Online fraud

[DonTom]

I almost got taken by a scam and I have no idea how this one worked.

I am going to use a little ham radio talk here, I hope some hams here can explain how this scam worked.

It started with this email that I received from W6JL (a ham I know who is for real):

Note: Both of our names is "Don", so that can cause confusion.

Here is how it started from an email other than the one on QRZ.com for W6JL.

"On Thursday, September 21, 2023 at 06:57:15 AM PDT, DONALD HUFF <[email protected]> wrote:


Good day,

I was thinking about you and hope that everything is going well.

Hope you're ok. Can I ask you a favor?

Don"

My reply:

"
From: Don <[email protected]>
Sent: 21 September 2023 18:36
To: [email protected] <[email protected]>
Subject:Re: Checking In............. Donald Huff


"Don,

Sure, all is fine here. I am now in Reno.

I have not been on the air much lately.

What favor would you like?

de -Don- AA6GA/7"

His reply:

"
Don,



"On Thursday, September 21, 2023 at 10:58:52 AM PDT, Donald Huff <[email protected]> wrote:


Happy to hear back from you, I need to get an Apple gift Card worth $200 sent to a friend who is battling with (Acute Lymphoblastic Leukemia) a type of Blood Cancer and has been undergoing treatment lately . It's her birthday , I've tried to order it online but my card was declined.. Can you purchase it from your end for me? I 'll reimburse you once my bank sorts the issue out. I am just trying to put a smile on her face in these trying times. Let me know so I can send you her email address

Thanks,
Don

So I send this, ONLY to his email address as shown on QRZ.COM:

On Thursday, September 21, 2023 at 07:55:18 PM GMT+1, Don <[email protected]> wrote:

Since the email address is different below, I just want to be 100% sure you sent me the below message,

But sure, I will be glad to, as long as it is really you!

de -Don- AA6GA

He does reply to from his real Email address! Thís is the part I do not understand!

His reply on his REAL email as shown on QRZ.COM:


DONALD HUFF
From:[email protected]
Toon

Thu, Sep 21 at 12:54 PM


Yeah, Don thanks for your concern. I sent the message using the outlook mail. it is my old email which i just recovered.

Thanks,
Don

Even though he replied on his real email, I still expected something was not right. So I did NOT reply to his next message:


Donald Huff
From:[email protected]
Toon

Mon, Sep 25 at 12:02 PM


Hi Don, how are you today, and how are your family?. I requested something from you and I haven't gotten your feedback.

Thanks,
Don
Don
From:[email protected]
Toonald Huff

Thu, Sep 21 at 2:29 PM



So, why can't you buy it in the town you're in?

-Don-

On Thursday, September 21, 2023 at 02:26:37 PM PDT, Donald Huff <[email protected]> wrote:


I am out of town. I promise to reimburse you as soon as i get back. Please help me Don

Thanks,
Don

Now I know something is wrong. I know Don quite well as I work him often on CW. He knows I am the last person alive from my entire family. But still not 100% sure of anything until today.

So I did not post about this until today when I know 100% for sure it was some type of fraud. Here is how I know for 100% sure now:

Today, from here in Flagstaff, I worked Don, W6JL today on CW. He says he has not sent me an email for more than a year!

So how did this scammer send me a reply from his REAL email, without Don, W6JL, even knowing about it?

I just cannot figure this scam out because of that and that only.

So how do email accounts get hijacked? Doesn't seem possible. But those are the facts.

-Don- Flagstaff, AZ

 

[JudyJB]

I moved from Michigan to Ohio when I bought my motorhome 11+ years ago. (I now use my son's house in Ohio as a residence.) What is really irritating is that because I was a registered voter in Michigan, I kept and continue to keep getting solicitations for donations from various people in Michigan running for office. Ditto from each political party. A couple of years ago, I finally contacted the place where I was registered to vote, and they deleted my name from the voters' roll.

However, obviously a lot of politicians and both political parties have kept my name on their lists, so I am still getting these emails and phone calls. Unfortunately, because I am medical POA for my elderly aunt, I need to answer all phone calls, just in case she is having an emergency. I do block all spam, at least.

I am hoping that someday, the contacts will slow down and maybe even stop. The funny thing is that I get more calls and texts from Michigan than Ohio!!

 

[John From Detroit]

Sounds like his primary E-mail has been hacked.
Alas. Considering hacking and scamming is a multi BILLION dollar a year business we really need the Government to go after the hackers and scammers and hit 'em with a fine.. I'm thinking the national debt is about the right size for the fine.

 

[Seilerbird]

So how do email accounts get hijacked? Doesn't seem possible. But those are the facts.

There are many ways to hijack an email account:

https://nuedusec.com/how-to-hack-email.php

 

[Ex-Calif]

I thought this part was pretty hilarious...

Don - I think that eMail thing definitely started with your friend getting his eMail hacked. There are ways to mask return addresses in eMail.

If you hover above URLs and eMail addresses you can often see the "real" address in a pop up near the bottom of the browser. If they are different then, "Danger Will Robinson"

I would say that the scammer you had was a pretty sophisticated one.

 

[Kodiak34SS]

Sounds like an email account takeover. Don, you should reach out to your friend via means other than computer/email and tell him to roll all of his passwords and enable 2FA on a separate channel (SMS or different, uncompromised email) where possible. Everything. Unique passwords for every account.

 

[DonTom]

Don, you should reach out to your friend via means other than computer/email

That's exactly what I did yesterday, when I worked (communicated with him) on CW (ham radio international Morse Code). That removed all doubts about it not being him on the emails, from two different email accounts.

-Don- Flagstaff, AZ

 

[DonTom]

we really need the Government to go after the hackers and scammers and hit 'em with a fine..

They are often outside the USA where we cannot do much.

-Don- Flagstaff, AZ

 

[DonTom]

If you hover above URLs and eMail addresses you can often see the "real" address in a pop up near the bottom of the browser. I

I did that on the one time he replied using his real email address (the sbcglobal email address). It did come back as being correct and that was the thing I didn't understand the most.

I just doublechecked it to be sure, it comes back as the same and correct email address. Perhaps somebody got his password, but he doesn't see this one email in his "sent" folder.

-Don- Flagstaff, AZ

 

[Oldgator73]

I’ve been getting emails from a cousin in Florida indicating there are some pictures I would be interested in seeing. This cousin has never emailed me . I cautioned my wife not to open the link to the supposed pictures.

 

[DonTom]

There are many ways to hijack an email account:

Thanks for that, but I cannot figure which trick was used when I got the reply for what appeared to be his real email.

After that, the ONLY thing that made me believe it had to be a scam was the content of the emails themselves.

-Don- Flagstaff, AZ

 

[garyb1st]

Always use curser to check if email addy same as what's showing. Never open email from unknown sender regardless. Never answer phone if caller unknown. They can leave a message. Fraud has to be one of the fastest growing cottage industries in the country.

 

[Tulecreeper]

Always use curser to check if email addy same as what's showing. Never open email from unknown sender regardless. Never answer phone if caller unknown. They can leave a message. Fraud has to be one of the fastest growing cottage industries in the country.

You can open the email, just don't click on any links or attachments. Not answering the phone is a good practice. I've tried to tell my 94 year old mother that if the call were that important the caller would leave a message. She replied that some people don't like talking to a machine and I told her, then again the call isn't that important. She won't listen.

 

[John From Detroit]

So how do email accounts get hijacked? Doesn't seem possible. But those are the facts.

There is a game on facebook
What's the name of your first pet (Many use that as a password)
Where were you born
What was your first phone number
And so on and so forth.. About half the questions are are asking about common passwords
None of which work on my accounts

 

[Jackiemac]

I did that on the one time he replied using his real email address (the sbcglobal email address). It did come back as being correct and that was the thing I didn't understand the most.

I just doublechecked it to be sure, it comes back as the same and correct email address. Perhaps somebody got his password, but he doesn't see this one email in his "sent" folder.

-Don- Flagstaff, AZ

There's a sophisticated scam where they actually take over your computer using an app called AnyDesk which is actually a legitimate app but the scammers get you to add it then they can see what you're doing live.

There's a TV show in the UK about how they try to warn the victims as its happening. This is ethical hackers who try to stop scams.

If that has happened to him then they can access everything. Hopefully not though.

 

[DonTom]

If that has happened to him then they can access everything. Hopefully not though.

I think that is exactly what happened. Makes perfect sense. Anyway, Don H. now knows, and he will surely know how to deal with it. The guy is 81 years old but is very intelligent and still as sharp as anybody with this type of stuff.

-Don- Flagstaff KOA, AZ

 

[Ernie n Tara]

It is fairly common for scammers to use your email addr to send you email. I often receive those threats that claim to have recorded your using porn sites or to having recorded you sending/receiving similar messages. They threaten to copy them to all on your address book if you don't send bit coin.
I ignore the mandatory nothing happens. Obviously, they simulate the addr,but don't actually have access to your computer (or they would make other problems for you).
Note that I don't use email at all on my financial computer.
ALL important material is handled on that separate computer!

Ernie

 

[Tulecreeper]

There is a game on facebook
What's the name of your first pet (Many use that as a password)
Where were you born
What was your first phone number
And so on and so forth.. About half the questions are are asking about common passwords
None of which work on my accounts

I see those posts all the time, and I'm only on FB a couple times a week. Questions like: Without naming the city you were born in, what is it famous for?, or, Of all the pets you've owned, if more than one of them had the same name what was it?

The scammers keep track of who answers the questions and they have a logarithm they run all these answers through and you would be surprised at how much info they can glean.

 

[jymbee]

You can open the email, just don't click on any links or attachments.

Actually just opening an email can have negative consequences and a lot depends on your particular email client. For example, unless your email client blocks all external links, the sending can be notified that you received and opened that email. Now they know you're a real person and that you at least opened the email which puts you higher up on the list as potential recipients.

Sites like ConstantContact, and MailChimp rely on knowing how many times an email from one of their campaigns is opened.

Not answering the phone is a good practice.

Yes! So simple, but effective. Get a call from an unrecognized or "restricted" number? Just hang up without even answering. If it's a real person that has an actual reason for speaking with you and not a robocall, they'll just redial. Tiny bit of inconvenience for them, but...

I do this any time I get a call from someone I don't recognize. Usually I've blocked some kind of spammer, but sometimes it's a legit call from, for example, someone at a doctors office that uses a different number then what you have for them.

 

[Kodiak34SS]

IMO, most social media is a scam.

If you use services which require security questions, why are you still giving them legitimate answers? They are additional opportunities to use secure passwords and phrases which are things people will not be able to guess, search, or phish for.

What's your mom's maiden name?
Th!$i5aSc@m9917 roses are r3d

What was the make of your first car?
My favorite color is blue.

What was your first phone number?
ABCDEFGHIJKLMNOP9876543210