WeLiveSecurity

It’s been a while since I’ve talked about hoaxes (here or anywhere else), but they haven’t gone away, even if we don’t see many of the stories about catastrophic, undetectable viruses any more.

Here is an old favourite that has hit my radar recently both by email and via Facebook. (Many antique hoaxes have taken on a new lease of life by migrating from email to Facebook.)

Mighty Hoaxes from Little Emails Grow

Since I haven’t discussed these for a while, maybe I should explain that by hoaxes I mean false information (usually circulated by chain letter, chain email, or the social media equivalent such as re-tweets or Facebook Likes). Most of the people who forward it do so innocently, if incautiously: they don’t intend to mislead. However, somewhere in the lifetime of such a hoax, someone did send out false information, often with no obvious motive except maybe to bolster their own poor self-image by making fools of other people. I don’t include out-and-out scams like phishing and 419s in this category of nuisance: some people do, but I think that’s just confusing.

I also use the classification semi-hoax for some chain messages: these are messages that may not be completely false, but at some point they’ve been represented or modified – deliberately or through misunderstanding – in such a way that the real facts are concealed or distorted.

Post Haste

I’ve seen this example of a semi-hoax a couple of times this year, but it’s been turning up regularly (especially at this time of year) for several years.

It claims that a warning is being circulated by or on behalf of Royal Mail (the UK’s primary postal service), the Trading Standards Office, or ICSTIS (now PhonepayPlus, the body that regulates premium rate phone services in the UK. The scam is described as follows, or in similar terms:

A card is posted through your door from a company called PDS (Parcel Delivery Service) suggesting that they were unable to deliver a parcel and that you need to contact them on 0906 6611911 (a Premium rate number).

I describe this as a semi-hoax because there is a certain amount of truth in it. There really was a scam intended to trick people into ringing a premium rate service in Belize associated with that number. However, the number was killed off at the end of 2005 (and the company behind it was fined £10,000), and claims that just ringing the number results in your being charged £315 or even £15 are sheer embroidery. The service rate was £1.50 a minute, and 090 premium rates currently cost UK phone subscribers a maximum of £1.65 per minute (£2.55 for mobile phone calls).

The hoax continues:

If you do receive a card with these details, then please contact Royal Mail Fraud on 020 7239 6655.

Well, it’s beyond unlikely that you’ll receive a card with those details, but if you do receive something similar (assuming you're in the UK, of course), that’s not the number to ring: instead, you can ring Action Fraud at the numbers listed here. Though I’d think that you’d be more likely to receive a scam message by email or as an SMS text message than shoved through your letterbox.

PhonepayPlus’s own statement on the hoax can be found here, and the Crime Stoppers web site lists it here. Premium rates and the number prefixes used vary from country to country, but information on UK premium numbers and the rates they attract is available here.

I’ve never seen this particular story outside the UK, which doesn’t mean it doesn’t happen: it’s actually quite common for hoaxes to be ‘translated’ from one country to another. However, in the US and elsewhere, there have been many alarmist tales of cell-phone numbers that you shouldn’t answer because if you do you’ll be switched to a premium rate service. (Service providers generally deny that it’s possible for an incoming call to be switched in this way to a chargeable, outgoing call.) This doesn’t mean that there aren’t current scams based on premium rate services, though.

Wangiri scam calls (wangiri is a Japanese term meaning something like “one ring and cut”) work by using software to ring random numbers, especially mobile phone numbers, and dropping the call after one ring.

The scammer hopes that the victim will notice the missed number and ring it back, not realizing that they’ll be calling a premium-rate number. Variations on this theme include calls that play a recorded message when the call is answered. While the message may implement a range of scams, one common gambit is to offer a prize, some kind of rebate, or some other incentive, to persuade the hopeful victim to call a premium rate number. Preferably an offshore number, since the illicit profit is likely to be greater.

In a more familiar context for followers of this blog, our friends at ESET Latin America noted recently that malware for Android devices detected in Latin America is dominated by programs like Boxer, an SMS Trojan that covertly subscribes the victim to a premium rate SMS number. More on that in due course.

In the meantime, here are some hoax-related resources.