scams

The other day, I received an email claiming I had been selected for inclusion in a very exclusive directory called Emeralds Who’s Who. My immediate reaction was to send it to junk. Then my eyes caught a glimpse of Roer.com – the brand name of my company.

The company where established in Norway back in 1994, and I also brought it with me when I lived in France for several years during the Dot.com period. Thus, the email was able to get under my guard simply by putting my company name and France into the body of the email. This was enough to catch my attention, and I started to read the full content of the email.

According to the email, I was a very accomplished business man. And to be honest, I am tempted to agree. I have had a lot of fun, and true, I have accomplished big things. But I usually do not brag about it, so not many people know.

Reading on, I learned that the

Who would not love to be part of that, huh?

They go on telling me about how the members help each others, creating business opportunities worldwide. Being an entrepreneur, global networks are always of interest.

A few lines of further reading bring on the sales message. One of the most useful sales tricks in the world of sales is to create a reason for hurry. Create a short-term offer or an opening that will close within a few days or hours. And make sure your client realizes the hurry. Yes, I am a sales professional with more than 20 years of sales experience. Yes, I conduct sales trainings.

Yes, I can recognize when someone is trying to pull my leg. Thus, I dismissed the time frame – as in my experience, if you want to buy something, you will usually be able to negotiate the same deal anyway.

Reading on, I learn that there is no charge for being considered into the Emeralds Who’s Who. That is nice, but I get the feeling that after the consideration is over, there might be charges.

Now I can click on a link, or copy-paste it into a browser, and they will take me directly to the application. And surely enough, a reminder of the hurry I am in if I want to be in the next annual publication. Signed by Anthony Miller, Research Director.

Temptation

No matter how tempting it is to click the links, I am a paranoid son of a b*tch. That may be what makes me good at security. So I do not click the links. Nor do I feel like taking part of a Who’s Who I never hear about before. On the other hand, there is a little voice inside saying:

I don’t know about you, but recognition is one of my main motivators. So I decided to spend a little time to look into this opportunity of fame. Perhaps it was true? Maybe finally someone had seen what I did in the past and wanted me to share that?

Another sales technique is to use the clients own motivation and need for recognition to make him feel good, and then want to buy from you. It is sometimes referred to as befriending, and is IMO a very important quality of a sales person. But, still IMO, the befriending should be honest, and truthful. After all, you want to build a relationship based on trust. So overdoing your befriending is not that useful.

Surely enough, I felt good. I had done something, and a research time had deemed what I had done as worth recognition in their publication.

Again, my paranoia forces me to do some research. I go to their website, which I find to be very pre-2000, a sure sign that they either do not know what they are doing, do not have enough money to do what they want, or that they do not care. None of which are good IMO, and I rise my guard.

I do find a physical address, some contact names and even a phone number. This is generally good, and as a result I lower my guard a bit.

Next step is to Google. I enter Emerald Who’s Who, and get an interesting list. Surely enough, the first couple of results points to their own website. Then there are several different sites and discussion boards claiming this is a scam. Many of those are years old, and the same scams are still taking place.

My guard is back up, and I start to read.

Pretty soon, I realize that the posts that are filled with poison against the Who’s Who are not a result of one or two people that are not satisfied with the services. I realize that my gut feeling was right all the time. The Emerald Who’s Who is one of several Who’s Who directories that only serve to scam people.

What I read is not fun, nor shocking.

I would normally just have deleted this email and moved on with my life. But this time I feel like I almost fell victim to a scam. And I tend to look at myself as a professional. A security professional. I should not be even remotely tempted to fall for something like this. And still I felt like this was an opportunity to get some fame and recognition.

I can only imagine how many people are falling for such scams. On the Emerald Who’s Who there is a list of Premier members (sorry, I have no idea what the pay for this). You can browse people on the list, and read about the merits of the victims. For example, you can read that a CEO (name not disclosed), enjoys golf and music, is married and has two children. And yes, full contact and website info is available. Go hustle!

Another one has a full list of accomplishments, image and contact info. Social engineering the people on these lists would be a dream!

And that is exactly what these Who’s Who directories are doing – they play you like a kid. They fool you into thinking that they care. They make you believe that what you have done means a lot to them, and that you are honored to be on their list. Most importantly, they use your own feelings and wish for recognition to charge your credit card ridiculous amounts of cash, they also put you out there on their lists to show the world how they fooled you.

So far, I have found several similar Who’s Who, and according to this great post over at Writer Beware (thanks Victoria), there are plenty of these sites. According to Victoria, these are other Who’s Who scams:

According to the comments to that post, you get the impression that there are a few people only who runs these scams, and that these people know each other, and compete. It seems like they all started in the same company, and then split up. To me it sounds like they are not happy with getting only a small piece of the cake, they all want it all.

I am not sure where they picked my name up, but it does not really matter. These days, it is extremely easy to find just about any name. And only a few minutes of research will be enough to make even the most careful ones lower their guards.

Did you fall for these tricks? How did you get out of it? What is your advice to others? When will such scams stop? How can we help each other to avoid such threats?

The size of the hacking/scamming/phishing criminals are increasing. We all know this. The size of the criminals available creates new market spaces. We know that too. Criminals tends lack ethics. We see evidence of that all the time! 

And here is a nice story to show you again the lack of ethics amongst the criminals - Mr. Brain offers his free phishing kit to aspiring scammers. Nice one, Mr. Brain! I bet they love it!

Only drawback - Mr. Brain gets a copy of all activities and all the information collected from the kits. And the scammers themselves get scammed!

Why Mr. Brain does it like this? We can only guess. What we do know is that it gets increasingly risky to run scams and phishing - as ISPs and law enforcement are now actively on the lookout. Thus, finding an ISP and running your scam yourself is no longer the best method.

Add to that the increasing number of dumb n00bs out there, wannabies who like to be Great Hackers, but lack skill, understanding and motivation. What do you get? A market for hacking tools. 

As with legitimate business, many different business models exists - selling tools and kits directly, revenue sharing - and now "information sharing" without consent.

I am quite sure that Mr. Brain have access to the infrastructure necessary to monetize on the information. And I am more sure that his clients - the wannabies above - have no or only little clue on how to monetize the same information.  And the poor n00b ends up scammed.

I must admit - I love it. 

I am ROFL imaging their faces when they realize they are 0wned.