ME YOU CATCH THEM OUT THEY ACT LIKE THIS.. pic.x.com/oSPTNVbWfm

---

https://twitter.com/julsbvby/status/1294702901835726854

poke681.bsky.social

@Poke681YT

Almost had me there @virgimendia pic.x.com/tb0AkLnUqv

---

Virgin Media ❤️

@virginmedia

@misslisa811 Sorry you've received this fraudulent DM Lisa. By now I am sure you're aware it was not from Virgin Media as firstly we'd never ask those questions and secondly we do not offer a DM option. Please can you you forward the twitter handle of the sender so we can investigate? ^LS

---

Lisa Jones

@misslisa811

@virginmedia @virginmedia it came for your twitter handle.... last night. I have also reported this to your customer services but they didn’t seem to concerned... told me to opt out of text message notifications :/ pic.x.com/HJvm9R4Wz4

---

Could automated tooling have stopped this? To a human it looks pretty obvious that this is a scam. But what heuristics would you use to train a model designed to stop this? And how many false positives would it detect?

Stay safe out there.

Support Dom in his quest to run 26 half-marathons in 26 silly costumes in aid of a children's hospice.

I managed to drag the call out for 6 minutes - have a listen:

I'm not a brilliant scam bater. I didn't manage to get his address, discover when he got my number from, or find out any significant details. But that wasn't my goal. With most of these phone scammers, I have two objectives:

1. Keep them on the line so they can't defraud anyone less sceptical than me.
2. Get them to see the error of their ways.

I'm usually pretty good a (1). Stringing people along is easy, but risks getting further unwanted calls.

(2) is more difficult. I sometimes ask them if they think what they're doing is legal. Or I ask what they wanted to be when they grew up. Some people genuinely think the call-centre they work in is a legitimate company - they're also being scammed by the scammers. It's usually fairly easy to turn those people. Asking them if they've ever Googled for "company name + scam" is enough to get them to see the truth.

Sadly, I don't think my call with "Björn" is likely to have changed his mind.

What's doubly annoying is that the phone number has been marked as a scam for months. According to OfCom it is registered to BT. Of course, it could be a spoofed number. STIR/SHAKEN can't come fast enough!

*sigh*

These scams are really common. And pretty easy to pull off. Renting an expensive sports car for a day is relatively cheap. Drive it to some fancy locations, wear a couple of rented designer clothes, perhaps pay for a pretty model to pose as your girlfriend, take a load of photos and you can fool Instragram users into thinking you're rich and successful.

And then you tell people on social media that if they want your lifestyle, they just need to "invest" in...

And, if you're really lucky, you can con a major newspaper into running puff-pieces on your wealth. Which draws in more marks.

It's all lies.

Incidentally, the DVSA take absolutely no prisoners!

Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date.

If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? A quick look at the URl shows a trusted domain at the start - followed by today's date.

It starts with https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain?

Scammers know these domains get blocked pretty quickly - so there's no point registering a generic name like billing-pdf.biz only to have it burned within a day. By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious.

Is there any way to stop this? No, not really. Domain names are cheap - you can buy a new .info for a couple of quid. The https:// certificate was freely provided by Let's Encrypt. The site was probably hosted somewhere cheap, and whose support staff are asleep when abuse reports come in from the UK.

And that's the price we pay for anyone being able to buy their own domain and run their own secure site.

Money and technical expertise used to be strong barriers to prevent people from registering scam domains. But those days are long gone. There are no technical gatekeepers to keep us safe. We have to rely on our own wits.

Would you fall for this fraud?

You'd probably realise that this was a (crap) text-to-voice system and that the tax authorities are more likely to send a letter than a phone call.

But not everyone is so switched-on. If you've not had many dealings with HMRC, would you know how they contact people? If you're on a noisy train and all you hear is "final warning.... legal action..."

You can learn how to stay safe online and report scams at https://www.gov.uk/topic/dealing-with-hmrc/phishing-scams

Early one morning, I received this email from someone I know (details redacted by me).

It came from his email, it has his signature at the bottom. This doesn't look like someone hijacking his email so far.

I don't put much stock by "Protected by Antivirus" claims - because they provide no proof that scanning has taken place.

I know you shouldn't open attachments. But it's a PDF and Google is showing a plausible looking preview. It was early in the morning, and I clicked on it.

*sigh* Last night I had factory reset my phone. I was slowly logging back in to all my services. So this screen wasn't unexpected for me. And, to be honest, I've got a bunch of Google accounts and always have to log in and out of them. OK, let's type in my email.... WAIT! WHAT?

A look at the URL bar shows accounts.googledrive.com.adge.gq. That's not a Google URl. Had they used something like login.accounts.googledrive.com... it would have been long enough for me not to see the phony adge.gq at the end. I'd almost certainly have clicked through.

The rest of the page is a pixel perfect recreation of the Google login page. With the exception of the "email provider" choice. If I'd have been less awake, I'm fairly sure I'd have fallen for this.

I put in a fake email just to see what would happen.

Asking for a password - thankfully, the scammers didn't use Gravatar to show the user a picture of themselves.

I put in a fake password - and got this extraordinary attempt to phish my details.

ARGH! Trying to steal yet more information. That's a realistic error message. I'm used to seeing asterisks blocking out my sensitive details.

If you fell for this, you've given up your email and password - no doubt used to send more spam - and opened yourself up to a barrage of scam phone calls claiming to be from your "email provider". If you reused your password with any other service - like your phone provider - your entire online identity is at risk of compromise.

I know what you're thinking. I should never have clicked on that link in the first place. I am usually quite security minded. In fact, before clicking on it, I long-pressed on the link so that Google could show me its destination.

Even a vigilant user gets no protection here from Gmail.

Today these criminals were unlucky. But they only have to be lucky once. Users will have to be lucky always.

Terence Eden is on Mastodon

@edent

Warning! I'll be on @BBCRadio4's You And Yours shortly.
Please tune your wirelesses accordingly. pic.x.com/6f3zsiwuin

---

Several people had contacted the show to say that they had missed calls from the number "08454290015" or "08439800142" - despite not answering the call, nor dialling it themselves, they'd been charged significant sums of money for receiving the call.

In once case, a couple had been charged over £300 for a twelve-hour call!

I did some digging on this. While it is hard to gather solid evidence without access to billing systems, I think I can see what is happening. Sadly, at the moment, there is no way to prevent this scam.

Firstly, I went to the regulator. According to Ofcom's data, the telephone number range is allocated to Red Telecom Solutions Ltd. They're a reseller of telco services - in this case, I think they are blameless. They've just rented the number to the scammers - and it would take a court order or Ofcom investigation to get those details.

Normally, dialling an 0845 number from a mobile is expensive, but answering it shouldn't cost anything.

Based on other complaints I've seen, it looks like people are being stung by a "reverse charges scam". On a normal reverse / collect call, the person answering the phone is asked to press a number on their keypad to accept the charges. In this case, customers are played a message like "You've won an iPad! Press 2 to find out more!" they're then played a longer message while the reverse charges rack up.

Finally, in the case of the couple who supposedly made a 12 hour call (without noticing and without the phone's battery dying) - the only explanation I can come up with is that someone has submitted mistaken or fraudulent call records to the mobile operators.

I spoke to the You and Yours team about this on Monday (17 minutes in):

As I was in the BBC Oxford studios for the interview, the local radio team asked if I could pop on the Nick Piercey afternoon show - where I said more-or-less the same thing.

How To Prevent This

Sadly, as a consumer, there's not much you can do to prevent this sort of scam. It is up to mobile phone companies and the regulator to crack down on it.

That said, here are my top-tips to reduce the likelihood of falling prey to these sorts of scams.

• Don't answer phone calls from numbers you don't recognise. That's not always practical, I grant you.
• If you do answer a call and it asks you to press a number on your keypad, just hang up.
• Don't dial back missed calls unless you recognise the number.
• Use the PhonePayPlus Number Checker to see how much the call will cost you.
• Register your mobile with the Telephone Preference Service. This will prevent reputable companies from phoning you with marketing drivel. Doesn't stop the disreputable ones though.
• Run anti-virus on your phone to make sure that you don't have any malicious apps on there which could dial phone numbers without your knowledge.
• Use an ad-blocker. Some adverts can trick your phone into dialling premium rate numbers. Typically they require the user to manually hit the dial button, so such scams aren't too successful.
• If you're really worried, consider switching to a pre-pay / PAYG service. You won't be able to lose more money than you currently have in your account.
• You can see if your phone has been set to divert calls to a premium rate number. Most phones will have a menu in the dialer for this. If you can't find it, dial *#21# to see if you have diverts set up.
• It is possible to check whether your voicemail has been redirected to a premium rate number. Again, check your phone's menus or dial *#61# and *#62# and *#67#. Check with your mobile operator to make sure the details are correct.
• Finally, always check your bills! If there's something suspicious on there, contact your operator straight away. If they refuse to help, complain to Ofcom.

At the moment, most UK operators won't place a cap on how much of a bill you can rack up. My personal opinion is that needs to change. A cap exists for roaming charges and stolen phones, so it is technically feasible.

In the mean time, stay sceptical and keep checking your bills!

At the moment, Chrome (and other Android browsers) ask for permission before accessing features such as geo-location, camera, address book etc. This is a security measure to prevent your private information leaving your hands without your knowledge.

At the moment, accessing the HTML5 Vibrate API doesn't trigger an on-screen warning. Its use is seen as pretty innocuous. Because, realistically, the worst it can do is prematurely drain your battery. Right?

I'm not so sure.

Evil Thoughts

We've all seen those scummy adverts designed to look like Windows pop-ups. They usually pose as a legitimate system request - "Update Java" or similar.

Suppose a malicious web page pops up a fake system notification and vibrates at the same time. How confident would you be of telling the difference between a legitimate pop-up and a .png on the web page you're viewing. After all, the phone buzzed - so it must be genuine.

Are you really receiving an "AirDrop" - or is this page trying to trick you?

Autoplaying sound on adverts in annoying - auto-vibration could be just as irritating. Imagine searching through tabs until you found the single advert which was pulsing away trying to get you to buy new insurance.

For now, the intensity of the vibration cannot be controlled - only the duration. It is not impossible to conceive of malicious code being able to exploit an unpatched browser flaw and overdrive the motor to destruction.

Faking Telephone Calls

When combined with HTML5 Audio, it would be possible to create a fairly realistic "Incoming Call" screen which vibrated and played a ringtone. Once "answered", the page could play some audio which says "Hi, can you call me back urgently - my number is [premium rate line]" and then, perhaps, automatically open up the dialer using the tel: URI. Could you tell if the above was a real phone call? If you looked closely, probably, but when the browser is playing your phone's default ringtone and the handset is vibrating, it would be pretty easy to be confused. Combine it with a WebRTC call and you're looking at a very convincing scam.

Video Demo

Source Code

Here's a basic example which you can try on your own phone - demo site.

<body>
   <script type="text/javascript">
      navigator.vibrate = navigator.vibrate || navigator.webkitVibrate || navigator.mozVibrate || navigator.msVibrate;
      navigator.vibrate([1000, 500, 1000, 500, 1000, 500, 1000, 500, 1000, 500, 1000, 500, 1000, 500]);
   </script>
   <img width="100%" src="phone.png" onclick="window.location.href='tel:09098790815';" />
   <audio autoplay="autoplay">
      <source src="ring.mp3" />
   </audio>
</body>

At the moment, the auto-vibrate and auto-ring only work on Firefox for Android. But no doubt other browsers will follow suite soon.

Warnings

Firefox was the only browser I found which supported Vibrate - on Android, neither Samsung's browser, Chrome, or Opera did - iPhone also doesn't yet support it. No one cares about Windows Phone or BlackBerry - so I didn't test them*.

Firefox doesn't currently ask for permission when a page requests access to vibrate.

Do you think browsers should warn before a page vibrates - or is the risk too low? I guess we'll have to see if the scammers take advantage of it - and whether there is a user backlash.

*Update: thanks to the comments on Reddit and on HackerNews it would appear that BB10 does support the vibrate API, Windows Phone doesn't.

Just the look of those permissions is enough to break me out in a cold sweat! According to Lookout - the leading security solution for Android - it's a payware scam. No doubt ready to send a barrage of Premium SMS to drain my phone's credit.

It's quite upsetting that a company like Yahoo would allow adverts like this on its networks. I understand that they have to look at millions of adverts - and some advertisers will change their sites after the advertising campaign goes live - but there needs to be a better way of monitoring these scams.

They claim that by sticking a light in your ear, you can cure both depression and cancer. These are dangerous quacks who need to be stopped.

Earlier this year, the Finnish TV show "MOT" did a rather detailed exposé of Valkee:

Valkee won the "Hoax Prize" from the Finnish Sceptics' Society.

The Finnish health watchdog has already severely chastised Valkee and forced them to change their misleading adverts.

So, Valkee haven't provided any proof that their "invention" works - the few trials they've claimed to have performed remain unpublished. They've been slapped down by both health and advertising regulators.

Recently, a fully independent study looked at whether sticking lights in people's ears had any effect on them... The results are unsurprising: Extraocular light via the ear canal does not acutely affect human circadian physiology, alertness and psychomotor vigilance performance.

Valkee is a swindle. They're preying on people with mental illnesses and giving them false hope. Their claims to be able to cure cancer and Parkinson's Disease are particularly despicable.

For more information, please visit http://earlightswindle.com/