Apple being sued for refusing to help iTunes gift card scam victims

An 11-count Class Action has been filed against Apple and Apple Value Services by seven Apple customers that are listed on the court docket graphic here. 

The group claims that Apple knowingly or recklessly enabled an iTunes gift card scam. All those listed as bringing the Class Action forward were victims of the iTunes gift card scam. 

The Plaintiffs state that Apple falsely tells victims that 100% of their money lost in the scam is irretrievable and this isn't true. 

Further, the lawsuit claims that Apple has retained hundreds of millions of dollars in commissions in this scam that should be paid back to those who were victims in this highly sophisticated iTunes Gift Card Scam.

www.patentlyapple.com

Phishing: Spot and report scam emails, texts, websites and calls

 

'Phishing' is when criminals use scam emails, text messages or phone calls to trick their victims. The aim is often to make you visit a website, which may download a virus onto your computer, or steal bank details or other personal information.

This page explains how to report phishing attempts, and protect yourself from scammers.

The National Cyber Security Centre (NCSC) is a UK government organisation that has the power to investigate and take down scam email addresses and websites.

Reporting a scam is free and only takes a minute. By reporting phishing attempts, you can:
reduce the amount of scam communications you receive
make yourself a harder target for scammers
protect others from cyber crime online

Please CLICK HERE to read more, understand the risks & stay safe. 
Need more help or further advice? Contact Donline.

www.ncsc.gov.uk

Bombshell report exposes how Meta relied on scam ad profits to fund AI

Internal documents have revealed that Meta has projected it earns billions from ignoring scam ads that its platforms then targeted to users most likely to click on them.

In a lengthy report, Reuters exposed five years of Meta practices and failures that allowed scammers to take advantage of users of Facebook, Instagram, and WhatsApp.

Documents showed that internally, Meta was hesitant to abruptly remove accounts, even those considered some of the “scammiest scammers,” out of concern that a drop in revenue could diminish resources needed for artificial intelligence growth.

Instead of promptly removing bad actors, Meta allowed “high value accounts” to “accrue more than 500 strikes without Meta shutting them down,” Reuters reported. The more strikes a bad actor accrued, the more Meta could charge to run ads, as Meta’s documents showed the company “penalized” scammers by charging higher ad rates. Meanwhile, Meta acknowledged in documents that its systems helped scammers target users most likely to click on their ads.

www.arstechnica.com

UPDATED 131125 - Which: Leaked Meta documents predicted 10% of its revenue came from scam ads in 2024. The social media giant projected earnings of $16bn from scam and banned adverts on Facebook, Instagram and WhatsApp.

Santander warns about celebrity endorsed crypto scams

 

Chris Ainsley, Head of Fraud Risk Management, Santander UK said: “We’re seeing a worrying rise in ‘celebrity-endorsed’ cryptocurrency scams, where familiar faces are being misused on social media in order to con people out of often life-changing sums of money. Rather than revelling in the promised high returns, people are losing significant sums after being duped by these highly sophisticated criminals. Always do your homework and thoroughly research any investment opportunity before moving any money - irrespective of who is endorsing it. “

How the scam often works:

1.    The customer sees a celebrity advertising a cryptocurrency on social media, Google, or even reputable media sites, or is introduced by another social media user to a crypto investment opportunity. The celebrity appears to be endorsing the opportunity.

2.    The customer clicks on a link and shares their contact details in order to find out more.

3.    They are then contacted by phone, email or social media, and offered high returns on the crypto investment with little or no risk. The fraudster will often employ high pressured sales tactics. 

4.    They are told to download specialist software to support them opening cryptocurrency accounts. The software is remote access software, giving the fraudster full access to the customer’s computer. 

5.    The customer opens (often multiple) crypto currency accounts and deposits money in them.

6.    The fraudster freezes access, and takes over the customer’s account, leaving the customer unable to access their money. 

What to do: If you think you’ve been the victim of a crypto scam, report it to your bank straight away. If you have downloaded software to supposedly help with the investment, turn off and unplug your computer and do not use it until you have removed the software and had it checked by a computer technician. If you think you’ve already been the victim of this type of scam, report it to your bank straight away. 

www.santander.co.uk

Web push notification scams and how to block them

 

Seeing pop ups similar to the above in the bottom right corner -or- filling up the right hand side of your screen? You are almost certainly seeing what is known as a Web Browser Notification Scam.

What is a Browser Notification Scam? A browser notification scam consists of fake messages that look like real notifications from websites. These scams deceive users into clicking on links that could direct them to harmful websites, phishing schemes, or malware downloads. The notifications often imitate real alerts, such as system updates, subscription confirmations, or attractive offers, making them hard to spot initially.

What is a Browser Notification? Browser notifications are messages that websites send to your device, typically showing up as pop-ups or alerts in the corner of your screen. These notifications can offer helpful information, like social media updates, reminders, or news alerts. When you visit a site that requests permission to send notifications, you’ll usually see a prompt asking if you want to allow or block these messages. While legitimate notifications can enhance your online experience, scammers have found ways to exploit this feature for malicious purposes.

Need a hand resolving this? Contact Donline.

www.trendmicro.com

Presume all cold calls are scams, public told

 

The public are to be told to assume any cold calls for investment schemes or other financial products are scams under a new Government campaign against fraud.

Ministers are to consult on plans to introduce a ban on cold call sales of products including mortgages, crypto currency schemes and insurance following evidence that millions of people are targeted by scammers each week.

Once the ban is in force anyone being offered such schemes can assume they are a scam and anyone cold calling will face fines of up to £500,000.

More than 40 million adults in the UK were the target of a scam text or call in just three months, according to research by regulator Ofcom.

Cold calls offering pension products are already illegal, and the latest announcement extends these powers to other financial services. Scam investment schemes cost victims £750 million in 2022-23, according to the City of London Police.

www.telegraph.co.uk

TV licence email scam: More than 5,000 complaints in three months

A TV licence email scam has led to more than 5,000 complaints over the past three months.

Cyber crime monitor Action Fraud said fake TV licence emails regarding payment issues had been sent out to try to collect bank details.

The number of reports has increased in each of the past three months, with 1,805 complaints in December alone.

Action Fraud told the BBC the scam was "particularly nasty as it looks so convincing".

The emails use headlines such as "correct your licensing information" and "your TV licence expires today" in an attempt to convince people to click on the link in the email.

Action Fraud said it received 5,057 complaints about such emails between 1 October and the end of December.

Here is a typical example (one that I received myself). Look out for poor spelling or grammar, dodgy sender addresses, dodgy URLs, etc. 

Take 5 - to stop fraud!

www.bbc.co.uk

Received an email claming that your PC has been hacked & they have your passwords? It's probably a scam...

Here’s a clever new twist on an old email scam that could serve to make the con far more believable. The message purports to have been sent from a hacker who’s compromised your computer and used your webcam to record a video of you while you were watching porn. The missive threatens to release the video to all your contacts unless you pay a Bitcoin ransom. The new twist? The email now references a real password previously tied to the recipient’s email address.

The basic elements of this sextortion scam email have been around for some time, and usually the only thing that changes with this particular message is the Bitcoin address that frightened targets can use to pay the amount demanded. 

But how did they get your password? Chances are, from an already compromised site & not from a direct hack on your PC. Check if your credentials are available online HERE. As always: DO NOT REUSE PASSWORDS!!! 

If you have received one of these emails & are worried / unsure what to do next - contact Donline.

www.krebsonsecurity.com

Warning issued to WhatsApp users over account takeover scam

 

Action Fraud has received many reports relating to a scam that steals access to a WhatsApp user's account.

The scam begins when a criminal gets access to another WhatsApp account which has you listed as a contact.

The criminal, posing as your friend or someone that’s a member of a WhatsApp group you’re in, will then send you seemingly normal messages to try and start a conversation with you.

However, around the same time you will receive a text message from WhatsApp with a six-digit code. This is because the criminal has been trying to login to WhatsApp using your mobile number.

The criminal will claim that they sent you their code by accident and ask you to help them by sending it to them. Once the criminal has this code, they can login to your WhatsApp account and lock you out.

The criminal will then use the same tactic with your WhatsApp contacts in an effort to steal more accounts and use them to perpetrate fraud.

What you need to do: Set up two-step verification to give an extra layer of protection to your account: Tap Settings > Account >Two-step verification > Enable.

THINK. CALL. If a family member or friend makes an unusual request on WhatsApp, always call (phone) the person to confirm their identity.

Never share your account’s activation code (that’s the 6 digit code you receive via SMS)

You can report spam messages or block a sender within WhatsApp. Press and hold on the message bubble, select ‘Report’ and then follow the instructions.

Every report matters: If you have been a victim of fraud or cyber crime, report it to Action Fraud or 0300 123 2040

www.actionfraud.police.uk

Browser hanging? Don't call that support number! It's a scam!

Users can protect themselves against this scam by avoiding clicking on suspicious links, including those that might be shortened. If they come into contact with the scam, they can try to disable the browser process using the Task Manager. If that proves fruitless, they should reboot their computer.

www.grahamcluley.com

Scam Alert: FBI ‘Increasingly Seeing’ Malware Distributed In Document Converters

Threat actors may attempt to distribute malware, including ransomware, by offering free document converters, according to a March 7 report from the FBI’s Denver office. “Agents are increasingly seeing” this type of scam. The scheme has been deployed globally, the FBI warned.

Threat actors behind the document converter scam disguise malicious software as a legitimate tool for file conversion. The software may claim to convert .doc files to .pdf files, merge multiple .jpg files into a single .pdf file, or download MP3 or MP4 audio files. In most cases, the downloaded software performs the advertised conversion. However, it also grants the attacker access to the victim’s computer.

Once installed, the malware allows threat actors to download additional malicious software or access files submitted for conversion. If these files contain identifying information —  such as dates of birth, social security numbers, or phone numbers — the threat actor may exploit them for identity theft. The attacker could scrape the submitted files for banking information, seed phrases and other information associated with cryptocurrency wallets, email addresses, and passwords.

www.techrepublic.com

Nigerian email scammers more effective than ever!

You would think that after decades of analyzing and fighting email spam, there'd be a fix by now for the internet's oldest hustle—the Nigerian Prince scam. There's generally more awareness that a West African noble demanding $1,000 in order to send you millions is a scam, but the underlying logic of these “pay a little, get a lot” schemes, also known as 419 fraud, still ensnares a ton of people. In fact, groups of fraudsters in Nigeria continue to make millions off of these classic cons. And they haven't just refined the techniques and expanded their targets—they've gained minor celebrity status for doing it.

On Thursday, the security firm Crowdstrike published detailed findings on Nigerian confraternities, cultish gangs that engage in various criminal activities and have steadily evolved email fraud into a reliable cash cow. The groups, like the notorious Black Axe syndicate, have mastered the creation of compelling and credible-looking fraud emails. Crowdstrike notes that the groups aren’t very regimented or technically sophisticated, but flexibility and camaraderie still allow them to develop powerful scams.

“These guys are more like a crew from the mafia back in the day,” says Adam Meyers, Crowdstrike's vice president of intelligence. “Once you’re in an organization and are initiated, then you have a new name that’s assigned to you. They’ve got their own music, their own language even. And there are pictures on social media where they’re flaunting what they’re doing. The whole idea is why invest hundreds of thousands of dollars to build your own malware when you can just convince someone to do something stupid?”

www.wired.com

Inside the Tech Support Scam Ecosystem

A team of three doctoral students, looking for insights into the inner workings of tech support scams, spent eight months collecting data on and studying the tactics and infrastructure of the scammers, using a purpose-built tool. What they uncovered is a complex, technically sophisticated ecosystem supported by malvertising and victimizing people around the world.

The study is the first analysis of its kind on tech support scams, and it’s the work of three PhD candidates at Stony Brook University. The team built a custom tool called RoboVic that performed a “systematic analysis of technical support scam pages: identified their techniques, abused infrastructure, and campaigns”.  The tool includes a man-in-the-middle proxy that catalogs requests and responses and also will click on pop-up ads, which are key to many tech-support scams. 

There are a slew of different versions of these scams, but generally they’re a type of multichannel fraud that occurs when a scammer claims to offer legitimate tech support via the phone or online to unsuspecting users, with the caller usually claiming to work for Microsoft or Apple support. As the Stony Brook study points out, many of these scams begin when a cleverly designed website tricks unsuspecting, vulnerable users into believing they have a virus, and that they need to call the number shown on the site to help them out. Sometimes, the page disguises itself as a Windows “blue screen” so that users find it more believable.

www.onthewire.io

www.microsoft.com

Deepfake scammer walks off with $25 million in first-of-its-kind AI heist

On Sunday, a report from the South China Morning Post revealed a significant financial loss suffered by a multinational company's Hong Kong office, amounting to HK$200 million (US$25.6 million), due to a sophisticated scam involving deepfake technology. The scam featured a digitally recreated version of the company's chief financial officer, along with other employees, who appeared in a video conference call instructing an employee to transfer funds.

Due to an ongoing investigation, Hong Kong police did not release details of which company was scammed.

Deepfakes utilize AI tools to create highly convincing fake videos or audio recordings, posing significant challenges for individuals and organizations to discern real from fabricated content.

This incident marks the first of its kind in Hong Kong involving a large sum and the use of deepfake technology to simulate a multi-person video conference where all participants (except the victim) were fabricated images of real individuals. The scammers were able to convincingly replicate the appearances and voices of targeted individuals using publicly available video and audio footage. The Hong Kong police are currently investigating the case, with no arrests reported yet.

www.arstechnica.com

Inside the TalkTalk "Indian scam call centre"

TalkTalk customers are being targeted by an industrial-scale fraud network in India, according to whistleblowers who say they were among hundreds of staff hired to scam customers of the telecoms giant.

The scale of the criminal operation has been detailed by the three sources, who say they were employed by two front-companies set up by a gang of professional fraudsters.

The sources describe working in "call centres" in two Indian cities.

They say as many as 60 "employees" work in shifts in each office, phoning TalkTalk customers and duping them into giving access to their bank accounts.

The whistleblowers say they were given a script in which they were told to claim they were calling from TalkTalk.

www.bbc.co.uk

Blue screen of death with a support number? Beware the malware scam

A new tech support scam displays a fake blue screen of death (BSoD) in an effort to trick users into installing malware on their Windows computers.

In this particular case, Hicurdismos masquerades as Microsoft Security Essentials, the anti-malware product that came pre-installed on all machines with Windows 7 and earlier.

www.grahamcluley.com

Met Police smash huge phone scam network

Police will text 70,000 people to warn them they have been victims of a banking scam in the UK's biggest anti-fraud operation. The Metropolitan Police have arrested an east London man accused of running an international service enabling fake phone calls to victims. Victims lost thousands of pounds, and in one case £3m.

Detectives only have their phone numbers and are asking people to act if they receive the message.

Metropolitan Police Commissioner Sir Mark Rowley described the investigation as the biggest proactive counter-fraud investigation ever in the UK. He said the criminals involved were responsible for the "industrialisation of fraud".

Detectives revealed that there could be 200,000 UK victims of the scams, which usually involved fraudsters calling, pretending to be a bank, warning a customer of alleged suspicious activity on their account.

An address in east London is alleged to have been at the centre of the service which police believe enabled fraud on a global scale.

www.bbc.co.uk

Shock Horror! Bitcoin mining rig is branded a "SCAM"!

The company behind a Kodak-branded crypto-currency mining scheme has confirmed the plan has collapsed.

In January, a Bitcoin mining computer labelled Kodak KashMiner was on display on Kodak's official stand at the CES technology show in Las Vegas.

But critics labelled it a "scam" and said the advertised profits were unachievable and misleading.

Now the company behind the scheme says it will not go ahead. Kodak told the BBC it was never officially licensed.

Wow, dodgy hardware & Cryptocurrencies, what could possibly go wrong?

www.bbc.co.uk

Martin Lewis to sue Facebook - to stop fake / scam adverts

Martin Lewis is the founder of the consumer help site MoneySavingExpert.com and the Money & Mental Health Policy Institute charity, as well as presenter of ITV’s The Martin Lewis Money Show.

Today, in an individual capacity, he will issue High Court proceedings for a campaigning defamation lawsuit against Facebook and will be seeking exemplary damages. This is not being done for personal gain – he pledges any and all money paid out to him will be donated to anti-scam charities.

Within the last year, the social media site (Facebook) has published over 50 fake Martin Lewis adverts (sample images here), which are regularly seen, likely by millions of people, in the UK. These adverts are often for scams. Many have big pictures of Martin and his name, alongside a raft of false promises or endorsements – some then link on to fake articles which continue the theme.

www.bbc.co.uk

Scareware scam: Restoro and Reimage fined $26 million by FTC

Two firms have been fined $26 million by the US Federal Trade Commission (FTC) for scaring consumers into believing their computers were infected by malware.

The FTC claimed that Restoro Cyprus Limited and Reimage Cyprus Limited, both based in Cyprus, operated a tech support scam since at least 2018 that "bilked tens of millions of dollars from consumers... using false and unsubstantiated claims about the performance and security of consumers' computers."

The companies, which have a common ownership, are thought to have been particularly successful at scamming older consumers with fake Microsoft Windows pop-ups. The pop-ups claimed computers were infected with viruses and urged users to "scan" their PCs "to avoid more damage."

www.bitdefender.com