A Tale of Three Scams

Mad Dash

Close Shave

Too Late

Backstory: Target lives alone approx 45 minutes from Port Lincoln and received a telephone call from "Amazon Prime"

Backstory: Target operates a successful business on Eyre Peninsula and received an authentic copy of an invoice from a regular supplier where the bank details had been altered

Backstory: Target is a successful business person recently retired and received a call from the "NBN" 

Where it started: Automated phone call from "Amazon Prime" advising that $79.95 was being charge to his credit card and that he should press "1" to chat whereby he rejected the credit card charge

Where it started: A bogus email came through from a supplier they don't deal with with a "PDF" attachment which disguised a link to a web page.  On browsing to the web page there was message to say that there were two documents to view and a button "View Files".  After choosing "View Files" another web page appeared with three eail login choices: Office 365, Outlook.com or Other email and the target logged in to one of them which gave up her email credentials to the scammer

Where it started: Automated phone call from the "NBN" advising that the target's internet connection would be terminated within 24 hours and to press "1" to retain the connection.

Where it went: Target was advised that it was OK to cancel but that hackers from India had compromised his computer and tried to use his credit card to make the purchase above.  Target was convinced to download and install the Anydesk app on his phone so that the scammer could "check his phone".  Target was then convinced to open his banking app however he does not use his phone for banking so the scammer then convinced him to go to his computer and allow remote access to his computer via the Anydesk web page.  Once the scammer gained access, the target accessed his internet banking which meant the scammer had access to his internet banking.

Where it went: The scammer logged in to the target's mailbox quietly which is easy to do because Bigpond Email has zero security.  The scammer then waited for any email sent or received involving an invoice of a significant amount.  Wihin a day or so, the target emailed an invoice to a customer for $10,000 where the scammer interrupted the email, edited the PDF to change the bank account details, and then sent the invoice to the intended recipient with a note saying the payment was to be made to a new bank account.

Where it went: The target was then connected to a technician who advised that the target's internet connection was being used by hackers and that the target's computer and bank account were at risk.