Warning - Scammers re-using baiters' ID's, docs, etc.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Sun Apr 13, 2008 3:33 am

I have been informed by some contacts of mine that it appears that scammers are visiting all of the various baiter sites and using posted documents against their victims. Passports, Certificates of Deposit etc appear to be getting re-used.

It seems that the scammers are photoshopping out the FAKE markings that all conscientious baiters put on these sorts of things.

This is just a heads up to everyone to please try to take extra care when obscuring docs to make it as difficult as possible for the mugus to use them.

I have not heard of any specific incidents of anything from here being used, but it's worth being a little careful just in case.

Posted: Sun Apr 13, 2008 3:35 am

Thanks for passing on the info. Very Happy

Baiting Guru Joined: 03 May 2007 Posts: 18313

Thanks William, I'm glad you posted this . . .
but I can't help but think of what I've seen of the lads' photoshop skills and would love to see their handiwork regarding this. Would the ID have a big white "fake" where they tried to take out the red one? Laughing

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

Some "FAKE" markings are easier to remove than others. It is far easier to remove a red "FAKE" from a green background than a green "FAKE" from the same background. It is trivially easier to remove any sort of "FAKE" on a plain white background.

It is tempting when you write FAKE on a document to do so so it doesn't obscure anything, after all you want everyone to see the document. However that marking is easily removed. The "FAKE" should cover all areas of the document that may be useful to a scammer.

See this aged thread for other ideas. Don't necro it.

Posted: Sun Apr 13, 2008 11:08 am

Technically another way to make the "Fake" harder to remove is to use rainbow-gradated coloured text (ideally obscuring some text on the page, or leaving it just visible through your rainbow text) - no longer does the photoshopper just need to key out a single colour or hue, instead the task becomes monumental and far easier to start from scratch

Another trick is using highly compressed jpegs - JPEG is a 'lossy' format, so compress until the text is still readable but you see 'compression artefacts' (eg mysterious "mosquitoes" around text), it becomes very hard (near-impossible!) to alter that image cleanly.

Western Union · Posted: Sun Apr 13, 2008 12:36 pm

William Wankur wrote:

It seems that the scammers are photoshopping out the FAKE markings that all conscientious baiters put on these sorts of things.

I�d be very surprised if scammers are doing this. That is a lot of work for something that can be easily obtained though other methods. It takes less time and effort to knock documents up from scratch, something scammers have been doing successfully for years - who produced all these fake-stamped certificates and passports in the first place?

Posted: Sun Apr 13, 2008 2:25 pm

I tend to agree with Mr Fishe. If the source of this information was a newspaper or magazine, I would go looking for Tigbitties and Gomer.

Posted: Sun Apr 13, 2008 3:29 pm

I also have another suggestion. If you do, for any reason, send a fake ID or some other document that could potentially be used this way, add something to make it patently ridiculous to anyone looking at the document.

In my experience, the scammers don't look closely at the documents and, even if they do, they are unlikely to catch cultural references.

I'm not saying that there aren't some victims that would be snowed anyway, but anything that reduces the odds can't be bad.

Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim. Or having a scanned passport that has an extra typed line at the bottom stating "NOTE: All citizens will be required to dance the Macarena when entering the country" can help.

Master Baiter Joined: 23 Jan 2008 Posts: 152

Spear N. Magichelmet wrote:

Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim.

I think that "most of us" don't even send fake IDs or other documents any scammer might re-use. If the laddie doesn't take a close look at the document, why should the victim do that? I, for example, would not understand the Fanny Mingetoucher-joke, because english is not my first language. So better keep those fake IDs for yourself and send the lad some re-named dlls or use writejunk.

Posted: Sun Apr 13, 2008 4:53 pm

Afferbecklauder wrote:

If the source of this information was a newspaper or magazine, I would go looking for Tigbitties and Gomer.

These re-touched documents have come directly from scam victims.

Quote:

Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim

I know that this has been discussed ad-nauseum, but cultural and language barriers make this problematic. I bait under many ludicrous names and the scammers never complain because American pop culture is unknown to them and our double entendres don't register. I have plenty of checks made out to Alotta Chexx and Iyamma Frawd that bear this out.

Gone fishin' Joined: 28 Mar 2008 Posts: 20

First of all, thanks to William Wankur for putting this issue up here. As for those of you questioning the source of the information, I am the source. I put the information up on a few anti-fraud sites yesterday, and contacted a few site owners about it. The tough part about it is, this is my first post to eater, so I doubt I'll be considered a reliable source by the members here.

The only convincing thing I can do is give you some of the data, and you can draw your own conclusions about it.

The following three image files are from a single scammer email. I've located the original sources of where the scammer got them and provided links.

http://www.biskitz4cheez.com/scambait1-1.htm

http://419.bittenus.com

http://antifraudintl.org
http://img80.imageshack.us/img80/1060/powerofattorney2vw8.jpg

Mod edit - image changed to link to prevent blowout, 600 pixels maximum width for images - SP

As you can see from this set of headers below, the scammer is sending from his account, back to his account as a way to save the files. The scammer account name has been intentionally changed and I removed the encoded image attachments (they're above).

Quote:

X-DUMP-MBOX: From scammer Wed Dec 26 03:51:49 2007
X-RocketMail: 00000002;R---------------;9909
X-RocketUID: 0000019116
X-RocketRCL: 497459;1;1286137690
X-RocketYMUMID: AFlhxEIAAVMyR3IWJQUzvHM6RFs
X-RocketMIF: 1198659109;506010;
Received: from [80.255.59.243] by web56815.mail.re3.yahoo.com via HTTP; Wed, 26 Dec 2007 03:51:49 EST
Date: Wed, 26 Dec 2007 03:51:49 -0500 (EST)
From: [email protected]
Subject: POWER OF ATTORNEY
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-978337894-1198659109=:86834"
Content-Transfer-Encoding: 8bit
Content-Length: 497459
X-Folder: Sent
X-DUMP-BEGIN: **********************************************************
X-DUMP-NOTES: The "X-DUMP-*" headers were created during account dumping
X-DUMP-COUNT: Message 189 of 681
X-DUMP-TIMES: 2008.04.09-22:56:31-GMT
X-DUMP-MSGID: 9909_543737_25765_615_370263_0_19116_497459_1286137690
X-DUMP-HDLEN: 615 Bytes In Header
X-DUMP-HDMD5: 16dcd57ab612e593a9c6fb440d4cf27c - Header Perl Digest::MD5
X-DUMP-BDLEN: 497459 Bytes In Body
X-DUMP-BDMD5: 8dd1a4a719e5964fa783a2d1a2877473 - Body Perl Digest::MD5
X-DUMP-DATUM: Body-Content-Encoding: (none)
X-DUMP-DATUM: Body-Content-Transfer-Encoding: (none)
X-DUMP-CEASE: **********************************************************
Status: R
X-Status: NT

rdhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

--0-978337894-1198659109=:86834
<encoded files removed>

As far as any of you know, the data above was obtained through perfectly legal means. None the less, all sites where I've post the above have moved the data off to their private sections because they do not want any indication of data from a scammer account being posted publicly. It is an understandable sentiment, and I wouldn't blame the mods/admis here on eater for doing the same. In fact, it's probably a good idea. If I could have posted it to your private section to begin with, I would have.

Everyone agrees there's no way to both prove the point with evidence, and keep things stealthy, so if my first post to eater disappears, I won't take it personally. :-)

In fact, I've PM'd one of your mods to have it moved. If it happens, I won't be able to see it or reply.

Unfortunately, the above is not the only occurance, and not the only account. I'm still trying to figure out quite a few things, in particular how and why the scammers are doing this. There are a handful of possibilities.

The scammers are sending the defaced documents to victims (a good thing since it warns the vics)
The scammers are attempting to remove the defacements and reuse the fake documents.
The scammers are collecting and indexing the defaced fake documents to prevent resusing them, so a victim would be unable to find the defaced version through a search engine.
...

I'm still doing the foresics work, and I may never have a solid answer, but it shouldn't really matter. The point is, you're getting used. It's a known issue, so I'm really just stating the obvious. It's still better to have the defaced documents available to the public in hopes a victim or investigator might find them.

If you do post similar files, please make sure they are significantly defaced to prevent the scammers from reusing them. Using rainbow gradients for your "FAKE" defacement text makes the defacements significantly more difficult to remove. It is also valuable if any important text such as names and similar contained in the images is typed out as in your posts containing the images. The reason for this is search engines cannot read the text within the images, but if you type out the text, then the search engines will find and save it.

For example, the name "GEJERO SIMBARU" in the first image above is what allowed me to find the original source of the image (I'm still in the process of contacting the site owner).

http://www.google.com/search?q=%22GEJERO+SIMBARU%22&num=100&hl=en&filter=0

Typing out the important text and posting it along with the images is important because it enables potential victims who run searches on names to find the fake documents.

Lastly, never post office document files (i.e. MS "Word" or similar) or PDF files. The reason is because no matter what you do to them, it is still very easy for the scammers to remove markings and reuse them. If you get scam documents in these formats, and want to post examples, please use "screen capture" software to get an image file (JPEG), then properly mark and post the image.

And never forget, the scammers are watching.

thanks,
tada

Posted: Sun Apr 13, 2008 5:26 pm

google image search for passport, ID, driving license. All turn up useable pics and all in seconds. Why would a lad bother chopping an ID when this is so much easier. Lads aren't that stupid.

Gone fishin' Joined: 28 Mar 2008 Posts: 20

I can tell you for certain one of the above images was found by the scammer through a google image search. This is known from the HTTP server logs. None the less, it was saved to his account.

If you have even a wild guess what the scammers purpose might be, I'm more than willing to listen. Though I have more information, your guess is still as good as mine.

-tada

Western Union · Posted: Sun Apr 13, 2008 6:23 pm

tada wrote:

The following three image files are from a single scammer email.

Erm, am I missing something here? Your three images all have fake stamps.

Gone fishin' Joined: 28 Mar 2008 Posts: 20

Yes, you're missing the fact the scammer is saving them into his yahoo account for some unknown reason.

If it was an isolated occurance, I would just think the scammer was an idiot. But considering there are a number of instances, and a number of related scammers doing this, it should make you wonder what's really going on here.

-tada

Posted: Sun Apr 13, 2008 6:34 pm

For some unknown reason. Confused

Posted: Sun Apr 13, 2008 6:41 pm

He's probably just getting ideas for what to send out. IMO you're reading far too much into this.

Posted: Sun Apr 13, 2008 6:46 pm

If I'm reading this correctly, the only way you would know if the scammer is saving them in his account is if you're in his account.... Just as a reminder, hacking is illegal and NOT condoned here.

Western Union · Posted: Sun Apr 13, 2008 6:59 pm

Maybe he�s the real Dr Gejero Simbaru of Sierra Leone? Wink

Look at the repository of fake documents on Eater and elsewhere. There are thousands of them. Tens of thousands. Lads have no problem creating them from scratch. Hell, there are markets in Lagos where you can get a birth certificate or banking document created to your specification for pennies, while you wait. Scammers have hundreds of templates at their disposal. They are not photoshopping old documents from baiter sites.

And how did we get to that anyway? It is quite a leap of logic from one lad making a copy of old documents to �scammers are visiting all of the various baiter sites� and �are photoshopping out the FAKE markings that all conscientious baiters put on these sorts of things�.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

tada wrote:

It's still better to have the defaced documents available to the public in hopes a victim or investigator might find them.

What am I missing, This is what have I gathered so far.

1. Lads are searching Anti 419 sites for lad documents and saving them, even if they have been defaced to prevent re-use. (You are not sure why, but it concerns you that they are)

2. We should post defaced documents for public view (Indexed with plain text of thier contents so they are more available to be captured by the Google, and thus easier to find by a Google search) so investigators and possible victims can locate them.

Wont this make it easier for the lads to find and save even more defaced documents, adding to concern #1?

I am not trying to be sarcastic, I really don't understand what you are getting at.

Gone fishin' Joined: 28 Mar 2008 Posts: 20

SlayerFaith wrote:

For some unknown reason. :?

I admire the skepticism.

I've got one example of a sad photo modification attempt done by this particular scammer, but it is merely to reuse an existing form image (name changes and such), rather than remove defacements.

It doesn't prove there was an attempt to remove defacements, but it does prove some knowledge of image manipulation.

I haven't had the time to fully analyze the modified image yet but I'll get to it eventually in the next week or so. If you're curious about image forensics and detecting modifications, there's a good starter article here:

http://blog.wired.com/27bstroke6/2007/08/researchers-ana.html

I would prefer to not post the example of a modified image, mainly because it further identifies a particular scammer, and I've already provided a good deal of information which could be recognized. I'm not too worried about it, but if you absolutely need to see it for further proof, then send me a PM.

It's not really a matter of one piece of information, instead, it's a bunch of pieces, and how they all fit together.

kind regards,
tada

Posted: Sun Apr 13, 2008 7:26 pm

tada wrote:

I've got one example of a sad photo modification attempt done by this particular scammer, but it is merely to reuse an existing form image (name changes and such), rather than remove defacements.

Lads do this all the time, usually badly. It is nothing new.

Gone fishin' Joined: 28 Mar 2008 Posts: 20

Pastor Frank wrote:

tada wrote:

It's still better to have the defaced documents available to the public in hopes a victim or investigator might find them.

What am I missing, This is what have I gathered so far.

1. Lads are searching Anti 419 sites for lad documents and saving them, even if they have been defaced to prevent re-use. (You are not sure why, but it concerns you that they are)

2. We should post defaced documents for public view (Indexed with plain text of thier contents so they are more available to be captured by the Google, and thus easier to find by a Google search) so investigators and possible victims can locate them.

Wont this make it easier for the lads to find and save even more defaced documents, adding to concern #1?

I am not trying to be sarcastic, I really don't understand what you are getting at.

It's a good question and it means I've done a very poor job at being clear.

Scammers have countless ways of getting fake documents. The fact that the scammers grab defaced documents from anti-fraud sites is a well known fact. Every anti-fraud or baiting site I've seen request defacement of images, so there's nothing new here, but often people forget or do a poor job of defacement.

My only real concern is a particular group of scammers doing something very odd with defaced documents. As older members here have pointed out, even when I do finish the forensics, it will still be very difficult, if not impossible, to prove what the scammers are doing.

Think about it this way; If the scammers are trying to index the information to prevent discovery of duplicates, we can burn up the scammers time by making tons of heavily defaced and easily found documents available on the `net.

We cannot prevent the scammers from indexing the defaced documents, or trying to undeface them, but if we can burn up their time, it's a good thing.

-tada

Posted: Sun Apr 13, 2008 8:10 pm

Quote:

In fact, I've PM'd one of your mods to have it moved.

I didn't see the need to move your post. Smile

Fake documents that are posted on Eater are required to be be defaced, and posted in a forum that is behind a login. If a scammer logs on to look for fake documents, we usually peg him pretty quickly.

What I am not getting out of this, is why scammers would look for defaced documents when there are plenty of sources to have any document made that suits the purpose.

Why are posted and defaced fake documents a concern all of a sudden?

Not quite a Newb Joined: 04 Apr 2008 Posts: 20

I took that first document that somebody posted, and I was able to remove the FAKE watermarks from it. I didn't use Photoshop or any other advanced program. I used Microsoft Paint.

As you can see, there are still some red things around the writing, but it would be hard to notice unless you were looking for it. I'm not saying that this is what they are doing. It still seems much easier for them to just create a new one. I'm just saying it is possible to do it with readily-available tools. If you want to put FAKE watermarks on something in manner that would deter this sort of "cleaning" of the document, best put them over things like photos or signatures, since a pattern can't easily be established around the watermark, and the lad can't easily overwrite it with something similar to the background.

Warning - Scammers re-using baiters' ID's, docs, etc.	View next topic View previous topic