Here, try Windows scam artists to trick credit card from us
New phone scam spreading, see how it went when they called Hardware.no.
NIKLAS PLIKK - 21st August 2013 3:39 p.m.
Anyone who has an email account is used to get inbox full of all sorts of possible fraud attempt. We have learned to filter out the worst, which offered millions from a Nigerian prince, or the bad formulated messages from the "bank" your saying that your password has expired. All this has been negligible garbage in a digital world, and even the most data-blind realize that there probably is not a good idea to press the weird links sent to you in an email.
But what do you do when someone calls you? What do you do when they say they are calling from Microsoft, and will help you remove viruses from your PC? This has become the new popular form of fraud, and only the last few weeks, several of the editors experienced getting calls from unknown numbers on his private cell phone. Finally curiosity took over, and we thought that next time we should see how far scam artists actually were willing to go.
Watch a video of the fraud attempt here:
[video]http://publisher.qbrick.com/Embed.aspx?mid=ADC1000C[/video]
The project begins
It was almost too good to be true when a fraudster called out of the blue, in the editorial meeting on Monday. Everyone around the table smiled when the phone was on the table. We knew what we were going to do, but it had to happen quickly. It was "Edward" from "a" caller, and would save my PC from viruses and total destruction. Terrific. I thanked quickly that he would help me but said that I was not at the computer. We agreed that he could call me back in an hour. Now we had to act quickly to put it all together.
Our quick-witted IT apprentice Ole pinpointed a laptop we could use, and sets quickly started to mirror the contents of a hard drive. This was to be PC we would give control over to the bad guys on. Hardware-editor Jørgen ran and fetched the camera, checked the memory card was empty. People were warned to be quiet when the call came.
The conversation we had been waiting for
After almost exactly one hour came the phone. I waved Jørgen over, screaming that there were swindlers. Ole worked diligently to back up your hard drive to the laptop, but it was not finished. Not good. I still took the phone. This time it was "Michelle" from "a" caller.
- Hi, this is Michelle from Microsoft support caller. You spoke earlier with my colleague Edward said you wanted to be called again later. Are you ready to fix your PC?
Of course I was not ready. The fraudster clear PC was not ready, and my regular work machine at work is a Macbook, of course, completely free of Windows.
- Uh, hey, yeah, if you could just wait a bit and I'll find my PC, I stuttered. I had to find a PC as soon as possible. Varg the Hardware was the unlucky victim, who had to give up her seat for the project to be implemented.
- Varg, I need your PC, I whispered, as I told Michelle loud and clear that I had taken up my PC.
- Brilliant!, Came from Michelle.
She seemed both professional and strict, though she might went through the steps a little well kept.
She spoke English with a thick Indian accent, which did not make it any easier to understand, but fortunately it is not the first time I've used a PC. This should be interesting.
Step 1: - Sir, your PC is infected
It did not take long since she had introduced himself to her began to command me to perform a series of commands on the computer. Everything to prove that I had viruses on your computer, of course.
To prove it all Michelle would direct me to the Windows Event Viewer, which is a Windows feature notorious for being misused by fraudsters.
- Sir, what button you see at the bottom left of your keyboard?
- I see the ctrl button
- Okay, next to the button, you see a square windows logo? Can you find it?
- Yes, yes, I found it.
- OK, brilliant! Press the button with one finger and use another finger to press the letter R for Robert with another finger. What do you do?
- Uuh, yes, when I see a Run window.
This continued the conversation for an eternity. We finally got into the Event Viewer, which for the uninitiated looks like a pretty scary affair. Here you will in fact know that things have both stopped working and that things are in danger, even though this really is normal. Even on a completely fresh computer or new computer in my case, it pops up tons of "error" here. This is therefore also a favorite place for predators, as they can easily persuade the inexperienced PC users that there is something wrong with their computer. I played with as clear as Michelle explained that all these errors make your PC slow and that "it will ultimately cause Microsoft will block your computer from server's." But what had really all viruses come in on PC?
Well, let me tell you. This is the virus that has entered the computer while you're online or surfing the web. They corrupt the software on your computer, and make it slower by the day. As long as these files will continue to weaken the PC, the PC will stop working forever. This is the virus we are notified that you have through your Windows license ID, which is why we are calling you today. OK? We assist you. We will help you, Michelle explained.
Step 2: Let us manage your PC
Welcome to Cloudsoft | Cloudsoft
After a while, I headed into their seemingly professional website,
Welcome to Cloudsoft | Cloudsoft . Because it totally lacked both the Windows logo, Microsoft identity and a URL that had some of the names in it, I thought I would be a little difficult.
- However, this is a Microsoft website? You said you were from Microsoft, right?
- Sir, yes, I'm calling from the Windows support from Microsoft. This is a Microsoft website. We use this to help our customers. Sir, can you see where it says Customer Help? Yes? Press Customer help.
It was not easy to get into more words while Michelle chattering in the way, so I let myself fully guide into the scam's arms.
What then happened was that a pre-configured version of Team Viewer was downloaded. This is normally a very straightforward service to let a friend help you fix PC problems online. You and your friend control the mouse and keyboard, and he can see everything that happens on your computer. Of course this is not the smartest thing to do if you are sitting with a scammer on the other side, but what we do not for curiosity's sake?
- This is a program that allows you to connect to our servers, to fix all the errors on your PC. You can also witness what we do, since we do not have the authority to do anything on your PC without having to watch what we do, says Michelle. This would later prove to be quite far from the truth, when they began to remotely control our computer.
With a little help from Michelle got set up TeamViewer and the fun can really begin. Now the swindlers had full access to my computer, and suddenly everything went in a much faster pace than before.
Step 3: Identify the viruses
- If you look here, I'll show you, so you can see the mistakes we have to get rid of. You can click on them yourself if you want. Okay. There, where you see what is wrong. You can see the files. They no longer work because you have a virus, and ...
- So the viruses on my PC enables these services has turned off?
- Yes, sir, that is correct.
Michelle continued her carefully rehearsed tirade about all the viruses my computer is exposed to and how they can help me. For the uninitiated computer user, it may well be enough scare propaganda would work. She rattled off all the errors in a demonic pace, and I did not know better might things like "being banned from Microsoft's servers" sounded like real dangers. Sometimes she let us press a few buttons, sure to feel a little safer about giving us control of the PC, even if it really was little doubt about who really was in control.
She started to download the files from their PC via TeamViewer with friendly names like "AWCSetup_Major.exe" which would "scan my computer for viruses". While she installed the pressure she quickly through the Norwegian terms of use, which I just had to ask if I should read through it. I have learned that one should read through these terms of use before approving them, right?
- Yes, yes, that's no problem. I understand. I don "nårsk".
- Do you understand Norwegian?
- Yes, I understand Norwegian. I will help you, do not be afraid.
- Oh, so we can speak Norwegian when?, I exclaimed in Norwegian.
- Haha, what happens is that I understand if people speak Norwegian to me, and if they say something naughty of me, I can not speak Norwegian, but I realize that, OK?
I assure her that I should say something naughty about her. She laughs, and suddenly I have and Michelle become best friends. What a nice lady who just wants to help me get rid of all the stupid viruses on your PC!
Now things start to happen. The program starts to "scan" my computer for the presence of viruses, and of course find the tons of hazardous programs. The whole thing is of course nonsense and vas, but I play with. Thousands of viruses? Yeah, no, that's not good. For all I know, the program has already started to install any applications in the background, such as keyloggers and trojans. I pretend like nothing.
We agree that my hard drive is crawling with viruses, and something must be done. Michelle has done its job and spread fear. Now is the boss "Neil" who will take care of me, and lead me through the checkout process so we can initiate.
Step 4: You must renew Windows certification
Neil continues to pound into his rehearsed lines. "Your computer is infected", "this is all the viruses on your computer", "computer says that everything is wrong," "Something is wrong with your firewall" and so on. I have started to get a little tired of the same information over and over again, just presented in different ways. Then comes the key question: How old is your computer?
Of course I have no idea, as it is not even my own PC. Windows 7 pre-installed, however, it has a Core i7 processor and looks quite nice out. I guess in two years.
- Well, it's fairly new, I think. Maybe two years?
- Yes, if you see here on the screen so you can see that Windows certification went out. Can you see it? OK. It expires after one year, and your certification has expired. That's why your PC has been infected, you know? But, Sir, there is nothing to be afraid of, I'll open up a CMD scanner, you'll see one of the problems.
Neil goes on to describe exactly what is wrong and why I need to pay to renew certification. As if the explanations went slow enough already, he would now write down every point.
"CERTIFICATE EXPIRED"
"FIREWALL CORRUPTED"
... Okay, I see where this is going. The half-hour long conversation begins soon to reach its main goal. All the work of "Michelle" and "Neil" had culminated to this moment:
- These are the problems with your computer, and it will take some time to fix the errors. To do that, we will work with your computer between one to two hours. You can just leave it as it is, you do not have to do anything, otherwise we will call you back when we're done.
The subtext here is of course "when we are ready to ransack the computer password, user name and personal info." During the conversation, they have already set up TeamViewer to be able to do all my screen black so I do not see what they do, and I can not imagine what they could have achieved if they sat alone with my PC for two hours.
- But, hang with us for five minutes so you get registered.
- Register me for what?
- For certification. To obtain certification on be registered with Microsoft.
- Is this an annual payment?
- No, this is a éngangsbetaling that you only need to pay one time in your life. No matter how many computers you have.
And guess what the best part is? It costs only 35 Norwegian kroner! For a great price! That is of course if you disregard that they get the credit card number, password, username, and everything else you certainly will not give the scammers who live by stealing your money.
Step 5: - Give us your credit card information
I'm starting to realize that the call is about to come to an end, as he will soon ask us your credit card information. I see my screen turn black when "Neil" finds the registration website. When the screen finally lit up again, I see a reasonably ugly website with a few Microsoft and Windows logos slapped on. Still, I would almost give them some credit for having changed the URL in the address bar one microsoft.com address, so that it looked slightly more legitimate out.
I'm starting to fill out the form, and try not to comment on the dreadful design. Is there really someone who goes on this? I can notice the voice of Neil is getting more and more excited as I enter my fake user information. I approach ever credit card field, and Neil is so close to his goal. Just a little again!
- Well, I will not give you my credit card number.
- But, how will you give us your details then? This is a safe website, let me show you.
What happened next was almost unbelievable. This is the oldest trick in the book. On the web it is perhaps best known as Hunter2-trick , and Neil was certainly willing to try even the dumbest tricks to get your credit card number.
- Look, if I enter my digits, what do you see now?, Ask Neil.
I can see on the screen that he enter the four cross, "XXXX", and I tell him that it's just what I see.
- Yes, exactly, that's because it's a 3D-Secure website. I see the numbers, but it does not for you. If you enter the digits will appear for you, but I can not see digits. The website is designed in this way.
However, now there was an end to the fun. This had gone too far and I was going to stay in the game longer to Neil. Instead of writing numbers as he would, I wrote rather just enter XXXX-XXXX-XXXX-XXXX.
- So you do not see the numbers I have written now?
- Yes.
It is completely silent. He still continues the heroic way and asking me to continue filling out the form. I continue to fill in the corner.
It gets quiet. This is usually the moment swindlers can cheer on as credit card number finally registered, and the crowning glory is complete. So it was not this time. I press the "Upgrade" button at the bottom, and suddenly the whole scam starts to unravel.
URL transforms itself from the "Microsoft.com" to the slightly less credible URL "24x7windowsguide.yolasite.com/register ....." and I ask Neil what the heck is going on.
- Sir, this is our registration, it goes through Yolasite.
- Should not this be a Microsoft website?
- Sir, Microsoft is not a bank. Microsoft is not a bank. This is another website. For example if you are doing online shopping brings up another thing. For example, if you order pizza, or ....
I interrupt him.
- Sir, there are even "make your own free website with Yolasite" .... you just crafted a free website to defraud me?
- ... That is correct.
- That is correct?
- Yes.
- So you have called me and talked with me for 40 minutes to get my money?
- Yes, that is correct.
Neil honesty is quite excellent now that he had been revealed. I had expected that he would either hang up or even continue to lie, but here came the honest answers in a row.
- Yes, I think you should be sorry, how many scams you really every day?
- Uh, about 1000?
PC monitor my coming back to life again and the cursor flying around. If he can not get my money can he at least erase everything I have on the PC, right? In desperation, he goes into the Explorer, select all and press "delete".
- Deleting all now?
- Neeei, no, why would I delete something? We clean up trash on your PC.
Neil is back in sell mode, trying to assure me he will do us good. It makes us nothing, then everything after all is backed up, and there is nothing on the PC some of us will miss. The rest of the conversation you can see in the video below, in which we reveal to our scammer that they had called the newsroom to one of the largest IT sites, and we'd record it all.
Her prøver Windows-svindlerne å lure kredittkortet fra oss - Hardware.no
