Email Scams, Telemarketing, and Identity Theft

[Sam Golden]

I know this is off topic, and probably not quite as juicy as SCADA, but it points to what I fear may be a growing problem.

 

I have had my home phone number in the National Do Not Call Registry, https://www.donotcall.gov/, since it's inception and I have received few if any telemarketing phone calls.

 

Within the last week, however, I have received more than a dozen calls.  After brushing the first few off, I became curious and started to ask the callers why they were calling me.  The results were startling.

 

Each of the first three callers I asked stated that they had received an email from me requesting that they call me.  Knowing that I hadn't done so, I asked for the email address.  They stated they received an email from Goldensaaaa@....  This apparently legitimizes their calling me.

 

Now, while telemarketing is annoying, it started me thinking about the implications.  Anyone can search various public archives such as 411.com and find a phone number for a name.  Anyone can create a gmail account as long as they can read the "captcha".  Is some "evil" telemarketing company hiring lots of people to generate lots of mail accounts and then offer these to faux-legitimize telemarketing phone calls?

 

It doesn't stop here, however, the next call I received was the result, so the caller said, of "me" requesting information from a web form on their web site.  Not true!  Is this the result of an "evil" telemarketing scheme as well?

 

I just signed up for credit monitoring as I suspect I will need this next. 

 

Should I be paranoid?

 

Regards,

 

Sam

 

 

_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

[Marcus J. Ranum]

Sam Golden wrote:
  > I have had my home phone number in the National Do Not Call Registry,

> https://www.donotcall.gov/, since it's inception and I have received few
> if any telemarketing phone calls.
>  
> Within the last week, however, I have received more than a dozen calls.  
> After brushing the first few off, I became curious and started to ask
> the callers why they were calling me.  The results were startling.
>  
> Each of the first three callers I asked stated that they had received an
> email from me requesting that they call me.  Knowing that I hadn't done
> so, I asked for the email address.  They stated they received an email
> from Goldensaaaa@... <mailto:Goldensaaaa@...>.  This
> apparently legitimizes their calling me.

Want to guess who sent it to them?

There's cut-outs in most spam/telemarketing laws that say you
can request calls or that it's OK if there's a "prior business
relationship."  It usually takes the telemarketers a few
months to figure out a way around each new law. After all,
their important message is, um, important.

After thinking it over for a few years (seriously) I've
concluded that spam and telemarketing are OK and I will
accept any amount of them as long as I still have free
speech. I don't, of course - in the US there are considerable
laws curtailing same (see 18 US 2257a for example) and the
FBI spends a lot of time and taxpayers' money going
after certain kinds of speech rather than others that
fall under the same laws. So, with spam and telemarketing
we're dealing with a social failure; the police won't
protect us and we are not given the tools to protect
ourselves. (And the phone companies will cheerfully
sell us caller-ID but then sell telemarketers the ability
to block it)  Ultimately, this kind of imbalance will
continue as long as it's profitable.


> Now, while telemarketing is annoying, it started me thinking about the
> implications.  Anyone can search various public archives such as 411.com
> <http://411.com> and find a phone number for a name.  Anyone can create
> a gmail account as long as they can read the "captcha".  Is some "evil"
> telemarketing company hiring lots of people to generate lots of mail
> accounts and then offer these to faux-legitimize telemarketing phone calls?


Yes. That's probably what's happening. Although the
telemarketers may simply optimize by not bothering
to do it, until someone complains - THEN - send the
"please call me" fake email.


> Should I be paranoid?

Was that a serious question? I checked the date of your
post and it wasn't April 1. Did you seriously ask the
firewall-wizards if you should be paranoid?

The answer is, "of course not!" It's not paranoia
if you've ALREADY got a brain-leech installed in you
and the orbital mind control lasers are making you
dance like a puppet.

mjr.
--
Marcus J. Ranum CSO, Tenable Network Security, Inc.
                        http://www.tenablesecurity.com
_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

[Paul D. Robertson]

On Thu, 30 Apr 2009, Marcus J. Ranum wrote:

> fall under the same laws. So, with spam and telemarketing
> we're dealing with a social failure; the police won't
> protect us and we are not given the tools to protect
> ourselves. (And the phone companies will cheerfully
> sell us caller-ID but then sell telemarketers the ability
> to block it)  Ultimately, this kind of imbalance will
> continue as long as it's profitable.
>

My phone switch (Asterisk/FreePBX on an 8yr old FreeBSD box) offers me the
ability to route calls by calling number, ask for identity to be replayed
to me prior to accepting the call, allows me to reject anonymous callers
and gives me the ability to run an IVR from hell on anyone I can't/don't
want to ID.  I can also forward to my mobile or not based on all of the
prior conditions, and new DIDs cost me ~$5/month for ones in a specific
area code (VoIPStreet,) or can be free in a couple of area codes (IPKall,)
and set my own outbound callerid to any DID I want (VoicePulse.)

'Course I live somewhere that actual broadband is available ;)

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul@...       which may have no basis whatsoever in fact."
           Moderator: Firewall-Wizards mailing list
           Art: http://PaulDRobertson.imagekind.com/

_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

[Bruce B. Platt]

Well, After Sam's post I received a phone call from an anonymous caller
who told me that I was pre-approved for a car loan as a result of my
web-form submission.  A submission I never made.

I reviewed my credit report activity the next day, and have been since.  
All kinds of business opportunities blossom as a result of such scams.  
My bank makes some more money by offering me a very inexpensive credit
monitoring service, and presumably the three Agencies get a share.  So,
I wonder who is hiring the "captcha" readers and how much this is costing.


Marcus J. Ranum wrote:
> The answer is, "of course not!" It's not paranoia
> if you've ALREADY got a brain-leech installed in you
> and the orbital mind control lasers are making you
> dance like a puppet.
>
> mjr.
After I hung up the telemarketer call, I quickly covered my head with
shaving cream.  As any self-respecting Psychologist knows, such coverage
used to be a standard method of defeating mind-control.  YMMV  :-)




[bruce.vcf]

---

begin:vcard
fn:Bruce B. Platt, Ph.D.
n:Platt;Bruce B.
org:ei3 Corporation;R & D
adr:;;136 Summit Avenue;Montvale;NJ;07645;USA
email;internet:bruce@...
tel;work:[phone] extension 404
tel;fax:[phone]
url:www.ei3.com
version:2.1
end:vcard

---

_______________________________________________
firewall-wizards mailing list
firewall-wizards@...
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards