Accident Scam Waiting to Happen

Beware of that accident scam call or text: losing money isn't the only risk.

Beware of that accident scam call or text: losing money isn’t the only risk.

It’s bad enough that most of us are often at risk of some sort of motor accident, but it’s seriously annoying that such accidents (real or fabricated) attract so many scammers.

This site mentions five scams commonly associated with actual accidents:

  1. The Staged (or Forced) Rear Ending, where the scammer stops or slows suddenly in heavy traffic so that the person behind is unable to stop in time. The scam is based on the belief that such accidents are, more often than not, assumed to be the fault of the driver behind. May be combined with…
  2. The Fake Injury Claim (think soccer player trauma histrionics…)
  3. Other kinds of Staged Accident
  4. The Phantom Victim – personal injury claims from people who weren’t actually at the scene. (So who is this guy Casper?)
  5. The Bad Samaritan. Ambulance chasers, and worse.

Of number five, the site says:

It’s all part of a setup to get your information so as to file false or phony insurance claims, of which they’ll take a hefty cut — if not all.

Here’s a variation on that theme that has become very prevalent in the UK in recent years. In the scam described above, it seems that there are two intended targets: the insurance company and the victim himself. In the UK version, it seems likely that the scammer never goes near an insurance company (which isn’t to say that false claims aren’t made against UK insurance companies, of course – clearly they are).

I’ve been writing for years about cold-call tech support scams, where scammers ring from call centres (more often than not in India) offering ‘help’ with an imaginary PC virus. In a common scenario, they claim that your PC is broadcasting ‘help me! I have a virus!’ messages and that Microsoft is passing that information on to them so that they can advise you. For a small fee, of course.

For some time now, possibly due to the overphishing of the pool of potential tech support scam victims, the same call centres have been trying other types of fraud. In the one I’m describing here, instead of claiming that they’re working with Microsoft, they say that they’re working with a government department, and that they’ve been informed by that department that you – or ‘someone at that address’ – had a recent accident, as a result of which you or they are entitled to compensation.

I’ve received quite a few accident scam calls, but most of them have been peculiarly unconvincing because even if the scammer is able to tell me who and where I am, he isn’t able to tell me anything about the supposed accident. But I suppose their average victim isn’t a hard-bitten and ultra-paranoid security researcher. It may also help that I don’t drive and haven’t been in a road accident for quite a while. (And hope to keep it that way.) But clearly, the hope is to find victims who have had some kind of accident and will be too pleased at the thought of getting compensation to notice that the scammer doesn’t seem to have any information about them apart from their phone call.

Accident scam cold-callers usually have the strong Indian or other Asian accents associated with tech support scams, though one call I received recently was from someone with a very Essex accent (who sounded about 13 years old, but I don’t claim that has any particular significance).

It’s not always clear whether the aim of the scam is to collect some kind of ‘handling fee’ or ‘release fee’ in advance, or to actively pursue a false claim. In the latter case, I suspect that the claimant will still have to make a payment in advance, only to find that he or she is eventually facing possible prosecution or other sanctions for attempted insurance fraud. It’s reassuring to see, though, that there are plenty of people having fun wasting the scammer’s time by stringing them along. I particularly enjoyed Sean O’Grady’s article in the Telegraph a year ago on the socially responsible aspects of keeping a scammer occupied. In fact, there were several aspects to that article that closely resembled my own experiences:

  • The use of a plausible-sounding but bogus company name.
  • “the open-ended, apparently well-informed “open” question/statement, of the kind that psychics use in their stage routines” – in other words, attempting to sound knowledgeable enough about your ‘accident’ (or your PPI, or whatever) for you to wonder how come they don’t know more about it.

However, O’Grady is clearly much better than I am at spinning a yarn to keep the scammer at the end of the line: his personal best is (or was) keeping a PPI scammer busy for 43 minutes.

It’s not all about cold-calling, though.

This is the content of a text message I just received. I’m far from being the first to receive such a text, but it is the first time I’ve received such a text:

£4865 IS STILL waiting in your name, It’s for the accident you had! To claim ASAP fill out the form at [reassuringly bland URL].

Well, that sounds pretty definite, doesn’t it, even if the punctuation is a bit off-key? (And ignoring the minor issue that I haven’t had an accident recently – what do they know that I don’t?)

But no, the link is to a catch-all form which tells me that I’m seconds away from finding out how much compensation I could be owed.

The form asks me:

  • Have I been subject to:
    • Road Traffic Accident
    • Slip, Trip, Fall
    • Accident at work
    • Medical Negligence
    • Other
  • Whether I was injured in the last 3 years
  • Whether I received medical attention for my injuries
  • Whether the accident was someone else’s fault?
  • Whether there’s anything else I’d like to tell them. (There is, but let’s not go into exactly what…)
  • Just a few details about myself…
    • Mr/Mrs/Miss/Ms
    • First name* [presumably the ‘*’ is to tell me that the entry field is compulsory]
    • Surname*
    • Mobile number*
    • Postcode*

Now I get to hit a button called ‘CALCULATE MY CLAIM’. And I’m advised that ‘By clicking “Calculate my claim” you accept to be contacted regarding your claim.’

I’m afraid I didn’t, since I don’t really want any more scam and spam calls: I get enough already. Well, actually I did, but since I hadn’t actually entered any information, it simply took me to the top of the form and asked me to fill in one of the first set of checkboxes. At that point I quit.

It is, I guess, pretty obvious that we’re not looking at a real, cut-and-dried compensation claim here, so there is no £4865 waiting for me in a brown paper envelope. Perhaps Sean O’Grady or another investigative journalist would have given them enough info to get them to call him, spun them a suitably convincing yarn, and found out more about them. But I’m not here to dig deep into one dodgy web site, but to alert people who may not have come across this lucrative little industry my friends in the US call ambulance-chasing.

Would someone have called me back and given me genuine help with claiming for a genuine accident, albeit for a fee? Probably not, given the misleading nature of the text I received. But maybe, though I suspect the fee would not have been trivial. Or would they have encouraged me to submit a false or exaggerated claim for compensation? If the latter, it would probably give them a nice pay-off if it was successful, and me an interview with the police if an insurance company believed I was trying to rip them off. In which case, the company would, no doubt, have said that I was solely responsible for the deceit.

There is, by the way, no information on the site about the company or individual behind the form, and I would suggest that even if you have had some kind of accident for which a claim for compensation would be possible, that you talk to a reputable solicitor/lawyer about it, rather than waste time on randomly-texted SMS messages and anonymous web sites. Not to mention the risk of losing money and attracting the attention of the police.

David ‘Oops!’ Harley
ESET Senior Research Fellow

Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center