Scamming Spammer Hooks the Wrong Person 408
CrypticSpawn writes "Read on SecurityFocus, a 55 year old woman spammed an FBI computer crime agent. She got caught mailing off a credit card scam to AOL users." Her scam targeted AOL users with messages saying their credit cards were refused during the last billing cycle, and linked to a false billing center page which demanded private information.
How gullable can people be? (Score:5, Interesting)
With the same logic, phone someone up, and tell them that if they don't want to be 0wN3d, they should disable their firewall, and tell you their IP address...
The darwin award exists for those who kill them selves in stupid ways... we need to invent an award for idiots that fall for obvious scams like this.
Re:How gullable can people be? (Score:3, Informative)
Re:How gullable can people be? (Score:3, Insightful)
Re:How gullable can people be? (Score:2)
Re:How gullable can people be? (Score:3, Interesting)
Re:How gullable can people be? (Score:5, Funny)
There is - it's called "Manager".
Re:How gullable can people be? (Score:2, Interesting)
Re:How gullable can people be? (Score:3, Insightful)
Think about it, how many
The fact of the matter is, most of us geeks just aren't good communicators and teachers when it comes to people outside of the community. We
Re:How gullable can people be? (Score:3, Funny)
NAZI!!!!!
Yeah, I think that's it.
Oh, wait. I can't talk now, there's an important message on the TV just for me and they're waving something shiney that goes "Ping!" It's not even $100, just 79 payments of $19.95.
Wow! I can afford $19.95
Gotta go.
KFG
Social Engineering (Score:3, Informative)
I received an email that was purportedly from Citibank, saying that I had received a money transfer. It was slick. The scammer had gone to a great deal of trouble to make it look like a real email from Citibank. The associated web site also looked real.
What tipped me off? The email asked for too much information, the scammer was being greedy. Examining the HTML source of the email revealed that the web site was in the wrong domain for C
Re:Social Engineering (Score:3, Informative)
Re:Social Engineering (Score:5, Informative)
http://www.myrealbankname.com:whatever@rea
The "www.myrealbankname.com:whatever" before the @ is not a URL, but a value sent to the real site which is denoted by the "realIPaddressindotlessformat".
For example, cut and paste this into your browser:
http://www.kuro5hin.org:section@1109654166/
The above URL doesn't take you to Kuro5hin, it takes you to the Slashdot main page.
Re:Social Engineering (Score:4, Informative)
Opera warns you every time you try to access a site with a username in the URL - does Mozilla do this too?
No, it doesn't yet. I agree-- it should. Mozilla bug 122445 tracks this issue. I suggest voting for it.
(Copy and paste5
http://bugzilla.mozilla.org/show_bug.cgi?id=12244
into your browser to go there; Bugzilla doesn't allow links straight from slashdot.)
Re:How gullable can people be? (Score:2)
Password Checker! (Score:5, Interesting)
People would show up and type in something that looked like a real password, and then type in another password as a message to me -- along the lines of Fuck You on a Silver Platter, Asshole.
Hackinthebox.org [hackinthebox.org] posted the site and a pile of gullable flies* showed up to check their passwords. I'm guessing people from HiB would send the site to other unsuspecting people, as a joke. Thing is, eventually some pretty scared people were emailing me. I took it down after while. It was getting to be more annoying than fun.
There is always someone out there who is greedy or scared enough to be scammed online -- it's just sad when it happens to someone you know.
* flies: a fly is someone who gets stuck in the web, and a spider is someone who owns it.
Re:How gullable can people be? (Score:3, Interesting)
Re:How gullable can people be? (Score:2)
Funny you should say that, my first reaction to this was that we should invent some new punishments for these scum-bags that at minimum involves removal of their reproductive organs.
Both the victims and the perpetrators of such crimes would seem to be a threat to our species.
Spammers and law enforcement (Score:4, Insightful)
Re:Spammers and law enforcement (Score:2)
FBI uses AOL (Score:5, Funny)
Re:FBI uses AOL (Score:5, Funny)
Re:FBI uses AOL (Score:5, Funny)
Now they are going for
"Investigation Time for America"
Re:FBI uses AOL (Score:5, Funny)
Re:FBI uses AOL (Score:3, Funny)
-Seriv
Re:FBI uses AOL (Score:2)
What I found more disturbing was that they don't have any clue about computers whatsoever. I interacted with them once to report progress on tracking an intruder, and to request help. They didn't understand anything I was telling them, since I was using advanced words like "DoS", "packet sniffer", etc. They asked me to mail them my logs... as in print them out an send them by post. They said they didn't have the ability to receive
They have geeks too! (Score:2)
That said, even FBI people get to go home sometimes [and contrary to /. opinion they aren't all hot-n-horney doctors or 1-900 addicts] and some of them probably even use AOL. This spammer just mailed the WRONG person. but you're right, normal FBI guys wouldn't have even noticed that the spam was a
bigger catch than just that (Score:5, Insightful)
She isn't the only one going down. But, sadly, there are still many more to go...
Phish (Score:2, Funny)
--matt
People aren't what you'd expect (Score:3, Insightful)
What this story teaches us:
- Little middle-aged (well, quite ripe already) ladies are not to be trusted
- AOL users are idiots, since they are prime targets of even little middle-aged lady spamsters
- FBI agents too open AOL accounts, which is worrying in a sense
Re:People aren't what you'd expect (Score:2)
I would imagine that FBI agents have AOL accounts to track people who are attempting to commit computer crimes, since AOL is probably a very target-rich environment.
Re:People aren't what you'd expect (Score:2)
Logic 101... (Score:5, Insightful)
Actually what it teaches us is
- Criminals don't wear stripes and sound like Cagney
- For any scam the best approach is to target the largest user group... more people means more idiots
- The FBI staff use personal email
This is exactly what you should expect, the FBI aren't a mixed race of mutant beings, and large crimes can be commited by pretty much anyone.
Re:Logic 101... (Score:2)
Notice the Stripe on the Hat [angelfire.com]
No wonder! (Score:4, Funny)
Earthlink users are getting similar spam (Score:4, Informative)
I've had about 2 e-mails a day of this ilk with respect to my Earthlink account for at least 3 months. A similar scam is in work with respect to Paypal. You don't need to be a total dunce to fall for this, either. Just naive and not savvy with raw e-mail source.
Re:Earthlink users are getting similar spam (Score:2)
eBay gets 'em a lot, I've seen some exceedingly slick ones.
Re:Earthlink users are getting similar spam (Score:2)
Does anyone know how I could block this guy from sending me e-mails? Not just in the e-mail cl
Re:Earthlink users are getting similar spam (Score:2)
Re:Earthlink users are getting similar spam (Score:3, Informative)
You know, there's a real easy way to stop that [earthlink.net]...
Seriously, I find that challenge-response e-mail does to spam what Moz does to pop-ups.
Hooks the wrong person? (Score:5, Insightful)
Unfortunately it is the case (Score:2)
The FBI clearly knows this kind of thing is going on, but they can't be bothered to do their job and protect US citizens (to be fair, they are too busy snooping on us and reading our private communications). Heck, you could have reported stuff like this and t
Re:Unfortunately it is the case (Score:3)
I used to send crap like this to the FTC all of the time, but now I just send it to them if I accidentally open one instead of deleting. If I am using AOL I ureport the spam using the AOL utility. Does not seem to slow it down one bit.
Face of a scammer (Score:2)
--
Geez... (Score:5, Interesting)
See for your selves (Score:5, Informative)
Re:See for your selves (Score:2, Funny)
"Your current information will be stored in a 256-bit encrypted protected server."
Re:See for your selves (Score:3, Funny)
Honestly, is amazes me that people fall for crap like this. It always reads like someone in bulgaria wrote it with with an English/Bulgarian dictionary. My favorite misspellings/miswordings are "asterik" and "social insurance number".
Fraud-ian slip (Score:2, Funny)
"Entering Fraudulent information is against the law. If done so on this form you are now hereby notified that AOL will persecute, fine, and charge anybody trying to commit fraud with our accounts.
persecute:
Re:See for your selves (Score:2)
It also says: WARNING: Credit-card fraud is a criminal offense. For your protection all transactions are carefully monitored and logged including IP adresses, ISP, and other pertinent information.
Hilarious! Ironic?
If you do view source, you'll notice that the javascript used on the form is quite lame as well.
Re:See for your selves (Score:2)
Re:See for your selves (Score:2, Funny)
No, poeple don't. They're probably very used to seeing spelling errors on the Internet, so it doesn't phase them.
apathy in law enforcement (Score:5, Interesting)
Danger Will Robinson, Danger! Rant Ahead!
Read on SecurityFocus, a 55 year old woman spammed an FBI computer crime agent.
Great. So what about:
...? It seems like every day I'm reading about how some guy got screwed over and the FBI/SP/Local cops just didn't give a shit enough to do anything about it, whether it was technology related or otherwise, because it wasn't sexy enough. Crime is crime is crime.
Case and point, you can pretty much scam anyone outside of your state and get away with it because interstate fraud laws have a $5,000 'ground floor'. That single law is probably the most responsible for the prolific fraud we've ever seen, virtual or otherwise. I could loose $4900 tomorrow and the FBI won't do jack shit. Some FBI nerd gets a scam email any moron would know not to answer, and they call out the swat teams. Faaaaantastic.
It's like the local cops who don't give a shit if your laptop, your radio, etc were stolen and hundreds of dollars in damage done to your car. But, mind you, they've got all day to sit out on 'speed patrol'...
Re:apathy in law enforcement (Score:2)
Crime is crime is crime but there is too much of it and not enough money/resources/people/time to stop it. So you go where your effort has the most impact.
Cops DON'T care about the little things because they have bigger ones to deal with. It's true. I had to track down a laptop thief myself (and I got my laptop back) because I knew the cops wouldn't do anything about it. When something of yours gets stolen, you need to get on it right away and get it back. Hire
Re:apathy in law enforcement (Score:2)
Besides, you may want to learn the difference between a traffic patrol officer and a detective.
Re:apathy in law enforcement (Score:2)
I think you missed the point here. This con artist got caught. It is news because we can all take revenge on spammers vicariously through reading this. It feels better than the end of a bruce willis movie.
*bzzzzt* (Score:5, Informative)
I hear you on the FBI thing. But consider: somewhere a just-not-worth-the-taxpayer's-money line has to be drawn. The FBI is seriously understaffed. (Go figure. The technologically astute are too proud to work for a measly $35K FBI salary, investigating tech crimes. Nooooo, gotta be making glamourous six-digit salaries on high-visibility programming projects.) But anyhow, the reason I'm posting is...
Unless you live in Andy Griffith Town, the officers who sit on speed trap duty are not the same ones who investigate theft. Different division, different rules, different salaries, therefore a different allocation of officers/resources/time/budget.
A traffic cop "sitting all day" on watch costs less than an investigating agent spending even half a day looking for stolen laptops chock full o' pr0n. It's harder to hire investigative officers and detectives, it's more expensive to train them and pay them.
Re:*bzzzzt* (Score:3, Insightful)
But how do you cost a crime? If you lose $500 from a stolen Credit Card, well, it's hard to justify a months worth of police time to track down the cuplrit.
But if say 1,000 people were each defrauded of $500, that half a million dollars obtained illegaly. But each complaint is only $500, too small to be investigated.
Makes you think, doesn't it.
Aggregation vs.single-time losses (Score:2)
Consider three cases - a single loss of $10k, a hundred people losing $1k, or 10,000 people losing $100.
There's no way the $100 loss would be investigated by any law enforcement agency, but it's the largest loss by far. Meanwhile the single loss of $10k is the smallest aggregate loss by far, but most people are going to really feel that loss while the $100 loss is usually (but not always) easily
There are so many... (Score:5, Informative)
I once received an email with a link that said that I needed to "update" my eBay account with a new: credit card #, my SSN, DOB. The funny thing is I never had an eBay account - ever.
I was at a hotel in Houston one time and I wanted to use my calling card to call home. After following the directions listed on the phone a few times, i was redirected to some telco that I've never heard of, and someone came on the phone, asked for the number I was calling and my calling card number. He then asked for my PIN. I said no way. He then told me that he couldn't make the call. I hung up.
Later, at the airport, my card worked perfectly. I wish I got the name of the telco that was blocking access to my long distance company so I could have filed some sort of complaint with the FTC.
Is it common practice for hotels to block access to your long distance provider so that you have to use their company for help that they charge you for?
I've gotten so paranoid, I've repeatedly hung up on legitimate calls. It's unfortunate, but this shit is hurting legitimate businesses and making it harder for us consumers to know if we're being taken or not.
Re:There are so many... (Score:5, Interesting)
Maybe a scammer just put his own sticker on the phone when he had the room before you. I doubt that housekeeping checks for that kind of thing.
Re:There are so many... (Score:2)
Yes, and it's illegal.
Complaints should be filed with the FCC.
it gets better (Score:5, Informative)
this story has more detail [hamptonroads.com]
so it's only an issue if it's personal? (Score:4, Insightful)
Re: (Score:3, Informative)
But why.. (Score:3, Insightful)
Its like waiting for a police station to be burgled before the police take action..
Some of these frauds are pretty blatent (penis enlargement pills etc), you dont need to be sherlock holmes to track them..
Re:But why.. (Score:2)
Are you saying Sherlock Holmes' little friend was really called Johnson, not Watson?
Oops... (Score:5, Interesting)
Re:Oops... (Score:2)
smart lady (Score:2)
Originally a Canadian scam (Score:2, Insightful)
conversation with my credit card company (Score:5, Interesting)
CC Company: No, but that sounds like a great idea.
me: Yes. Now do something about it.
What do you think the odds are that the idea ever got past the person I talked to on the phone?
Re:conversation with my credit card company (Score:3, Insightful)
based on that, I'd say the odds are pretty damn slim.
wouldn't work for long (Score:3, Interesting)
I got a very official looking e-mail from "PayPal" asking for all my information. Then I noticed the URL and that my password wasn't getting asteriked and typed in "howwouldyouliketogotoprison" in the entry fields and hit submit. I also e-mailed PayPal and within minutes the site was gone. I doubt I was
Re:conversation with my credit card company (Score:3, Insightful)
The problem with the general public having its own poison number for inputting into scam forms, is that someone with a grudge could input said number into legit forms, and ca
Re:conversation with my credit card company (Score:3, Informative)
I work in such a company - while I don't work on a financial contract there are several in the office I'm in for banks everyone of you has heard of.
In many countries they don't have as many privacy laws as
Re:conversation with my credit card company (Score:3, Insightful)
The US has privacy laws? You mean the ones that allow companies to sell the information they collect on you, without your permission? And the ones that have no requirement for companies to protect said information against theft by outside agencies?
Yes, those're mighty impressive laws.
If you want to see privacy law, try looking at New Zealand's Privacy Act, or some of the European legislation. The US may as well not bother pret
businesses cause these problems (Score:2)
On some occasions I have said I would call back so that I would be sure of their identity, and they get upset. (Yes, from a legitimate business calling for a legitimate reason).
Why must society slow evolution? (Score:2, Funny)
Re:Why must society slow evolution? (Score:2)
Um, Shouldn't he have got this ON THE JOB (Score:2)
Spamers lack imagination. (Score:4, Insightful)
Light punishment? (Score:3, Insightful)
That's it? 37 months in prison for her cohort.
Yet the RIAA is trying to hit people for $150,000... and Ashcroft wants "hackers" sentenced as terrorists and put in jail for LIFE.
Want to stop identity theft? Jack up the jail term..big time. 3yrs in jail for stealing a ton of credit card numbers is pretty weak.
Re:Let em guess she was American ? (Score:3, Insightful)
Re:Let em guess she was American ? (Score:2)
I bet postmaster@homelandsecurity.gov gets plenty of spam...
Postmaster, Instant Pleasures
Hey Postmaster! We were waiting for you last night
Postmaster, v^iagra is cheapest here............2qx3
postivic@homelandsecurity.g o v, thanks for your purchase
100% satisfaction guaranteed on inkjet cartridges, postmaster xd ds jj1esdzzb
Postmaster, get home delivery of V a l i u m and V i a g a r a
Postmaster You could have money coming blackbody
Re:Let em guess she was American ? (Score:5, Insightful)
They are very convincing... stealing all the branding of a legit informational email. I'll tell you, my mom and dad just cannot tell the difference between http://www.citibank.com/signup/account.jsp and http://www.citibank.com@192.168.0.1/acct.jsp.
These scams can be compelling to people who don't understand that ALL email should be untrusted, and that all URLs within email should be untrusted, and that all forms that you fill out should be untrusted.
Re:Let em guess she was American ? (Score:2)
Re:Let em guess she was American ? (Score:3, Informative)
Re:Let em guess she was American ? (Score:5, Funny)
Do wish to have arcane knowledge and be the envy of your 133t friends? How on earth those spammers, well know for deep knowledge of the darkside, produce a cent sign when it isn't on the keyboard?
You (sir/madam) have been carefully selected as one the few who have what it takes to secret forces and such power right at your fingertips!
Don't be a clueless dork anymore. Just send $19.95. Your seat at the table of the Illuminati is waiting. . . for you (sir/madam)!!!
KFG
Re:Let em guess she was American ? (Score:2)
Re:maximum of five years? (Score:2)
Re:maximum of five years? (Score:2)
Seriously, knock off a few spammers and see what happens.
They way they are being treated now, it looks like the law looks the other way. Spamming is several crimes. Misrepresentation, fraud and theft of services to start.
Re:maximum of five years? (Score:2)
You don't wanna end up on the death-row because a particularly savvy spammer managed to pull off the perfect forgery with your name on it...
Re:maximum of five years? (Score:2)
Really. I don't know what it is.
Re:maximum of five years? (Score:2, Informative)
Millions of spam go out, and the named joe gets hit with all the ire and bounced-mail replies. His ISP usually becomes quite upset with him as well, and he's left trying to explain to everyone that he doesn't even know what the hell is going on.
Its a really neat way of framing somebody on the internet - making it appear to
Re:Bad argument (Score:2)
You can't reverse all of the punishment, but you can reverse part of it.
Re:hm (Score:3, Interesting)
Read this [deekoo.net]. Be sure to read all the way to the end for fairly positive proof that the guilty party was, indeed, a woman. In fact, it was a woman-owned, woman-run, all-female spam gang.
Regards,
Anne
Re:Here is more info on her (Score:2, Informative)
Re:I don't think we should prosecute these people (Score:2)
Re:I don't think we should prosecute these people (Score:3, Insightful)
I know some extremely intelligent people who fell for things like that.
It is not about how smart you are, rather it is
whether you choose to belive certain things or have the experience to tell the scam from the real thing.
Re:What's wrong with FBI having an AOL account!? (Score:2)
The FBI agent was off-duty.
-Lucas