Comment by dimitar | Hacker News Reader

Comment by dimitar | Hacker News Reader

Parent Full thread

There is a company registered that commits the following mobile ads fraud:

* The buy targeted ads from Google, served on YouTube targeting small children and clients of a particular carrier

* When you click on the ad (even if by mistake) you find that you are subscribed to a game service and immediately charged a small fee (5 euros) via your carrier (DCB). You may or may not see a chrome window open and close.

* If you extract the link from your chrome history and visit it again on your computer it looks like a benign form, with terms of use and you need to click at least twice to subscribe.

Now these guys will actually return you the money if you bother to find them and ask it back. They will appear really legitimate as the fraud is difficult to reproduce, and the bet is that they steal a relatively small amount of money and it's possible not everyone notices it on time. Worse I'm sure many parents will blame their kids.

The awful thing is that this scheme wouldn't be possible without Google and the mobile carrier. I actually had DCB disabled because I knew the problem exists, but the carrier had reenabled it without my knowledge. I clicked a link by mistake when I was choosing a video for my kid and got charged.

My project is to research a possible way to reliably reproduce their fraud so I can report it to the authorities. I know for sure they don't have the means to properly investigate it..

I have a somewhat related experience with DCB/premium SMS-es. I run a relatively small-but-not-trivial amount of IoT devices that communicate over GSM/2G. For that end I'm using a local GSM carriers "IoT SIM" cards/packages. A year or so ago we started noticing DCB/premium SMS charges on our account and that was super weird, as we know what our devices are capable and what not. First month it was a device or two, so there was a possibility someone stole our SIMs and is using them in regular phones or what. But next month, a lot more SIMs had these charges. We compiled our case, sent it to our contact at the carrier and the fees/charges were quickly dropped/refunded. All is well, it happens - weird but ok.

But a month or so ago we were tracking down some other issues and requested detailed connection logs for 2 of our SIM cards. And what do we find there? DCB/premium SMS charges. It looks like they are just filtering them out from our invoice and not charging them to us, but some backend system somewhere is still processing those fees.

So it seems like this whole DCB thingy is way more unregulated as one would think. Now I'm really interested how the charges even started appearing on our SIMs, why they did not resolve them at the source and how many people get their money stolen that way and they don't notice a few EUR here and there (fees were around 1eur in our case).

Interesting stuff.

The number of times that anti patterns have morphed into this (literal fraud) seems to be increasing lately. For example, after paying extra for a refundable ticket from JetBlue, it was impossible to cancel. Their "cancel ticket" button threw an error saying "This part of our website isn't working, please call this number" for which there was obviously a 6+ hour wait.

I'm really keen on finding a systematic way of preventing these types of scams.

The systematic problem is the carriers who are processing such payments and don't ban abusive merchants, even when getting tons of complaints from users.

Here I don't think there is a legitimate mainstream use for DCB beside connecting to Google Play and Apple Store. The carriers can and should be able to tell me where my charges where coming from. Instead they call centre told me "its probably something you got from Google Play" even thought I've disabled the DCB payment method there. I found the vendor by inspecting my history as clicking an ad leaves a trace. Most consumers probably are not savvy enough to do that and give up at that point.

Edit: Even worse, this carrier offers a "safety online" package.. that is almost extortion since its safety they fail to ensure if you don't buy the package.

This happened to me, in France, through the Orange mobile carrier, around 2018. They've reimbursed me without issue.

I consider myself savvy, use an adblocker and don't click on obvious frauds. Yet it happened.

That's what hurt my pride, not gonna lie. Plus its angering they are targeting children with this.

I wish you good luck! Perhaps TLSNotary might be of service: https://tlsnotary.org/

Interesting! I bet you do care if this succeeds though.

Well, I'm not betting anything on it..

Need any help with this? You've piqued my interest.

Sure! I don't really know where to start, I got the link.. I wonder how I can increase the odds of getting one of their ads so I can record what happens.

my email is duzunov@fastmail.com

You might be able to run a virtual instance of Android (on a PC), and use wireshark to capture the traffic, and maybe burpsuite if you want to get spicey. I think, I am no expert.

I wish you luck.

Already did that, however the link no longer works the way it did originally. Its either "expired" or they also detect the carrier, DCB enabled. Don't know how they could do that thought.

Wait, how is this technically possible?

I think this is the question. I think they either probably generate links that change once clicked once.

The link is not the problem, but how do you charge someone money without their knowledge?

I described how this works in the original post. They do send an SMS with a link to unsubscribe, but that only cancels future charges, not the original one. And it's possible that a lot of the scammed people don't see it on time or confuse it for another purchase they made. Especially since the presumed targets are children. Then even if you unsubscribe, you still get a bill from your carrier. I had to pester both this firm and the carrier to remove the charge.

That doesn't answer my question. I'm asking: how is it possible to make it so that if someone clicks some random link, their money will be immediately transferred to your account, without needing any confirmation? And if it's possible, why do scammers bother tricking people into voluntarily sending them money when they could just do this?

Thank you

Reply on news.ycombinator.com