THE NEWSLETTER | 06.11.25 | V05N18
Co-Founder/Content: Doug Fodeman | Co-Founder/Creative: David Deutsch | Scambaiter: Rob M
Approved Advertisement
Some Social Media Posts Are Malicious!
People have come to expect a tremendous amount of fraud to target them via their email inboxes and texts, but less so in their social media communities. It’s critically important to change our thinking about this because scammers are increasingly using social media services to target people with fraud. This is due, in part, to the fact that services like Meta (owner of Facebook, Instagram and WhatsApp) have fired lots of employees who were responsible for protecting their communities from fraud. Twitter also did this in the Fall and early Winter of 2022 after Elon Musk purchased the platform. And some services, such as Truth Social, have never had any real guardrails in place against fraud to begin with. Even community platforms such as NextDoor are overwhelmed by the fraud that uses their platform as a means to target their members. We have another such case of this fraud, but this time it is multi-faceted. It began when a woman saw a post on Nextdoor.com on May 31 and asked me to evaluate whether or not it was legitimate.
On May 31, a woman named Kathy M. posted a job opening on Nextdoor.com. (It has since been removed.) Nevermind that Kathy had joined Nextdoor just days earlier, it was one of those jobs likely to bring a lot of attention because of the flexibility it came with…. Full or part time, flexible hours, and work from home remotely! Kathy simply asked anyone who was interested to text her at 267-268-6623. (Note that Kathy turned off any discussion associated with her post so that people couldn’t comment or ask questions publicly.)
And then, not much later, Kathy M. posted again about this job. But this time her post included a lot more details about the job. Notice that in both posts Kathy implies that she represents a company by saying “We’re seeking a motivated, reliable, and self-driven individual to join our team…” and “We’re currently hiring….” This will be important to remember, as you’ll see later.
On June 1, we asked Google to search for Kathy’s phone number and it showed us two links to a Facebook post about a home for rent on Snelling Ave in Minneapolis, Minnesota. One of the posts included a photo of the property. The other post also said to “TEXT OWNER @ (267) 268-6623.” So it seemed to us that, perhaps, Kathy, was a realtor or involved in home and/or apartment rentals. However, there were no business links associated with her phone number. No websites, either.
We were curious about this property that Kathy owned in Minneapolis, MN and conducted a reverse image search for that 3-bedroom house with the red door. Unexpectedly, Google found that exact house photo listed on the website Apartments.com. But when we clicked the link to this particular house, we learned that it had already been removed from the listing and/or was no longer available. More importantly, we noticed something rather odd about the information that Apartments.com included about this home in the Google listing. Their website said that this home was located in Bloomington, Minnesota. Kathy had stated that this home was located on Snelling Ave. in Minneapolis, Minnesota. Again, we asked Google…. “Is Snelling Ave, Minneapolis in Bloomington, Minnesota.” Google said no! It said that Snelling Ave. is not in Bloomington. It is located in Minneapolis. This discrepancy seemed terribly odd and, from our perspective, casts some additional doubts on Kathy’s credibility and the legitimacy of this rental offer.
I decided to reach out to Kathy, as a man named Derek, and tell her that I was interested to apply for the job she had posted a few days earlier on NextDoor. As instructed, I texted Kathy at (267) 268-6623. I also asked her what was the name of her company but she ignored me. I also asked her for the name of her business website and she ignored me. Twice! I also asked her twice if we could talk over Facetime rather than texting. Again, she ignored my request.
Kathy did tell me that the actual job was to be her personal assistant, helping her as “her online rental sales agent.” She told me that my job would be to publish house rentals using my social media accounts, but providing her telephone number for people to contact. And, by publishing “2 houses per day” she said “I will pay you $1,055 per week.” I estimated that it would likely take me less than 8 hours per week to do this work as her “personal assistant.” That works out to be about $130/hour by my estimate. Sounds like a great deal!
My final text to Kathy M. was to ask her how long she had been pushing this scam on Americans. She never responded. Sadly, a scammer disguised as a woman named Kathy is running a fraud that has multiple angles. Obviously, her absurd pitch to pay more than a thousand per week for a few hours of work is a complete job scam. And by using MY social media accounts means that I would defrauding the public! But her scam is also about posting fake home rentals that will likely require a down payment from interested people. We strongly suspect those down payments will simply disappear, as would the properties listed online.
Scammers are using lots of angles to target people on social media. On June 2, another man posted a “SCAMMER ALERT” after a beautiful, young Asian woman randomly contacted him. The woman was named Anna Yang. She said to the man “I just came here for the first time. Can you recommend some local food?” This man has been heavily targeted by many pig-butchering scammers in the past year and he’s shared them with us. They are typically disguised as beautiful, young Asian women. He checked Anna Yang’s NextDoor profile and it showed she was part of the “Lynwood” neighborhood. (“Lynwood” is misspelled.) But the man also discovered that an hour earlier her profile said she was from Charleston, South Carolina! Another neighbor added this response to the post… “Yes, I am getting versions of them too… brand new profiles… no posts, but a DM with a question like recommendations for Yoga, etc.”
Over the last few years, we’ve reported on fraud in many forms targeting people on social media. Fraud has increasingly made its way into these online communities in the form of fake advertising, fake profiles, stolen profiles of real people, phishing threats disguised as texts and emails from social media services, and more. It is simply far too easy to deceive others online, even in social media services! Remember to verify, verify, VERIFY! Especially if someone you don’t know, perhaps new to the social media service with few friends, posts a link or job offer or recommendation for anything!
Approved Advertisement
Tremendous Data Breach To Be Concerned About & Protecting Yourself!
We’re very sorry to have to report to our readers that a massive data breach was exposed in May. Unlike other data breaches, this one appears to potentially have extremely serious consequences based on the volume and importance of the data found. More than 184 Million records were found in a plain text file hidden on a server. The file was not encrypted or secured and was found by a cybersecurity expert named Jeremiah Fowler in early May. The data included a tremendous number of full login credentials for users across multiple accounts including Email accounts (e.g. Gmail, Apple, Yahoo, Microsoft), Social Media accounts (e.g. Facebook, Instagram, Twitter, Snapchat), Streaming services (e.g. Netflix), commercial accounts (e.g. Amazon), gaming accounts (e.g. Discord, Roblox, Nintendo), and many others such as Spotify, WordPress and even Paypal, as well as other bank/wallet accounts! Mr. Fowler is reported to have contacted a small random sample of people whose data was compromised and all of them confirmed that the data he discovered was accurate. This breach is rather frightening, especially because so little is known about the how, where and why of it. Here are three links to read more information about this breach. (We’re grateful to our longtime reader who brought this to our attention! Also, just recently, our own Experian account sent us information about this breach as well, with suggestions how to monitor and protect ourselves.)
- https://www.wired.com/story/mysterious-database-logins-governments-social-media/
- https://www.foxnews.com/tech/massive-data-breach-exposes-184-million-passwords-logins
- https://www.tomsguide.com/computing/online-security/more-than-184-million-passwords-exposed-in-massive-data-breach-apple-google-microsoft-and-more
In case it isn’t obvious about this data breach, our advice to our readers, your family and your friends is to take the time to change ALL of your passwords! We understand how exhausting and challenging this can be. But in today’s digital age, it is truly better to be safe, than sorry. Also, please don’t change your passwords by just adding 1 character. That’s not safe either. Here is another resource, we’ve often recommended, to check on personal data exposure based on prior breaches or dark web exposure. Visit “Have I been pawned?” (https://haveibeenpwned.com/) and enter your various email addresses, including those of your family members. It is safe to do this and “Have I Been Pawned?” will let you know if your email, and any information associated with it, has been found in known stolen data breaches going back many years. (It has not yet been updated to include this latest data breach.) Nowadays, as a result of the frequency of data breaches, we also recommend that you write down the date of the last time you updated your various passwords too! Sadly, the odds are you’ll likely have to do it again in the next few years!
Over the years we have often informed our readers of the risks for many, especially Americans, that come from the over-exposure of our personal information online. Especially from the sale of our personal information through online data brokers. The European Union has better laws protecting their citizen’s privacy than the US. Well unfortunately, it is soon going to get even worse for Americans. We just learned that in mid-May the Trump Administration’s Consumer Financial Protection Bureau cancelled plans to more tightly regulate the sale of Americans’ sensitive personal data. You can read more information about this lapse here on Reuters or on TheHill.com. We think that by 2026, Americans are likely to see even greater instances of email, text and other fraud targeting them because of the ease of acquiring their personal information.
Last week Scambaiter Rob shared a surprising email with us. It was an offer from a “Ms. Donald Cynthia” (**eye roll** Seriously? Donald Cynthia?) for a low-interest loan. She sent it from a free Gmail account but claimed her bank was the Westerra Finance Credit Union, using the domain westerracunion[.]com. Our surprise comes from the fact that this domain is still active after six months, though it has no website we could find. It’s reputation amongst security services is HORRIBLE! (Including finding malware on the site.) Just check out VirusTotal.com, Scamadviser.com or Scam-Detector.com! This is just another example of how poorly some Registrars and hosting services respond to reports of misuse by the domains registered through them!
Another recent fraudulent email that actually put a smile on our faces came from a Mrs. Elizabeth Emmanuel. Her email to Rob started with “Hello Dear How are you doing today?” And then she claimed to be an employee of the US Border Customs & Protection Division! Given everything we’ve seen reported in the news lately about the Department of Homeland Security’s efforts (through ICE) to arrest and deport people without any due process, it’s nice to see that there is still a Division of Homeland Security that is kind, caring and so sweet! But we did find it odd that her email was sent from a server in Brazil and not a DOT-gov US Government email account.
If you, or someone you know, is on Medicare, please review this link. It is a good resource how to protect yourself and report Medicare-related fraud from Medicare.gov:
https://www.medicare.gov/basics/reporting-medicare-fraud-and-abuse
According to this article, scammers are taking advantage of the tariff confusion from the current administration. Check out…. https://www.aol.com/tariff-confusion-creates-perfect-storm-164717745.html
In a “feel good” report, check out how internet vigilantes go after scammers and turn the tables to protect the innocent! Visit:
https://www.yahoo.com/news/internet-vigilantes-trilogy-media-turn-011421269.html
As we already know, scammers often go after the same people whom they have successfully targeted once before. This article addresses this point and is called “What you do after a scam matters more than you think.”
https://www.cnet.com/personal-finance/what-you-do-after-a-scam-matters-more-than-you-think/
The digital codes used to better protect you are sometimes used in a type of fraud to target you! This article offers an explanation how this works: https://www.fox5vegas.com/2025/05/22/fox5-investigates-scam-alert-digital-codes-designed-dupe-you/
Learn how fraudsters in New York are targeting people when they park their cars! It’s surprisingly simple, yet easily missed. We’re guessing that this fraud also happens in other major cities with parking meters. Visit: https://gothamist.com/news/parking-in-nyc-is-hard-enough-dont-get-suckered-by-the-meter
Approved Advertisement
Verify Your Microsoft Account, Pistol Purchase & WHAT is this?
A critically important employee at an American company in the center of the US was targeted by two very similar and clever phishing threats just days apart. Clearly, the same scammers were behind both threats considering how similar they are AND the fact that the links in both contained a redirect sending her click to the same phishing website in Turkey!. Fortunately, this woman is very savvy and doesn’t fall for this junk. She routinely looks carefully at the FROM addresses of emails, evaluates their English carefully, and mouses-over the link to see where it points before clicking it! All of which are good practices for staying safe! And, when you receive an email that claims your password has expired but the email addresses you as “Hello User,” we’re pretty confident that it is a fraud!
One of our readers received an email thanking them for their order for a “pistol!” Now that’s a word we don’t often see or hear much these days. Of course, this fraud was sent from a free oddball Gmail account. But the text field in front of this oddball account had the person’s full name! So it appeared in his inbox as though this man sent this email to himself. Without question, anytime you see an email to YOU that appears as though it was sent from YOU, and YOU know you didn’t send it, lunge for the delete key! At best, it’s spam. At worst, it’s malicious! Remember to report your smelly phish to us and Google!
We want to leave you with one more phishing email that had us scratching our heads and asking “What the heck is this?!” The Subject is clear….”Everything’s Been Reviewed.” But “William Freeman” leaves sooooo many questions unanswered!
Selling Your House, Luxury Watches, & Cozy Nights
As we all know, cybercriminals often steal the advertising information from real companies and link this information to their malicious websites. We saw that recently when one of our readers sent us this email pretending to be from the business called Liz Buys Houses. But this clickbait came from an oddball Gmail account (username: unnati2457jha) and, more importantly, the links point to a 6-month old website called Lanostravacanza[.]com!
Rob recently shared a too-good-to-be-true email with us that came to him from a domain called xdf43[.]com. This domain was registered in China in late July, 2024. The email claimed to offer amazing luxury watches at incredible discounts, as much as 90% off! We all know the expression “if it seems too good to be true, it is!” Don’t believe this junk! Especially when the links in this clickbait point to a website in Russia that was registered less than a month before Rob received this email! (look for the “.ru” in the link at the bottom!)
If you ever get an email inviting you to take a survey for a well-known brand, like Hilton Hotels, that email had better come from the company it claims to represent! This “Cozy Nights” survey request came from another free, weird Gmail account. The link is 100% malicious and points to a server owned by a company in France. ‘Nuf said. Delete!
Your To-Do List & AAA Survey
One of our readers sent us this very dangerous email with the subject line “Reminder Your-to-do-6/3/2025.” There was no content whatsoever, just an attached file. But that very small attached file is an SVG file. As we’ve pointed out many times this year, these SVG files are now the weapon of choice to drive your web browser into the waiting arms of a malware bear trap on some scammer website. Never, EVER, click on attached SVG files!
Below is another highly malicious email disguised as a AAA survey, offering a “car emergency kit” if you fill it out. But this clickbait didn’t come from AAA and the link points to the misused services at GoogleApis! If you ever see an email that says this offer “expires today” don’t rush to click! Instead, look even more carefully because this time pressure is another tactic often used by cybercriminals to manipulate your clicking behavior!
Too Many Bizarre & Malicious Texts!
Last week was a true “textplosion” experience as so many of our readers shared scam texts with us! And many of these texts were bizarre or unusual, unlike others we typically see. Let’s start with this extremely weird text that was posted on Reddit recently. We’ve never seen anything like it before! However, other respondents to the Reddit post said that they’ve received this text. It claimed that a security camera had caught the person who received this text, using drugs while at work! Bizarre, right! Even if this were true, (it wasn’t) your employer wouldn’t send this as a text, and certainly not as late as after 10 pm! Swipe left! Tap delete!
Gemini is a global cryptocurrency exchange. The TDS reader who sent us this text does, in fact, do some cryptocurrency trading, he said. But he doesn’t have a Gemini account or use their services. If you read this text closely, it’s easy to see that this is a completely manipulative trick to get Gemini customers to call the scammers at 646-313-3790.
We’ve seen this before! If you ever get a text telling you that someone has paid you money, typically $1000 through Cash App, DO NOT CLICK THE LINK! No one has given you that money and this is a complete fraud.
Next we have a couple of fraud alerts that readers sent us. The first pretended to represent Chase Bank but was sent from an email address at the domain mvjathletics[.]com. The second one pretended to be from Bank of America but didn’t come from bofa.com. It came from a malicious mimic called quickview-bofa[.]net. We could go on and on with the malicious texts our readers shared with us. But for this week, it’s enough!
Until next week, surf safely!
Copyright © 2025 The Daily Scam. All rights reserved. You are receiving this email because you have subscribed to thedailyscam.com
Marblehead, MA 01945