Phone Scams: Are you still using your phone for phone calls?

A well-known practice are calls that ring once, coming from a number starting with +247 or another ‘exotic’ country number. Anyone calling back is making a very expensive phone call to a premium rate phone number. This even could also work for a phone call that comes from a local ‘payable’ phone number.

Various scam attempts are received via Messenger and other platforms.

It is important to know that these scams often come from your existing Facebook contacts. In practice, this involves a hacked account which then goes on to scam other Facebook friends.
A good example is where a man received a request via a contact on Messenger to pass on his mobile phone number, supposedly for the purposes of taking part in a competition. After passing on the number, he receives codes on his mobile phone that he must pass on. The man does so and is subsequently charged several Eeuros in addition to his subscription. In practice, this was a purchase via a special payment platform, whereby payment was made via the telephone invoice. By giving the codes to the scammer on Messenger, the fraudulent (and non-existent) purchase is confirmed.

There are a lot of malicious calls which concern phishing and fraud in all its forms.

A familiar practice are the calls that allegedly come from onr on behalf of "Microsoft Global Security". Criminals try to get the victim to do things on his or her PC to gain access to the system (and possibly the bank account). My colleague Tim Berghoff was fortunate enough to be able to record such a call and he published the recording on YouTube. While the techniques might have changed since then, the very same method of operation is still being used.

Remarkable: Sscammers also use "Security department" or "Customer Service Department" of your telecomprovider as a cover. Victims are told that they have been hacked and must install security software. The perpetrator gave instructions over the phone on how to install this. In practice it was probably malware that was installed because afterwards over 1000 euros was transferred from the victim's account.

Another practice that occurs regularly is a fictitious debt collection agency. Here the victim receives a call about an outstanding debt for a traffic fine. If they refuse, they are threatened with a bailiff and the police.

A lot of problems are also coming from unwanted calls from call centers. Sometimes the problem has been going on for several years. Sometimes people are called by robocalls, some people were called almost every night by an automated system, often at fixed times. These sorts of calls are very annoying but in most cases they don’t get away with your money. The problem is that they seem to use a similar approach as all the other scammers and it is very problematic to distinguish from the other calls you normally get and this is very annoying.

While not fraudulent per se, a technique called "spoofing" is frequently used by criminals to lend more credence to their claims or to cover their tracks. The issue is: Spoofing cannot always be addressed in a way that makes it impossible to abuse. If it concerns calls from a foreign network, or messages via Whatsapp, Skype or Messenger, it is sometimes very difficult to identify the perpetrator or even block the call or the message.

Phone operators are also not always prepared to block a number because it sometimes involves spoofing. In this case, a phone number is spoofed during a call. Blocking such calls would therefore result in legitimate numbers being blocked, while the criminals then continue to call from other numbers.

A first good indication that a phone call could become problematic is if the call is unsolicited. When someone has contacted you out of the blue, don’t give them your or any personal information, bank details or info where money is involved. Do not give them money and especially do not give them remote access to your computer.

It is sometimes very difficult to spot immediately if an incoming call is spoofed. Be aware that a Caller ID showing a local number does not necessarily mean it is a local caller. There have been cases reported where fraudsters spoof a well-known phone number such as local emergency services, where they pose as police officers. The objective is to bring their victims to hand over valuables "for safekeeping", under the pretext that the police has received information about an imminent burglary in your home.  

If you want to return a call or text from someone who claims to be your phone provider or a government department or your bank: Try to search  the provider or organizations’ official contact details and get in touch that way, via the official channels.

Cybercriminals typically want to suggest that something is very urgent. You either owe money or you need to fix something or you need to do something as soon as possible. One popular pretext would be to suggest that your bank account will be terminated or your credit card needs to be validated. The only thing you need to do is very easy: Just hang up the phone or don’t answer the message in case of text message!

If you think you have been scammed and have shared your bank details or credit card information or allowed the other party remote access to your computer, the first thing you should do is to call your bank. The bank has the possibility to stop more money leaving your bank account and may help you recover what you have lost. If your home computer was remotely accessed with your permission already, close the connection immediately and hang up the phone. Then disconnect the computer from the rest of your home network by unplugging the network cable or disabling your WiFi connection. This will prevent any malicious programs from spreading throughout your network at home. Then back up all your important data right then and there – do not restart your computer.  

You can also block the number or block the person on your phone, to avoid receiving more scam calls or messages from the same person. Talk to your phone company about call blocking possibilities they may have – they usually also have ways that allow you to block premium rate phone services, in case you happen upon such a phone number. Alternatively or additionally you can install some apps on your mobile device to block unwanted calls.

Still, there are much more mobile threats out there which we didn’t discuss today. All the problems and scams mentioned above are real and we all need to be very careful about this. Security awareness trainings will help people with these problems as it gives an organization’s end users the knowledge they need to protect confidential information from cyber criminals. It also can help to take the appropriate security measures.