Feeds

'Untraceable' phone fraudsters eye your credit card

Press 1 for low-tech phishing scam

Choosing a cloud hosting partner with confidence

Scams involving email and fake banking websites may get all the attention, but a recent rash of fraudulent phone calls shows criminals haven't given up on more traditional tools for tricking people into surrendering credit card numbers and other sensitive information.

The calls begin with a recording that makes a tempting offer - usually for a lower credit-card interest rate or an extended car warranty - and then invite the caller to speak to a live agent. The agents then ask for information including the credit card number and expiration, name, address, and in some cases social security number and other data. Recipients who have fallen for the ploy report finding charges as high as $900 on their credit card.

Your reporter has received three such calls in as many weeks. After taking the bait for a lower interest rate, an agent named Donna said her company, amorphously called Financial Services, uses its clout to negotiate directly with the issuing bank to lower my rate. Eventually, she put a supervisor named Johnny Davis on the line to answer questions like where Financial Services was incorporated and whether it was a member of the Better Business Bureau.

His answer: "That has nothing to do with the purpose of the phone call. Are you interested in us negotiating your interest rates of your accounts?"

Obviously, Davis wasn't the least bit daunted by the questions and neither were any of his colleagues, judging from similar online accounts, in which recipients report getting an abrupt click when seeking such information. Other people report receiving the calls every day at 3 a.m.

The reason Johnny, Donna and the rest of the cabal can't be bothered with maintaining even the appearance of legitimacy is they know they are largely untraceable. The varying phone numbers that appear in recipients' caller id screens are spoofed. There is little that typical users can do to find the real origins of the call.

"I actually pursued it a little bit," said Dan Clements, head of credit card-monitoring service CardCops after he received a call. But because CardCops, a division of Affinion Security Center, is set up to focus on internet-based abuses, he took a pass on one based solely using phone lines. "I couldn't dig in on it," he said.

Identity theft investigators at Consumer's Union say they are unfamiliar with the scam. Officials from the California Attorney General's office the the Federal Trade Commission didn't return phone calls by time of publication.

That's left people to resort to alternate ways of handling the calls. One person, for instance, started Stopping Heather, a site named after the perky voiced operator whose recording graces the beginning of many calls. Participants are encouraged to log as much information about the calls they receive as possible, including spoofed numbers and the scripts of the scammers. Ad-hoc forums on sites such as 800Notes serve much the same purpose. Others report keeping a whistle or an air horn at the ready.

The surge of calls come as security researchers report an up-tick in so-called vishing attacks, which use VoIP, or voice over IP, to trick people into turning over banking credentials and other sensitive data. Last fall, more than 12,000 people in Texas were targeted in a scam that attempted to capture their account details for eTrade and two local banks, according to a recent report from iSIGHT Partners.

Vishers typically set up demo accounts with one of the many VoIP providers, carry out their attack and then move to another provider. The attacks observed in the report were different from the recent scam, however. They typically rely on emails that encourage recipients to call an automated number and manually enter their account information.

The use of live agents at a time when open-source public branch exchanges and similar gear makes number spoofing cheap and simple is a wrinkle that will take time for enforcers to crack down on.

Says Ken Dunham, iSIGHT's Director of Global Response: "We don't really have the trained individuals in [industry] or law enforcement in place to rapidly respond to these new kinds of threats." ®

If you have intelligence or insight about this or related scams please contact Dan Goodin using this link.

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Apple grapple: Congress kills FBI's Cupertino crypto kybosh plan
Encryption would lead us all into a 'dark place', claim G-Men
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.