Scam Baiting with Jim Browning

most of us have received that call from someone claiming to be from microsoft tech support saying that there's an issue with our computer that they want to help us resolve this scam has evolved and become so sophisticated and so refined that it's become big business in and of itself today's guest is jim browning jim can't stand scammers so he's doing something about it jim has been baiting investigating and exposing scammers on his youtube channel for over five years his channel now has over 2.3 million subscribers and many of his videos showing how these scams work have been watched millions of times i'm your host chris parker and this is the easy pray podcast jim thank you for coming on the easy pray podcast today yeah thank you chris thanks for having me can you give me a little background on what tech support scams are well i think most people will recognize the tech support scam by a cold call they usually phone you up and claim that they're your internet service provider or their amazon or they have some excuse to basically get you to turn on your computer and get you to do stuff so yeah the way that you recognize one of these is there's a computer involved in there somewhere so it's that they're wanting to connect to your computer by and large i mean ultimately they're after money as pretty much all scammers are and their way of getting money from you is to get you to follow a few instructions on your computer inevitably they will want remote access to your computer although they're not always tell you that they will dress it up in some way typically they'll say for example we're giving you a refund of some kind but the way that you get your refund is you need to follow a few instructions they'll get you to type stuff out and what you're really doing is giving them direct access to your computer sometimes they'll tell you that they're getting that access most of the time they want to oh that's really interesting all the like when i think of the tech support scams that i've gotten um usually it has always been a cold call but it's been like hey we're calling from microsoft and uh your windows computer has been compromised and is being used to spend spam and we want to help you resolve it or it's participating in a botnet or something like that and i'm usually like oh yeah tell me more which computer this is if the is it oh it's you know they start telling a story and then i'm like well that's it's interesting because i don't have a windows computer yeah that's it and i think the way to put them off is usually sorry i don't have a computer although these days they're quite happy for example to say well do you use your mobile phone your cell phone or your ipad or whatever and they'll still get you to run a few instructions there to give you remote access to that device as well so it doesn't have to be a computer or laptop it could be any device and as you say that's the classic tech support scam where microsoft or we're your internet service provider and you've got a problem of some kind but these days they kind of have variants of that so they will ultimately want that remote access but they will pretend to be your credit card company or the most likely one particularly in the last number of months is we're amazon we're amazon prime and we've noticed something suspicious on your account but again the crux of the scam is exactly the same they want access to your computer they'll want you to log into your online bank account and when you do that then manipulate things so that it looks as if they've either put in money or they'll actually transfer money from one of your own accounts into your current account and say look we've given you some money here but hey we're going to want it back oh kind of the the verific we're just verifying that this is a legitimate account that type of thing yeah well they usually promise some sort of refund no if it's amazon prime they will dress this up in a way to say it looks like you've been charged 80 or whatever amazon prime and of course most people will say well hey i don't want to pay for that or you've got this wrong there's some sort of mistake and their script will tell them to run through the normal stuff get you to log into your computer check this out by following their instructions they get the remote access and then they'll say can you just check your bank account there just to make sure it's it all looks okay and as soon as you do that all of a sudden your screen will go black and when it goes black they can see your screen but you can't and they will manipulate your screen and particularly the amount of credit that you have in your account so that it looks as if they've put money in there or even taken money out but the long and short of the scam is that if you think that they've actually put money in when they shouldn't have they will then kindly ask you to return that money because their job might be on the line if you don't do so and most people looking at their bank account if they think it's genuine will say well if you never intended to give me that money i'll certainly return it but of course if you do that it will be at your own expense it will be your own money which you're returning yeah and they put in well they didn't put in money they gave the appearance that they put in money and they they actually when the screen is black they will literally edit the screen to make it look as if money has gone in or as to say that the common one is they'll actually even probably have a couple of different bank accounts maybe with within the one bank and if your savings had a few thousand dollars say they will transfer money from it into your say into your current account and then they will say well actually that's the money we've put in now we want it back so you lose your own savings now that's particularly scary so was there a particular uh event that happened in your life that got you interested in dealing with this or was it just uh by chance really just by chance i never really intended to be a youtuber of a couple of million subscribers on youtube at this stage uh but i never really that that's not my day job at all i have a a proper job in it and i certainly never intended to really get into this sort of area at all the only reason why i did was like most people i get lots of these cold calls um because i'm an engineer at heart i really thought is there something i can do about these is there some way to report these calls exactly again i'm probably curious i want to see how their scam works i want to know the ins and outs of what they actually do so i literally one day allowed the phone call to to ring i answered it and i just went with what they were asking me to do and i recorded it so it really could warn other people and naively originally thought that look if i put this on to say youtube and point their internet service provider to this material maybe their service provider will throw them off the network or maybe the police will get involved but unfortunately i was very wrong about that it's very difficult as it turns out to actually do something about these people are typically in a foreign country more often than not india and even if you have very detailed information about these guys you're running the scams it's very difficult in practice to get anyone to do anything about them yeah that's the unfortunate one thing i've uh one common thing i found out about most scams is that it's it's gonna be next to if not impossible to either get your money back or get the people in trouble yeah i mean i've i've actually gone as far as being able to get the names addresses locations blood groups of the people who are running the scams and i've reported that the relevant authorities and until very recently there's really been very little or no action at all in the country where they originate now that might be changing uh very recently there's something called the cbi which is the i guess the indian equivalent of the fbi have recently carried out a number of raids and some of the very big players and certainly some of that information has come from me and other youtubers so we might be able to maybe get to a point where even if you do present that evidence it might be used in the future i'm kind of crossing my fingers for that one so so you say some you know some of these big players have been uh rated how large are these operations we're talking just a couple of people in a in a home or is this like a full-fledged call center with hundreds of people working at it well the ones that have recently been rated are definitely the biggest players i mean the people who run the scams can be anything from three or four people right through to i was able to get information on one of the organizations which employed 300 people over three or four i think it was three or four floors in one call center and they were making the order of 1.8 million dollars per month running a scam you know it's upwards of 10 million dollars a year wow running just pure scams and and it was multinational as well they actually taught their um the scammers to speak foreign languages so that they could run the scams in as varied languages as english spanish even japanese wow that's that's amazing you know because i've always personally kind of wondered at least with the the more traditional like hey i'm calling from microsoft uh and we're gonna charge you sixty dollars to fix your computer do you think like all the employees know that they're participating in a scam or there's some of these that maybe they're not as apparent to even the employees that it's a scam well for sure at the very start it may not be apparent in fact i know for sure that they recruit graduates and they will not generally advertise that they are a scam company and it may take well i would say days or weeks possibly for some to figure it out so you can't blame the people here in their very short amount of time but it doesn't take that long to figure this out and some of them are even blatant enough to advertise the type of thing that they do and they'll disguise it in kind of colloquial terms they will say things like we are a pop-up business or and that simply means that we're going to put adverts on people's computers which maliciously compromise them and force them to call what they think is microsoft so they will they will have their own little localisms for describing what the scams really are and most people who are applying for those sort of jobs in general will know what they're getting into gotcha so is there like i i've watched a couple of the videos and you've you've gotten some crazy amount of detail on some of these operations how did you go about doing that and what are one of the stories behind it well i mean um at the very basis of this i'm an engineer and i'm a curious engineer as well so i have enough computer knowledge i guess to allow me to do a little bit more than average i guess i deliberately let the scammers connect to my computer but it's set up in a way that when they get access to me i can if you like reverse that connection and get access to their computers and chances are if they have a lot of files lying around their computers a lot of them have things like id cards sitting around there i can see who it is that they are and there's even been examples of where the scammers run their own cctv their circuit television so they were actually filming their own offices and i could see this that they were gaining access to a server which had all that tv footage so i was able to see what they were seeing and i was also able to effectively watch them as they were running their scams and it sounds incredible that anyone would have cctv of a scam operation but that's exactly what they were doing so there is an example on the internet where i was able to literally call one of these scammers and as he was answering the phone to me i could see him and watch him on his own cctv answering my call and i kind of combined that with they also recorded the audio of every single phone call that they made and again because it was internet accessible i was able to not only see them but hear examples of other people who had been scammed as well and there's a documentary went out on a bbc panorama program where i was able to actually get footage of other people being scammed as well by putting together the cctv with the audio recordings as well so i had a very very clear evidence that this particular call center were engaged in scamming and they actually had a very they thought their scams through very well they had a a good front to their organization they set themselves up as a travel agency and to the outside world they were taking calls about um you know you want to change your flight or whatever but the fact behind all of that was this scam operation so pretty sophisticated stuff yeah that's that that seems pretty uh strange to me that they would retain their own internal camera footage and they would retain their own call logs and yeah they're called recordings the call recordings were there because they they do the scamming in a very professional way they will actually review their agent's techniques you don't know honestly if you don't for example pull in enough money they will go back through those call recordings and say well here you could have done this a little bit better it's like any legitimate organization they will try and make their agents perform as best they can so they make lots and lots of money but it's honestly that is the reason why they record the calls that that's crazy that they're sophisticated enough that it's not just hey let's just get the money but let's try to figure out how to be better about this we're gonna treat them like treat our scammers like employees and do scam training with them correct i mean if you've ever been in a any big company and you put yourself onto one of these kind of performance plans and it would look like any other big company and literally they will have incentives for the people who pull in a lot of money but equally there would be disincentives if you have a lot of people who call you back and want their money back that will come directly out of your bonus and even worse still if there's a charge back that again not only comes out of your bonus but you'll be put into a band of category of employee who is on a performance related plan and if you don't pull your socks up and don't get enough revenue within a certain number of days you can be thrown out of the place it's uh it's unfortunate if you're in a very big indian call center with lots of demand then you're very replaceable and i think a lot of companies and employees of that company will know that yeah that's that that to me is so much beyond what i ever suspected uh these operations would be yeah i mean the big ones are certainly very professional um some of the smaller ones definitely wouldn't be like that in fact i've seen operations where it's literally a few brothers and their friends maybe who have set one of these things up it really just depends on the type of scams they're running typically do you see them targeting more than just you know bank accounts when they're on the phone with them uh are they like trying to compromise the computer to put it on the botnet um allow like like allow a remote access to the machine even when the user's not there sometimes they will retain that access uh most of the time it's purely to get a bit of money out of someone so if it's like a pop-up scam where you see this kind of strange virus like message on your computer most of the time that's just to get a one-off payment and that's usually the last you'll hear of those scammers but there are definitely some who even after they've taken money off someone will call them months later again saying look we're now your computer maintenance company and we've noticed more strange activity on your computer and once again they'll take you through kind of a very set script and of course they're lying to you there's nothing wrong with your computer at all and they want further payments from you but again they rely on that because most people don't know that it's been a scam the first thing they'll see is this strange pop-up with a real loud warning and this guy got rid of this puppet for me so most people who fall victim to that scam aren't even aware that they're a scam victim so that is one type of scan but say the other one is if you get onto one of these scammers call lists inevitably you will get lots more calls because they will sell that data to other scam companies and they will follow it up saying we're the guys who helped you out a few months ago um but we're going out of business and we're going to give you a refund and then to go through that type of scam that i mentioned at the start of the call where again they'll want you to log into your bank account and ultimately transfer money back to them yeah unfortunately that's another common thing just even with a variety of scams that once someone has been victimized they're now just an even bigger target for additional scams yeah those lists are gold dust for other scammers if you've fallen victim to a scam you're far more likely than an average person to fall victim again so you do find that that data gets bought and sold i mean i've i've given fake details you know i never use my real name i give fake details pretty much to every scammer that i come across but i'll hear those details echoed back to me months later from a different call center so they pass the data around without a problem that's amazing so so we talked about like pop-ups and unsolicited phone calls are there other ways that these scams start yeah i mean the most common ones are the cold calls and probably the ones that most people are familiar with but there's another more subtle one which is simply if you go on to your search provider whether it's google or bing or whatever and say you need genuine support say maybe for a printer or some sort of device whatever it is and you just type in the word printer support or printer help desk a lot of people don't check very well that the site that they're going to is a genuine support site and the scammers manipulate search engines so that their phone number even though they don't represent the company they're supposed to be will appear high up in those search results and if you phone one of those numbers they'll kind of sound legitimate you know they'll say you know what you make and model and the kind of stuff you'd normally expect a typical support organization to ask you but then all of a sudden they'll say right well to fix that problem i'll need access to your computer and if you think you've called a genuine desk that's quite a likely scenario for them to be able to manipulate you and go through the same sort of scam they'll say when they have remote access hey look you've got hackers or whatever and we're gonna have to charge you for this software so search engine results don't always trust them or look very carefully at what the domain that you're going to actually looks like is it the genuine thing and sometimes it's very hard to tell that you know yeah unfortunately scam sites are getting in some cases look better than legitimate sites uh yeah i mean they will they will create very convincing looking websites uh if you look very carefully at them you will find that sometimes they're lazy enough not to do certain things the obvious one is uh look at the the external links you know sometimes a lot of facebook twitter links and so on if those don't link anywhere at all chances are that's a scam website it is something small to look for and do you recommend are there other ways to to check with if the companies are legitimate uh if if you know what you're doing it's easy enough so you know for maybe someone who's maybe not so literate with computers it can be quite hard there are software which you can install uh that sits alongside your antivirus which will tell you whether a site is legit or not um there are ways that you can do this but you know you just have to look carefully and be diligent if you don't have that software on your computer gotcha and if someone thinks they've been a victim of one of these scams is there a recourse that they should take or preventative measures that they should take well yeah it depends again on the type of scam i would say more than anything the big one is if you figure out that you have been a victim of that scam go to your bank or credit card company and tell them first and in theory if it's happened recently you maybe you'll even get your money back if you can prove it's been a scam um that isn't always the case and if it happened four or five months ago or more then it's actually in practice very difficult to get your money back i've recently written to a list of people that i find out were victims of certain scammers and there was maybe over 800 of these and i wrote to most of them saying look write your bank or credit card company and try and get your money back that way maybe three or four percent of them were able to get some money back but most were not and it is quite difficult because in the vast majority of cases your money has gone overseas and it's difficult to to get that back although in most cases particularly if you send like an e-check or if the credit card or the bank transfer happens within say the us or some local bank there's always the possibility of being able to get your money back there so again if you act quickly enough go to your bank and they should sort you out so you think if if someone has been able to previously gain remote access to the machine should you reinstall the operating system and wipe it just assume that it's been compromised that is the most safe thing to do but i found in practice even though they've got remote access all they really want is that payment and it usually happens just once so in most people's cases it's probably okay just to remove that remote access software it'll be called something like teamsure or any desk or ultraviewer or something called screen connect it's a few different variants of this and usually just by uninstalling that bit of software it usually makes your pc safe from those scammers again i've got to say if you wanted to be ultra sure though yeah back everything up wipe the computer and put the stuff back on again because i say most people don't have to do that yeah it's they're they're not really looking to take over the computer they're just looking for the financial transaction typically typically that's i mean 90 of the time that will be the case there are scammers who are deliberately um they will use your computer and indeed your bank accounts to launder money and although there's not many of those you need to be very careful if they have put something on your computer particularly if you leave it on and unattended i have seen scammers take your identity documents create bank accounts online bank accounts typically in your name and we'll use that to launder money so you've got to be particularly careful in that case now i don't want to sound too frightening most of the time they don't do that but it can happen yeah it's just one more thing to be aware of in this respect indeed yeah it depends on the organization say most or after a one-off payment are they are they looking for payment i mean obviously they're primarily looking for credit card transactions or like wire electronic funds transfers are they looking for like itunes gift cards and other types of they do do that i mean yeah you hear a lot of scams involving gift cards and there is a good reason for that um gift cards are a little bit like cash they're very anonymous so if you read out a gift card number to a scammer they that's as good as cash to them they can pretty much instantly cash that in you do tend to find that they try to use gift cards because for the reasons that it was mentioning that people can get their money back you can only do that if it's an online bank transfer if you use a gift card or read out a gift card number that's a one-way thing you're never going to get your money back that way so that's why the gift cards have become the currency of scammers they prefer to use that because say once you read that number out that's end of story yeah so that that should almost be a a red flag is no legitimate uh you know no legitimate online business is going to primarily look for gift cards as a form of payment they're going to want a credit card number correct yeah it's a big red flag if anyone says gift card to you that should be ringing alarm bells that's pretty much always a scam is there a particular type of gift card that they're particularly looking for it depends the big one at the moment are amazon gift cards and those are the ones which are probably most easy to launder at the moment it used to be itunes and android or google google play cards these days tends to be more amazon but honestly there could be others you know walmart target they're equally as valuable to a scammer gotcha have you ever talked to any of these companies that have the gift cards and talk to them about you know other ways that they can put additional securities it's almost like you know their their the gift card purveyor gosh if that's the right word should almost be able to see these series of transactions as being suspicious because they can see these things in bulk well yeah a lot of employees are trained to say to people if you pick if you're buying large denomination gift cards um that they will challenge the person buying the card have you been put up to buying these cards has anyone um you know has anyone got access to your computer that's that they should be asking and but it doesn't always work because quite often what happens is the scammers will coach the victims what to say whenever they go into these gift card shops and what the way they usually spin the lines is they'll say look we've given you too much money you're going to return it to us via gift cards but if you say to the employees of the gift card store that you're in to buy these to get a refund they will they will add on 20 tax and they just make that up okay and it's only purely to avoid that kind of questioning by the employees um if you they will be coached to say look i need to give these gift cards to a relative or there's a medical emergency or whatever that will be drummed into those victims before they go into the store and it's really as to say just a way to kind of combat the questions which they should be being asked unfortunately not all store employees are fully trained in this they'll not always recognize that someone going in to buy two thousand dollars worth of apple itunes cards look suspicious but it should be it should be part of the training but you know everyone's human yeah yeah so that's you know almost one of those like additional warning signs that you've been scammed if someone's coaching you on what to say to somebody else or to not talk to a relative or to not explain to people what's going on that should be a huge red flag absolutely and i've literally watched in the last month or two um they've managed to recruit people in the us and the uk to assist with these scams so sometimes if you hear a foreign sounding accent over the phone it can be more suspicious than somebody who signs local and they're now coaching people here you know complicit with the scam to run through the same sort of thing and they will coach their victims what to say not only for gift cards but even to make a bank transfer so i've watched one person in the uk trying to convince another person in the uk the scammer and the victim to go into the bank to make a transfer and the way that they ran that scam was to say that look there's a person in the bank who is in league with these scammers and we need you your help to try and figure out who that bank employee is and what what we need you to do is to go into that bank and make what they describe as a dummy transfer to another bank account and that will unveil the scammer who works in the bank and that is just purely a story to avoid the questions that the bank employees should ask so they will be coached to say um when you go into the bank you know don't alert anyone in there because you don't know who's the scammer and who isn't and just make this transfer say you're transferring your money to a friend or relative and here's what you should say so literally they will try and coach the victim to avoid any of the the questions that the bank employees should be asking and if they can successfully coach the victim then that's their best way of getting money out of that victim's bank account wow that's particularly particularly cunning yeah it is and unfortunately it works and i've literally watched scammers in the last month or two making a massive amount of phone calls to get maybe one or two victims maybe they'll make tens of thousands of calls to get one or two people who are prepared to believe what is quite a far-fetched story but nevertheless particularly if you're maybe slightly older slightly you know there's people who are just very unfamiliar with this sort of scam and you know if you're if you sign legitimate then you can be believed you know anyone literally anyone can fall for these sorts of scams yeah it's so the advice is don't talk to anybody ever [Laughter] oh no no no no i think i think the general advice is always be wary of cold calls and no legitimate company would ever have a problem with you just asking questions about the phone call so i think be a skeptic would be my best course of advice to anyone don't take things at face value research them if it sounds a bit odd then use your gut instinct and check it out yeah it's that you know even when i've had fraudulent charges on my credit card and had the bank call me and say hey there was this fraudulent charge in your card and they very clearly had enough they were able to give me enough information it was very clear that they were from the bank i gave them nothing and it was just like nope i will call back on the number on the back of my credit card and contact the fraud department and any real fraud department is gonna go is gonna say yes that's the right thing to do any wrong you know any fake fraud department is gonna try to spin a line of no you have to do this right away or you know or something indeed that's one of the big telltales is there's some sort of urgency with it that's always a bit of a hallmark of there's got to be a scam i mean you're right i get the same phone calls from my bank to say that something suspicious happened no one will mind if you call them directly on the published number for the bank yeah and that's that's that's a great advice even if it i don't know so much in the uk this happens but in the us you can forge caller id so even if the inbound call matches appears to match the the number you can't really even trust that either correct i mean literally whenever i'm calling scammers i am forging my caller id and sometimes i even use the scammer's own number so they can't block me anyone can forge any phone number you can't rely on a caller id there's there's nothing in the telephone system which verifies that the number being presented is a real number or the number of the actual caller i believe there is at least in the us there's legislation in the works to try to change that and yes i've heard of this this shaken stirred yeah at best though that will be able to um identify a real legitimate number okay but it won't be able to filter out the hundreds of scams of scam phone calls which are either international yeah or they're they're just not a registered number so if you don't know much about the number at all it wouldn't be able to filter that it's only kind of limited in what can be done on the telephone system but i think the best advice is just never trust the caller id especially at the moment yeah yep it's a lot of the systems that we use both for the internet and the phone were were built on implicit trust you know emails the same way that uh the systems were designed such that everybody is who they claim to be and trust trust but do not verify and date yeah yeah it's like nothing wrong nothing wrong with asking some basic questions about any phone call you make and receive yeah that's great advice is there any final parting advice you'd like to give the audience and then also uh where could people go to learn more about what you're doing and to find your your videos well i guess the advice i would give i've probably mentioned already is just kind of be skeptical about any phone call you get i mentioned a few other scams um cold calls are fairly easy robocalls i would say the vast majority of robocalls are probably scams although some companies do use them the bit the advice about search engine results are not always your friend um is something to pay heed to particularly if you're gonna phone a number which a search engine throws up again be a little bit skeptical look into that in detail but i guess overall is just research things um i mean my channel shows what the most common types of tech support scams are so if you get a chance at all just google jim browning my name and you'll be able to see examples of all sorts of different types of scams and i think if you understand how they work even if the scams themselves change a bit you should be able to recognize when a scam is happening to you and that's the reason for the channel it is about awareness and if if i can help anyone just by helping somebody to identify when you might be being scammed then it's a success so say if you just google jim browning you'll find me and say there's there's lots of entertaining videos in there as well some it's not just about this is how scams work it's kind of nice to wind those people up and actually even the odd time get them arrested which is kind of one back for the victims yep and we'll make sure to link to both your twitter and your youtube channel in the show notes for the episode yeah thanks chris and jim thank you so much for coming on the podcast today yeah you're very welcome thank you for listening to this episode of the easy pray podcast if you like this episode help support this podcast on our mission by leaving a review at easyprey.com review notes in a transcript of this episode with jim browning can be found at easypray.com 41.

Channel: Easy Prey Podcast

Views: 10,584

Keywords: easyprey, podcast

Id: HfdP2RubT9s

Length: 38min 20sec (2300 seconds)

Published: Fri Jan 08 2021