A little help with a very strange scam

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

** SUSPENDED ** Joined: 19 Feb 2012 Posts: 160

Hello all

I've just got off the phone with one of my contacts and it seems there is an interesting phone crime that has just started doing the rounds here in Malaysia.

Mobile users from a particular phone network are all being called and told they have won 5000RM in a lucky draw. So far so simple but the scammers are not asking for any bank details.

Instead victims are being asked to go to an ATM to 'get their winnings'. Right now we have no idea exactly what is being asked of the victims once they get to the ATM since those that reported the call to us realized it was a scam early on.

However, we do know the following;

- all calls are coming to a certain network, other networks are unaffected
- they are all asked to go to an ATM from their own bank, not any other bank, however it seems they are not being directed to a specific ATM
- the accent of the persons doing the calls is not local but since it is in Malay then we think the scammers are Indonesian

Anyone got any ideas exactly what is going on here? Your help would be much appreciated as my police colleagues are baffled as to exactly what this is. I have a few theories as to what might be going on but I don't want to prejudice your ideas so I won't share them just yet.

All help extremely welcome!

I will update when any news comes in.

Posted: Mon Mar 19, 2012 6:18 am

Maybe the victims are being shadowed for later mugging?

** SUSPENDED ** Joined: 19 Feb 2012 Posts: 160

TheDane wrote:

Maybe the victims are being shadowed for later mugging?

That was my first thought as I have heard of victims being asked to go to an ATM, withdraw funds and then be mugged. However in that case the victim was asked to go to a specific ATM that the muggers were waiting at, in this case unless they criminals have thugs at every ATM in the country then they are kinda stuffed...

Of course they might be covering a few ATMs and then just waiting to get lucky but in that case why bother calling people? They can just wait for some guy to make a withdrawal and then follow on from there.

But yes, your suggestion is one of the leads being followed, trouble is that ATM mugging is quite common so finding these specific guys is a problem. Plus it is a heavy drain on manpower to send officers to have a look at every ATM only to have the gang move off somewhere else as soon as they see a police officer.

Master of Master Baiters Joined: 26 Sep 2008 Posts: 689

You need someone who is prepared to comply and go along with the request. Or intercept a call.

- Caller & victim don't know each other, that eliminates mugging, hacking of passwords, card pin numbers etc.

- All you have is a compliant potential victim .... but how does the victim get his supposed winnings from an ATM machine? It's not just going to hand over 5000RM (£100?). You can't have a conversation with an ATM ... so what's left?

"Oh sorry you couldn't get your money, there was a fault in the system ... go here (specific location) instead ...?"

Alternative - "to validate your winnings and so you can withdraw your money we need your card & pin number" .... simple card theft.

Posted: Mon Mar 19, 2012 10:07 am

Cpt.J.H wrote:

However, we do know the following;

- all calls are coming to a certain network, other networks are unaffected

OK, so they have someone on the inside of one of the networks.

Quote:

- they are all asked to go to an ATM from their own bank, not any other bank, however it seems they are not being directed to a specific ATM

When you say this, do you mean that the scammer is saying "go to an ATM of XYZ bank" where XYZ happens to be the bank they're with? Or is he just saying "go to your own bank's ATM"?

If it's the former, it'd be interesting to correlate the banks to the billing details of those accounts - are they working out whose bank is whose by where the bill for the phone is paid? In which case, Occam's Razor suggests that the source of the phone details would be the same as the source of the bank ones...

The real test of this would be a) that everyone who got sent to a particular bank paid their phone bill FROM that bank, AND b) that some of those people had accounts with other banks.

As for the purpose. My guess is that - as I think N N N has said - there will be a "problem", which will require a fee to be paid to get around, or they collect card details and PIN.

If I had police powers, I'd be making sure that every call to/from that number was traceable. I expect the scam calls will be coming via PAYG mobiles, though.

The other tactic might be to try and introduce some "marked fivers" at the phone company end, so that the source of these leaks could be identified a little more precisely...

Not quite a Newb Joined: 02 Mar 2012 Posts: 31

Maybe they just installed some ATM skimmers, and want to drive as many people to use them as possible before they get discovered?

Posted: Mon Mar 19, 2012 1:21 pm

Is it possible to transfer money to someone else's account on some ATM networks? I could see the lad sending the victim instructions to choose a language option they can't read and have them enter the information to make the transfer. All the while victim is thinking the ATM is going to spit thousands of dollars at them.

Posted: Mon Mar 19, 2012 1:58 pm

malmel wrote:

Maybe they just installed some ATM skimmers, and want to drive as many people to use them as possible before they get discovered?

That skimming problem is rampant in our area though not through telephone calls. The skimmers are inserted at gasoline station pumps and at unmonitored ATM machines. Lately the police have been surveilling certain gas stations and ATMs and catching the criminals as they return at night to get their skimmers.

I know first hand about this as after Christmas my checking account was wiped out by a skimmer. The credit union (bank) restored my funds after I filed a complaint with the ic3.gov website.

Master of Master Baiters Joined: 26 Sep 2008 Posts: 689

Conversion 5000 Malaysian ringgits is just over £1,000 (not £100) or $1600 ... do bank ATM's spit out that much cash even if you have an account at the bank?. Also note that's a lot of money to your average Malaysian wage earner, around 2-3 months wages!

Skimming ... NEVER use a petrol station ATM ... NEVER!

Also .. that's an awful lot of cash machines to monitor to gain any reward and why bother with all the phone calling? Just select any unmonitored ATM at random ....

Posted: Mon Mar 19, 2012 4:22 pm

N N N wrote:

Conversion 5000 Malaysian ringgits is just over £1,000 (not £100) or $1600 ... do bank ATM's spit out that much cash even if you have an account at the bank?. Also note that's a lot of money to your average Malaysian wage earner, around 2-3 months wages!

Skimming ... NEVER use a petrol station ATM ... NEVER!

Also .. that's an awful lot of cash machines to monitor to gain any reward and why bother with all the phone calling? Just select any unmonitored ATM at random ....

Yeah, I don't think it's about the ATMs. I wonder what happens if people go back to them to say "I didn't get my money" - I suspect that's where the scam begins.

Posted: Mon Mar 19, 2012 6:23 pm

I'm only a newbie, so I wouldn't put too much faith in this, but it sounds like this scam may be about gathering information. The fact that only one network is being called suggests an inside man. Is it everybody on that network being called? Is it contract phones? Prepaid phones? both?

If it's only contract phones, and a limited number of them, there may be another link. How many different banks are they being directed to? Again, if all the victims are with only 2 or 3 different banks, it could indicate more inside men.

Can you give any more information on the exact content of the calls? I ask because if it was just about getting people to an ATM, it would be easier to mass send a text.

Posted: Mon Mar 19, 2012 6:46 pm

Cpt.J.H wrote:

- all calls are coming to a certain network, other networks are unaffected
.

It happened before, some corrupted employees from a certain mobile company in my country sold users numbers and names to spammers. Their justification was it's (harmless). The information would be sold later in the black market.

Another suggestion is that the scammers may have access to the company's database.

Posted: Mon Mar 19, 2012 6:59 pm

I'd almost bet the one network is a red hearing. It's possible the lad/s just bought a list of subscriber numbers all from network.

It seems too random and too much work to mug victims if you don't know which ATM they will go to. Telling a victim to go to "their" bank just makes it look less suspicious and less likely to get mugged.

I'm guessing what happens is the victim goes to his ATM realizes he does not have the money then contacts the scammer who tells him he must send fees to release the money, get a special pin/ATM card or similar.

The advantage to this strategy is time investment. You get the victim all wound up and ready to get his money.

Btw should something like this be behind a login or am I just being paranoid?

Posted: Mon Mar 19, 2012 7:07 pm

Cpt.J.H wrote:

That was my first thought as I have heard of victims being asked to go to an ATM, withdraw funds and then be mugged. However in that case the victim was asked to go to a specific ATM that the muggers were waiting at, in this case unless they criminals have thugs at every ATM in the country then they are kinda stuffed...

Unless they know of the victims whereabouts when they call him, then shadow him to whatever ATM he chooses. Now the mugger knows that the victim has cash, and all he need to do is to wait for the right time to strike.

Just a theory - I'm not LE, and I have no idea if it's an MO a criminal would use.

Posted: Mon Mar 19, 2012 7:13 pm

^^Not that it's impossible but it seems like it would make more sense to just stake out an ATM and wait for someone to withdraw money. Seems like a lot of trouble calling and following someone.

Posted: Mon Mar 19, 2012 7:52 pm

My guess is that they've got a list of numbers from a telephone company and they're calling people to find out whether they have bank accounts to form a shortlist for stage two of the scam. They might also be asking specific questions to ascertain the wealth level of the marks, but without a recording or a transcript, there's no way of telling.

** SUSPENDED ** Joined: 19 Feb 2012 Posts: 160

Thank you all for your replies, it is good to see not only some things I was thinking being stated but also some new ideas as well.

I am in a rush to go off to the communications regulator to talk to them about a different case but I will ask them about this one too and see if they heard anything. I'll reply to you all properly when I get back.

** SUSPENDED ** Joined: 19 Feb 2012 Posts: 160

Sorry for the delay but the case is an interesting one. Here's the beef;

The scammers have access to the manuals for all the various ATM machines and their workings for every single bank here. Another gang was caught doing this a few years ago and it seems someone simply bought their data.

So the scammers are simply sending a victim to a machine from their own bank and then being told to do something. The other gang that were caught were actually getting the victims to set up online bank account login details so the scammer could access their online account but online account security has been massively revamped these days so something else is suspected.

Other avenuse such as the ones suggested about stealing bank data are also probable here as well but I think that the fact that the victims are being sent to their own bank is key here since from their own bank's ATM the victim has access to many features such as bill payment, share applications and card requests. One possibility is that the victims are being asked to apply for a credit card or cheque book from the ATM that is then used by the scammer.

Another is that they are actually being directed to hack the system inadvertently. Scammers tend to avoid doing this now since most ATMs have CCTV built in but in this case the victim will be the only one identified and not the scammers.

Interestingly, as someone mentioned, 5000RM is a lot of money but the figure is telling since it is the exact amount of money that an ATM is allowed to dispense at one time; higher amounts have to go over the counter. It is also the standard 'max withdraw amount' for most savings accounts. Thus simple robbery is also a possibility.

Still as of yet there have been no official complaints which is probably a good thing as it means the scammers may have failed.

Posted: Wed Mar 21, 2012 5:09 pm

I do not think the scammers would be this smart, but I was thinking that maybe it's a distraction for a bigger scheme later on? Just watch the area, it might just be my paranoia, but I think it's possible.

Posted: Wed Mar 21, 2012 9:21 pm

Kariko wrote:

I do not think the scammers would be this smart, but I was thinking that maybe it's a distraction for a bigger scheme later on? Just watch the area, it might just be my paranoia, but I think it's possible.

I don't know about Malaysia but there are some extremely talented techies in Singapore, lots of Indian and Korean tech college graduates and local tech talent.

** SUSPENDED ** Joined: 19 Feb 2012 Posts: 160

dropja_drawers wrote:

Kariko wrote:

I do not think the scammers would be this smart, but I was thinking that maybe it's a distraction for a bigger scheme later on? Just watch the area, it might just be my paranoia, but I think it's possible.

I don't know about Malaysia but there are some extremely talented techies in Singapore, lots of Indian and Korean tech college graduates and local tech talent.

It pays never to underestimate the scammers so it is right to suspect this is part of something bigger. Even if it is just getting money or card details that money and those details will of course surface again in the halls of crime.

I spent some time going to various bank's ATMs and sticking an ATM card in to see just what I can do to it without touching the code. A workmate of mine also looked into this and it is quite possible to exploit the system from the keypad and screen alone if you know what you are doing. By extension you can then direct an innocent third party over the phone to get, say, the ATM internal key which would allow you to exploit all the ATMs belonging to that network.

Though the lads we see on this forum are often quite stupid the network that controls, organizes and maintains them is very smart. The gang that were originally found with this data had spent a long time learning about ATMs and their workings, the guys doing the calls and so on may just be button pushers but someone further up the chain has a lot of knowledge. In fact I suspect that they just called in these Indonesians since they speak Malay (alibit with an accent), someone else is pulling their strings.

And as dropja_drawers says there is lots of local talent in any country. I sometimes think to myself what could happen if half the users on this forum decided to go into crime! In the days of globalization everything is globalised including criminal talent.

Posted: Thu Mar 22, 2012 10:50 am

@Capt J.H.

Based on what you've said in the last couple of posts, I've had a bit of a thought.

You say the ATM's can be used to pay bills. This implies the ability to perform a transfer. The victims are going to collect their money. IF the scammers give instructions to the victims over the phone while the victim is at the ATM, they could be trying this:-

The scammer gives the victim instructions to access the scammers account. The victim then attempts to transfer the 5000 to his own account. He gets the 'insufficient funds' message. The scammer makes his excuses and hangs up. The victim is annoyed and goes home thinking he's lost nothing.

But! there would be a record on the scammers account of the attempt to transfer the funds, including time/date and the victims account number! and since the scammer knows which phone he was talking to at that time he has a name to go with that account number.

IF the scammers can grant access to their account without a card due to the manuals they bought. From what you said in your last post about the things possible with the right knowledge, this may not be all that far fetched.

Posted: Thu Mar 22, 2012 4:27 pm

ATM's have different features in different places - it could be, for instance, that the 'top up a PAYG mobile phone' is being used to get free top-ups in exchange for some supposed PIN number. Or maybe it is possible to set up a transfer to the scammer's account (or some other mule's account).

How about this - phish some bank account details, find the phone number related to that account, and use some kind of functionality where typing something on an ATM authenticates a transfer of all the cash, or sometrhing.

Not quite a Newb Joined: 02 Mar 2012 Posts: 31

If you can make payments at the ATMs from one account to another, it might be that they're promising that the winnings will be made available after paying a small fee...

** SUSPENDED ** Joined: 19 Feb 2012 Posts: 160

You are all proving pretty damn well why I posted this in the first place; the ideas are all good.

Right now all that is off the table is a direct bank transfer. The banks between Malaysia and Indonesia are so well connected, often using the same systems, that any dodgy transfer would be shut down within hours and whoever controlling it traced; the scammers aren't that stupid.

@Angus T Leaves, I think that what you say isn't really that far fetched at all. Granted it is a bit of a long winded way to gain bank details but given that people are so careful about stuff online and with services like paypal meaning that your bank details are quite safe from hackers, criminals are becoming quite inventive. In fact every ATM in this country has a note from the RMP and Central Bank on it saying 'never give out your bank details, contact our hotline if anyone tries to get them off you'. Thus the scammers have to be smart and play into human nature; offering something for nothing. Like you say, victims may well walk away thinking they lost nothing but in reality someone now has their bank details.

@manbiteslion, again quite possible. The ATMs I was looking at had a lot of features, I was on one able to apply for shares and bonds for example. I think that the pay and go top up is quite credible; the scammer could keep the victim going round and round topping up the scammers phone until they twig (yes, just press into that and enter the pin number I give you. Didn't work? Try another). It is especially valuable since top up credit can be transfered between mobiles here.

@malmel, of course, the most basic scam of them all! 'Sorry sir, it seems there is a problem. However if you just step over to the cash deposit machine and deposit 50RM/100RM/500RM into this account then I'll have the winnings transfered'. They might not get many but the fact that they have got a victim to walk to the ATM might leave enough victims thinking 'well it's only 50RM/100RM/500RM' that it pays out. And of course it can easily be combined with any of the other scams. As I said it is highly likely that the scamers will get caught trying to transfer the cash to Indonesia but the amounts might just be small enough to slip through.

Still the overall update is that no official police reports have been received on this scam. If someone had been scammed then I'd expect to have a report in by now... let us just hope that it means the scammers were incredibly unsuccessful.

A little help with a very strange scam	View next topic View previous topic