THE NEWSLETTER | 10.22.25 | V05N37
Co-Founder/Content: Doug Fodeman | Co-Founder/Creative: David Deutsch | Scambaiter: Rob M
Approved Advertisement
Can You Tell Which of These are a Fraud?
How capable are you in figuring out online fraud? We have a quiz for you! Try to find the fraud, or just read the full Top Story to see the answers. Below are three very different businesses, each with its own website. To be safe, on Monday, October 20, we used the following three tools to check each of these websites for malware and found none: VirusTotal.com, Zulu URL Risk Analyzer, and Sucuri.net’s site check tool. (Obviously, if you choose to visit the sites below, you do so at your own risk. By participating in this quiz, you agree not to hold us responsible for any threats or issues that may arise from visiting any of these websites.) So the point of this game is simple… Can you find the fraud? To play, visit each of the three sites listed here and make your evaluation. Then return to our newsletter, click the link to visit the full story and see how you did! Good luck!
- Avis Law Firm – avislaws.com
- Alart Security Services – alartsecurityservices.com
- Rock Asset Trust Bank – rockassetstrust.com
Before we reveal which, if any of the three business websites listed above is a fraud, we want to remind our readers that we offer a fun and educational training workshop called “Can You Find the Fraud? – Are you smarter than a scammer?” We’ve given this workshop to Chambers of Commerce, businesses, schools, and non-profit organizations to help train their employees/members to better protect themselves and the companies/organizations they work for. It’s fun, game-like, and we guarantee that you’ll learn a lot! If you’re interested or have questions, contact Doug@thedailyscam.com.
[1] Avis Law Firm – avislaws.com – FRAUD!
We hope you came to the same conclusion we did regarding this supposed Canadian Attorney’s website. This fake attorney’s website came to our attention in mid-September when a woman from Washington state in the US sent us a photo (shown below) of a letter that she received from John Davis, head of this firm. If you read this letter carefully, you’ll see that what John Davis is proposing to the recipient is 100% ILLEGAL, even though he says that it is “compliant with legal standards.” That, of and by itself, should make any recipient suspicious! The woman who contacted us suspected this was a form of fraud. She also said “though they are in Ontario, the envelope was postmarked Jacksonville FL. I reported [this] to the FTC fraud division. I don’t like that it has my maiden name, and they have my home address. (We are unlisted and low/no social media footprint.) I actually messaged them via their website “contact us” function and said it was a scam.”
We also shared the following observations with the woman that we felt were serious red flag warnings about this law firm…
- The fact that this law firm is called “Avis Law” but uses a domain called avislawS.com makes it immediately suspicious to us! NO REAL business would register their domain with that discrepancy.
- Their domain, avislaws.com, was registered about 5 weeks before this woman received her letter, though they claim to be in business for 20 years!
- Six reviews on Yelp also report getting these scam letters in August and September.
- It is funny that this firm is called “Avis Law” but the Senior Partner is named “John Davis” and not Avis.
- The Ontario Law Society doesn’t show any such lawyer’s name in their location of Mississauga, Ontario.
- Neither does the Canadian Bar Association know this lawyer named John Davis.
Besides reporting this fraud to the FTC, we recommended that the woman report this fraud to both the Canadian Bar Association (cba.org) and the Law Society of Ontario ( https://lso.ca/contact-us ) and finally to the Canadian Anti-Fraud Centre (CAFC) at https://antifraudcentre-centreantifraude.ca. And remember that she expressed concern about her personal information being exposed and used in this fraud. Sadly, this is our new
normal. We informed her that there are NO USEFUL laws or regulations here in the US to help Americans protect our privacy! Period! (And it is upsetting.) As an example of our lack of privacy, Would you believe that I can literally discuss my interest out loud to purchase a new pink sweater in the same room as my TV, computer or phone (if their listening features are turned on) and within two days I’ll see ads for pink sweaters appear either in my social media feeds, or on websites I visit. (I have actually conducted this exercise with 7th grade students in an Internet Literacy class unit about privacy online. More than half of the students also reported the same results.) “Online privacy” is an oxymoron!
[2] Alart Security Services – alartsecurityservices.com – FRAUD!
This fraudulent website was fun to investigate! Let’s start with their “Employees” web page found here at http://alartsecurityservices.com/employees.html. Notice the photo of the man identified as “Napoleon Best,” the International Relations Manager. That photo is a stock photo sold on iStock.com! Or the Employee photo of “Amelia Kaya” who is incorrectly described as “Security Personal.” (We don’t want to point out the English error in case these scammers see this article!) Her REAL name is Thando Mazibuko and she works for a Bank in South Africa. (Two LInkedin accounts corroborated this as well.) And then there are the group of Security guards listed by first name. Take a close look at the Security guard named “Arnaldo” (Bank Security.) He’s actually wearing a shirt with the logo for another security business called Allied Universal Security Services, at aus.com!
Most of the photos of Security men are stock photos. For example, we.found the photo of “Adalberto,” seen here at https://www.alartsecurityservices.com/img/tm.jpg, in lots of places around the internet including this stock image from iStock. In the iStock image, he is writing a ticket for someone but he is clearly the same man described as “Adalberto! (We also found spelling errors on their website but would rather not point them out and make it easier for them to fix these obvious errors.)
And then there is their supposed New York address, which is clearly listed on their Contact page. Alart Security Services states that their Corporate Office is at #3602 E Tremond St, Bronx, New York. However, Google tells us that this is the address for a New York Assemblyman! We actually called this man’s legislative office in the Bronx and the person who answered the phone said that they never heard of any business named “Alart Security Services.” Need we say more???
Interestingly, they also list a phone number as +27 (65) 527-4215. “+27” is the country code for South Africa and 65 indicates that this is a mobile phone! Their website also claims that they are a subsidiary of “unik international diplomatic company” but Google can’t find any such company! And finally, as if the above wasn’t enough, we have some interesting observations about the domain for this business Alart Security Services. We found on their website that they also call themselves “Alert Security Services.” The obvious misspelling “alart” is classic for scammers from other countries! And we have another possible hint as to where these scammers might be located. A WHOIS lookup for alartsecurityservices.com on whois.domaintools.com shows us that though this domain was registered waaaay back in 2018, it was registered by someone in South Africa and is hosted on a server in Sri Lanka! Very interesting for a business that claims to be located in Bronx, New York!
[3] Rock Asset Trust Bank – rockassetstrust.com – Also a FRAUD!
The first tell-tale clue is the domain name itself: rockassetStrust.com If you call yourself “Rock Asset Trust Bank” why the extra S in the domain? Their domain, rockassetstrust.com, used to be listed on VirusTotal.com by two security services but, as of October 15, they are no longer listed there. No matter. There is a lot of other evidence of fraud! Like the fact that they list their address as 2 Station Road, Brundall, Norwich, Norfolk, NR13 5LA, United Kingdom. But Google tells us that this is the address for an Accounting business called Graver & Co. Also, Rock Asset Trust Bank claims to have been in business for 25 years! And yet, their domain rockassetstrust.com, was registered just four months ago on June 13, 2025!
And this bank claims to have 145 branches around the world, and another 165 ATMs. However, if you want to know where these are located, you are asked to contact them! That’s ridiculous for a real bank to say this! Speaking of contact, did we mention that they don’t provide a phone number anywhere on their website? But, quite oddly, they do have another bank name located on one of their less important webpages as “BivetFinance.” Oh, and before we forget….did you notice those three stellar reviews about this bank on their top page? Each of the three images are stock images available on Freepik, such as this one of “Robert Bob.” (Robert Bob??? Seriously? – We love scammer stupidity!)
There were many other red flags that we can identify about each of these fake businesses but you get the point. We hope you correctly identified all three of these businesses as scammer’s websites and found many of the issues we highlighted! If you are ever interested in having a fun, 1-hour workshop to teach your employees/members how to “find the fraud,” just let me know! Doug@thedailyscam.com
Approved Advertisement
Exposing Job Scams, Scammer Stupidity, & More!
We have repeatedly said that job scams have exploded across social media, email inboxes, and texts. Obviously, this type of fraud has been very lucrative for cybercriminals or they wouldn’t have increased their push to use fake jobs! Below is a recent example that appeared as a job post on a NextDoor.com community webpage. The job was posted by someone using the name “Jessie Esp” who said she was “a licensed life insurance agent from Primerica.” Here are the major red flags associated with this supposed job opportunity. First of all, Jessie posted information about this job with an American Company using an Australian service called Linktree. The link to this job post on Linktree was flagged as “phishing” by PhishTank. We visited that link and discovered little more than another link to a Google Doc. The Google Doc included some additional information about this job, plus a form to fill in your personal details. Most critically important to note is that NOTHING about this job post leads back to the company website at Primerica.com! (And below this is another job scam that may have a clue about where these scammers are located!)
Recently, David also received a job offer, via a random text, to apply for a remote position with Scripps Health. Of course, he jumped at this wonderful opportunity and had a brief text-based interview. Unsurprisingly, he was immediately hired! He then received a “welcome” email from Joey Vasquez (shown below), via a lame, misspelled domain called RecruitingSdepts.org. The email asked him to send a photo of his driver’s license back to them as proof of identity, along with a signed 2-page pdf called “Employment Offer Letter” that had been attached to the email. This offer letter was particularly interesting because the signature for the President Chris Van Gorder of Scripps did NOT match his name at all. Not even close! However, a reverse image search of that signature immediately connected us to both a Pinterest and Facebook account in India! Hmmmm….Could this be a hint about the scammers who are behind this fraud?
- https://in.pinterest.com/pin/1127377719199301317/ (The subdomain “in” refers to Pinterest in India)
- https://www.facebook.com/db.Plaban44/posts/signatureyoutubeviratkohligalinadubriturathee-jailyneojeda-carryminati-eminemtac/412423157014534/ (The Neloy Gym Centre is located in Bardowali, India.)
We can guarantee that if David had sent these scammers a copy of his driver’s license, it would be used to perpetrate other fraud, and possibly, identity theft.
We love celebrating scammer stupidity and this next fraud made us all laugh hysterically! Scambaiter Rob was recently communicating with Barrister George Conrad about a consignment box full of money that had his name on it. The good Barrister desperately needs some English lessons! And he needs to understand that there is a different meaning to the word “ship” when you substitute a t for the p!
A longtime reader sent us one of many malicious emails he gets concerning health and healthcare. He said “Another scam for cures that don’t exist. This one has been flagged as malicious by total virus. I really hate these snake oil ads. With the type 2 diabetes epidemic. These fake cures will only result in further misery and deaths for diabetic individuals. These same ads show up constantly on YouTube. The only thing that changes is the recipe… onions and vinegar one day. Then avocados and olive oil the next day.” It is a commonly used trick for cybercriminals to try to get you to click malicious links by sending emails about health-related topics! This one came from a server in Brazil to an American citizen. Of course the email begins with “this shocking video…” Cybrercriminals LOVE to say “shocking video” to generate clicks! The links all point to a malicious website called chahdia[.]online.
Deeeleeeete!
Someone made and posted a very funny short video on YouTube video about “free money” giveaway scams. It’s good advice and should put a smile on your face…. https://www.youtube.com/watch?v=P93I7SeRD8U
If you are in your teens or 20’s, or have children in this age range, the chances are pretty good that you (they) have a Discord account. (And if you don’t know what that is, think online game-playing, and ask the younger generations!) We mention this because Discord recently announced that one of their tech support companies was seriously hacked, compromising Discord data on more than 5 million Discord users. This data included usernames, email addresses, customer personal data and more. This data can be used in phishing scams and other fraud. Best to inform those with Discord accounts, in case they don’t already know! Read more about this data breach here on these articles….
Speaking of Discord, scammers are reaching out to people on Discord and asking them to “test their newly designed games.” But the games are actually disguised malware. Yikes! https://www.malwarebytes.com/blog/threat-intel/2025/10/can-you-test-my-game-fake-itch-io-pages-spread-hidden-malware-to-gamers
Last week our Top Story exposed more than 40 fake or low quality “knock-off” stores. That triggered another report from two of our readers. Please avoid the following additional bogus stores… Verdeco[.]site and Floravita[.]website! The floravita[.]website domain was registered in Iceland on 10/10/2025 through Namecheap; Scam-Detector.com rates this online store as untrustworthy. The Verdeco[.]site was registered on October 15 through Namecheap, just 2 days before this “store” was reported to us!
Apps like 1Password are becoming increasingly popular considering that most of us now have dozens of online accounts. Thus it shouldn’t surprise anyone that scammers are targeting people to get their one password for their 1password accounts! Check out…. https://www.malwarebytes.com/blog/news/2025/10/phishers-target-1password-users-with-convincing-fake-breach-alert
Increasingly, cryptocurrency ATM machines are being used almost entirely to support fraud! This fact is getting more and more attention, such as this video report on Good Morning, America. For example, their report describes how an 85-year old woman almost sent thousands of dollars to scammers through a Bitcoin ATM, until a bystander stepped in to stop her. If you see something, say something! Check out…
Another fake job scam drained a victim’s bank account!
https://consumerrescue.org/news-and-alerts/linkedin-fake-job-scam-alert-zelle/
For Victims of Fraud:
Scam Alert is an international victim reporting and intelligence platform. It gently guides scam victims through a detailed process to record essential evidence such as crypto wallet addresses, transaction hashes, and scam websites. Reports are enhanced with blockchain analytics to uncover typologies, link cases, and map criminal networks. Victims receive a report for submission to their local authorities, while Scam Alert works directly with LEAs, WASPs, and exchanges to ensure intelligence is delivered in a digestible format. With victim consent, Scam Alert even provides follow-up updates if there is further related activity and information that could benefit the victim, such as asset seizure by authorities. This service is free-to-use for scam victims, so feel free to share this with your newsletter subscribers! https://scam-alert.io/
Apple iPhone Purchase, iCloud Account to be Deleted & Coinbase Purchase
Oh NO! Your iCloud account will be deleted today “due to lack complete verification.” Now there’s some all goodly English grammar! This rotten phishing fraud actually came from a fashion-shop website called attireappco[.]com. No doubt, it was hacked and used to send this phish. But most importantly, we want our readers to look at the link that you’ll be sent to if you click the button to “Complete Verification.” That long crazy link is a marketing link tied to a redirect. Your final destination is a well-known phishing website at hwy82how[.]com.
Deeeeleeeeete!
https://safebrowsing.google.com/safebrowsing/report_phish/
According to Google’s AI, the US based Coinbase cryptocurrency exchange is very popular, with over 100 million members! It’s no wonder then that we’ve been seeing lots of scam emails and texts (see below) that pretend to be about your coinbase purchases or login attempts to your account. The phishing fraud below came from a free Gmail account with a name that doesn’t match the name before it. Of course, if you didn’t make this purchase, you’re asked to call the scammers at 818-453-1878. Don’t do that UNLESS you have your airhorn can ready and wearing your noise cancelling headphones! Remember to report your smelly phish to us and Google! https://safebrowsing.google.com/safebrowsing/report_phish/
Student Loan Forgiveness & Claim Your $100!
What could be better than free money!? Imagine how excited I was when Bartahroch Atiya told me that the “Student-Loan-Debt-Department” was trying to contact me because I was eligible for a student loan forgiveness program under new 2025 guidelines! But wait… Oh yeah, I don’t have any student loans! This scam email is hysterical, especially if you reach the junk that was hidden at the bottom after scrolling past a long blank section of nothing-ness. If you can find LOTS of blank white space at the end of an email, you know it’s a fraud!
Patricia Cervantes sent an email to one of our longtime readers to inform him that he had a $100 bonus coming to him for heat guns! Heat guns? Hmmmm….her email came from a free, popular email service in Bulgaria called ABV. But the link to activate that bonus pointed to a completely unrecognizable brand called onlypage[.]click. No surprise that this domain is malicious and was registered a few months ago in March.
Delete!
Weaponizing American Politics, USPS Delivery Problem & Incoming Failed Messages
For years, cybercriminals have weaponized American politics. So it is no surprise when one of our readers shared this malicious clickbait with us. Supposedly, RFK Jr was about to drop a BOMBSHELL, making liberals FURIOUS, and this was just the beginning! But it is all just a trick using politics to manipulate YOU into clicking a very malicious link! The shortened links in this email will redirect you to a website called servercodeinfo[.]com. We’re certain that it holds NO information about RFK but, more likely, holds malware lying in wait, like a bear trap! Lunge for the delete key!
Since when does the US Postal Service have offices in Tanzania? This email came from a top star website in Tanzania, claiming to be an “Urgent Notification” about your delivery. What was most funny about this fraud was the fact that the graphic for the US Postal Service was actually HUGE! We had to shrink it down to the size below just to get it all to display in a reasonably sized screen! This long email contained a single link at the bottom pointing to gulfmedicaltourism[.]com which contained a redirect to a malicious website at sidesteamroll[.]com! Does any of this sound like usps.com to you?
Delete!
According to the email below, we’re having trouble with our email server at TDS. Apparently, our email system is in jeopardy because the email below says that we have three emails that were sent to jeopardy@thedailyscam.com but cannot be delivered! One of them is an invoice from August, while another is a contract agreement! Oh dear! But wait, we don’t use a construction and agricultural machine company in Poland, which is the owner of the server that sent the email: interhandler[.]pl. If we were to click “RESOLVE MESSAGES” at the bottom of this email, it would send us to a website in Iran called TehransHiring[.]com! No thanks, we’re not looking for work in Iran! And we certainly don’t want the malware lying in wait for us there, either.
Texts from the Philippines, South Africa & Morocco, and Coinbase Fraud!
When a text arrives from a phone number that begins with a plus sign (+), you know that those first numbers next to the plus sign are an International Calling Code. Why would Patricia from Miramax, an American film/TV production company based in California, send a text to a US citizen at 4:00 AM EST from the Philippines about a job opportunity? (“+63” International calling code.) Because Patricia is a scammer!
And why would Layla, from the Kroger Recruiting Team send her text from a phone number in South Africa? (“+27” International calling code.) Plus, her job offer is too good to be true! Base pay of $1000 for 4 days of work?! Because Layla is a scammer!
And why would Debra, a recruiter from Kelly Services in the US, send her text from Morocco?! WOW! Earn $950 for 4 days of work?! Amazing! Too bad Debra is also a scammer! Report and block all these scam texts please!
And finally, as promised, lots of readers have reported receiving scam texts related to their Coinbase cryptocurrency exchange accounts! Of course most of the recipients of these texts don’t have a Coinbase account so it’s easy to see through this fraud. Below are three examples…
Until next week, surf safely!
Copyright © 2025 The Daily Scam. All rights reserved. You are receiving this email because you have subscribed to thedailyscam.com
Marblehead, MA 01945