The Daily Scam Newsletter (August 5, 2020)

THE DAILY SCAM NEWSLETTER — AUGUST 5, 2020
Content Director Doug Fodeman | Creative Director David Deutsch | Issue 311

We want to play a game with our readers… Guess the Scam site! Below are four websites that offer auto transport services. One of them is a complete fraud. Can you guess which is the scammer’s website? You can use whatever tools or resources you want to help you make your decision. (Please note that though we have used three different online tools to test for malware on the scammer’s site, we have no control what these nefarious characters may do with their websites. However, given the type of scam this represents, it would be extremely unlikely for them to set a malware trap on their site. If you visit these sites, you do so at your own risk. We visited all of these websites on August 1 and found no risks.) We’ll reveal the scam website in our Top Story below.

Montway Auto Transport

Nationwide ShipEx

UShip

Direct Express Auto Transport

There are many different ways to see through scams. Nigerian 419 scams are probably the easiest of all simply because the reality is that ONLY scammers will contact us via email to say that they have money to give to us, or wish us to enter into a business partnership, etc. However, we would like to remind our readers that one of the ways to see through scam emails is when you get an email from one address but are asked to reply to a different address (or that reply is automated in the “reply-to” settings.) Also look for country codes in sender’s email addresses. These will often reveal that the email is highly suspicious. Here are three examples. The emails were sent from India, Brazil and Romania. All of them ask you to reply to a different email address than the one used to contact you.

August, 2020 marks our sixth full year of exposing online and phone-related threats, scams and fraud. We want to thank our many thousands of readers for contributing their stories, scam texts, emails and suspicious social media posts over the years. It is only with your effort and willingness to share your experiences that we are able to offer such relevant and important content. We are very proud of this partnership with our readers and the fact that together we have helped more than a million people to recognize these risks and learn how to avoid them. Education against cyberthreats is key!

Check out our newest article about a fake businessman and construction company! Read Michael Hills and Hills Inc. Construction is a Scammer.

Daily Scam Home Page

During the last few weeks we have been informing readers of a noticeable increase in scam emails disguised as product purchases and containing call-back phone numbers. What makes these emails so dangerous is that they don’t contain any clickable links (or working links). They offer phone numbers to call to cancel your order (that you never placed to begin with!) Here is another such email that pretends to an Amazon purchase of a Firestick for $799! The Firestick shown in the email can normally be purchased for about $40-$50. But wait, you can call the scammer’s phone number 877-546-5672 to cancel your order. This email was sent from a generic iCloud account. Calling these scam phone numbers is VERY DANGEROUS because these cybercriminals are so clever at manipulating people once they have them on a phone call.

WARNING: If you use Google to investigate suspicious phone numbers, BE EXTREMELY CAREFUL NOT TO CLICK on links to any websites EXCEPT the most well-known websites like 800notes.com. The cybercriminal gangs who target us KNOW that most of us will search for phone numbers in Google. They have created lots of malware-laden websites displaying their scam phone numbers that try to infect our computers when we click a link to investigate them. For example, searching for 877-546-5672 pulls up a link to the crap domain lbogbjtgu[.]xyz. This domain was registered in Japan in October, 2019 and is hosted on a server in Germany. Step away from these bear traps!

Here is another phish pretending to be from Amazon asking for a “Payment Address Verification Request.” Apparently, your Amazon account has been blocked “because our service has detected two unauthorized devices.” The email didn’t come from Amazon.com, but came from “account-service.net,” a domain that was registered less than 3 weeks earlier. The link in this email will redirect to a hacked website for a restaurant in Spain (“.es” = España = Spain)

Though this next email says FROM “Support@apple.com” the REAL email address is in the <> brackets that follow. The email came from vcuxas[.]com, a domain that was registered just 4 days earlier in Canada. The message says that they have been unable to “charge you for your account” and that you’ll be locked out in three days. Of course, that’s not how Apple operates. The link obviously doesn’t point to Apple.com!

One of our longtime readers sent us this email pretending to be from Wells Fargo Bank about an “unusual incorrect sign in attempt.” We were curious about the oddly named domain that showed up when we moused over “Verify Here.” When we looked it up we discovered that the domain used in this link is for a hacked website to a lock service in Vietnam!

Daily Scam Home Page