Online scams: how to save money and personal data

[root]

The former hacker reveals the schemes by which Internet fraudsters steal money, and the Yandex expert gives advice on how not to become a victim of swindlers.

Pavel Sitnikov
cybersecurity expert, former hacker​

Hackers are no longer lone geniuses: they are highly professional teams of IT specialists, analysts, even sociologists, psychologists. The newest fraudulent schemes in Russia are based on an analysis of the situation in the country - for example, users are promised social payments, allegedly imposed by new laws, or ultra-low interest rates on loans.

Given the current state of the economy and the debt burden of Russians, one of the most common schemes today is fraud with microfinance organizations. Let's consider one of them.

How scammers disguise themselves as MFIs and steal money and personal data

A person receives an e-mail or messenger message that promises him very favorable credit terms. By clicking on the link, the user sees a beautiful, catchy, compact and informative landing page.

Every day Yandex shows users about 15,000 phishing and fraudulent warnings. Behind such a warning is the operation of several services at once. Yandex Browser checks the page against the database of infected pages and blocks attempts to access malicious pages. Even if there is no page in the database, but the program still seems suspicious, the second stage of verification begins - already more detailed, using machine learning algorithms. The browser also blocks infected links in mail and instant messengers and warns the user about them. Before the site gets into Yandex search results, the algorithms check it, study the content and statistics, information about the owner. Found suspicious sites "Yandex" pessimizes, displays warnings for them, or even removes them from the search results.​

Anton Mityagin​

Head of Internet Security and Anti-Fraud Department at Yandex​

​

To attract people, scammers use chat with pseudo-responses - allegedly from customers: the desire to be like those who have already "become happy" forces the visitor to stay on the site and continue their actions.

In the Yandex application and browser, you can leave or view a review of the site, compare the ratio of negative and positive responses. At the same time, Yandex's algorithms are able to find and automatically delete false reviews left by the scammers themselves. The user can analyze the page before making a purchase on it or ordering a service. All reviews are checked for compliance with the publication rules (not only automatically, but sometimes manually, through the Yandex.Toloka service), uninformative messages are deleted.
Anton Mityagin
Head of Internet Security and Anti-Fraud Department at Yandex

Upon reaching the registration form, the unsuspecting user enters his data. After registration, a letter is sent to the specified mail with a link to confirm the address.

From the letter, the user enters his personal account and fills in the required data for a loan application (all matches with real data are random).

What follows is a little trick, which is often used in fraudulent schemes: the so-called sales script - a prepared script for a dialogue with a client:

Thanks for your choice! We make a decision. It can take up to three hours to make an automatic decision.​

Such text makes the client-victim stay on the site. After some time, the site gives a positive response.

​

The client enters his personal account and waits for the money to be credited to the virtual MFO card. In the meantime, the fraudster opens the administrative panel of the service and looks at the submitted applications.

He finds new ones, examines the conditions requested by the client and begins to act.

Fraudsters see all the entered data, including the user's password. Practice shows that people often use the same password to log into various sites: from e-mail to an account in an online store, where, among other things, card data can be saved.

Using algorithms, attackers try this password in all services where you have ever registered. Yandex daily suppresses from 30 to 100 thousand such hacking attempts. Never use the same password on different sites and enable two-factor authentication.

In addition, password managers are effective. These are programs that themselves generate complex passwords for all services; the user just needs to remember the password from the manager himself. In Yandex Browser, you can also come up with complex passwords, and if they are not enough, use the master password - it protects the rest and is known only to the user.
Anton Mityagin
Head of Internet Security and Anti-Fraud Department at Yandex

In the field that is displayed to the client as the number of his virtual card, the fraudster enters the number of his - also virtual - card and the requested loan amount.

After some time, "money" appears on the wallet in the client's personal account.

It is worth clarifying that all the actions of the fraudster with the client occur extremely quickly - so that the potential victim does not have time to "jump off the hook."

In a hurry, fraudsters can even create a fake payment schedule for persuasiveness.

So, the client "receives" the desired amount, sees the details of the loan terms and interest rate. After that, the pseudo-MFO allegedly gives the client a virtual card of his organization (recall, in fact, this is already a valid fraudster's card). To use credit money, the virtual card must be activated.

Card activation is a paid service, the cost is comparable to the actual payment to the bank for servicing a credit card. In our case, this is 1100 rubles. The victim is even allowed to choose the most convenient way to lose their money. In most cases, the site has clear and detailed instructions for payment - including through online banking.

​

Bottom line: the victim lost 1,100 rubles and gave the fraudsters personal data (email address, card number and password that can be used for accounts in other services).

This type of fraud is not designed for high one-time profits, but for massive deception. At the same time, it is not easy to investigate such cases - to track down fraudsters and collect a package of evidence on them, most often cases are closed "for lack of a complete corpus delicti."

The good news is that radically new ways of online crime are rare, and existing developers already have countermeasures in place. Despite the fact that the developers block the access of intruders, users should still keep in mind the basic rules of online security. Be skeptical about high discounts and too tempting offers. Don't ignore warnings about malicious sites, or better yet, check their URLs. If you see an advertisement for a questionable online store, you can complain about it. And also make it a habit not only to read reviews of other users, but also to write your own - this will help someone not to fall into the hands of scammers.
Anton Mityagin
Head of Internet Security and Anti-Fraud Department at Yandex

A source

 

[Частный детектив Азербайджан]

Thanks to the "ex hacker" for the info.

 

[David Mamedov]

Thanks to the "expert" for this.

 

[частный детектив. Узбекистан. Ташкент.]

Thanks for the info, even though I'm not a hacker, it was still useful to know all this.

 

[Kiril Harchevnikov]

Interesting and informative.

 

[Детективное агентство. Грузия.]

Thanks for the invaluable information!

 

[Частный детектив. Москва.]

Огромное спасибо за советы! Полезно.

 

[Детективное агентство Израиль.]

I don't worry about protection anymore. Thanks a lot for the article!

 

[poles1469]

Thanks for the correct information!

 

[Детективное агентство Одесса]

Спасибо!