My dad got scammed for $3k worth of gift cards

Between lost cards, the obvious money laundering and tax avoidance grifts, etc, it's a pretty absurd instrument.

How do you feel like we could enforce #3? I suspect someone would use a VPN to fool any location/verification system, or is there something else going on here?

RE: Target data collection Determining if someone is pregnant so they can find ways to get that person to shop at Target drives their bottom line. What incentive is there to invest as much in preventing scammers from succeeding? I don’t know what the solution is, but doing something (even an information campaign) is better than nothing at all.

I don't know that full Know Your Customer laws should be in force here with gift cards, but both Target and the bank that facilitates these transactions should be doing more to prevent these.

I don't see why data collection is necessary here, if gift cards are such a fraud vector, why not put a 24hr delay in activation on gift card purchases over a $100 to give scammees a chance to understand what happaned and prevent the scammers from profiting.

Breaking interoperability with the world's installed base of circuit switched, 25+ year old PSTN equipment is not on the table for the big phone carriers.

Unfortunately, the gift card is an item that is intended to be easy to give to other people, just like cash. This doesn't seem like an easy problem to solve.

I think (4) has the most chance of success. Even just adding a 4 hour "activation time" on cards worth more than $250 would make the scam just a little harder to pull off, and real consumers would rarely be inconvenienced. The guy in this story would have realized he was scammed and had ~4 hours after the call to try to fix the situation.

Apparently it was $1k at Target and another $2k at Safeway. This was just under the limit of $1030 per person per store at Target. Perhaps the limit should be lower, or employees should be instructed to be more wary.

I imagine Target doesn't want to be too strict here, both because they don't want to inconvenience customers making legitimate purchases, and because they don't want to give up the revenue derived from scammers defrauding people (not that they would ever admit to the latter).

I'll point out that (at least on my phone with T-Mobile), "Scam Likely" comes from T-Mobile's "Scam ID" service. STIR/SHAKEN produces a different message, "Caller Verified", when a caller is confirmed. Source: https://www.t-mobile.com/support/plans-features/scam-id-and-...

This seems like something the Consumer Finance Protection Bureau could collect data on and put some sane regulations in place? The gift card industry is poorly regulated in general.

According to the article, that is not what happens; instead, the gift cards are redeemed in the US: 'Once the scammers obtain gift card numbers from a victim, they transfer them to a group of US-based “runners,”'

The runners described above would probably have some kind of presence in most major US cities, and they could just pick a runner in the nearest major city to the victim without raising any location-based red flags. Note that neither Safeway, nor Target have retail stores in Bangalore (or anywhere else in India), only offices.

Why though? One makes them money and the other... also makes them money but by doing nothing about it

I established this system because it is possible I will be involved in an accident or something and I do want my relatives to be able to trust someone calling if I am unable to do so. Many scams start with news of an accident so this usually stops them before they get to the asking for money part. I also make it explicitly clear that an emergency call would never be a request for money. I have savings and insurance and there is no occasion where I would need money from relatives, ever.

> then realizing what was going on then positively jovial at how they'd played the scammers along for almost a full day.

...because once they realize they're talking to an old lady, they may realize the "kidnapping" story may not work, but a call verifying something for a Stimulus check might (for example).

Just hang up. You won't outwit them.

Perhaps a pre-established code phrase is a good way to address this. "If I ever need help, I will mention that [memorable vacation] we spent together. If that vacation isn't mentioned explicitly, it's not me."

And people think Pascal's wager is a good argument and you lose nothing believing in hell.

My anecdotal story to the contrary of yours: I have a friend who graduated from a top 10 US college a few years ago and couldn't find a job. Right when they were desperately filing for applications and feeling very worried about their future (as recent college graduates are wont to do), this person received a call from 911 that fell exactly into this class:

>Impersonations of government employees accounted for ~60% of these cases.

The "911" was from the local police department of the city where they lived. The person was told that a warrant for their arrest has been issued - that 3 years before, there was a particular document to be filed with the IRS that had to declare all scholarship money awarded for a particular scholarship, and according to their documents, that document is three years overdue and has already incurred $700 in fines. The amount of time elapsed since the due date warranted x many jail days without immediate payment, and a mark on the criminal record... additionally, since this involves defrauding the government, their freshly minted university degree was about to be revoked.

My friend is an immigrant. They didn't know that university degrees couldn't be revoked, nor that no such thing as "government vouchers" bought from a grocery store existed (this was the trick - when the person arrives looking for the vouchers at Target or Office Depot, the agent on the phone says that some gift card can be an acceptable form of payment instead).

I took note of this scam both because of how elaborate it was, how believable it was (especially to someone less than familiar with the US government), how the person on the "911" call used psychological tactics to continue to make this vulnerable person more and more panicked about their future particularly at a time when they were already financially insecure. My friend was not gullible. But my friend did fear repercussions from the US government enough to completely fall for this scam.

The scary thing in noticing this, is knowing that it will happen to me (us all) one day. I'm hoping that by noticing it I can stave it off for as long as possible, but maybe that kind of thinking means I'm already on the track...

These days he is limited to the basics on his PC: email in outlook, checkbook in Quicken, basic web browsing... and he often runs into trouble with them. I'm on TeamViewer about once a month helping with something. He also has an iPhone and iPad but can just barely do the basics on them, watching him try to use them is just painful. Some of that is due to crappy modern UX, especially on the iDevices, but his ability solve tech problems and deal with unexpected situations has dropped off a cliff the last few years. Age is coming for us all...

He's now retired, in his late 70s and beginning to show signs of age related dementia.

Last year he fell for a phone scam from someone claiming to be his ISP, where he was persuaded to install remote desktop software onto his computer and login to internet banking. The scammers weaved a tale about fixing his computer and sending him an "authorisation code" which was actually the SMS code from his bank as they'd added themselves as a new payee. He simply read it out to them.

The scammers transferred just under $10,000 to their account.

Luckily, they'd set off enough red flags that he called me asking why his ISP wanted to know what bank he was with. Once we worked out what had happened we called the bank straight away and were able to get the transfer stopped by the bank just in time. It was a Saturday and he was literally saved by the weekend. Very lucky.

Turns out he was in the process of changing ISPs when the call arrived, so a garden variety phone scam was perfectly targetted.

He has coding streams where he makes countless tools to take up more time / capture information from scammers. He has a fake bank site he uses to capture banking details of scammers when they try to wire money to themselves from the victim's bank account (he has a relationship with bank fraud teams and law enforcement.)

He's also a talented voice actor and social engineer who can keep scammers on the phone with who they think is his bank for hours. Absolutely worth a watch on YouTube or his Twitch streams if you have a moment.

I am not a recipient for such scamming but I do receive phone calls on a daily basis, which I started screening of course. If I pick up and don't say anything they will hang up in 5 to 10 seconds. I think they're harvesting for potential victims.

Although his practices are more... grey hat, he's managed to successfully shutdown whole companies. He provided content for a BBC documentary too: https://www.bbc.co.uk/programmes/m000fzx2

Even though he regularly sends information to authorities, it is very rare that they will do anything.

https://youtube.com/watch?v=J9MPy2qAc7U

Here's the same scam from his stream 3 days ago: https://www.twitch.tv/videos/668914814?t=5h4m20s Abandoned Toyota Corolla on the south border of Texas with blood, _exactly_ 22 pounds of cocaine, cash. Multiple bank accounts and addresses registered with your SSN, funds wired out of the US.

Every other business that deals with the transfer of money (banks, for example) is expected to put strong measures in place to make sure that the money is traceable and that they're not helping criminals. Why shouldn't large companies like Target be held to a similar standard?

Moreover, the incentives here are very worrying. Yes this guy got scammed out of $3k, but Target also got $3k in revenue. Without some sort of penalty/punishment, Target is incentivized to do the bare minimum to minimize their PR exposure (which they can do by saying "we take this very seriously and have adopted some new policies" but not really acting on it) but to otherwise allow this to keep happening. As the prevalence of these gift card scams has skyrocketed, so have gift card sales for these large companies.

I worked at a store years ago and we had all these things implemented:

- Limit on gift card purchase amounts per customer, per day.

- Stopped stocking Western Union cards because they were such a scam target.

- There was also a scam where scammers would call the store itself to pose as a "corporate employee" who was "trying to verify that the gift card redemption system was working" and would have the cashier activate a gift card, run it as cash, and read off the numbers. And apparently that worked well enough that every time we activated certain gift cards, a massive box popped up on the POS screen saying "IF THIS TRANSACTION IS HAPPENING OVER THE PHONE, HANG UP IMMEDIATELY AND CANCEL THE TRANSACTION."

At a certain point there's only so much that can be done by the store itself.

This is a key point worth mentioning in any "nothing to hide, nothing to fear" discussions about online tracking and the dangers of giving away private information to websites, big or small. Once the data is out there, it's available to any company with deep enough pockets to purchase it.

https://www.npr.org/sections/money/2013/11/11/244545556/the-...

But some states use a plain-old .com, and the sites aren't well done, so they look sketchy, even when they're legit. Worse, they sometimes have URLs like comeclaimyourmissingmoneythatyouforgotaboutandwereholdingforyou.com

If you're curious about missing money, go to the web site of the Secretary of State in every state where you've lived or gone to school. There's usually a link.

For California, the site is https://ucpi.sco.ca.gov/UCP/Default.aspx

Same is true of banks and such. A few months ago, I got a mortgage, and I was totally blown away by how much profoundly suspicious shit that was actually legit happened. Like, I'd get calls from totally random new people from the mortgage company, no warning by anyone who I actually knew that this new person was calling, often from their personal cellphones---and it would turn out that the call was totally legit, and I actually was supposed to send more sensitive financial documents to this random new person. Totally bonkers.

There should certainly be more checks and balances around that. Perhaps a personal limit, and requiring a registered business to be the purchaser above that. Or perhaps a redemption system.

But the incentive is not there for the stores. It’s of course better to sell gift cards than the equal amount of merchandise for them

I had a text from her when I woke up the other day, she'd bought a new phone and now the company was asking weird questions.

I figure for sure it's a scam and I phoned her immediately. But I gradually realised it's actually not what I thought. I normally buy phones by just... buying a phone, like a cheeseburger or a T-shirt, cash or card. But she's got a new phone on contract, so that's a credit deal and the questions they're asking, though prying, are credit agency ID confirm questions. Where you've lived, photo of a passport, stuff like that. The firm seems legit, they're not new to the business, they have a relationship to a Credit Reference Agency that I've worked with before, so it's probably fine.

She seems reassured that I'd actually thought through why this might be OK, and so long as her new iPhone shows up in the next few days all is good, otherwise I guess I need to walk her through anti-fraud processes in case somebody got all that as precursor to taking out credit in her name.

With my mother I got a call from her one day because her PC was literally screaming. She'd clicked a link or visited a web site or something and now it was constantly loudly demanding she phone the scammers and give them money to "unlock" it. She'd had the peace of mind to instead walk into another room and call me. I talked her through switching it off, bringing it up in safe mode and forgetting the (hijacked) default page on the browser. Relatively simple scam, but I expect it's effective on too many people.

I probed a little bit since I was curious how he perceived it and he effectively said the idea of getting a deal took the best of him.

I know some elderly folks who I thought were in pretty good shape mentally and such got pulled into one of those scams. It was the grandchild calling for money from jail type thing.

I never would have thought they would have fallen for a scam like that, they did.

You can never talk too early to older folks about this stuff. Lay down some hard and fast rules such as "Never give out info / anything to someone who calls you first, call them at a number you look up on your bank statement, or call someone directly. Call me / alternate person if someone asks your for information or money, etc."

Scammers have excuses of course but some of those rules will work.

I think that's a stereotype, rather than a rule. I've seen articles in the newspaper occasionally where the victim is a person in their 30's or 40's.

I suspect that we don't hear a lot about that because there isn't a lobbying or information group like the AARP for 30-somethings. Also, losing $250 to a scammer is less tragic for a younger victim with a full-time job than it is for a 70-year-old on SNAP, so they don't talk about it as much.

When I worked in a large office with very ordinary, I saw people of all ages falling for scams. They just didn't know they were scams until it was all over, and then they just stopped talking about it.

Or switch them to Linux. For browsing/mail it's perfect. And if they want to have Windows games then make a separate partition where they play there and cut access to internet for that Windows installation.

Somewhat ironically, it's also what scammers tend to use.

For security reasons the account you access in Remote Assistance is the account requesting help, and UAC prompts on the remote machine (anything on the "secure desktop") are not remoted, and have to be agreed to by the person you are assisting. However, if you have setup an Admin account on that machine, you can still use any RunAs tools of your choice/familiarity (runas.exe, Shift Right Click Run as User, PowerShell Start-Process -Credential) to escalate to your Admin account (so long as they don't need you to input your password on the "secure desktop").

...I'm curious about how many people however, are totally fooled by the scammer--everything is very realistic up to a point--but then get to the part about paying the IRS in...iTunes gift cards. "Like, what?...[click]". 90 percent? 10 percent? Maybe no one.

What worked for my mom was to have her listen to an NPR radio show where they investigated this sketchy world. https://www.npr.org/sections/money/2017/08/18/544448670/epis... and https://www.npr.org/sections/money/2016/01/29/464859624/epis....

Once she was able to see the system behind the calls, that screened out 90+%. There are still banks that call her every week to try and convince her to refinance her mortgage on terrible terms. The best antidotes to this are financial security (even if what you're telling me is true, I don't need to do it to make ends meet), financial literacy, and hard-and-fast rules.

1. Never give any information over the phone. Particularly financial or identifying information.

2. If you feel sold or pressured, tell the person that you need to go to the bathroom, and that you'll call them back. Then, call me and we'll talk through it together.

I got a couple phone calls from my mom over the next couple weeks, but they built her confidence to the point where she can spot the scams out very clearly now.

I can't imagine how difficult this would be, if my parents had short-term memory loss or worse. This industry is really soul-crushing, and the FCC needs to stomp it out.

1) Gift card = scam. Always, 100% of the time. No government agency and no legitimate company will ask for payment via gift cards, ever. My in-laws nearly got scammed by "Apple support" calling to say their router had been hacked and was being used for illegal activity and that they needed to pay using iTunes gift cards to have "Apple support" "clean out their router".

2) Nothing is immediately urgent. Unless someone is dying in front of you, the problem can be solved later. Banks, government bureaucracies, lawsuits, etc all work via snail mail and lawyers and paperwork, not by calling you up and telling you you're going to jail and are going to lose all your money unless you do something immediately.

1. Between TMobile's "Name ID" app, and Google's call scammer screening, I very, very rarely get any scam calls through anymore. That's a huge change from recent experience for me.

2. I absolutely love Android's "screen calls" feature, where it does speech-to-text over the phone. 9 times out of 10 it just discourages scammers from going further.

3. Most importantly I think is just to train (and practice!) people that if they don't recognize a caller, just hang up. Don't talk, don't apologize, nothing, just hang up. People are socially conditioned to think that's rude, etc., but it today's age, that is by far the safest thing to do.

Yes, very likely poor, desperate and also under duress by their “managers” to meet their quotas. It doesn’t absolve them of their sins though. The system might even be gamified for these callers and they lose sense of their own morality at some point if they have any.

This scam has been going for so long yet the authorities don’t seem to be doing enough either in US or here in India. I wish someone powerful enough takes this scam head-on and uproot the whole system. It really preys upon one of the most vulnerable members of our society and we should collectively do something about it.

/rant

Apple does this at its stores. I bought a gift card there just before the pandemic, and the clerk read me disclaimer text about scammers and gift cards, and then I had to sign the statement on his iPhone before I could pay.

If I don't do it someone else will.

If they're dumb enough to fall for it, they deserved it.

Some think that everyone in the target country they're calling is rich and/or insured and/or will get reimbursed by their government anyway, so it's more like shoplifting (from an insurance company or the government) than stealing from a person.

Scammers rarely work alone.

For most, it's just a job. One that pays decently well. In most cases the companies(yes, companies) involved maintain the appearances of a normal call center, with sales targets and everything.

One such scam company was even providing Japanese language training, so they could target a market that's less disputed.

I personally think what the scammers are doing is no more morally corrupt than Nike paying workers fifty cents an hour to make a pair of shoes for $2 than they sell for $400, or health insurance companies denying coverage to people literally dying in the name of profits.

All of the above (and scammers) are extremely morally corrupt and "wrong", the only difference is some of them have been normalized.

In the book, a boy -the author- suffers severe neglect and betrayal, and grows up a criminal. Thief, mostly. His motives are complex.

He tends to see others as prey, there is the passion for the chase, he is fascinated by the criminal side of life. He seems quite smart and inventive, thinks his crimes through, but does not care too much about morals. Prison is a risk of the job. Otoh, close friends and partners are respected and can trust him.

It was a strange, interesting mix. I nevertheless hope I never meet the author.

    Nobody ever wakes up in the morning and says, "What I am going to do today is evil, and I'm okay with that."
    When I thought through each of the examples of society-wide atrocities,
    examining them through the new lens I had gained in that deposition room,
    immediately I saw it: In every single case where people cooperated with evil, they used eloquent lies to assure
    themselves that what they were doing was actually good.

2. Victims are insured, they will get their money back from their government.

The system works, except when my kids are at school and my paranoia makes me assume every call is about them.

But this is not what happened.