Approved Advertisement

The scammy domains in the above fraud are easy to spot! But what about when scammers register malicious mimics that are meant to resemble legitimate domains or represent the purpose of a legitimate domain? As stated above, the REAL domain for the US Social Security Administration is ssa.gov. But what about ssa[.]mysocialsecurityupdatealert[.]com? In this malicious mimic, “ssa” is a subdomain, separated from the FQDN by a period, and is worthless. Anyone who owns a domain can create whatever subdomain they want. The actual domain used in the email below is MySocialSecurityUpdateAlert[.]com. DOT-com is called a global top level domain (gtld) and the US Government will rarely use DOT-com for any of it’s websites! (Note: two important exceptions are usps.com for the US Postal Service and govdelivery.com. The USPS is an independent government agency. It operates as a self-funded, business-like entity, making “.com” more suitable for its retail services. Govdelivery.com is a digital communications platform designed specifically for government agencies and public sector organizations. Typically, links pointing to govdelivery.com will then redirect you to either a DOT-gov official US government website or a US State owned website.) It also turns out that mysocialsecurityupdatealert[.]com was registered less than a month ago in the European Union, making this domain an obvious fraud! However, making this fraud more difficult to spot is the fact that the link to “View Your Secure Message” points to a tracking service at AWS (Amazon Web Services). But this link also shows a redirect buried in it! The redirect points to another malicious mimic website called ssaccesspoint[.]com. This website was also registered less than a month ago in the European Union!

In our third example below, the email claims to represent the US Social Security Administration and was sent from a quasi-official domain mimic called StatementsDocuDownloads[.]com. This domain was also just registered a few weeks ago, on January 19. But much more importantly is the fact that the link to “View Statement” points to an executable Windows file named “SSA_2025_Documents.” This is likely very dangerous to click!

Below is a screenshot of the pdf file that was attached to the email above. Notice that it doesn’t provide you with any additional information whatsoever. It simply claims to offer another clickable button to download your file. Again, the link to “View Document” points to the same malicious executable file!  The REAL US Social Security Agency will NEVER, EVER send you an executable file! It is essentially a file that will run or install a program on a Windows computer!

International cybercriminals heavily target American citizens during tax season, and disguised as social security account information, because it is highly profitable! For example, it was recently reported that the FBI shut down three call-centers in India who had pretended to be the US Social Security Administration. They targeted Americans and are alleged to have stolen at least $50 MILLION dollars! (Source: AOL Finance forum.) With tax season upon us, and with more than 75 Million Americans currently using social security benefits (Source: Monthly stats at ssa.gov), we have a huge red target on our backs! International cybercriminals are taking aim! Please consider sharing this article with friends and family to help raise their awareness.

Approved Advertisement

By the way, the website for Wallet Living claims that their address is at Trafford Park in Stretford, Manchester UK. This is actually the address of a large shopping mall and the mall’s business directory doesn’t list any business called Wallet Living at all! (NOTE: Many websites report that Wallet Living DOT com is legitimate. We believe that it is NOT! For example, it has also been reported as phishing fraud on StopScamFraud.com.)

Rob also received another bizarre email invitation to join a Google Classroom from someone named Maximillion Nelson. But this wasn’t just any classroom! It was a class where “one spin can change your life.” Yeah, right, because we all know that legitimate casinos use Google Classroom to send out invitations. Oh, and did we mention that multiple security services found the link to this Google classroom to be malicious?

Rather concerning, one of our readers reported to us that he’s been heavily targeted for a few weeks by dangerous emails that appear to come from people he has known for many years. However, each name uses an unfamiliar email address! Nearly all of these very malicious emails claim to be about photos, pics, and images. These emails always provide a link to click to view these photos. On February 10 alone, he received 6 of these very malicious clickbait! Remember, just because you see the name of a friend or relative in the text field, it doesn’t mean that they sent it! Always look at the sender’s email address and be very wary about clicking a link just to see photos! Most people would simply drop the photos into the body of the email rather than providing a link!

We have a few fun, short scam calls to share with you from Rob. In each, his Old-Man-Bot is showing serious signs of aging! Actually, he may be getting a bit nutty. Sometimes it throws the scammers off, including in the last recorded call below. The caller mimics the Bot in unkind ways and then finally hangs up. Honestly, we have no idea what his scam call was about but WOW, this guy is NOT empathetic at all! Oh yeah, he’s a scammer! Duh! Let’s start with a call from Harry about auto insurance…

Next we have three quick combined phone messages from different people with questions about a loan. The first is from Melissa representing the “National Loan Review Center.” This type of scam call has been reported many times, including here on Nomorobo.com and here on Robokiller.com. The other callers sound awfully similar but claim to be from Lisa and Rachel. Each call is a short message…

This next call is from Mike, representing the Firefighters and EMS Fund. Apparently, this organization appears to be a real registered 527 political nonprofit organization, but it is NOT a non-profit charity fundraising organization. We found several credible sources online calling this organization’s fund-raising practices scam-like, such as this article from the Ironton, Ohio Tribune and this article from the Oklahoma Channel 4 News.)

Finally, we have this wonderful recording to share with you. Honestly, we don’t know what to call it or who the fellow claims to represent, but it will certainly give you an idea what an A-hole some of these people are!

At about 9 pm on March 4, David received three phone calls in quick sequence from three different phone numbers. Two of these calls left the same identical voice message… “Detected a recent attempt to create a new account using this phone number. If you did not authorize this action, please press one now to secure your account.” These voice messages came from 844-414-5566 and 888-999-6514. The fact that the same message was delivered from 2 completely different phone numbers (and possibly a third), tells you that these calls were a form of fraud! Also, what new account? With what service? Beware!

We have a bit of good news to report to readers. In late February, New York Police arrested a scammer who was trying to con a 66-year old woman out of about $22,000! Check out: https://dailyvoice.com/ny/oceanside/changxuan-liu-charged-in-22k-apple-scam-attempt/

Also, according to this report from the Risky Bulletin Newsletter, Cambodian authorities are promising to dismantle the major cybercriminal scam compounds in Cambodia by April. These compounds have enslaved thousands of people and are used to defraud millions of others around the world. Progress has been made, but is it just a way for the Cambodian government to deflect attention away from what they won’t do, or that they will allow other scam compounds to pop up elsewhere? TBD… 

https://risky.biz/risky-bulletin-cambodia-promises-to-dismantle-scam-networks-by-april/

Here’s another win to celebrate. Back in late January, 2025, we reported a story about a victim who lost nearly $7000 to scammers in a “missed jury duty violation” fraud. The victim paid these supposed violations via cryptocurrency kiosks found at a gas station and convenient store. A few weeks ago, the Massachusetts Attorney General filed a lawsuit against Bitcoin, the owner/operator of these kiosks for several reasons, including the fact that their kiosks are heavily used to facilitate fraud! We hope other states follow suit (literally)… https://www.mass.gov/news/ag-campbell-sues-bitcoin-kiosk-operator-for-facilitating-crypto-scams-against-massachusetts-consumers

Google has been getting a lot of negative attention lately. This isn’t surprising, given how it’s tools are so universally used and abused! In mid-February, it was reported by Malwarebytes that Chrome issued an update for a very serious coding flaw that allowed cybercriminals to implement malware infections through it! Yikes! Please be sure that your version of Chrome is up to date!  https://www.malwarebytes.com/blog/news/2026/02/update-chrome-now-zero-day-bug-allows-code-execution-via-malicious-webpages

Also, according to this article on Tech Radar, cybercriminals are using a phishing domain called google-prism[.]com to trick people to hand over their Google account information and more. Check it out… https://www.techradar.com/pro/security/this-new-phishing-campaign-uses-a-fake-google-account-security-page-to-steal-passcodes-and-more

We’ve all been hearing about the explosive growth, use and abuse of AI around the world. Our government refuses to require AI-creation companies to put critically important guardrails in place to protect Americans. We mention this because AI tools are increasingly used to easily build fake websites targeting Americans, according to this article… https://www.marketplace.org/episode/2026/02/23/ai-makes-it-easier-to-code-websites-including-ones-that-scam-consumers

Congratulations! You have a unique opportunity to be scammed! This supposed Costco email is not an advertisement. It’s a fraud that came from gwus[.]org and has links that misuse Amazon’s AWS services, again! Does any of that sound like Costco to you? Also, can we just point out that this offer is for “up to $100 cash” value. AND YET, they displayed some items that cost a LOT MORE than $100, such as that Samsung Galaxy Z Fold phone! (Estimated cost is many hundreds to about $2000, depending on the model.) So no, this offer’s presentation did not make sense, unless it’s a fraud!