Anatomy of a scam

This morning the phone rang and the doorbell went at the same time. After I'd dealt with the postman, I picked up the phone. Nobody answered... there was the usual 'I'm being connected to an autodialler' pause. OK, it's probably one of those 'you've won a holiday in Florida' scams. But it wasn't.

I got an Indian voice, obviously in a callcentre, on the line telling me that they were checking up on all the Windows PCs (I don't have any) as registered with Microsoft (using my name as found in the phone book). After a bit of spiel she told me to go into Event Viewer and look for red crosses and yellow triangles. According to them, these are evidence of 'infection', and my (non-existent) machine was very infected. I was then passed over to a 'senior technician' called who would resolve my 'problem'. (Actually, red crosses and yellow triangles in Event Viewer are nothing to do with infection)

This agent was called 'Mark Brown' on the 10am-5pm shift, and the person I originally spoke to was 'Suzanne' (given I could hear lots of Indian language in the background, this is unlikely). His number is apparently 0161 884 0503 (for the benefit of Google, that's 01618840503 or 0161 8840503)

He sent me off to www.pctechnosupport.com, repeatedly saying that they were a Microsoft Certified Professional. That appears to be the scammer's site. He said that they could clean all the infection from my computer and there was no monthly fee but there would be a small charge of £129 for 2 years or £189 for 3 years, to remove the mythical infection and give me a call once a month to check my computer was operating normally (most probably sales calls to extract more money).

I was told to go to the 'remote support' link on pctechnosupport.com, which sends me off to logmeninrescue.com (a genuine remote login provider). After typing in the 6 digit code they gave me, this downloads a .exe to start a remote login session (he just told me to click 'Run' and then 'Run', nicely ignoring all the security warnings. Anyway, why ask users to install unsigned malware when you can use a legit program to do it for you). Which isn't a lot of use on Linux (and no way am I giving them full remote access to any computer).

As I said the installer stalled (I was staring at the ceiling, making all this up), they sent me off to www.logmein123.com (another genuine site) which redirects to logmeinrescue.com. Again I said the installer was being very slow. After it 'increased' in single-percent per minute, they said they would ring me back. So 'Mark Brown' went off to scam a more promising target, and someone unnamed rang me back in a few minutes. My hypothetical installer was still at '61%'. So he told me to go to Start->Run (I was deliberately unclear as to which OS I was running - 'Mark' thought I was on Vista, this guy thought I was on XP) and type 'inetcpl.cpl' (which is a Control Panel plugin) and 'Repair' my network connection. This I did.

So back to www.logmein123.com and to run the installer again. Another 6 digit code, another installer download. Again this installer was being strangely slow. There was some swearing in the background and they hung up (after 40 mins).

About 15 mins later they rang back. Now I'm told to go to Start->Run, then type 'iexplore logmein123.com' and do the same rigmarole again. My side was again 'being slow'. After about another 15 mins they hung up on me again.

Another 15 mins, and the phone rings again. I'm sent off to www.pctechnosupport.com again. This time the agent is getting impatient, and tells me that he's coming to activate my 'protection' which is '100% safe and secure' and will mean there are 'no problems with your computer'. Despite having no means to actually do anything on my computer. He's going to give me the 36 month option at £189.
He sends me off to pctechnosupport.com -> Service Plans -> UK flag -> Premium:
http://www.pctechnosupport.com/catcollection.php?cid=3&lan=gbp
click on AlertPay and 'click here to pay' and it sends me off to the AlertPay website to enter my credit card details. Strangely my entirely made up credit card number wasn't accepted. I picked the example number of 4111 1111 1111 1111 and AlertPay complained that it was already registered (someone's been trying this stuff before). Oh dear, it says to call customer service. The agent (think it might have been 'Mark' again) tells me to call my bank and unblock my card. That was a 20 min call.

10 mins later, another call, 'Mark Brown' this time. www.pctechnosupport.com, back to AlertPay. Details in again. Oh dear, my card's already been registered. This time he sends me off to google 'team viewer 5 free'. I get directed to the TeamViewer page and told to click 'download'. Now Firefox (in Linux) was sucking up all the CPU of my netbook and couldn't get there. So this time my PC really was being slow.

Next, I'm told to go turn off my PC and boot into Safe Mode with Networking. Then go to Google again. Back to logmein123.com. He shouts across the office for a 6 digit code. Run, Run, oh dear it's being slow to install again. Stuck at 39% he's sounding a bit downcast. I'm sent off to teamviewer to download that, but 'unfortunately' that's being slow too. Now it's time for showmypc.com. Sadly this one's being oh-so-slow to download again. After this download taking 20 mins he's sounding quite fed up.

At 70 mins into this call I'm getting a bit fed up, and have done everything I can do by saying inane things at the phone every minute or so whilst reading my email etc. So I go and take the phone into the bathroom and have a shower, while he's still on the line (listening to the sound of running water!). Amazingly, he's still there 15 mins later. Now it's lunchtime, so I go and make lunch. At some point while I'm making lunch (a bit too quietly, perhaps), he hangs up.


Anyway, by saying 'yes' at appropriate points and parroting back at them what was on their script I managed to waste almost three hours of their time. Which isn't worth a lot compared to their likely profit, but every little helps.

(For the avoidance of doubt, this was clearly a scam. By wasting their time like this I'm keeping them away from some more vulnerable target, and reducing the profitability of the scam)

So these appear to be the scammers:

Domain Name.......... pctechnosupport.com
  Creation Date........ 2010-02-25
  Registration Date.... 2010-02-25
  Expiry Date.......... 2011-02-25
  Organisation Name.... jay
  Organisation Address. co MONAESTRY
  Organisation Address. 126, KALIBARI 1ST LANE. NEW BARRACKPORE.
  Organisation Address. KOLKATA
  Organisation Address. 700131
  Organisation Address. WEST BENGAL
  Organisation Address. INDIA

Admin Name........... jay ghosh
  Admin Address........ co MONAESTRY
  Admin Address........ 126, KALIBARI 1ST LANE. NEW BARRACKPORE.
  Admin Address........ KOLKATA
  Admin Address........ 700131
  Admin Address........ WEST BENGAL
  Admin Address........ INDIA
  Admin Email.......... kk_callezee@rediffmail.com
  Admin Phone.......... +91.9748230041
  Admin Fax............