'Tech support' scammers using fake downloads to snare new victims

Intentionally failed installation lures users into calling ‘support’ line – which drags them into multimillion pound scam.


“Microsoft virus phone call” scammers are tricking people into paying bogus support fees by setting up fake websites offering antivirus downloads designed to fail on installation.


The failed installation tells the user to call a phone number – which connects them to the scammers, who then talk the customer through a process that makes it seem like their PC has a virus infection. The scammers “install” software and charge annual fees, part of an ongoing process that has cost victims millions around the world.


The new version of the scam was discovered by the security company Malwarebytes, which documents it in a new blog post. It has reported a number of websites and telling LogMeIn, a legitimate remote support tool that is favoured by the scammers, of codes they use so they can be blocked.


“The online tech support industry is facing a big problem right now,” Jérome Segura of Malwarebytes told the Guardian. “There are too many fraudulent companies being overly aggressive in reaching out to people, whether it is with cold calls, online adverts or fake pop-ups.


“And then in between you have companies that perhaps started an honest business but over time have gone shady because they realised how easy it was to make an enormous amount of money using deceptive practices. That is bad news for consumers who are walking a minefield when looking for support.”


The modus operandi of the tech support scammers, almost all of whom operate out of Kolkata in India, is to use phone directories and cold-call people telling them they are “from Microsoft” or “from Microsoft Windows” and that their PC has been reported as transmitting viruses. They then tell people to open a program on their machine which appears, to the uninitiated user, to be warning of errors on their system - but is in fact indicative of normal operation. The scammers then tell alarmed customers they can “fix” the problem for a price which can range to hundreds of pounds. They use LogMeIn or another remote support company to gain remote access to the system, and “fix” the nonexistent problem.


The Guardian exposed in July 2010 how the “support scams” were being run from call centres in India. Subsequently the Guardian obtained details of three individuals, two based in India and one in Canada, who were believed to be the ringleaders of one of the scams, using an online payment company to route their payments from victims. The details were passed to police.


In October 2012 the US Federal Trade Commission froze the US bank accounts and assets of a number of “tech support” companies in India, alleging that tens of thousands of Americans have been tricked into paying for unneeded “support”. Among those who had accounts frozen was a company called Pecon Support, now inactive.


However, that has not stopped gangs in India from making cold calls and scamming victims – often older people who do not realise that Microsoft does not make such calls.


“We know that there are multiple organisations in India as well as the US but getting an exact picture of how they relate to each other is not easy,” Segura told the Guardian. “This is in part due to the fact that these groups use multiple identities, websites and hundreds of different phone numbers. This particular antivirus ripoff scam was located in India, but unlike so many others the technicians showed a better command of the English language, in fact sounding quite British. These are the kind of little details that we, as investigators, pick upon because they can help us to identify various accents and put individuals on a map, because we know accents vary per region in India.”

He said that one technician told him that they were receiving an average of 3,000 calls a day. “If we keep in mind the price for support services typically ranges between two to four hundred dollars, we are talking about a multimillion dollar industry that crooks are exploiting every single day,” Segura said.



The guardian.com