Tag Archives: FCC

‘Can You Hear Me?’ Scam Hooks Victims With a Single Word

Scams recently reported to the Better Business Bureau’s Scam Tracker.

Don’t pick up the phone to answer calls from unknown numbers. Instead, let them go to voicemail.

That’s the operational security advice being promulgated to Americans by the U.S. Federal Communications Commission in response to an ongoing series of attacks designed to trick victims into uttering a single word.

The FCC says in a March 27 alert that the scam centers on tricking victims into saying the word “yes,” which fraudsters record and later use to attempt to make fraudulent charges on a person’s utility or credit card accounts.

“The scam begins when a consumer answers a call and the person at the end of the line asks, ‘Can you hear me?’ The caller then records the consumer’s ‘Yes’ response and thus obtains a voice signature,” the FCC warns. “This signature can later be used by the scammers to pretend to be the consumer and authorize fraudulent charges via telephone.”

Fake Tech Support

This isn’t the first time that fraudsters have “weaponized” the telephone.

Scammers have long phoned consumers, pretending to be from a government agency such as the Internal Revenue Service. Another frequent ploy is pretending to be from the support department of a technology firm, such as Microsoft or Facebook, and then trying to get victims to pay for bogus security software meant to fix nonexistent problems on their PC.

Authorities have made some related arrests. Last year, Indian police arrested 70 suspects as part of an investigation into a fake IRS call center scam.

Also last year, the FTC announced a $10 million settlement with a Florida-based tech-support scheme, run by an organization called Inbound Call Experts, also known as Advanced Tech support. The FTC and the state of Florida said the organization ran “services falsely claiming to find viruses and malware on consumers’ computers.”

Researchers Study Scammers

In a recent paper, “Dial One for Scam: A Large-Scale Analysis of Technical Support Scams,” researchers at the State University of New York at Stony Brook described how the tech-support version of these scams work, as well as how they might be disrupted by targeting the infrastructure on which scammers rely.

“Scammers use specific words in the content of a scam page to convince the users that their machines are infected with a virus,” the researchers say.

The Stony Brook researchers designed a tool called ROBOVIC – for robotic victim – that found that of 5 million domains that it successfully connected to during a 36-week period beginning in September 2015, it logged 22,000 URLs as serving tech-support scams, connecting to a total of about 8,700 unique domain names.

But those 22,000 different web pages used a total of only 1,600 phone numbers, of which 90 percent were connected to one of four VoIP services: Bandwidth, RingRevenue, Twilio and WilTel.

The researchers also phoned 60 scam telephone numbers to log the social engineering tactics – aka trickery – used by scammers. The researchers found that on average, scammers waited until 17 minutes of a call elapsed before offering their services in exchange for money. Most would offer support packages that ranged from a one-time fix to multi-year support, with costs ranging from $69.99 to $999.99. Scammers would typically offer multiple options, then try to persuade victims to pick the middle-priced one, the researchers found.

Freelance attacks appear to be rare. “Through the process of interacting with 60 different scammers, we are now convinced that most, if not all, scammers are part of organized call centers,” the researchers write.

Fake Support is Lucrative

These attacks are relatively easy to launch, inexpensive to run, potentially very lucrative and show no signs of stopping.

Peter Kruse, head of the security group at Danish IT-security firm CSIS, this week warned via Twitter that multiple websites were pretending to be related to the technical support group from Czech anti-virus software developer Avast and urging individuals to call one of the listed phone numbers.

Needless to say, these numbers don’t lead to Avast, which develops free security software that’s used by many consumers. Instead, the numbers go to call centers tied to fraudsters. Avast has repeatedly warned that this a well-worn scam, with attackers often claiming to be connected to Avast, Dell, Microsoft, Symantec or other technology firms.

Advice for Victims

There’s no way to prevent criminals from running these types of scams.

But law enforcement and consumer rights groups have long urged victims to file a report, even if they didn’t suffer any financial damage as a result.

For anyone targeted by the “yes” scam, the FCC recommends immediately reporting the incident to the Better Business Bureau’s Scam Tracker and to the FCC Consumer Help Center. The FCC’s site also offers advice on tools for blocking robocalls, texts and marketing calls.

Anyone who thinks they may have been the victim of phone scammers, for example, by paying for fake tech support, can file a fraud report with their credit card company.

Authorities also recommend they report the attempt to relevant authorities, such as the FBI’s IC3 Internet Complaint Center. Law enforcement agencies use these reports as a form of crowdsourcing, helping them secure funding to battle these types of scams, as well as take them down.

 

House Votes in Favor of Letting ISPs Sell Your Browsing History

Your internet history and browsing habits are for sale, and the House voted Tuesday to keep it that way, rolling back rules that would have barred internet service providers from selling your data without consent.

The measure would bar the Federal Communications Commission from enforcing rules it passed last year, during President Barack Obama’s administration, that would have required broadband providers to get your explicit consent before they could sell your personal data.

Before Tuesday’s the vote, representatives who wanted to keep the rules stripped the debate down to something as mundane as buying underwear online, privately.

“I know there has got to be somebody in this body who believes [internet service providers] should not have anybody’s underwear size,” said Rep. Keith Ellison, D-Minnesota.

With strong opposition from Democrats, the measure narrowly passed in the House by a 215-205 vote. No Democrats voted for the bill, and 15 Republicans opposed it. A similar version squeaked through the Senate last Thursday on a party-line vote of 50-48.

The president’s signature is all that is needed now to roll back the rules, leaving consumer data fair game for internet service providers and, crucially, barring the FCC from issuing similar protections in the future. The White House said in a statement on Tuesday that it “strongly supports” the repeal.

After the vote, the Internet & Television Association issued a statement applauding the congressional action to repeal “the FCC’s misguided rules.”

“With a proven record of safeguarding consumer privacy, internet providers will continue to work on innovative new products that follow ‘privacy-by-design’ principles and honor the FTC’s successful consumer protection framework,” the group said in a statement. “We look forward to working with policymakers to restore consistency and balance to online privacy protections.”

CTIA, formerly the Cellular Telecommunications and Internet Association, an advocacy group for the industry, applauded the measure’s sponsors last week for “seeking a common-sense and harmonized approach to protecting Americans’ privacy.”

“Wireless carriers are committed to safeguarding consumer privacy, and we support regulatory clarity and uniformity across our digital economy,” CTIA said in a statement.

But internet privacy advocates are framing this as a battle between privacy and profits.

Kate Tummarello, a policy analyst at the San Francisco based Electronic Frontier Foundation, said the “commonsense rules” Congress voted to repeal were designed “to protect your data” and keep internet service providers from doing a “host of creepy things” without your consent.

“Of course, the ISPs that stand to make money off of violating your privacy have been lobbying Congress to repeal those rules,” she said in a statement before the vote. “Unfortunately, their anti-consumer push has been working.”

The measure has also spawned a call to action from Data Does Good, a company that wants to empower people to leverage their data to help in the fight for online privacy rights.

The premise: Give Data Does Good your Amazon shopping history, which they say they’ll automatically anonymize and pool with others before selling it to retailers.

Data Does Good will then donate $15 on your behalf to a non-profit of your choice that is fighting for privacy rights, such as the Electronic Frontier Foundation or the ACLU.

Still more to come.  Remember the NSA already has all of this information.