The link was one of those shortened links – a short-url, in the trade. They are useful to fraudsters because the completely disguise. Naturally, the recipient had clicked on the link and was taken to a Yahoo! Com website called Yahoo Pictures which required him to log-in.
Strangely, after all the complaints about Google’s new one-sign-in policy, it was the absence of such a policy at Yahoo that facilitated this fraud.
The fake website, it turns out, is hosted at config-verify.info. Increasingly, we are finding that .info domains are used by scammers, spammers and other fraudsters. This domain name is interesting because the full page reference (hidden by the short url) was far too long to fit in the address bar and anyone scrolling along would have found the words verify and login and config, They also appear in the genuine log-in address.
The domain config-verify.info is behind an identity protection service called WhoisGuard which has its listed address as a drop box in California.
Then it began to get really strange. The sender of the message said that she was installing a webcam and suggested they test it. She gave another short URL. That was the first indication to the recipient that there was trouble. He switched to a non-Windows PC with industrial strength firewall.
It was then that the whole scam became apparent.
First, the very modest woman who was apparently sending the messages started with “do you want to see something before I go for a shower.” In the context of their messaging over a long period, this was not in any way suggestive. He clicked on the link and there was a live cam, mostly obscured by a box asking for an e-mail address and a password to set up an account. The e-mail address would be used for verification. That might not have, of itself, rung alarm bells – but the site, faked to look similar to Yahoo sites, had a sex-related name. That was the first warning sign he noticed. He did not provide an e-mail address.
Then a message arrived; they need your credit card for verification. The webcam service is free if a Premium member invites you; have you done it yet? Then a copy-paste of the same it’s free if you’re invited message.
Why not use Skype or YM video, the recipient asked. “Because I like HD and that doesn’t work on them”. That was the final straw: this is someone who lives in a remote location and her internet connection drops out constantly. Any kind of video would be difficult, HD would be impossible.
“Have you done it?”
“No. I don’t think you are who you say you are.”
“K” – end of conversation.
But in the meantime, some ten minutes had gone by during which time the criminals had been in possession of the recipient’s log-in information. Luckily, the account is used for simple social chat only. Therefore the chance for it to be abused has been limited and there is no personal or sensitive information in the chats or in the mails.
The phone number quoted in the domain registration is +1.6613102107 and that shows up on numerous bulletin boards as related to a wide range of scams over a period of years. Way to go California, if it’s still in service and still being used.
As the idea tumbled, the recipient realised – his friend would be at work, not in the shower at that time of day, her English was different, she wouldn’t know now to set up a webcam or anything else – she can’t even reset her wifi router. It was only when the behaviour became uncharacteristic that these things began to fall into place.
Some, perhaps receiving a message from someone they did not know so well, or perhaps not thinking of why using such a service didn’t make sense, might not have thought to break off before even giving an e-mail address.
Domain information provided by http://whois.domaintools.com/config-verify.info
Tip a friend
Download PDF version of this page