Hacker News Reader

Comment by ahelwer | Hacker News Reader

I fell prey to this. Might have been the exact same website, too. Had had a drink with dinner, thought heck why not file for my EIN for an independent consulting LLC I was creating? Was using a fresh OS install where I hadn't yet installed Firefox with an adblocker. Usual defenses were weakened. Boom, $250 down the drain before I really thought it all through. Fortunately I was able to get it refunded by initiating a chargeback and telling their website support that I believed they were misrepresenting themselves as the IRS. It really was a "welcome to the real world" moment, though - my very first act as a new business in the US was to get scammed. This theme has continued. 90% of the business mail I get are scams masquerading as official government mail to get business licenses or whatever. These websites are run by scumbags who should all be arrested. And Google, of course, should pay actual penalties because it's been all upside for them.

View on HN

People think I'm paranoid checking domains, certificates, and bank numbers but it's a small price to pay as you found out. You lost $250, some lose thousands.

This stuff needs to be regulated, companies like Google need to be held accountable for what they serve up to users. No more hiding behind this shield of "we're just a platform" when they damn well know they're the platform. It's all fun and games until your (grand)parents lose 20K to some scumbag scammers.

Some lost millions.

In genuine scams, yes. But nobody will accidentally pay millions for a business license that's also available for free.

That's true, that's outside of the expected range. But confusion of authority is the same principle at this level or at a higher one it doesn't really matter. This particular context has a low expected value but the same principle in another context can cost very large amounts of money.

Recently a big dutch retailer got caught out by a small thing, a suppliers administrative email got hacked and the company as a result wired a couple of million to the wrong recipient.

The real problem in this case is that Google has a perverse incentive to allow these ads-as-serps. Personally I think Google should be named as a co-conspirator in fraud cases like these. That would get them to clear this up pronto.

Some "service" numbers in the Netherlands advertise in google by showing a real phone number (for a gov institution or a business) that links to their paid number. People wait for 10-30 min then are call-forwarded to the real number. They may make multiple calls like that until the phone bill arrives that lists on average "40 euro service numbers" but even then they might not see though the scam, even if you see though it is hard to not just repeat the mistake. I suspect they steal a measured amount of money and time per user as from what I hear its always 30-50 euro.

Yes, I've seen those too. I've already alerted OPTA to this and have sent multiple messages to Google, nothing however has changed so far.

This is a total scam and should be dealt with accordingly.

Ransom should work.

You don't have to like it. If the government asks for information you cant expect 100% to just say NO.

As long as they actually provide the service they're advertising, it doesn't sound quite as bad as an actual scam. Reselling something at a markup but with better advertising is common in commerce. Up to the customer to decide if the price is what they're willing to pay. It's only government services that have a kind of aura of "don't be a dick" around them, maybe because people feel they can trust them not to be profit driven.

It's definitely a scam. They do not "provide a service", they mislead you into thinking you are dealing with a government office and that you are paying an official fee.

This is not "better advertising", it's just a scam.

If they mislead you, sure it's dishonest. But if they're just better at being found, they have every right to charge for that. It happens all the time in the private sector. The world is full of resellers. It only feels like a scam because we imagine that it's not fair to pay for advertising. In my country, there used to be a little industry of businesses that would collect tax refunds for you and take a cut. You could just fill in the forms yourself, or you could stop at a kiosk and pay them do the tedious paperwork. Not saying that's OK when they pretend they actually are the government though.

They’re no different than the homeless guys who take free newspapers and try to badger you into buying them.

If you don't want your post color to be washed-out, remember to post through news.ycombinator.fastposts.com. For the regular fastposts small fee, your post will be made to HN with the maximum visibility hacker news allows!

> This stuff needs to be regulated,

Regulated? Fraud is illegal.

It needs to be PROSECUTED.

Perhaps if we all start using all-caps, somebody in government will hear us. You are right, of course.

> Perhaps if we all start using all-caps, somebody in government will hear us

YES - THE NAVY

How will you prosecute them? Not only most scammers are nameless, but most are from countries where government needs to fix lot of things before they are effective against scammers.

That's easy. Those scams operate because the countries/players have access to the US financial system.

You provide the incentives to the countries to fix their problem by cutting them completely off. If someone using a bank in Cyprus did it, you tell Cyprus government that in 48 hours the Fed will block all transactions with that bank and you block it. They move to another bank, you repeat it. Eventually Cyprus government ( and Cyprus banks ) have to make a choice - continue to tolerate scammers using their banks and be locked out totally out of the US financial system or crack down on the scammers.

While we are at it, let's also throw 2-3 nukes to the country in case they dont fix it.

Well, it wouldn't be nukes but if someone who outed US Gov wrongdoing was there, I'm sure the US could force down their aircraft or whatever.

You're right. Dunno why you're getting downvoted.

Follow the money and report the issue to the institutions along the line. If they refuse to shut down the scammers and to stop facilitating their crimes, shut the institutions down for being an accessory.

Same with Robocallers... Also call them what they are. Call them terrorist and you block off the countries enabling these terrorist groups. Sanction them too

Hang on, how are robocallers terrorists?

There are different types of terrorism. It falls under the cyberterrorism and critical infrastructure category.

I still don't understand how robocallers are engaging in terrorism, or damaging critical infrastructure.

Don't get me wrong; I'd love to see them picking up trash on the side of the highway for next twenty years of their life, or worse. But calling everything "terrorism" really reminds me of the years following 2001.

Didn't Lenin say "The purpose of terrorism is to create terror?"

I don't know about you, but I'm scared anytime my phone rings that it is another robocaller.

Or, you know, punish the platform that allows for these scams to happen.

You don't even need to be this severe. The credit card system demonstrates how things can work: make the bank post collateral and pay a small transaction fee per transfer. Refund any fraud victims out of the fees and/or by issuing charge backs onward to the bank. If they facilitate a lot of fraud, raise their fees. If they refuse to pay the fees, seize the collateral and cut them off.

I find it funny in this case: If they operate from a bank in China then the Chinese gov. will block all tech exports to US until you unblock their bank.

You prosecute the ad companies that are complicit and assist them in their endeavors. The scammer himself might be out of reach of US law enforcement, but Google which is promoting their scams (and getting paid for it) is definitely not.

The problem is that it's hard to draw a clear line between legitimate consulting, and fraud.

If the government forms are byzantine and you go to a lawyer and pay them $250 to fill them for you, you aren't being scammed.

If you visit a web site that clearly tells you that it's a third party website, you can waste your time with the horrible government site, or you can pay 10 bucks and use their optimized form, you're not being scammed.

If the web site now shrinks their disclosure a bit, maybe moves it below the fold, jacks up the price... at some point 90% of the people would agree that they're "scamming" people, in the colloquial sense, but this lack of a clear line makes it hard to charge them criminally.

The way to handle this would be to

1. require clear disclosure for any kind of "online 'government bureaucracy help' service", with everything (font size, contrast, cannot be showing anything else at the same time to avoid drowning the disclosure out)

2. Make providing such "services" without the disclosure punishable by serious jail time, confiscation of any earnings, etc.

3. Actually enforce it, including through international arrest warrants, going after credit card providers when the scammers are abroad, etc.

4. Follow up to see if the problem went away and adjust the requirements until it does.

Omit any of these, and the problem will stay. And right now, none of these seems to happen.

I'd still think you're being scammed if it takes 250 to fill out a form.

Those companies are scamming you through the government, like they do with taxes

If you ask a lawyer to fill out a form for you, it's going to cost a lot of money. That's not a scam.

But let's not nitpick. The example number for a non-scam full-disclosure website was $10. That seems legitimate to me.

Did you read his comment? He didnt lose $250, he filed a chargeback dispute with the credit card. What he will lose is few points of his credit score due to the fact the charge was recognized (so not a fraud but intentional purchase).

Citation needed. As far as I know, chargebacks don't affect your credit score. Either you are in the wrong, and the chargeback is denied, or you are in the right, and the money is returned because it was wrongfully taken (scam, stolen CC, etc).

Frankly, I think the "we're just a platform" excuse goes out the window when they directly make money from it. If you sell an ad, you need to proactively ensure that the ad isn't illegal. Full stop.

Another common one for new LLCs is threatening, official looking letters telling you you need a workplace safety poster or you will go to jail/pay monstrous fines.

The law is real but only applies in very specific circumstances and the letters come from companies graciously offering to sell you overpriced posters.

It freaked the hell out of my partner when we got that, had to explain to her at 3AM that we weren't going to lose our business over a poster. That kind of stuff really rattles your bones when you've got so much going on already with a new business.

Oh yes I got that one! It really does work as a sort of DDOS attack against new businesses, you're trying to get all this stuff sorted out and the scammers know how easy it is to sneak in one more form to be filled out & fee paid.

What really stunned me was that in our state, the official website even has a statement letting you know about these fraudsters... but apparently they can't actually shut them down or stop them from mailing every new LLC? It's incredible how ill equipped we are to shut down scammers who have a nice downtown Chicago Loop address.

It’s rough out there. Was helping a friend of a friend last night who had been scammed into giving out her Instagram password. They’ve change the email / phone / pw on the account. In her case the account is actually a substantial business (art) portfolio with a lot of followers.

Naturally, after a little digging, I discovered that her email was using the same pw and had also been compromised (hackers deleted the emails from Instagram about the email address change).

As ever, the main issue is that getting through to Instagram to get any real help seems impossible. Which sucks, because surely changing all the details on an Instagram account should flag something on their side.

You usually login in the West Coast, then, all of a sudden, you started login in the East Coast -- hey, GOOGLE, FACEBOOK, isn't that ODD?????????????????

I can't believe they act as they don't know what's going on and have no means to deter this. They SHOULD BE LIABLE!

No, that isn't really odd. People travel. Should my account be locked everytime I visit family?

I permanently lost access to may aim account a while back because I tried to connect while traveling out of country.

The key point here is that it's impossible to travel long distances in a short amount of time... Of course people travel. What's not normal is to log in in Miami and in the next minute log in Seattle....

VPNs are pretty mainstream these days. If you talk to anyone working on anti-abuse you'd find the answer to most "Why don't you just.." ideas is because it'd impact many orders of magnitude more legitimate users than victims.

I turn on my company VPN and the next minute my network connections come from their HQ halfway across the world.

If I leave my desktop logged into my account in LA—or it even has some form of autologin enabled and it reboots and auto-logs-in—but I log in from my phone in DC three seconds later, that doesn't mean I traveled from LA to DC in three seconds.

well... it might be normal, if you're on VPN and traveling and what not.

The key, imo, is 'normal'. A new account has no activity, but an account that has, say, 3 years of only ever logging in from IPs located in, say, Detroit area suddenly has logins from Europe and attempts to change email/pass/etc while activity is still coming from Detroit - that's an anomaly. But until there's historical data to compare against, you can't really know. And... unless you've got a lot of computing power to check for that all the time (or outsource that sort of stuff), you probably can't detect that.

Not sure about facebook, but google used to(no longer use them) warn me about location change(SMS and e-mail to secondary account).

I usually log in from one city in Germany, now I suddenly log in first from another city in Germany. It's the same user agent, but an empty cookie jar. Should the login be denied?

Now I log in from a city in the Netherlands, 20 minutes later. From a phone, again, empty cookie jar. Even with a helicopter there's no way to make it there that fast. Should the login be denied?

(The answer is "no, because I've traveled to another city to visit a conference, and the conference network was routed in a weird way and the GeoIP data for their exit IP was incorrect".)

People jump locations all the time, for reasons like remote desktop sessions, mobile roaming, personal and company VPNs, etc.

Locking out a real user has a significant cost.

Should be able to get that account back unless they stole her email as well. Typically the original email is able to recover the account and it doesn't matter that the hackers changed the email.

She managed to get it back now. Thanks.

I had a similar experience but I knew to stop when they asked for payment.

I'm well aware that EINs are free, having had about half-a-dozen of them for various businesses.

I googled something like IRS EIN and clicked the link. I saw a page that looked exactly like the IRS EIN page as I remembered it. I filled out my information. When I clicked submit, I saw a payment page. It was only then I realized I had been duped and looked at the domain.

Reply on news.ycombinator.com