Warning - Scammers re-using baiters' ID's, docs, etc.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Western Union · Posted: Sun Apr 13, 2008 8:45 pm

tada wrote:

The fact that the scammers grab defaced documents from anti-fraud sites is a well known fact.

Absolutely not the case. You are making assumptions again. We ask that people deface documents because we don�t want to become an easy resource for fake ID. It is a precautionary measure. It is not because there are hordes of scammers downloading every document posted.

tada wrote:

If the scammers are trying to index the information to prevent discovery of duplicates, we can burn up the scammers time by making tons of heavily defaced and easily found documents available on the `net.

You are finding solutions to non-existent problems. Scammers are not trying to index documents. The very notion is ridiculous. I seriously suggest you spend a little time reading the site and learning how scammers work. Scaremongering like this helps no one, however well intended. Just because something is possible does not make it true.

Elite Baiter Joined: 17 Sep 2004 Posts: 1269

January wrote:

I think that "most of us" don't even send fake IDs or other documents any scammer might re-use.

As Jan said, we don't send fake ID's anymore.

thread title wrote:

Scammers re-using baiters' ID's, docs, etc.

A baiter created a fake Wang Quin passport several years ago and it's still kicking around. They've been at it for years, unfortunately.

Posted: Sun Apr 13, 2008 10:48 pm

I think the answer to this problem is simple.

A.) We need to make all the victims stop sending their ids!

B.) We need to tell all governments to make their public documents private again, and express the fact that only 5 RSOTs should be on each document they create.

Tada seems to know much about this, and I'm sure he's willing to head up a committee to put this into motion!

Now: Problem solved -

Or wait - people may still upload pics to myspace, photobucket, facebook, imageshack....

Damn - maybe we should have all image hosting sites taken offline?

Or wait - even better solution. Let's just get rid of the internet all together.

There you go..... no more scammers....

But then the phone rings - it's someone asking me if my roof needs to be fixed after the storm that came through last week......

hmmmmm maybe we all just develop paraphrenia!

Posted: Sun Apr 13, 2008 11:12 pm

In fairness here, I think tada has some valid points if you boil it all down to-

If you post a document, watermark it.
If you watermark a document, do so effectively.
Scammers are snakes in the grass and not to be trusted.

That essence is something we can all agree on, whether or not we agree on the motivations and actions of scammers in general or particular?

Or am I now misunderstanding?!

Posted: Sun Apr 13, 2008 11:16 pm

Eliza_Doolittle wrote:

Tada seems to know much about this, and I'm sure he's willing to head up a committee to put this into motion!

There is no need to post sarcastic comments. Tada has posted something that is important to him/her, and even if his comments are not agreed with, he should still be respected as a member of this forum. Evil or Very Mad

Gone fishin' Joined: 28 Mar 2008 Posts: 20

sheboppe wrote:

What I am not getting out of this, is why scammers would look for defaced documents when there are plenty of sources to have any document made that suits the purpose?

I really don't know, but I'm trying to figure it out. At present, it still doesn't make sense.

sheboppe wrote:

Why are posted and defaced fake documents a concern all of a sudden?

Fake documents are an on-going concern, both here and elsewhere, so there's nothing new in this regard. In many ways, I've only been stating the obvious for those who are familiar with these things.

The thing that is new, and doesn't make sense, can only be seen when you start looking at all the facts together.

Scammers are collecting defaced fake documents, when there are plenty of easy ways for them to get unmarked fake documents.
There is a group of more than 12 individual scammers working together and all of them are collecting defaced fake documents.
The group is proven to pass victims (a.k.a. "jobs" or "work" or "magas" or "mugus" or "mayes" in West African scammer parlance) from member to member to further perpetuate the crimes.
There are multiple accounts being used by each of the scammers to store defaced fake documents. We have only been granted access to data from a handful of these accounts, but we believe there are more (most scammers have tons of accounts).
At least some of the scammers in this group can operate image manipulation tools.
Due to the server logs from the sites hosting the defaced images, we know the scammers are using google image search to find the defaced images.
The scammers are not saving the other non-defaced images which would obviously turn up in their image searches.

It is certainly possible I'm reading too much into things as has been claimed here, but when I add up all the facts, they don't make any sense at all. Since the facts are contradicting each other, and it is not an isolated incident, we are most likely looking at a change of tactics.

As for "all of a sudden," you can blame it on me trying to be discrete, polite, and not break any rules around here. I fully realized there might be issues raised regarding the fact the data came from within a scammer account, and even asked for this to be moved where Eater keeps such things.

Mr Fishe wrote:

tada wrote:

The fact that the scammers grab defaced documents from anti-fraud sites is a well known fact.

Absolutely not the case. You are making assumptions again. We ask that people deface documents because we don't want to become an easy resource for fake ID. It is a precautionary measure. It is not because there are hordes of scammers downloading every document posted.

tada wrote:

If the scammers are trying to index the information to prevent discovery of duplicates, we can burn up the scammers time by making tons of heavily defaced and easily found documents available on the `net.

You are finding solutions to non-existent problems. Scammers are not trying to index documents. The very notion is ridiculous. I seriously suggest you spend a little time reading the site and learning how scammers work. Scaremongering like this helps no one, however well intended. Just because something is possible does not make it true.

Mr Fishe, your remarks are rather pointed, but I won't take offense to them. Just as I don't expect victims to believe me when I call them with warnings from a recognized organization, I most certainly do not expect you or anyone here to believe me when I'm entirely new to Eater. I've been expecting the typical victim responses like, "how do you know?" and "who the hell are you?" as responses in this thread, so as always, I'm just doing my best with them. Though I'm certainly new to Eater, reading yet another entertainment bait might be good for a much needed laugh, but the odds of it actually being educational for me are rather slim. I simply don't have the time to be active on every single anti-fraud, victim assistance, and baiting site and still get the real work done. None the less, I still know it's important for all of us to collaborate.

I never said there were "hordes" of scammers doing this, so please refrain from the straw man arguments. At present we've identified 12 individual scammers. There are possibly others. They are all doing this same saving to email nonsense only on defaced images found via image searches.

For notes, your rhetoric is reasonably good. :-) --But please realize there's no need for it. I'm not your adversary.

People here were questioning where the information came from, and why it was important, so I stepped up to the plate. I've shared information which you do not have, and at this point, I have shared as much of it as I can. If there is a potential change in scammer tactics going on, then the folks here Eater should know about it as quickly as possible, even if the analysis is uncertain or the source unvetted.

If it was an isolated incident, I would not have wasted my time, or yours. Instead, we're looking multiple occurances, across a number of sites, on a number of dates, done by a group of related scammers. I cannot explain the contradictions and oddities in these facts, but unfortunately, I've got the proof sitting here right in front of me.

The idea of scammers possibly indexing the defaced images for the sake of avoiding detection, is both outlandish and rather disturbing, but it is still one of a number of viable possiblities. I'm sorry it seemed like fear mongering, but it made more sense to list out all of the possiblities, than to intentionally ignore the frightening ones. I was initially not very forthcoming about the facts, but now that you have them, I hope you'll see the reasoning for inculding the "ridiculous" possiblities.

We may never agree on importance or validity of everything, but I thought this is important enough to make you aware of the situation, so you can draw your own conclusions.

I have neither the time nor inclination to argue with anyone here. You may be able to validate my claims on your own, or you may not, but either way I've told you what I can. If advance information on developments is unwanted, I'll most certainly stop trying to post it here. It's one less thing for me to do. I know a ton of great work gets done here at Eater, and I have a lot of respect for the people who do it. I'd rather be a help than a hinderance here. If you think I can help out in some way, please let me know.

kind regards,
tada

Posted: Mon Apr 14, 2008 1:51 am

Tada - it is natural for people to question the source of the information that is posted anywhere. It is just human nature to want to know where it came from. People like to substantiate what they read or hear.

You are very welcome to post here, and you are not causing any issues. If you don't want to reveal the source in a public forum of where you are getting your information, that is fine, but please be kind enough to PM it to me or another mod to evaluate. It's difficult for us to tell members that PM us about your info that it's true if we can't even back it up.

There will be those who agree with you, and others that don't. Please don't let that deter you from posting info that you have on Eater. Very Happy

Posted: Mon Apr 14, 2008 2:19 am

It's a valid point, but too large to deal with effectively. It reminds me of that other post..... with the Solution!

IBTL

Posted: Mon Apr 14, 2008 3:22 am

One easy tactic to deface a jpeg is to use the spraycan tool in mspaint. It creates many single pixel and small pixel group spots that must be recolored one at a time. The clean-up would be painfully time consuming and very difficult to do in a convincing manner. - vdJ

Posted: Mon Apr 14, 2008 3:40 am

Concerning the theft of actual baiter information I just got one in my inbox from a P. Phile.
At first I wasn't sure if he was a badger or not, but upon googling p4rk4 ph1l3 the name turned up on a few scam sites. I'd like to think that it was a muppet scammer who's grabbed a baiter's joke name and is trying to use it to give himself some kind of credibility Smile

A good way of obfuscating a scammer image would be with the kind of php script that is used to make captchas.

[edited: typo]

Posted: Mon Apr 14, 2008 4:30 am

Rodus wrote:

google image search for passport, ID, driving license. All turn up useable pics and all in seconds. Why would a lad bother chopping an ID when this is so much easier. Lads aren't that stupid.

Lazy - has anyone mentioned that lads are lazy yet?

The best way to solve this problem is petition all ISP's to block transmission of graphics files. That way the scammers would have to resort to faxing.

It's a lot harder to capture a fax of a fake that we deface before faxing it to Rover for filing (alphabetically please Rover) that he can then fax to members who ask to view it.

Bugger. Just remembered I don't have a fax...

Posted: Mon Apr 14, 2008 9:30 am

Quote:

Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim.

Sorry, I wasn't clear when I wrote that. I meant to say that most of us use silly names, not that most of us send false IDs. I've never actually sent a real piece of ID to a scammer, just a very large renamed .dll, and a photo of Roosevelt (FDR).

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

Those documents are useful to photochopping lads even in their current state:

They provide ideas for documents - and documents are what drive 90% of fee requests.
They provide clip-art for use in other documents. Even a real drop-shadow from a real scanner would be useful. Logos, signatures, stamps and seals would be a great resource.
They provide information about what a document should look like - I'm thinking passports here.
Many of them can be cleaned up relatively easily. Although, if it were me, I'd only bother for a passport, and only then if it were trivial or a rare country.

Elite Baiter Joined: 02 Jul 2006 Posts: 1702

Scammers are adaptive, if they want an image they will get them, we just make it more difficult for them to use our images.

Nothing we do to the images will prevent there re-use, what stops them being re-used is the scammers seeing them with FAKE over them.

OK is a universal word, and so is FAKE, lads around the globe in every europe language know fake is fake, ask a japenese tourist what fake means they will tell you, as well as chinese and russians.

Fake is and always will be the best method of photo securing, and 419eater needs to keep it as it is, because people see our images and learn what to look out for.

If a lad is so lazy to send them out with FAKE still visible then we love it, if he is that lazy he deserves to get the feedback most will send him.

Its highly suspicious how you know he is storing things, and best not to discuss that, but at the end of the day lads will find the docs either here or on google, perhaps at best we should add the fake a bit more obtrusive espcially of photographs they prove impossible to fix, but on docs once you have seen a dozen you have seen nearly every variation, i wouldnt lose sleep over it - its how lads operate, nothing new.

Posted: Mon Apr 14, 2008 11:26 am

What a conundrum - I guess we'll have to wait and see exactly what's going on here, so here's my conjecture...

I'm inclined to agree that the talented artists will not bother removing watermarks, especially if the watermark is a good one.

I guess there are a few possibilities -
* a brand new modality - pretending to be 'internet cops' with a dossier of fake ID's they've caught, to use as a convincer.
* Collecting a list of dead ID's not to use
* Creating a clip art gallery to cobble together fresh ID's using the non-watermarked sections of each.

I hope it's the second or third, not an arms escalation with our hard work being used in vain in order to scam more. Sadly I suspect it may be the case. If it is, we may need to add a watermark link to scamwarners too...time will tell...

Posted: Mon Apr 14, 2008 12:06 pm

manbiteslion wrote:

I guess there are a few possibilities -
* a brand new modality - pretending to be 'internet cops' with a dossier of fake ID's they've caught, to use as a convincer.

I can go into my catcher account and pick out a handful of such documents/attachments, all without "FAKE" written on them. All a lad has to do is set up a similar "catcher" account and pass it around. I've got a fake lad account, and because of a couple of replies I sent last October pretending to be a lad seeking help from another, I now regularly get batches of fresh formats in that account, complete with documents for many of them. All for sending out a few replies. I don't even have to think about opening Photoshop on any of them.

manbiteslion wrote:

* Collecting a list of dead ID's not to use

Do you know how many emails I've received from lads claiming to be "Patrick Williams" over the past year? Or "Mary Jones" (Marry Jones, in one case)? Or "Williams Mensah"? And they're the less famous ones. There are, of course, the hundreds from Charles Soludo and all the Abacha family.

manbiteslion wrote:

* Creating a clip art gallery to cobble together fresh ID's using the non-watermarked sections of each.

<http://images.google.com/>

This thread is dealt with in three easy steps:
1. Meh.
2. Shrug.
3. Move on.

There's nothing new being presented here for discussion, and what appears to be new info is conjecture and what-ifs.
Mountains. Molehills. Rearrange into the correct sequence of events.

Posted: Mon Apr 14, 2008 12:57 pm

I am more than a little intrigued by the header posted by Tada being of any use to a scammer. As a mass mailer myself, as are the lads, a quick look in the Sent box will show the email anyway, so why send it back to himself - he's already got a copy.
From experience, if I want to store my scripts, I add the addy of one of my less active accounts in the bcc. I do this because I use the responder extensively, and it's easier to sort through 50 than maybe 5000.
I really believe that if a victim is going to be conned by an ID of any sort, it matters not whether it is an original fake or a restored fake. The single remedy is really to educate potential victims.
Sorry, I don't have the answer to that part.

Posted: Mon Apr 14, 2008 12:59 pm

I wonder how big the lad image database is.

I have received several copies of the "sick man hooked to tube" picture
from different lads, and have received my second "counting the money"
movie (mpg file). And the usual pictures from modeling sites.

Posted: Mon Apr 14, 2008 3:36 pm

You won't get a lad to do anything unless he thinks it leads directly to a payout. Therefore, why on earth would a scammer spend his time making an index of phony documents (and then un-defacing those documents!) when the same thing can be obtained more easily by other means? It just doesn't make any sense. Confused

In fact, if lads are making an "image database", I say more power to them since it means less time scamming. Sounds like an own goal to me.

Marked-up documents 1, Lads 0.

Posted: Mon Apr 14, 2008 3:57 pm

The OP's assertion that he has identified a dozen scammers targeting baiting sites for posted examples of documents for reuse does not suprise me either.

The more valuable (to a lad) documents such as passports, DL's, other forms of photo ID are going to obtainable, it's just a matter of where the lad wants to get them from.

The more successful scammers simply puchase the documents from document specialists, then recycle their own for new vics, changing the names when necessary.

These may be cheapskate lads Smile

with more time on their hands than money in their wallets.

If these guys can't afford to go out & buy their own fake IDs, then it makes me wonder about the believability of their formats.... Wink

Nope, the sky is not falling...

Posted: Mon Apr 14, 2008 4:14 pm

What I don't get is that the lads made the fakes to begin with; and with far less skill than would be required to remove defacing marks. I really can't see what the point would be in doing that, but what a great time wasting modality. Let them knock themselves out.

No question, we have to be careful about what we send lads. I knocked up a Moneygram receipt as part of a bait. After I lost my lad, I rebaited with another addy. Guess what I got back? My own receipt offered back to me as proof that my lad's "other partner" had paid his share. Who knows how many real victims that went out to.

Sometimes letting the lads reuse things isn't the worst thing in the world. Like this CLASSIC.

I know, I know, it still might fool a non-english speaking vicitim. But no doubt, it spared a few too.

But this thread isn't really about what we send them, it's about what we post. Lads can grab formats and fake docs from baiting sites. That's fine. Roaches can drink condensation from pipes, but there's no need to change building codes to prevent it.

Posted: Mon Apr 14, 2008 4:29 pm

If we were really worried about scammers taking images from sites but still wanted to compare them, the easiest way to do it would be make a database of the hash of the contents of the images and you could compare the hash of the image you to see where it has been used by other scammers etc.
I actually think for romance scams that would be a good idea since there are such a mind boggling array of model photos out there, you'd need a lifetime to sift through them to compare an image you have with ones doing the rounds. It would also be an excellent way for people who believe their identity is being misrepresented to check, but I'm veering off topic now.

Posted: Mon Apr 14, 2008 5:15 pm

I have to admit that I am a little lost - not offended, though my name was mentioned - however I'm not clear why. I've never posted an ID except with the word fake across it.

Yes, I have posted photographs of scammers, one of Mr G0mer and some spoofed newspaper articles, but how they could be used baffles me, and substitutes would be available anywhere or could be made up by a scammer, though I can't think how they'd use them (newspaper articles about the death, arrest and machinations of a criminal ???).

I can show a google search that will bring up 1000's of passports. I can believe that scammers are barely capable of google searching, but then I find it hard that even the stupidest Lad would waste the time removing 'FAKE' from documents, let alone watermarks, when it's a lot easier to use what's already out there - and not all scam sites are as careful as we are.

If a mod is unhappy with any of my pictures, I am here to be pm'd, but I am naturally cautious and believe what I have done falls within the rules here. There is always a fuzzy edge to all rules, whether it be in regard to ITP's or documents. It would be ridiculous to say that any bait you find involves any third party, you must drop, or that you must never send a photo or a document; that would stop a lot of baiting.

I think that the rules as they stand are common sense and protect potential victims, as well as we can, and I don't believe that I go against them in the letter or in the spirit.

Raising the question is fine, but if there's a problem with one of my pictures, link to it and I'll reconsider whether I was being reckless, or not. I'm not offended, just a little perplexed. Was it my "Busy Bees' H0ney Emp0rium" shop frontage ?

Edited to obscure shop name, though if the Killer Bee Lad can Google, we're all doomed. Very Happy

Posted: Mon Apr 14, 2008 5:24 pm

If we effectively deface the fake documents, the occasional lad who tries to restore them won't have much, if any, luck. We just have to be thorough, that's all.

Making the documents available here, or at any anti-scam site, really, is important for convincing (potential) victims that they're dealing with scammers. I mean...the lads use the documents to make their lies more believable. We use the defaced fakes to make the truth easier to believe.

We just have to do a thorough job of defacing the fakes, is all. That way, the lads get no joy *and* potential victims get something solid to help them process what the scammers are trying to do. Win-win all around as far as I can see.

Posted: Mon Apr 14, 2008 10:13 pm

@ Gomer and Tigbitties

I mentioned your name along with Tigbitties in the context of being the source of misleading information, and I acknowledge my participation. I did not mention documents. We are all adept at misleading lads. The post obliquely referred to Newspaper and Magazine clippings. of which I have done my share.
It was a tongue in cheek post, and intended as a compliment, not a criticism.

Warning - Scammers re-using baiters' ID's, docs, etc.	View next topic View previous topic