The tale from a phone pishing attempt

They have a call centre in my hometown, handling calls for a cell phone provider and a credit card company (for the most part at least). My understanding is the company mostly does incoming calls, ie. customer support lines and the like. Their operators identify themselves by the company they're taking calls for, not as Online Support.

Seems like a drop-in-the-ocean type of solution.

I think he meant do not follow their instructions through the actual phishing part.

My father in law has a couple of times.

The first time -- he said "oh really? I guess I'll format the drive then" and they hung up.*

The second time -- we'd talked about the scam and he just yelled at them a bit then hung up.

* Gamers who download cracked software become really good at re-installing windows. :P

I got a similar call in February. They tried to get me to download and run a remote support/screen sharing tool. But nothing about going to the event log.

When I quizzed the guy he said he was from Microsoft and they got an alert that my computer was running slowly.

I got one at my Uncles place. He only has Macs and they claimed to be from Microsoft so quite quickly I knew it was a scam.

They claimed his Windows computers were sending bad packets onto the Internet. I played along and asked how they were able to see all my bad packets. They claimed that Microsoft gave them direct access to the central Internet router so they could clean up the Internet.

After a bit of this (they wanted me to install a program) I got bored, yelled at them and they hung up on me.

Yup, we get these at a place I work quite regularly. Presumably they're targetting small businesses to some extent. However I've had one at home and have friends in the same UK area that have had them (they have all Macs).

I strung them along a couple of times. For me they did the eventviewer thing, I played naive. They took me to gotomypc (IIRC) or at least an equivalent and wanted me to install a custom app from the site so they could "fix" my comp.

Now I tend to just ask them why they're trying to scam me and if they understand that we're not well off and trying to scrape a living too, usually they hang up. Once I said "You're just trying to scam me aren't you?" and the guy replied "Yeah, it's all just a big scam" unfortunately I was with clients so couldn't chat to him more.

If I'm not busy I'll ask them to hold the line and then just put the phone down (not on the hook) and leave it til it gives the "you forgot to hang up" alarm.

I had one last year. The company name given wasn't that but it was similarly generic. They did talk me through the event log thing which I went through with but took my time constantly complain that my computer was being slow - they caught me at a time I wasn't doing anything more important so I figured I'd waste some of their time.

After that he asked me to install some software so their specialist could share my screen and help fix the problems. He got a little exasperated as I kept getting the URL wrong that he was telling me to type into my browser. I eventually went to the site using Firefox with scriptblock on a Linux VM. The site looked quite professional, but when I had a poke around after the call there was a lot of obfuscated javascript (not minified, but altered in ways that were obviously to disguise its function from casual inspection (very long seemingly random variable names for instance) and for no other reason) in the page which leads me to think it might have tried a drive-by download even without the user continuing with the remote control software. Anyway I wasted a bit more of his time telling him that the file was downloading very slowly, and asking if he knew of a way to speed it up, and then telling him I was getting "not a valuable execution" errors when I tried to run it. In the end the line just went dead: presumably he either worked out I was just playing with him or they are just instructed to give up after a certain amount of time and start work on the next mark.

Here's a voicemail I saved of a phishing call:

http://www.wikiupload.com/SWUSHQPIZSISWW3

Contents (google voice text-to-speech * ):

This is not active. To activate computer protection go to www, dot G ohh Hey Al, yeah. H. Hey Al, dot com failure to do so may result in severe computer malfunction. To activate computer protection go to www, dot G ohh Hey Al, yeah. H. Hey Al, dot com failure to do so may result in severe computer her W W dot G ohh Hey Al, yay. Bye. Yes, dot com failure to do so may result in severe computer malfunction. To activate computer protection go to www, dot G ohh Hey Al, Yeah. H. Hey Al, dot com failure to do so may result in severe computer malfunction. To activate computer protection go to www, dot G ohh Hey Al, yeah. H. Hey Al, dot com failure to do so may result in severe computer malfunction. To activate computer protection go to www, dot, G, hello Hey Al, yeah. H. Hey Al, dot com failure to do so may result.

* er, voice recognition

Not a call like that. I have received several calls offering to "renew my magazine subscription" on some magazine I don't read, and I always play along until they want my credit card number at which point I ask for a callback number and they hang up.

In general, I've gotten so weary of this that I never give any info even to valid callers unless they can spout off a whole load of info about my current relation with whoever they say the represent. They almost always say that I'm the first to ever point this out, which I find unbelievable.