Old-school internet scams: five that just won’t die

We would like to think that people learn by their mistakes, and given the publicity surrounding certain online scams, nobody would fall for them any more.

Unfortunately, this doesn’t appear to be the case. Scammers are sticking with tried and trusted methods of stealing information and, ultimately, money from their victims.

The keyword for the people who perpetrate these scams is profit, and as long as that profitability remains, there is no compelling reason for them to be retired.

While the average PC Pro reader is surely too savvy to fall for such scams, the people criminals target are the less technically-adept family and friends that our readers provide free IT support for.

Point them in the direction of this feature, or print it out and make sure they read it, and you could save yourself some precious time. Here are our top five old-school scams that are still doing the rounds, and our tips on how to mitigate them.

This is Microsoft calling…

A PC Pro reader contacted us recently to advise he had just been cold-called by someone from the ‘Windows Support Service Centre’ which told him Microsoft had noticed he was downloading infections every time he browsed the Internet with his PC.

They got him to look at the Event Viewer and claimed all the entries under applications were infections and these were causing his PC to run slowly. The solution was to grant remote access (using TeamViewer to keep it simple for the victim) and, no doubt, then pay a fee of some kind.

These kind of ‘IT support scams’ have been ongoing for at least seven years now, and show no sign of stopping. Why would they? All it takes is for the scammer to persuade to victim, and they are always the less technically adept, to look at the Event Viewer in Windows and inform them the list of errors and system messages they see are proof of infection.

The payload for the scammers can be as simple as a one-off fee paid to remove infections that aren’t actually there, by directing the victim to a website where a fake scan will run, or by persuading them to allow the ‘support guy’ to take remote control of the target machine. Other times, scammers will try to convince victims to buy an ongoing subscription to a support service that isn’t needed, or to purchase rogue security software – which, ironically, may install data-stealing malware.

Android twist

A new twist on the tech support scam has been spotted by researchers at Malwarebytes, moving away from the traditional Windows using victim it has seen the perpetrators moving into the smartphone and tablet arena.

The mobile hardware is simply being used as a way to attack the desktop. The scam works by placing sponsored adverts in search engines that offer Android tech support. When contacted by phone, the scammers get the victim to connect the device to the desktop PC and install remote access software to enable the smartphone or tablet to be accessed and scanned.

Then the usual claim of an infection on the PC, causing whatever problems the victim was having on Android, is made – and the same-old same-old solution of a support subscription to make it go away offered.

Common-sense solution

To mitigate the risk of falling victim yourself, or more likely a family member less IT-savvy than you, common sense applies. Firstly, Microsoft advise that neither itself nor its partners make unsolicited phone calls in order to charge for security support fixes.

If the caller knows your name, that’s because they have got it from a directory or other mailing list; if they know your operating system, that’s because they made an informed guess (Windows 7 is the usual approach).

Secondly, never allow anyone remote access to your computer unless it is a verified and legitimate representative of a company you are a customer of and with whom you initiated the support contact.

Thirdly, if you are searching for help with support then search for the problem you are actually having and you will find lots of free advice online from genuine folk willing to help for free.

Never allow anyone remote access to your computer unless it is a verified and legitimate representative of a company you are a customer of and with whom you initiated the support contact

You do not need to pick a randomly advertised service (such as with the Android scam) online. If you cannot find the help you need in support forums then either contact your device supplier/manufacturer or a local IT support shop you can pop into yourself and see who you are dealing with.

Rogue software

Sometimes tied in with the Microsoft Support scam, but by no means always, the rogue software scam continues to show no sign of slowing down despite being more than ten years old.

The method of execution is always pretty direct: either a “support engineer” directs the victim to install the software, or pop-up messages on an infected website tell you that your PC is infected and offers a utility to clean it.

The latter method is actually very similar to the former, but takes the human element out of it; instead of a someone on the phone giving instructions, the victim is left to follow their own instinct and is prompted by the fear factor.

So just as rogue fire extinguisher salesmen used to shout “fire” through the letter box of elderly targets, so rogue software shouts “infection” at you through a fake scan of your PC.

The clever bit is that the software itself is often free, but installs data-collecting malware. Fees kick in when the victim wants to get rid of the infection.

It’s clever because the clean-up fees have to be reasonable in order to get a victim to take the bait, so even if done on a subscription basis the profit is relatively low. Throw in the data-collecting malware, however, and rogue software becomes the scam that just keeps on giving.

The mitigation is simple: ensure that every device is protected by a double whammy of malware detection software – even the most basic, comes-with-the-OS variety will do – and a little common sense.

Just as you should always make your own way to the online banking site if you get an email telling you there’s a problem with your account, rather than clicking the link provided, in order to check it out so you should always make your own way to a security scanning service. There are plenty of genuine, and free, services out there to quickly scan your PC and check for malware.

Download Malwarebytes and keep it on your PC ready to use when needed, or visit an online service such as those provided by security vendors Trend Micro, BitDefender or ESET.

Phish pharming

By now, everyone is aware of the email evil that is phishing: messages that attempt to fool the recipient into visiting a cloned website where login data can be harvested, infected sites where drive-by trojans can be installed to their PCs, or clicking links to directly download infected files.

Whatever the payload, wherever that end-point is, the phishing methodology will always involve pretending to be someone or some business that they are not.

Pharming ramps this passing-off process to another level. It’s a much more sophisticated technique that can fool even the more informed user, the type of user who thinks they have got the “stay safe” message and avoids link clicking, instead following the advice we gave in the rogue software section about always entering the URL directly in the browser.

Once a target computer has been infected with the appropriate malware, the scammers then have the ability to automatically redirect any browser-based request from the intended site to a fraudulent one instead. Of course, this does require the malware infection in the first place and anyone following the best practise advice of having suitable anti-malware protection in place can count themselves unlucky if hit.

Unless the scammers compromise the DNS server instead, that is. A process known as DNS Cache Poisoning, a type of DNS spoofing, can be used which will fool most people. This isn’t an everyday scamming scenario, we grant you, but it is still being used – and on a scale that warrants its inclusion at number three in our list. It involves compromising a cached DNS server at the ISP level by injecting a forged DNS entry into it.

If they manage that, and it’s by no means an easy task, then any user of that ISP trying to visit the target site will actually be automatically taken to the fake one instead. If this is a bank or payment processor, for example, the effort required to execute the attack becomes very profitable indeed.

Mitigation isn’t straightforward, and mostly needs to be done at the ISP level, although checking the validity of trust certificates (by clicking the padlock symbol in most browsers) is one way the end user can spot fake sites.

Facebook fakes

Scammers have been using Facebook ever since it first exploded onto the social networking scene, and sadly show no sign of stopping doing so. With a billion people to target the chances are high that they will get lucky, let’s face it.

The most common Facebook scams involve the Double-L factor, or likes and links if you prefer – which we’ve previously covered here, so read up on why you might want to think twice about liking and sharing fake Facebook messages.

Which brings us to what you just did: clicking a link when asked without really thinking about it. You can be forgiven for doing so here, after all you trust PC Pro and the link to another feature was within the context of the content you were already reading.

But to be honest, that’s exactly how the Facebook scammers operate: they leverage the trust you have in your network of friends and links appear to be validated as they come from people you know.

As far as context goes, many Facebook links scams will purport to deal with current events. Wen Justin Beiber gets arrested and is in the news, there will be messages flying around claiming to have video footage of him hitting a policeman or crashing a car.

Hitting the link to that video – which has arrived in your feed because a friend has already clicked the link and unknowingly caused it to be sent to everyone in their circle – will keep the distribution chain unbroken by sending it to your friends. That’s not all it does, however: it will also either ask you to download a module to enable the video to play (which will actually be malware of some description) or ask you to complete a survey before you can watch the video itself.

The video, of course, doesn’t exist, but the never-ending loop of surveys and download requests is very real and earns the scammers a small fortune by way of affiliate fees or advertising revenue. The same payload may be dropped onto unsuspecting social-network users who follow links to download apps to see “who has viewed your profile” or a similar non-existent Facebook function.

Voucher scams

Finally, again with the same payload, there is a seemingly never-ending supply of users willing to believe that by sharing a post and hitting a like button they can get one of a limited number of money-off coupons worth anything up to £150 from their favourite retailer.

As with most scams, the best mitigation is to keep your curiosity and greed in check. The “if it seems too good to be true, it probably isn’t true” adage usually applies. And just because a message appears to have come from a friend, don’t trust it if it’s asking you to click on something or like something.

At the very least, send them a quick message if they knew they had shared that? If they did, then a quick Google search on the subject matter may well shed some light on whether it’s a scam or not. If in any doubt at all, don’t click it.

If it’s a video you are after, go to YouTube and search for it yourself – outside of the Facebook environment. If it’s a money-off voucher, visit the supermarket website and see what it has to say, and email customer services to check if it’s for real (it won’t be).

Internet Dating

We really couldn’t leave a round-up of long-lasting internet scams without including the online dating game.

The scamming techniques here come from two distinct directions: fake profiles operated by con-artists and fake profiles operated by the dating site itself.

The latter is more common than you might imagine, with some recent investigative journalists revealing that teams of people have been employed to create fake profiles that show an interest in dating site subscribers in order to keep their subscription active.

This is bad enough, but at least the rogue dating site is only after your monthly subscription; the rogue soulmate is after much more. After registering with a popular dating service using a completely fake – but convincing – profile, the rogue romancer will proceed to woo anyone who contacts them.

After a period of regular correspondence online, which can also transfer to telephone contact (but never Skype as that would give the game away), an arrangement to meet is made. This is by far the most common method of realising profit from such a scam, but is not the only modus operandi so be warned.

Anyway, the person is either living abroad or at the other end of the country and, as bad luck would have it, cannot access their funds to buy a train or plane ticket. And so the sting begins, with money being transferred and arrangements being postponed for plausible reasons and more money being requested and so on.

Eventually the victim twigs and the scammer simply then deletes that account and moves to another profile. Both these scam methods are easy to mitigate against though, and the simplest way is to use a tool such as Google Image Search (images.google.com). Just drag and drop the image attached to the dating profile into the search box, and Google will find other occasions of the same image.

Scammers sometimes use not-so-well-known actors and actress pics, and often just images stolen from Facebook. They also usually reuse these across dating sites, and by searching for the image it quickly becomes apparent when a fake profile is being used.

Even if the person isn’t a scammer as such, and was just pretending to look like someone else, at least you’ve saved yourself wasting time on a faker…