A scam phone calls and emails discussion.

[AndrewE]

United Utilities (water) and Good Energy (dual gas and electricity) already have had me on their priority register in the 15 years since my 65th birthday.

I have looked at https://www.enwl.co.uk/power-cuts/extra-care/our-extra-care-register/ now and it looks like a really valuable extra fall-back... I shall certainly register there if/as I get more frail, but I'm felling pretty spry at the moment. I would suggest that (from what you have posted) you might well benefit, in fact might even be their target client.

 

[londonbridge]

Very realistic "PayPal" email today about suspicious activity on my account. One minor error was sending it to the email address of the society that I am treasurer of. There has definitely never been a PayPal account linked to that address.

Reported of course

This was mentioned in the latest issue of Computeractive magazine. Attached photo is of the article from the relevant edition, issue 719.

PayPal scams from ‘genuine’ email address

What’s the threat?

Scammers are targeting PayPal users with emails that appear to come from ‘service at PayPal dot com’, which is the address PayPal uses for genuine messages (though sometimes it ends with the suffix ‘.co.uk.’) This makes the scam very hard to spot.
It was detected by security firm Malwarebytes, which said scammers have used malware to spoof PayPal’s real address, so it appears as the sender in the ‘From’ field. The subject line looks plausible too (‘Set up your account profile’), which is repeated in the heading. The email itself claims someone has used your account to make a payment through the US cryptocurrency exchange Kraken.com, and says you should click the ‘Set up your profile’ button to dispute this.

How can you stay safe?

The biggest giveaway is that the email address shown isn’t your own, but uses a random name from a distribution list that represents a group of recipients. This allows the scammers to target people en masse.
To add urgency, the email says the link it wants you to click will expire in 24 hours. Emails from PayPal will never do this. Also, the email doesn’t address you by name, unlike genuine messages.

Meanwhile the food rewards scam I posted about earlier is popping up in more guises including Morrisons and Iceland, and also as part of another scam page/group called “UK Rewards”, which claims to be giving away free tickets to Alton Towers to anyone who comments with the word “Tickets”.

 

[najaB]

This was mentioned in the latest issue of Computeractive magazine. Attached photo is of the article from the relevant edition, issue 719.

They've over-stated the sophistication of the attack when they say "which said scammers have used malware to spoof PayPal’s real address" - unless they've used malware that sends the messages from within PayPal's infrastructure (so that the messages have a valid DKIM signature), then it's exceedingly trivial to display whatever you want in the 'From:' header. It doesn't even have to be an email address.

 

[londonbridge]

Reported the food rewards scam and associated pages and as usual Facebook refuse to remove it/them as it/they doesn’t/don’t violate community standards….useless.

 

[d9009alycidon]

Had the weirdest email today purporting to be from Yodel saying that they had a parcel (NHS test kit) for delivery and giving me options for delivery. All the links looked wrong so it was binned.

 

[Mcr Warrior]

Had the weirdest email today purporting to be from Yodel saying that they had a parcel (NHS test kit) for delivery and giving me options for delivery. All the links looked wrong so it was binned.

One that might first have been reported / on-sent to <information.security@yodel.co.uk> before then binning, maybe?

 

[d9009alycidon]

One that might first have been reported / on-sent to <information.security@yodel.co.uk> before then binning, maybe?

Got another one this morning so took your advice and forwarded it, Thanks.

 

[najaB]

Got another one this morning so took your advice and forwarded it, Thanks.

Time for my obligatory PSA: when forwarding suspect scam emails always forward the original as an attachment as that will preserve the email headers. Forwarding it in the usual way (e.g. CTRL+F) only sends the message body which is (almost) useless for forensic purposes.

 

[AndrewE]

A useful article in the Guardian today (where it might be least needed!) https://www.theguardian.com/money/2...gy-saving-plugs-will-cause-nothing-but-hassle

Cut your energy bills by a third? No, these ‘energy-saving plugs’ will cause nothing but hassle​

The plastic ‘eco-plugs sold via social media or cold calls either never arrive or have no benefits when they do. And they can be dangerous
“If a device really could cut energy bills by hundreds of pounds, it would be sold by major retailers and recommended by trusted consumer groups. The fact that it’s being flogged on social media or through cold calls is the red flag,” says Blagbrough.
...

“Some victims hand over hundreds for a gadget that never arrives. Others get a cheap, unsafe electrical item that can overheat or cause fires. In the worst cases, criminals use the purchase process to harvest card details for further fraud.”

The plug-in devices are sold for less than £10 and often claim they will save you money by managing the electricity supply efficiently, therefore reducing your electricity bill.
...

What the scam looks like:​

The devices are often labelled as “eco-plus” or “energy saving plugs” and are advertised and sold through social media or via cold calls. There may be fake endorsements attached to the adverts.

Often, the sale is simply a scam and people will receive nothing after the payment goes through. Or the payment details may be used by the criminals selling them for other crimes.

If the plastic devices do arrive, they often have poor-quality soldering, contain too much lead, and are potentially unsafe. A Which? investigation of some devices found the pins were often too short or snapped off easily.

 

[KevinBrum12]

A useful article in the Guardian today (where it might be least needed!) https://www.theguardian.com/money/2...gy-saving-plugs-will-cause-nothing-but-hassle

This is where the old "Watchdog" programme of John Stapleton and Lynn Faulds-Wood is missed. Back in the day, they would have been all over this. The audience who need to know about this dangerous scam are unlikely to read The Guardian.

 

[AndrewE]

This is where the old "Watchdog" programme of John Stapleton and Lynn Faulds-Wood is missed. Back in the day, they would have been all over this. The audience who need to know about this dangerous scam are unlikely to read The Guardian.

agreed, which is why I said "where it might be least needed!"

 

[cb a1]

Wasn't sure whether to post this here or in the 'What made you happy today?' thread.
Cold call about BT upgrading lines in the area and what's my internet speed.
After 2 and a half minutes the exasperated cold caller finally snapped with: "Are you stupid or an idiot?" To which I replied: "Both." At which point he hung up .
At least I wasted over 2 minutes of his day.

 

[3141]

I received an interesting email this morning (below). It must be a very large city with at least 174 district courts. I take it that Offense R. No is an identifier of the offense and not the number of times they think I've offended. I didn't click on the VIEW SUBPOENA DETAILS button which is presumably where malware starts getting onto the computer.

COURT SUBPOENA​

A FINE AND IMPRISONMENT MAY BE IMPOSED FOR FAILURE TO OBEY THIS NOTICE

Before the City 174th District Court Judge​

CASE NO.:​	187418601910-3​
COURT:​	IN THE 174th DISTRICT COURT​
OFFENSE:​	COPYRIGHT INFRINGEMENT​
Offense R. No:​	281709521​

VIEW SUBPOENA DETAILS



Delivered to: me@emailaddress

IMPORTANT: YOU MUST BRING THE ATTACHED DOCUMENT WITH YOU TO COURT.


Sincerely,



The Court Clerk​

 

[Xenophon PCDGS]

When I returned from my weekly NHS clinic visit, there was one missed call noted which had left no meassage. That call had an 01445 exchange number, which is in the Gareloch area of Scottish Highlands.

As I know no-one in that far-north region who would likely to call me, I have sent it into "scam call oblivion" and blocked it.

 

[londonbridge]

Reported the food rewards scam and associated pages and as usual Facebook refuse to remove it/them as it/they doesn’t/don’t violate community standards….useless.

Well I’ll be…..I reported it again the day after my earlier post and this time, after nearly a month, they’ve actually decided to remove it.

 

[Bevan Price]

I keep being bombarded with email claiming that my (non-existent) subscription to McAfee anti-virus has expired, with assorted - mostly suspicious "reply to" addresses. Most go automatically into the spam folder but a few get through to the inbox. Be cautious if you get anything similar....I just delete them all.

 

[DannyMich2018]

I keep being bombarded with email claiming that my (non-existent) subscription to McAfee anti-virus has expired, with assorted - mostly suspicious "reply to" addresses. Most go automatically into the spam folder but a few get through to the inbox. Be cautious if you get anything similar....I just delete them all.

It's not just me then! I get a few all close together. I also get annoying emails saying my pictures/ files will also be deleted as payment supposedly failed! All complete rubbish.

 

[Paul1160]

Me too!!.I usually get the McAfee,pictures/files rubbish at least twice a week.Don't even bother to open the email,just gets deleted.

Just received another one this morning.

 

[Jon_jpwh]

I received a text today from a mobile number and apparently from alt.tickets offering Beth Hart tour tickets. The link was to a https://arep.ink website which a Google search suggests is a scam. I have reported it as a scam. Beth Hart shares my surname which I presume is just a coincidence.

 

[najaB]

Interesting one today, a friend received an email which said their WhatsApp account was going to be cancelled by the end of the day, and provided the usual link to a website to 'fix' the problem. The interesting twist is that when I downloaded the source code of the website (it was a plain link without any tracking info), it has a form with the expected 'Enter your phone number', however the action joins to a Discord server.

I'm guessing that the scammers then pose as customer support and attempt to take over the account by getting the user to accept the request to change number on their current phone.

 

[d9009alycidon]

I have been bombarded with emails from someone claiming to be "Interactive Brokers" "Formal Advisory — Renewal of Form W-8BEN for Tax Compliance"

Dear Client,

This official advisory is issued under IRS compliance obligations. Your W-8BEN certification, which verifies your non-U.S. tax residency, has expired and must be renewed.

Failure to renew may lead to withholding at the highest rate permitted by law and potential account restrictions.

Please complete your renewal promptly through our secure submission portal:

This is followed by a link which I have not clicked on.

 

[swt_passenger]

I have been bombarded with emails from someone claiming to be "Interactive Brokers" "Formal Advisory — Renewal of Form W-8BEN for Tax Compliance"

Dear Client,

This official advisory is issued under IRS compliance obligations. Your W-8BEN certification, which verifies your non-U.S. tax residency, has expired and must be renewed.

Failure to renew may lead to withholding at the highest rate permitted by law and potential account restrictions.

Please complete your renewal promptly through our secure submission portal:

This is followed by a link which I have not clicked on.

‘Advisory’ as a noun makes it automatically highly suspect, whatever else it says…

 

[najaB]

I have been bombarded with emails from someone claiming to be "Interactive Brokers" "Formal Advisory — Renewal of Form W-8BEN for Tax Compliance"

Dear Client,

This official advisory is issued under IRS compliance obligations. Your W-8BEN certification, which verifies your non-U.S. tax residency, has expired and must be renewed.

Failure to renew may lead to withholding at the highest rate permitted by law and potential account restrictions.

Please complete your renewal promptly through our secure submission portal:

This is followed by a link which I have not clicked on.

Do you trade any stocks or shares on US markets, or have an income from the USA? If not, ignore it.

If you do, ignore it and then go to your trading platform or employer/income source and fill in you W-8BEN there.

 

[Jon_jpwh]

I received an email yesterday, not from Microsoft, warning me that my cloud storage might be full. Annoyingly it also created a repeating diary entry in my Outlook calendar which I had some difficulty in deleting.

 

[Xenophon PCDGS]

I received an email yesterday, not from Microsoft, warning me that my cloud storage might be full. Annoyingly it also created a repeating diary entry in my Outlook calendar which I had some difficulty in deleting.

A real email from Microsoft is as rare as hen's teeth...

I did not realise that only scam call-centre staff were "The" Microsoft employed...

 

[3rd rail land]

I received an email yesterday, not from Microsoft, warning me that my cloud storage might be full. Annoyingly it also created a repeating diary entry in my Outlook calendar which I had some difficulty in deleting.

Had loads of emails over the past few years saying my cloud storage from various vendors is full. The spam filter catches just about all of them but it shows just how persistent these scammers are with this type of scam. The emails don't even look plausible and anyway I don't use cloud storage beyond whatever free limits the major vendors provide.

Microsoft will never email you about your OneDrive storage. You may ell get s popup in the taskbar telling you your storage is almost full, if using a Windows device, but that's about it.

 

[styles]

So today was pretty hilarious.

I have a second stage interview with a client later this week. This has been coordinated via a recruitment agency. I got the call today to say the second stage was on for Thursday and the agency would send me a calendar invite and brief.

Shortly after that phone call, I got a call from my bank. They were asking me if I'd been applying for jobs etc and given they'd cold-called me and started asking personal questions, I said I'd put the phone down and call the main customer services number to ensure it was all legit. I call the main CS number and after a few minutes on hold I get reconnected to the person from the bank who cold-called me, confirming it was legit. He was very understanding.

After some to and fro, it materialised that the person I was speaking to had exactly the same name as me.

The recruitment agency had taken two candidates they had with the same name and joined their records together. So this random person at my bank had received information about an interview I have on Thursday simply because he has the same name as me! It was simple coincidence that I happen to bank with the same company that this other candidate works at, and had provided his work email address for (why people do this, I don't know).

The recruitment agency did call me shortly after and confirmed my email address, but also read out this bank person's email address and confirmed it wasn't related to me.

So now I have a weird position of needing to make data protection complaints to two different companies, though mainly the recruitment agency, but I don't actually want to do it until I've had my second interview because I don't want to burn a bridge as they say.

How are companies this incompetent?!

 

[AndrewE]

Shortly after that phone call, I got a call from my bank. They were asking me if I'd been applying for jobs etc and given they'd cold-called me and started asking personal questions, I said I'd put the phone down and call the main customer services number to ensure it was all legit. I call the main CS number and after a few minutes on hold I get reconnected to the person from the bank who cold-called me, confirming it was legit. He was very understanding.

Did you call from a different phone? Otherwise I understand that you might just be continuing the call to whoever (whichever potential scammer) called you in the first place.

 

[styles]

Did you call from a different phone? Otherwise I understand that you might just be continuing the call to whoever (whichever potential scammer) called you in the first place.

I called from the same phone, but after a few minutes wait. At which point the original connection will be gone and it'll be a legit new connection between me and the call centre.

The whole thing checked out as well, so I wasn't too concerned.

 

[najaB]

Did you call from a different phone? Otherwise I understand that you might just be continuing the call to whoever (whichever potential scammer) called you in the first place.

That used to be the case for landlines - the calling party could hold the line open - but was changed a few years back. Now if either party puts the receiver down the call is cleared after a few (I want to say three?) seconds.