#phishing

[kyra45]

“Rayban charity glasses event” is a scam don’t click any link in a post that says that.

Old tumblr users remember this scam back when it first went out.

[meanya]

I saw a post before about how hackers are now feeding Google false phone numbers for major companies so that the AI Overview will suggest scam phone numbers, but in case you haven't heard,

PLEASE don't call ANY phone number recommended by AI Overview

unless you can follow a link back to the OFFICIAL website and verify that that number comes from the OFFICIAL domain.

My friend just got scammed by calling a phone number that was SUPPOSED to be a number for Microsoft tech support according to the AI Overview

It was not, in fact, Microsoft. It was a scammer. Don't fall victim to these scams. Don't trust AI generated phone numbers ever.

[prokopetz]

I just got another one of those phishing emails where it pretends to be a confirmation of a subscription you never signed up for and tries to trick you into providing personally identifying information for "confirmation purposes" when you attempt to cancel, but:

a. this one is for a weekly grocery delivery service, of all things; and

b. the fake shopping list contains nothing but ham.

I have been fraudulently subscribed to ham.

[mostlysignssomeportents]

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

[redbuddi]

SCAM ALERT!!!

This morning I woke up to this email

Scary right? It looks as though all of a sudden I owe over a thousand dollars to some studio I've never heard of. This would be enough to make anyone jump to correct the situation. But if you get this email or ones like it, stay calm, do not call the number, and do not click ANY of the links.

This email is fake. I logged into paypal through normal means and there was no such invoice sent to me. While obviously I didn't call the number or click the links to check for sure, this is most likely a classic phishing scheme. Essentially if you click any of the links or call the number, you will be asked for your login information in a way that looks legitimate, but once they confirm your login they will disconnect you, change your password, and have complete access to your paypal.

tl;dr, If you get the email pictured above or anything similar, delete it immediately. Do NOT call the number it provides. Do NOT click on any of the links it contains.

[kurouppy]

Commission scam alert!

A scam is going around currently where someone will dm artists offering $200 via paypal to draw "their sons dog", regardless of the artists actual commission price which is typically much lower, so far I've seen the dogs name is often bailey but it can be other names too

The account will most likely be blank with no pfp, bio or posts and a small amount of likes and follows that all seem to be found on one or two tags. The usernames will be a combo of around 3 words that seem randomly generated. Typically they will insist on it being a specific payment method (currently it's paypal) and refuse to send money any other way

Here are the exchanges I had with them and their blank account, typically the scammer will follow this general script. Do not accept comms from a user coolcowboywitch

Here are the pictures of the dog they sent me, reverse image searching didn't come up with anything so I'm not sure where they're from (potentially AI generated), if you get sent these exact pictures it's most likely a scam

There are two main ways this scam can work:

1. They are attempting to steal your paypal login information or to trick you into sending them money. There are many ways they can do this, including sending phishing emails or claiming they can't pay you unless you send them money first

2. They will either send you money and then file a charge back or send you money that never processes in the first place, meaning you do the labor and never get paid. This can even lead to your account being overdrafted

A similar scam was going around on instagram a bit ago that instead offered $300

Posts with recent examples of this scam:

X, X, X

Deeper explanation of how the scam works:

X

[alexahasanartblog]

Just a warning to artists out there, this is exactly what to look for when you suspect someone may be trying to scam you when asking for a commission.

This person, @choppedpersonchild , blatantly attempted to scam me out of money. Their initial ploy was clever, we had a genuine typical discussion regarding size of the picture, contents and shipping costs only to follow that they had sent money and instantly I received this email, which is unfortunately a poor attempt at imitating PayPal, one of the most common scams circulating on the internet currently.

Things to note about this email are the lack of PayPal branding, lack of mention of my PayPal username, which will always be laid out in full in a real PayPal email, and a complete lack of notification from the PayPal app or website, which also notify a user of messages. To read more about this I encourage people to read the official PayPal website regarding scams and phishing.

https://www.paypal.com/us/security/learn-about-fake-messages

It's so important to be skeptical and aware of scam attempts that happen thousands of times every single day. These scams evolve constantly and it's vital to remain aware and double check every aspect of any email you may receive and NEVER CLICK LINKS!!! These are common ways for malicious people to steal your private information. With all this being said, be careful, be aware and be skeptical.

[rslashrats]

this website url looks definitely legit and won’t steal my info if i visit it

[sophisticatedpjparty]

PSA for my fellow artists

Please be aware of a paypal scam going around right now!

Tonight I received messages from a "commissioner" asking me to draw a picture of her and her son. She offered me a large amount of money for my work, which leads me to my first point:

Always ask for payment upfront from new customers!

Doing so protected me from losing time (and potentially a lot of money) working on a piece for a scammer.

She claimed she was willing to pay extra for the work to be "finished as soon as possible". In hindsight, this is one of many common ways scammers create a false sense of urgency so you don't have time to think critically about what they're asking.

Secondly, she asked for the email used for my paypal. She claimed it was for sending payment, but this was actually a method for sending a scam email later, claiming that there was an issue with her payment requiring me to "refund" her $200. This is when I was able to confirm that it was a scam, stopped, and reported the email and the tumblr account. Had I not blocked her she likely would have continued to insist that she'd made a payment or possibly even threatened to take action against me if I didn't refund her money I never received, again, another common way scammers create a false sense of urgency and panic.

But other artists may not be so lucky, or know how to recognize these kinds of phishing schemes, so I thought making this post could be helpful!

Warning signs:

1. She asked for my pricing information and email through DMs, rather than reading my pinned post or using my carrd when directed to, things a legitimate customer would know to do.

2. The email was from "service paypal" (instead of just "paypal") and was in my spam folder.

3. The email used an impersonal greeting. All official paypal emails will begin by addressing you by name. It also contained a handful of grammatical errors that might be missed at first glance, especially if the scammer has successfully created a sense of panic.

4. The email claimed that due to the large size of the payment, the transaction could not be completed until an additional $200 payment was made from the customer that should be "refunded" to them once "made". This is blatantly untrue and an extremely unprofessional/sketchy practice a legitimate business like paypal would never use.

In my case, it claimed that it was part of the process of creating a business account- business accounts are free to create, however, and I already have a store page.

5. Most importantly: I never received any payments or notifications through paypal's official app or website.

Scammers will send you fake screenshots of their payments to attempt to convince you that they've spent or lost money and that it's your responsibility to help them get it back. Don't believe it. They're just trying to get you to "compensate" them for an issue that never occurred, by any means necessary. If there was any genuine issue with their payment, they could work with paypal or contact their bank to cancel the transaction or refund them. If you never recieved any payment, you don't owe them anything. It's not your job to "refund" them.

If you encounter a scam like this, block, report, and change your paypal password for good measure.

I got lucky, I didn't lose any money or get scammed, I only wasted a few minutes talking to her before I recognized it for what it was and stopped interacting. Sometimes, however, even if you recognize that something is a scam, just opening the email and viewing any attachments may potentially compromise your information. Never click any links in an email like this.

Below are screenshots of the email I recieved, which I'll be sharing for awareness purposes.

I'd also like to include this page from Paypal's website about the common signs of a phishing scheme:

Take care out there and look out for eachother! Please continue to spread awareness about these kinds of scams when you see them so your favorite artists can stay safe and informed.

I'll be updating some of my commission guidelines later to account for situations like this in the future.

Thank you for reading!

[haycoat-art]

@ai-art-thieves to spread awareness because how haven't they been caught????

found another phisher, but this time they reblog posts and adds their phishing link to them

Not stealing photos, but uses tags from the original to boost their phishing link to the Tumblr algorithm. And their description seems very reminiscent of ChatGPT writing...

[kyra45]

Ray-Ban Glasses scams

(Ray-Ban Glasses scams)

If you’ve been on tumblr for about a decade now, you’ve likely came across this scam at some point. This scam, commonly targeting long abandoned accounts no longer used by the creator, uses Ray Ban sunglasses for the phishing scam. These compromised accounts then crawl the following list and tag everyone that’s in it. Whoever clicks their link will then also get hacked and continue the same phishing scam for as long as it can. That’s why it’s usually so numerous when it starts small. This scam commonly appeared on Facebook but does have its roots on tumblr too.

If you see an account posting an image that reads “rayban charity glasses event” and is followed by the same word and then a ton of mentioned accounts with a link, that blog has been hacked and is trying to spread the phishing further. It’s suggested to report these hacked accounts so they can be took down and the creator can later on regain control by contacting support and changing their password first.

[skarabrae-stone]

Don’t Fall for “Sick Cat” Phishing

Just a reminder that if someone you don’t know suddenly sends you a message asking for help paying vet fees for their sick pet, it’s almost certainly a scam. Don’t give them your money! And make sure to report them to Tumblr for phishing:

click the meatball menu for “report”

select “report something else”

select “unlawful uses or content”

select “phishing”

[scam-alerts]

🔎Scam Exam(ination)🔍

Seen as: Click here! / Read more... Scam type(s): Phishing / Malicious website

Good day everyone, today I'd like to talk about a scam that is some what pretty obvious to spot on tumblr. Unless you're someone who straight up lets curiosity get the best of them and you go clicking links on sketchy looking blogs without thinking. (Don't do that.) You'll probably be able to avoid it.

Now, for safety reasons I'm not going to be linking the blog in question that is running this scam because I'm not going to 'tempt fate' for the sake of documentation. But I will be showing you through the help of a couple useful websites, what's going on behind the scenes.

-----

The first thing I noticed (other than the blog only being a few days old) when I saw this persons posts was, well, what I consider to be one of the most biggest and immediate red flags that was on every single post of theirs.

If you know anything at all about internet history and internet safety, one of the most common and well known ways that malicious actors try to get you to go to their scam/phishing website is with the temptation of a big reward if you do x to y.

'You've won a free $100 gift card! Click here to claim!'

'Hot local singles in your area! Click here now to find them!'

Memes aside, it should go without saying that you should not, under any circumstances, click links that look like this that you receive via email, text, or that you see in advertisements. Not only could these links lead you to a phishing page (wiki) that mimics tumblr or another social media platform in an attempt to get you to log in. Doing so would result in your account being compromised and your login information being stolen.

Tempting links like these could also lead to a web page like the one that this one in particular I'm about to show you, too.

With the help of Cloudflare via their url scanner tool I was able to examine this website, see where it redirects people to, view the HTML (for you nerdy folks) and in turn see the landing page it takes you to when you click it. Without clicking it myself.

Want to know what this takes you to?

A page leading to a fake popup with a link to install a virus.

Now, let me be 100% clear: These viruses are bad.

From what I know of them, not only do they hijack and steal all of your login information on the device you installed it on, 9/10 it will also install a keylogger onto your system. What this does is: even if you uninstall the virus and your system seems clean, these bad actors will still be able to monitor your device and steal your information unless you factory reset your device or PC.

Here's information on keyloggers. (malwarebytes)

If these bad actors really, really wanted to ruin someones day, by installing these 'free apps' it could also put what is known as Ransomware on your device. A trojan that locks down your device, encrypts your files, and demands you pay a ransom for it to be unlocked. All of which is under a timer or it will completely brick your system.

Here's a video by IBM that explains how ransomware works.

Another very, VERY useful website I'd like to share that I became familiar with through some channels on youtube that talk about scams is VirusTotal. https://www.virustotal.com (despite its name, it's not a virus!)

This website has two key features I think are awesome: 1- You can scan a url for viruses/malicious activity to see if it's been flagged by one of the many antivirus vendors on the market. and 2- You can upload files you downloaded to see if they are infected by trojans or malware before you even open them.

CloudFlare and VirusTotal are 100% free to use websites with no sign up or cost. (No this isn't an ad and no I am not sponsored. These are just resources and I am giving them to you lol)

-----

Final thoughts: I know curiosity may get the best of us at times, but don't let that become your downfall. If you see blogs that are only a few days old exhibiting this behavior, please make sure you report them on your own time and don't encourage mass reporting by making posts about them.

Remember: Stop and think before you click that link. :)

Other helpful guides on spotting scams. (by @kyra45)

[mostlysignssomeportents]

PSA: A pretty clever phishing email

I got a message warning me that my Twitter account was about to be suspended for suspicious activity, inviting me to click a button to prevent this. The URL the button went to *was* an x.com link, but it used a security vulnerability in Twitter's backend that allowed redirections to push me to an OATH server that would prompt me for my Twitter login and 2FA, and then send the attacker a valid token they could use to take over my account.

Here's the (redacted) attack link:

https://x.com/ [BREAK INSERTED] i/oauth2/authorize?response_type=code&client_id= [UNIQUE ID REMOVED] Q&redirect_uri=https%3A%2F%2Ftwo.opensourced.us%2Fapi%2Fcallback%3Fi%3Dtwit&scope=tweet.read+users.read+mute.write+tweet.write+tweet.moderate.write+offline.access&code_challenge= [UNIQUE ID REMOVED] &code_challenge_method=plain

[intelligentchristianlady]

PSA. Warn your friends and relatives (especially the older ones).