Has someone offered you a huge sum of money or a valuable consignment? It's a 419 or advance fee fraud - find out how they work, and what to do to be safe.
by Tawnos Fri Dec 30, 2011 5:29 pm
Found my way here via the old new thing, seemed apropos to share this since it happened a couple days ago, and I don't see it mentioned.

This was pretty clearly a scam, but it's not one I see documented on the site. A person I had not heard from in a while messaged me on facebook December 22nd with the following message:
scammer:HI
how you doing?


I was away, and did not respond. On the 28th, I received this message:
scammer:hi
how you doing?


The following conversation ensued, the very first comment tipping me off that something wasn't right:
Tawnos:hey <redacted>, how have you been?

scammer:Am not too good at the moment,I and my family are in a deep mess right now


This was the first tip off. I am not somebody this person would contact about personal information like this. Also, the English used did not match how this person would normally speak ("I and my family" - this person has only a wife, and he always referred to her by name). However, I decided to see what was up, maybe something tragic occurred and I'm the only one around :roll:

Tawnos:that's too bad

scammer:We are currently stuck in Manila Philippines,went there on a short vacation and was mugged at a gun point last night


Ah, open with an explanation for why a person might need to send money to the Philippines. Not a bad gambit, though it seems odd this person would go there, it at least provides something that _might_ be plausible.

Tawnos:ouch
everyone okay?

scammer:I was hurt on my head,writing you in tears now as we speak,All cash and credit card was stolen off including phone,it was a brutal experience and horrendous

Other patterns are emerging that are further tip offs. The use of commas instead of periods is unusual. If anything, this person would typically overuse periods/ellipses in electronic communications. The "writing you in tears" is a detail intended to pull on heartstrings (ha, like I have a heart! ;) ) and make the situation seem urgent. It was late though, and I wanted to go to bed, so I just verified in the very very rare likelihood this is real and not a scammer:

Tawnos:quick question: how do you know me? I need to verify something

scammer: did i ask you for money??

Tawnos:I don't know, did you? I'm trying to verify this is <redacted>, and that I don't need to call him and make sure his account is okay
Thus: how do you know me? <redacted> would know the answer to this, a person impersonating him would not

scammer:Computer engineering at California


This is the giveaway, as it is a copy/paste from info the person would see on the first line of my facebook profile. As a bonus, it has the same capitalization that facebook uses, and doesn't include the text which wraps to the next line (and makes it make sense, as "California" isn't the name of a university). I think he realized the gig was up though, as he logged out about 10 seconds after sending that, and the next morning my friend's facebook account was deleted.


Anyway, something to be aware of, I haven't seen this before, but it was something that might have duped my less technically savvy friends. I'm guessing the next line would have been something about needing money wired for something - to get to the US embassy, to buy a ticket home, etc. Either way, something that might be worth reminding any of your social media-going, but less scam-savvy friends about: just because a person is logged in as someone you recognize, does not mean it is the person you know.
Advertisement

by AlanJones Sat Dec 31, 2011 3:21 am
Hi Tawnos and welcome to ScamWarners,

Your friend has fallen for a phishing scam or had a keylogger installed on his PC, which is how his FB account came to be hijacked.

If he hasn't done so already then he should change all his passwords for his email etc.

Please do not tell scammers that they are listed here - it will take them seconds to change their fake details and their new details will not be listed for any future victims to find.
by Joseph Sat Dec 31, 2011 12:30 pm
Have your friend do a virus scan before changing passwords or change passwords on another computer that is known to not be infected. I would also change the security questions/answers on any compromised account as that is a good backdoor to get back in for the hacker. Facebook hackers tend to use Remote Administration Tool's (RAT's) or need to spoof their victim's IP to even log into the stolen FB account. About a year ago, FB implemented a security system that would check a users IP address on log in. If your IP shows you in a totally different country than your usual log in, it will not let you in unless you know your own security questions.

Give it a shot sometime. If you go on vacation in another country, try logging into facebook and see what happens. The results are truly annoying.

- Joseph Kovacs
仁義
by Tawnos Fri Jan 06, 2012 7:28 pm
Joker wrote:Remote Administration Tool's (RAT's) or need to spoof their victim's IP to even log into the stolen FB account.

That would explain why the scammer was contacting me at 1am - a time I'm often up, but the compromised person is extremely unlikely to be. I used to do IT work for this guy, but I'm guessing he hasn't bothered keeping various antivirus and malware scanning tools up to date since I moved to WA.

I'll be sure to follow up and see. Others should be on the lookout for this malware: http://blog.seculert.com/2012/01/ramnit ... ocial.html

Who is online

Users browsing this forum: ClaudeBot and 21 guests