Police in the UK have announced the arrest of eight suspected “home delivery” scammers in a bunch of early-morning raids across the south of England.
The aptly if not catchily named DCPCU, short for Dedicated Card and Payment Crime Unit, is the law enforcement group behind these busts.
As you can imagine, more people than ever are relying on home deliveries during the coronavirus pandemic.
Sadly, cybercriminals have been quick to join in, using the very simple but effective ploy of emailing or texting you to say that “your parcel couldn’t be delivered.”
Crooks join the home delivery revolution
As Naked Security readers have pointed out before, you don’t always know in advance which courier company an online vendor might might use, so even if the crooks send you a fake message from a company you wouldn’t normally expect, it’s easy to fall for it.
You might think, “Well, I’ll check it out anywyay, just in case,” as in this example that ripped off the well-known brand DHL:
Another way the crooks make the message seem more believable is to pick the name of a courier company that’s specific to your part of the world, giving their message a local touch that somehow makes it feel more likely.
Here’s one from last year where an innocent looking text message…
…redirected to a webite tailored to the location of the person who clicked through.
In that case, the message was reported to us by someone in Canada, so the crooks presented them with this:
In the UK, the ripped-off courier company is very often Royal Mail, because of its brand recognition in Britain, but the crooks typically rotate through many different courier brands, or choose them at the time you click through, based on your location at the time.
The crooks only need a rough idea of where you live. Just your country is usually enough, and they can typically figure that our either from the phone number to which they originally sent to the bogus text message, or from a rough idea of the internet service provider you’re using. For example, if you show up from an IP number (network address) that’s allocated to BT (formerly British Telecom), you’re probably in the UK; Telstra means you’re an Aussie; Telkom SA puts you in South Africa; and so on.
A little money goes a long way
The trick you see in the “pay page” above is very common: to set your mind at rest, the crooks ask for very little money, typically from about 99 cents up to amounts such as £1.49, €1.99 or, as shown above, $3.
The idea is that the modest fee sounds believable, and it might feels at though it’s worth the risk of paying out the money anyway, given that it’s only a few dollars, in case it is a real delivery and you miss out.
Of course, the crooks aren’t after 99c, or £1.50 or €2, and in all likelihood they won’t even try to process a payment against your account right away.
After all, after you’ve filled in the fake payment form on the fake site, the crooks have all your card data anyway, including the all-important three-digit security code (CVV) on the back.
So they can use your card to buy items for themselves later on, such as popular electronics products that they can sell online almost immediately and “cash out”.
Even if you get your money back in the end, the crooks still drain the value of the fraudulent transactions from someone, typically the merchant, who ends up not getting paid.
The scam gets worse
In the UK, and in many other countries, however, these scams rarely end with just a hack of your credit card.
In fact, the crooks may not try to charge your card at all.
Instead, they’re relying on the fact that, after a while, perhaps a few minutes or hours, or perhaps the next day, you will probably realise that you fell for a scam.
Then you’ll rush to cancel your card at your bank, and promise yourself to be more careful when clicking through to websites in future.
Believe it or not, this suits the scammers just fine, because they’re not after some money from your credit card; they’re after all the money in your regular account.
This is where their social engineering skills come in, because they wait a while, perhaps a few days or even longer, and then call you up pretending to be your bank investigating the fraud.
They are likely to congratulate you on reporting the scam and not getting suckered in beyond the original website…
…and then they use their gift of the gab to convince you to move your funds to another account, one that they have thoughtfully set up for you in advance.
They’ll tell you that this is because that the account that was hit by the scammers needs to be shut down and investigated, or will given some other bogus fraud prevention “reason” that they’ll explain in the most positive and helpful terms.
Of course, the unfortunate victims that get drawn along this far often lose everything, because the the premise is, after all, that the defrauded account needs to be shut down completely, which means that all the funds need to be shifted from it first.
LEARN MORE ABOUT SOCIAL ENGINEERING
Listen to our special-episode podcast with Rachel Tobac, a renowned social engineering expert, and give yourself the confidence and understanding not to get sucked into saying or doing the wrong thing online:
What to do?
- Don’t click links in text messages from courier companies. Find your own way to the right website and start from there. It’s a little bit less convenient for genuine delivery messages, but that’s a small price to pay for not paying the huge price of clicking a fake link by mistake!
- Don’t be in a hurry to enter card details on a website. Stop and check the website name and the site contents carefully first. The crooks don’t always make silly mistakes such as spelling errors, but often they do. If you spot it’s a scam up front, then you can simply bail out before you type any data into the site.
- Don’t rely on the phone number that pops up when someone calls you. Telephone caller identification is insecure and can be faked by criminals. If a caller tries to convince that you can definitely trust their identity by checking the number on your phone’s display, they’re lying and you can be sure they’re a scammer. Your bank will never make this claim because it’s not true.
- Never call your bank based on a number you received in a message. If the crooks sent the message, you can be sure the number will just lead back to them and they will pretend to be the bank to continue the subterfuge. The crooks know which numbers they used for which scams, and prepare accordingly, so the answer you hear when the crooks pick up will sound perfectly believable.
- Never transfer funds out of your bank account on someone else’s say so. Your bank will never ask you to do this. If they needed to freeze your account they could do so without processing a withdrawal first. If someone insists you need to transfer money as an anti-fraud measure they’re lying and you can be sure they’re a scammer.
We can’t emphasis this last point enough.
Your bank will never ask you to “fight fraud” by shifting funds from one account to another using a regular payment in your banking app, for the simple reason that that’s how frauds are committed, not how they are prevented!
