Free Piano Giveaway!

Scammers can be so clever and so stupid at the same time! On August 5, we received an email at The Daily Scam from a woman identifying herself at Gina Fogle and using the email address harrisonvr3131985@gmail.com. Gina told us “I’m offering my late husband’s Yamaha Piano to any music enthusiast who may appreciate it. If you or someone you know might be interested in receiving this instrument for free, please feel free to reach out to me.”  We would love to comment on how remarkably kind this seemed but our cyberfraud spidey-senses started tingling wildly and wouldn’t go away! And yet, would a scammer, disguised as Gina Fogle, REALLY contact anti-fraud experts to give away a piano if she was truly a fraud?  Nawwwwww. So of course I responded. A few days later my email said “Hi Gina, I’m a music teacher at a school and we would love, love, love that piano!  Is it still available? Thanks, Doug” Can you guess which path this went down? Can you predict the outcome! Lovely and generous woman on the one hand, or sleezy fraudster on the other hand? One of these is the correct characterization! And we tricked someone involved to click a tracking link!

A critically important “Tell” indicating that you are engaging with a scammer who runs certain kinds of fraud is to look at the “reply-to” email address before responding. If your email reply is automatically going to be sent to a different email address than where the email came FROM, then the odds are extremely high you are communicating with a scammer! Gina’s email came from harrisonvr3131985@gmail.com but my reply was automated to go to ginafogle@outlook.com. (Also, notice that her name doesn’t really match the name in front of the @ symbol of the first email address!) Hmmmmm…. But how could I resist? Her piano was in impeccable condition and recently tuned! And Gina told me that she was moving to France. Her husband would have wanted her to give it away to someone deserving. Awwwwwww! That’s so nice and I felt that I deserved it! The free piano is already being stored at the movers, located in Little Rock, Arkansas….

OK. Here’s a big reveal that some of our longtime readers may remember. We exposed this exact same fraud back in January (Top Story) and again in February (The Week in Review) of this year! In fact, the initial emails we received back then were IDENTICAL to Gina’s email in early August. They even included the same exact photos shown above! But we couldn’t resist our anti-scam impulse to reply! I said “Wow! Thank you so much Gina. Yes, I’ll check with your movers to see what they charge. Please send me their contact information and website. Thanks again and best wishes.”  What we were most interested to discover was the domain name and website of the new fake shipping business! And “Gina Fogle” sent me this sweet reply in which she also asked me to send her photos or a video of my excitement when the shippers show up with my new free piano!

If it isn’t already crystal clear, Gina’s fictional story makes money for these scammers once I agree to pay for the shipment of the piano and send them my payment in advance! Their bogus shipping business is called Metroleads Logistics Freight Forwarding and uses the domain metroleadslogisticsfreight.com. They also use this Outlook email address: metroleadslogistics@outlook.com.  This fake shipping company claims to have been established in 2009 and in business for more than ten years. And yet, it’s domain wasn’t registered until March 15 of this year! Even the Zulu URL Risk Analyzer found this bogus shipping company very likely to be malicious!

The Metroleads Logistics Freight Forwarding business lists their phone number as 870-200-9910 and their address as 12 Shackleford Ridge Road, Little Rock, AR 72204. It doesn’t take a rocket scientist to search for this information and discover that this phone number has been reported twice to the Better Business Bureau scam tracker site as a scam used in the giveaway of a free piano. (Be careful when you search for phone numbers! Many links that return are malicious!) Also, a search in Google for this business address shows us a practically empty lot, along with a couple of trucks that have a different business name on them. Google says that the business located there is called Contact Blue Truck Moving Company, not Metroleads Logistics Freight! What is also notable is that the two people who reported this fraud on the BBB website (Feb. 28, 2024 and March 5, 2024) both referred to a fake shipping business called Metrolight Logistic Freight using the slightly different domain metrolitelogisticfreight.com! And of course, the names used by the fraudsters in their emails have changed too. 

The fact that other people have reported this type of fraud this year, plus our own several reports about this fraud in the last 8 months, tells us that this scam has been very lucrative for these scammers. They will likely continue to run it and steal people’s money as long as they can get away with it! But how is this possible? How can they continue to perpetrate this fraud, over and over, and with impunity?! We suspect the reason is that these scammers are not located in the United States, the European Union or Australia. We decided to try to scam the scammers and trick them into revealing their exact location to us!

I sent an email to info@metroleadslogisticsfreight.com saying….

Dear Metroleads,

Gina Fogle referred me to you with the Reference Code: RS4022091. She has offered her piano to me (for our school) and said that you are the moving company that has it in storage.  Please tell me how much it will cost to ship it to Beverly, Massachusetts?

I can then inform our school’s administration and give you a specific address if they approve the shipping fee.

Here is their reply….

(Christopher McAstocker ??? Seriously?) I then told Christopher that our school would like to choose the least expensive, 28 day shipping cost of $1480. I added that our business office would cut a check and have it sent via 3-day fast mail to their address at Shackleford Ridge Road in Arkansas.  This was his response…. “we regret to inform you that we do not process check payment. However, you can still proceed with your payment using either bank transfer or Zelle.” This is, of course, a serious red flag! I said that I would bring that information back to our business office at school and hope they would be able to comply. I asked for the account information to make our payment and Christopher sent me this…

Accountant Bank Transfer Payment Details:

• Bank Name: US Bank

• Beneficiary/Accountant Name: Brittny Ramirez

• Account #: 157544092768

• Routing #: 122235821

• Bank address:  78-435 HWY 111  La Quinta CA, 92253

Christopher McAstocker also asked me to provide him with a copy of the payment receipt as soon as we made the payment. I am 100% certain that this scammer wanted to immediately know when the payment was made so that he could move that payment out via an untraceable method to another external account! The faster he can move it, the harder it would be for me to recover my funds. 

A day later Christopher sent another email asking if we had made the payment yet. I replied, saying that our business office had tried to make the payment but it didn’t work. I included a link to a screenshot of the error they received when they tried to make payment to Brittny Ramirez’s account. But, in fact, the link was a tracking link that would show me the general location of the person who clicked it. It turns out that Christopher McAstocker first tried clicking my link four times in less than a minute while connected to a VPN (Virtual Private Network) service located in Miami, Florida. But his click didn’t display anything to him (by my design).  So, he logged out of his VPN service and 30 seconds later again clicked the link I sent him. His click showed me that he was really located in downtown Lagos, Nigeria!

A few minutes later I got this email from Christopher…. “It seems there was no picture attached to the email you sent, and the link you provided didn’t display any picture when I clicked on it. Could you please resend the image directly as an attachment? That way, I can better understand the issue and help you resolve it so we can proceed with the payment.” I replied to his email to say that I would try to figure out why it didn’t work and get back to him. In the meantime, I said, could he please recommend one of two nice restaurants located in his Lagos neighborhood. I included their names. Unfortunately, I never got a reply to my question. Oh well.  The  lesson here is if it seems too good to be true (free piano), it is!

[NOTE: This scam was also reported to the University of California Phish Bowl last February!]

Did you know it is remarkably easy to look up people’s names, addresses, phone numbers and other personal details through online data brokers?  And when we checked last week, it appears that there are more than 200 online data brokers in the U.S., and thousands around the world! On August 8, Consumer Reports published an outstanding article about the effectiveness of “data removal services.” You might be surprised at the results. We were! However, please note that the researchers who conducted this study acknowledge using a very small sample size and other limitations. We can also confirm some of the results reported in this article…

• Deleted profiles can sometimes reappear months later on the same data broker’s site

• After opting out to have your data removed from a data broker, it may take weeks before your data disappears

• It is more effective to opt out manually yourself. HOWEVER, it will require hours and hours of work to locate all the data brokers and do this yourself. (We tried this last year.) Also, the data broker landscape frequently changes and new data brokers popup every few weeks or months

Though it is important for people to monitor and try to reduce the amount of personal information found online about them, it is also nearly impossible, especially as it appears on the “dark web” as a result of hacked services. We think that legitimate companies sometimes elevate these concerns in somewhat sleazy ways in order to generate income for the company. Here’s a perfect example of what we mean. We learned last week that a 90 year old woman was on the Internet when her PC showed this Norton Popup. Supposing for a moment that this was a legitimate popup generated by her Norton software (assuming she had Norton software installed), this popup creates anxiety and concern, making it more likely to lead to a sale for Norton. Not cool! Instead, why not email the owner’s account directly with their advertising pitch and tell people that you’ll be doing this a few times each year? Keep in mind that popups like this are OFTEN a method used by scammer’s to manipulate your behavior and leading people into being victimized.

We hope readers see that we try our best to stay politically neutral in our effort to educate the public about online and phone fraud. However, we will always expose fraud, regardless of the political party or candidate who engaged in it. Last week, many news services reported that former President, Donald Trump, posted images showing that Taylor Swift and her “Swifties” were supporting his candidacy for the upcoming U.S. election. These images were found to be AI generated, and there has not been any official endorsement of him by Ms. Swift. We find this fake endorsement another sad example of the unacceptable use of AI to perpetrate lies. Coming directly from a former President of the United States is egregious. You can read about this on Business Insider, CNN, USA Today, Wired Magazine, and many other sources.  According to a short video post by a CNN Reporter, there are already more than 550 fake claims posted on social media about this year’s election. (He doesn’t list them, only mentions the number of them.) We strongly urge readers to be extremely wary of any election-related news that appears on Social Media because it is simply too easy to lie in these platforms. Also, while your own particular point of view may lead you to distrust certain news organizations, MediaBiasFactCheck.com is an excellent site for revealing bias in news articles and sites.

We have a warning to pass on to our readers. We’ve recently learned that local scammers are putting fake parking tickets on people’s cars, generally in big cities. (Apparently this fraud was reported as far back as 2017, but it is making a resurgence.) These fake tickets often have a QR code that you are asked to scan and then make a payment online. REAL city/township parking tickets will never use a QR code! This recent short Youtube video from WBIR Channel 10 news from Knoxville, Tennessee does a nice job explaining this fraud. Here is another perspective about these same scams from CBS News in New York that arrive on your phone via a text.

Last week we shared with our readers a victim’s story about a romance scammer disguised as a man named Richard Dietrich. This romance scammer has opened a new account on the dating app Plenty of Fish (POF) and continues to use stolen photos from a Russian Engineer named Andrej Kanyuk. We have added several more photos used by this scammer to our feature article about this fraud.  

Below is a link to a shocking article worth reading. What this US Banker did is ilegal, dangerous and egregious! He destroyed people’s lives trying to enrich himself. In fact, he, himself was a victim of a pig butchering scam and it landed him in jail for decades!

https://www.aol.com/news/cryptocurrency-pig-butchering-scam-wrecks-202959513.html

Remember to check out our monthly podcast series: https://www.securewon.com/resources/podcasts/

Mandatory Safety Audit, Hi Wizard, & PC Doctors

Our friend and professional scambaiter, Rob, sent us this very unusual phishing fraud last week. It claims to offer you a “self-employed tax refund” of up to $32,200! But this fraud came from a hacked and misused website called EcoEasyContest[.]com. More importantly, clicking the link back to this website will cause you to be forwarded to a nasty phishing site called GigWorker[.]claims. This domain was registered about 3 months ago and already has a very low trust score from Scamadviser! Don’t believe the bogus reviews in this phishing scam email!

Buckeye Broadband is a cable company located in the state of Ohio. One of our longtime readers from there sent us this phishing scam that targeted him. The lesson here is crystal clear. It doesn’t matter where in the world you live, or how large or small the company is that provides you with email and internet services. Scammers WILL target you while pretending to be your service provider! In this case, this phishing email came FROM a real account at buckeye-express.com and was sent TO a buckeyebroadband.com email address. This was all done to make this email appear to be legitimate! The victim was “BCC’d” as others were likely BCC’d as well, so their emails are not seen. The link to log into your “Buckeye Broadband” account actually points to a phishing page on the free website service called Weebly.  It is OFTEN misused by scammers! Deeeeleeeeete!

Why is Google soooooo bad at stopping this type of phishing fraud?  It doesn’t take a programming genius to identify these types of scam emails! And scammers send these phishing emails out by the thousands every week! Are you listening Google? DO A BETTER JOB OF STOPPING THESE THREATS!

Remember to report your smelly phish to us and Google!

https://safebrowsing.google.com/safebrowsing/report_phish/

Warby Parker Frames & Enroll in a Clinical Study

Yes, Warby Parker makes some cool eyeglass frames. But when an email promoting five free Warby Parker frames comes from the domain LifeCare-Insurance[.]org, there’s a problem! And then when you spot a HUGE red flag showing that the link to get your free frames points to a different website called HerbalHairCareSupport[.]com, it’s time to LUNGE for the delete key! And then pat yourself on the back for  dodging a digital bullet!

We want to remind our readers of the importance of recognizing 2-letter country codes. Check out this email offer to be compensated up to $3000 by joining a clinical study presumably offered by the company Rxtra Clinical. But that company’s domain is rxtraclinical.com and NOT urbanbvse[.]de.  Do you know what the DOT-de means?  It stands for Deutschland (Germany) and is a 2-letter country code! That immediately means that this email sent to US Citizens is a fraud! Delete!

Your Spouse Has Been Kidnapped & Invoice Will Send You to Malware!

Last week we saw this frightening post on Reddit.com. A spouse received a scary call that no one ever expects to get in their lifetime!  The caller claimed to have kidnapped her husband and was extorting money from the wife in order for her to get her husband back alive! The call appeared to the wife as though it came from her husband’s phone number and profile photo, hence supporting the scam that the caller HAD her husband in his custody. How, the man asked, was this possible for the scammer to call using his number and profile pic? This is called “caller ID spoofing” and is easy for scammer’s to do! ​​(See FCC description of Caller ID Spoofing.) There are even apps that make it easy to spoof a caller ID! (They should be illegal in every country!) And, with the ease by which cybercriminals can look up your phone numbers, your relatives (and their numbers) and then capture your profile photos online, this fraud is a piece of cake to set up. There are several things that our government can and should do to make fraud like this harder to perpetrate….

1. Make caller ID spoofing apps illegal; demand that phone services do more to prevent this fraud
2. Create better data privacy protection laws in the US (and other countries) so that people can OPT-OUT to have their personal data removed from ALL data brokers! And if their personal data can still be found on these data broker websites, then make it easy to prosecute them or sue these companies!

This invoice appears to have come from an email service in Canada (“.ca”) The business that received it doesn’t do business with anyone in Canada, let alone the name of the sender.  The recipient immediately recognized the attached file as a threat because it ended in DOT-html! We safely downloaded that html file and carefully cracked it open to inspect it (while wearing hazmat suits.)  It contained only 4 lines of code. The code showed us quite clearly that it was designed to send the recipient’s browser to a website in Argentina where nasty instructions were waiting to cause harm to his device! Delete! 

Package Deliveries Delayed

Below are two more examples of malicious clickbait that were sent as texts to people’s phones. Both pretended to be about problems with a package delivery. The first pretended to be from the package delivery service in the UK called EVRI, while the second was disguised as a text from the United States Postal Service. Both are malicious and neither one of them points to the service they claim to represent!  These types of clickbait are still popular with scammers because they are effective! Look before you click!

Until next week, surf safely!

Copyright © 2024 The Daily Scam. All rights reserved.
You are receiving this email because you have subscribed to thedailyscam.com

Marblehead, MA 01945

Contact Webmaster