Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label Internet scammers. Show all posts

Meta Struggles to Curb Misleading Ads on Hacked Facebook Pages

 

Meta, the parent company of Facebook, has come under fire for its failure to adequately prevent misleading political ads from being run on hacked Facebook pages. A recent investigation by ProPublica and the Tow Center for Digital Journalism uncovered that these ads, which exploited deepfake audio of prominent figures like Donald Trump and Joe Biden, falsely promised financial rewards. Users who clicked on these ads were redirected to forms requesting personal information, which was subsequently sold to telemarketers or used in fraudulent schemes. 

One of the key networks involved, operating under the name Patriot Democracy, hijacked more than 340 Facebook pages, including verified accounts like that of Fox News meteorologist Adam Klotz. The network used these pages to push over 160,000 deceptive ads related to elections and social issues, with a combined reach of nearly 900 million views across Facebook and Instagram. The investigation highlighted significant loopholes in Meta’s ad review and enforcement processes. While Meta did remove some of the ads, it failed to catch thousands of others, many with identical or similar content. Even after taking down problematic ads, the platform allowed the associated pages to remain active, enabling the perpetrators to continue their operations by spawning new pages and running more ads. 

Meta’s policies require ads related to elections or social issues to carry “paid for by” disclaimers, identifying the entities behind them. However, the investigation revealed that many of these disclaimers were misleading, listing nonexistent entities. This loophole allowed deceptive networks to continue exploiting users with minimal oversight. The company defended its actions, stating that it invests heavily in trust and safety, utilizing both human and automated systems to review and enforce policies. A Meta spokesperson acknowledged the investigation’s findings and emphasized ongoing efforts to combat scams, impersonation, and spam on the platform. 

However, critics argue that these measures are insufficient and inconsistent, allowing scammers to exploit systemic vulnerabilities repeatedly. The investigation also revealed that some users were duped into fraudulent schemes, such as signing up for unauthorized monthly credit card charges or being manipulated into changing their health insurance plans under false pretences. These scams not only caused financial losses but also left victims vulnerable to further exploitation. Experts have called for more stringent oversight and enforcement from Meta, urging the company to take a proactive stance in combating misinformation and fraud. 

The incident underscores the broader challenges social media platforms face in balancing open access with the need for rigorous content moderation, particularly in the context of politically sensitive content. In conclusion, Meta’s struggle to prevent deceptive ads highlights the complexities of managing a vast digital ecosystem where bad actors continually adapt their tactics. While Meta has made some strides, the persistence of such scams raises serious questions about the platform’s ability to protect its users effectively and maintain the integrity of its advertising systems.

Two Cyber Scammers Arrested; Police Uncover Transactions of ₹60 crore in Bank Accounts

 

Two cyber fraudsters were detained last week on Friday in Gujarat for allegedly being involved in a scheme that defrauded college students of lakhs of dollars by persuading them to like YouTube videos. Authorities investigated their bank records and discovered transactions of 60 crore in the previous three months. 

Rupesh Thakkar, 33, and Pankaj Od, 34, both natives of Gujarat's Gandhinagar district, were detained. They were traced as part of the investigation into a case filed by a 19-year-old student who was conned of $2.5 lakh in October of this year after taking up a part-time job that required liking YouTube videos.

The then-unknown offenders were charged under Indian Penal Code sections 419 (cheating by personation), 420 (cheating and dishonesty), 467 (forgery), 468 (forgery for the purpose of cheating), and 471 (using forged papers as genuine). 

"We determined where the accused were stationed through a technical investigation that involved tracing the accounts to which the complainant had made the payments. We arrested them early this week with the help of Gujarat police," said a Matunga police officer. 

The police have also seized several bank documents, including credit cards, debit cards, and cheque books, as well as devices, including six mobile phones and 28 SIM cards, from the two guys. They also discovered rubber stamps used to certify falsified documents shared with the accused's victims. 

"Analysis of their transaction history revealed that the two men have made 60 crore transactions in the last few months. However, the accounts we could link to only had 1.1 crore, which we froze," the officer explained. He went on to say that the remainder of the funds had already been transferred to other accounts that were also under investigation. 

Police believe that by thoroughly examining the accounts of the two accused, they will be able to solve several more incidents of cyber fraud. Both of the arrested suspects are currently in police custody.

How Con Artists are Getting Conned? Here’s All You Need to Know

 

Scammers keep demonstrating how evil never sleeps. While their goals—to acquire peoples' financial and personal information—remain the same, their strategies frequently change to stay relevant. In fact, con artists have improved their methods and abilities to the point where some of them even con fellow con artists since their familiarity with the techniques makes it simpler to evade discovery and extort something from them. 

According to a recent Sophos study, cybercriminals are allegedly defrauding one another of millions of dollars and utilizing arbitration to settle disputes over the schemes. The findings also reveal how attackers carry out their schemes against one another using tried-and-true techniques, some of which are decades old, such as typosquatting, phishing, backdoored software, and false marketplaces. 

Let's go through each technique one at a time for those who are not familiar with how they operate: 

Typosquatting: An attack that targets users who inadvertently enter the incorrect website address into their browser's URL field. Internet users frequently have no notion that the websites they are viewing or buying from are phony. This identity theft could be used by dishonest website operators to trick users into disclosing their personal information. 

Phishing: An online scam in which victims are duped by receiving emails purporting to be from banks, mortgage lenders, or internet service providers. 

Backdoor malware: Malware that bypasses standard authentication procedures to access the system.  As a result, application resources are accessible remotely, giving attackers the ability to remotely update malware and run system commands. 

Fake marketplace: The website acts as a launchpad for scams like fraudulent goods, catfishing, and even hacking. 

Hackers and fraudsters are now more prevalent than only knowledgeable software developers and computer specialists. Today's technology is so user-friendly that "noobs" could be in charge of a fraud occurrence that costs companies and clients millions of dollars. 

The number of fraud incidents rose by more than doubling (178%) in Asia-Pacific alone in the first quarter of 2021 compared to the same time in 2020. The two most frequent occurrence categories are online banking fraud and account takeovers, with increases of 250 percent and 650 percent, respectively. 

Scammers getting the taste of their own medicine 

For this research, BreachForums, an English-language cybercrime forum and marketplace that focuses on data leaks, as well as Exploit and XSS, were examined by Sophos X-Ops experts. Russian-language cybercrime forums Exploit and XSS provide access-as-a-service (AaaS) listings. All three locations have dedicated arbitration rooms. 

Even while it occasionally causes chaos between "plaintiffs and defendants," the scamming of fraudsters is lucrative. Some alleged offenders simply disappear or call the complainants themselves "rippers." Sophos examined 600 scams over the course of a year, with claims ranging from US$ 2 to US$ 160,000, costing hackers more than US$ 2.5 million between them on just three sites. 

Not all scams are conducted merely for financial gain. Matt Wixey, a Senior Security Researcher at Sophos, claims that interpersonal conflicts and rivalries were common. They also found cases where con artists would defraud those who had defrauded them. 

“In one case, we found a trolling contest set up to get revenge on a scammer trying to trick users into paying US$ 250 to join a fake underground forum. The ‘winner’ of the contest received US$ 100,” Wixey stated. Additionally, Sophos discovered that the dispute resolution and arbitration procedures left a wealth of unused intelligence behind, which security professionals and law enforcement might use to better understand and stop cybercriminal tactics.

Scammers are Using Twitter Bots for PayPal and Venmo Scams

 

Internet scammers are using Twitter bots to trick users into making PayPal and Venmo payments to accounts under their possession. Venmo and PayPal are the popular online payment services for users to pay for things such as charity donations or for goods such as the resale of event tickets. This latest campaign, however, is a stark warning against making or revealing any sort of transaction on a public platform.

How fraudsters operate? 

The fraud campaign begins when a well-meaning friend asks the person in need for a specific money transferring account — PayPal or Venmo. Then the Twitter bot springs into action, presumably identifying these tweets via a search for keywords such as ‘PayPal’ or ‘Venmo’.

Twitter bot impersonates the original poster by scraping the profile picture and adopting a similar username within minutes in order to substitute their own payment account for that of the person who really deserves the money. 

Twitter user ‘Skye’ (@stimmyskye) posted a screenshot online detailing how she was targeted by a Twitter bot. Skye noted that the bot blocks the account that it is mimicking, and scraps the whole profile. 

“Because you’re blocked, you’ll see that there’s one reply to that question but the reply tweet won’t show up. If you see a ghost reply to a comment like that, it’s almost always a scam bot. They delete as fast as they clone your account. You won’t even know it happened,” Skye wrote.

“They will delete the reply tweet, but the account itself will usually not be deleted, just change the username. So, the accounts are usually not brand new, they even have followers. You need to check closely,” she warned. 

“Given that the mechanism is automated, I’m willing to bet that the attack is fairly successful. A Twitter user would need to pay close attention to what is going on in order to notice what’s happened. Don’t publicly link to your PayPal (or similar) account – deal with payments via direct message instead. By doing this, the scam bot won't be triggered, and wouldn't be able to show up in the same chain of direct messages even if it was,” Andy Patel, researcher with F-Secure’s Artificial Intelligence Center of Excellence, advised users.