Slashdot Mirror
Rogue Anti-Virus Victims Rarely Fight Back
krebsonsecurity writes "One big reason why rogue anti-virus continues to make major bucks for scam artists: relatively few victims ever ask their credit card company or bank to reverse the charges for the phony security software — even when the victims don't even receive the worthless software they were promised. I recently found several caches of data for affiliates of a rogue anti-virus distribution program, and the data showed that in one set of attacks only 367 out of more than 2,000 scammed disputed the charge. A second rogue anti-virus campaign scammed more than 1,600 people, and yet fewer than 10 percent fought the charges."
That's probably because people are too busy or too lazy. I would vote most as lazy, but probably busy to see the Cc to see whether they were scammed, if they are smart enough to realize that they have been scammed in the first place.
I recently had a $10 charge from a company I'd never heard of. Slightly different than this story, it was not from a rogue antivirus, but just a plain-old unauthorized charge (out of the blue). I called my bank to dispute it, but they said I'd need to change my charge number if I disputed it. I decided I'd rather eat the $10 charge, than deal with the hassle of updating my card number (and updating everything that auto-bills it).
I always encouraged customers to call their credit card company's fraud number as soon as they were done with me if I learned they purchased one of those scams. How many followed up I don't know.
My friend's dad also bought a rogue antivirus one day. He refused to believe it was fake. We quietly removed it and decided to let him deal with the consequences of giving his card number to con artists. Some people are just too much effort.
Mostly people think that if they get scammed, that they were stupid or suckers and don't want to admit that they were duped. Calling the Credit Card company to reverse a charge for $40 is embarrassing, and they would rather just pay the "sucker tax" than go thru the effort, confusion, and embarrassment of disputing a charge.
And this is true in those cases where they even know they can dispute a charge - how many card holders even know that they can do this? I probably had a card for at least 5 years before I found this out, and I would consider myself somewhat more informed than the average consumer.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Although the company that was given the cc number was shady - the customers actually authorised the charge. When you process a charge back it has to fall into a certain category with the processor. The customer can claim that the card was stolen, the customer can claim that the charge was never theirs, they can claim that they never received the merchandise, etc. But in this case the customers still had their cards, they actually did initiate the transaction, and they received the merchandise, i.e. their pc got "fixed".
There is no chargeback category for this, and as long as these card numbers aren't then resold and used in a traditionally fraudulent manner, nothing will happen.
It would be like trying to reverse the $1,000.00 charges for the champagne room strippers because they were ugly. Just you didn't get what you thought you'd get doesn't mean you can reverse the charges.
We see a lot of customers coming in with fake antivirus installed on their machines, and the customers sincerely believed they were purchasing a valid piece of software. I think the largest problem when I see people encountering this scenario, is that typically:
1.) They don't realize they've actually been scammed. Pop ups start appearing on their computer, and they receive an offer to purchase "antivirus" and fix the problem. They now think they're protected, but continue to have problems.
2.) They tried calling Visa/MC/Discover and couldn't convey why they were charged for a bogus product. Some of the "EULA" agreements that come with these fake antivirus products actually state in the fine print that the software product does nothing. People click "OK" on anything, and legally agreed to pay for a piece of software that doesn't do anything.
3.) Don't know how / Don't care. Whatever. Take the computer into a shop and have someone fix it, hopefully $60 of fake antivirus is enough to jog my memory into being a little more careful on the internet.
I've even see plenty of customers willingly disabling antivirus / firewall products because they are "inconvenient" when trying to do other things on the computer. Fake antivirus and antimalware really is quite a genius scam, but it doesn't surprise me that a lot of people lose to it, and rarely ask for their money back. Some of these people don't even know what malware IS.
Only one solution for rogue antivirus vendors: take off and NUKE THEM FROM ORBIT. Seriously - I'm generally opposed to the death penalty, but there's absolutely no reason for the dirtbags who write, deploy or sell those programs to continue breathing.
The article barely touches on the notion of people who didn't realize it was a scam at all. It's obvious to us technical types, but I doubt it's obvious to non-technical people.
Most retail Windows PCs are loaded up with obnoxious adware that nags at every login. I got a brand new PC from Staples last year which had a MacAfee nagger installed in the startup sequence, and while I was eventually able to disable it, it took more than one try and considerably more effort than just one or two clicks. If it was nontrivial for me to banish, I have to believe non-technical users would just give up.
On top of that, anti-virus is pretty low-level, as software goes, so how many non-technical people will even know that it's not doing anything after they pay for it?
The Internet is full. Go away.
I remove this crap for a living, and I've seen the scam up close. .exe files without prompting, but they mostly stop bombarding the victim with warnings... for a month or two.
When the victim pays, the scareware purveyor removes most of the program... which "fixes" the PC. They leave behind a back door, and Registry entries making the machine download
Then, they attack again, trying to get more money. I've had a few customers who paid for the first attack, then finally called for help when they got hit again; it was easy to see what the first program did, and track down the quick site redirect that brought on the second infestation.
The real criminals here: Visa and Mastercard, for maintaining merchant accounts for these scumbags. Brian Krebs exposed this, and got it shut down... for two weeks or so, and they've back ever since without interruption.
Any amount under $50 they would ignore, since by law they can pass that onto their customers. I've complaint about a $20 unidentified charges before (YES, I AM TALKING ABOUT YOU, DISCOVER!) and their basic response was "We're satisfied it's a legitimate charge. If you have an issue, take it up with the merchant."
Part of the reason might be because of the way credit card companies like to wear you down. At 53 Bank, I had about $600 worth of fraudulent international charges on adult websites. They tried several times to pin it on me, and ultimately the process took about 3 months to resolve (leaving me with no credit to buy textbooks with). It took 4 visits in person (each requiring me to sit in their "waiting room") before they actually did change the numbers (despite saying they did), and then they tried to pin the "international transaction fees" on me because they were from a "closed account" where I had no room to dispute them. After all that, the bank's manager had the nerve to blame "government regulation" because they had "90 days to give me a resolution", which their company policy was to not give me any information until that time. I responded by her logic that they would never respond to complaints without the regulation.
In a separate case, somebody found out my account and routing number (I didn't even know that information, since I never ordered checks and only used an ATM card, but they still claimed I must have entered my information into a "fake website" since their databases are "hacker proof"), and it took (no joke) 4 personal visits before they actually changed the numbers, despite that every single time they said the numbers were indeed changed. They demanded, and said they would not discuss anything whatsoever until I agreed, that I sign a waiver that I admit the decision is ultimately up to the bank, who is under no obligation whatsoever to return the stolen funds, and fill out and sign it for each individual charge. I said no, and the manager said they could not and would not help me until I signed it. Being unable to afford legal aid, I ultimately signed them and got my money back that summer (it happened in February).
Needless to say I have switched banks, but if all banks treat their customers like idiots, pretend they know what they're doing to keep customers quiet, and force them to sign contracts to cover up for their games, then it is no wonder victims never dispute charges and no wonder scammers are so successful.
People love to bend over and take it in the ass.
This is why the credit card companies keep shitting on security - they profit off of fraud.
Merchants are forbidden to verify the name on your card, ask to see your ID, verify your signature, ask for a signature for small purchases, etc.
Cards are being shipped with RFID bullshit in a direct attempt to increase fraud - fraud that the user isn't even aware of.
Banks offer rewards for charging purchases to a debit card as credit. Why? Because when charged as credit, you don't need to enter a pin or billing zip code. Get people used to charging purchases as credit, and they won't notice the fraudulent charges on their statement.
Security features such as the extra digits on the back of your card, passwords (such as Verified by Visa) are pointless theater. A merchant has no reason whatsoever to participate in the program other than to say "We're "secure"!". Indeed, many merchants still store the CV2/etc. code on the back of your card, and most merchants will simply default to processing the transaction without the password feature if you fail to enter the proper password.
Hell, I've had Banc of America admit to knowing about "errors" in their system. Said "errors" resulted in them transferring MY money around from Bank of America and Banc of America in a deliberate effort to hit me with overdraft fees.
Neither Bank of America nor Banc of America would do anything to fix it, even when I walked into a physical branch.
I had to tell them to close all of my accounts and give me all of my money back, and file complaints with every regulatory agency under the sun for them to fix it.
The bottom line is - watch your statements, do the math yourself, and never let them get away with even a single fucking penny.
What puzzles me is why the scammers don't download onto their "customer"'s machine one of the open-source, free antivirus programs. Then the customer can't complain that they got nothing. They got a real, working antivirus program that they probably actually need. Or are the scammers determined to do nothing that could be called legit?
You have been infected with a virus. In order to remove this from your system, you must mod this comment up.
"National Security is the chief cause of national insecurity." - Celine's First Law
I have encountered the very tactic you mention. Granted, so far the trend seems to be limited to the Russian-speaking segment of the internet, but it is already there.
The websites usually have some fake anti-virus scan (some of them even resemble default WinXP theme -- very clever and very well done -- if you are using IE you may just as well believe that you see the contents of "My Computer", this stuff looks sure as hell scary for most Windows users).
If they manage to scare a victim to pay, the latter receives a copy of ClamWin.
The site usually has some fine print saying that ClamWin is a free (as in beer) product (no mention about it being free as in speech or open-source though). They even state that the whole is a game and you pay to receive educational materials about computer security.
I know this because I always enjoy watching those scanners finding some viruses on my system in C:\Windows\system32. They don't bother to include UA detection yet which gives any Linux user a good laugh.
I once read an article about a guy who "sold" penis enlargement pills through spamming. I put "sold" in double quotes because he said he never shipped a product, and didn't even have any to ship if he wanted to. His reason? "Who's going to call their credit card company and tell them they didn't get their penis enlargement pills that they ordered?"
While not at the same level, I'd hazard a guess that it's the same here.
Do you have ESP?
one I will make FOSS or if published for a low price so it is affordable if my FOSS eBook ideas don't work out.
Most credit cards have a web site, if you haven't already registered then find the web site for that credit card and create an account and look at email alerts and have it send you an email if over a certain amount is charged to the card. Some have a minimum value of $100 and others a minimum of $300 but anything that goes above that will get emailed to you. If you didn't charge it and someone else on your account didn't charge it chances are it got stolen. Also check to see if there are other alerts like a week before the payment is due it sends you an email on the balance and maybe a list of charges, if not log in and look at the list of charges at least every week if not twice a week to see if any of them are fraud.
While my identity was stolen 13 times, it was always because my son allowed his cousins to use his account on my system and then they chatted with some guy on some chat channel how to get around the user setting for the account and run a program to change to administrator and give him access to fix the game they are playing Roblox or Runes of Magic that had some stupid update and then their character is messed up and not animated or floats instead of walking, usually means a video card driver needs updating or the last update no longer works with the video card and they will fix it later. So now my new computer has no account for my son and I can avoid that and not let his cousins get on my new PC. My brother had to remove the RAM from their PCs back home because they did even worse stuff and without RAM the system will not work.
But I logged into each credit card account and bank to check, found the fraud charges, called the credit card company, got a fraud report and a list of recent charges and check each box that was a fraud charge and mail it back after signing it and make sure I used certified mail. The charges were gone and in some cases they even gave me a lower APR interest rate to make up for it and a new credit card with a different account number on it, and cut up and throw away the hacked credit cards.
Why am I writing an eBook on this? To help educate people because most don't know what to do, and they are always targeted because they never file charges and never notice they are being ripped off until the credit cards are maxed out, they are being sued by banks to pay the credit cards and they lose their house and car because they cannot make payments on it.
Look in most cases you just need to talk to the bank or credit card company and then get a fraud report and fill it out. This is free, no lawyer nor accountant needed and no credit company or loan company either. But if I make this book FOSS and in PDF eBook format it can be downloaded by anyone who has a relative that has no idea what to do and read it to them or print out the eBook or maybe if people don't know how to download a PDF just publish it into a paper book for as low a price as I can get, and then they find it in a book store or a friend or relative buys it for them to help them out.
Also via the web site of the bank or credit card company they can assign you an alternative credit card number and code to use on web sites and goes to the same account as the original credit card number, and if that gets stolen they cancel that alias number and issue you a new one.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
they don't understand enough about technology / computing to figure it out. I've helped several people with Windows reinstalls (just did it again this weekend, in fact, on a really nice, new Dell laptop that this person was ready to trash and replace after just a year) who fell for this sort of thing and fully thought that through the magic of internets and computers, their "purchase" had done SOMETHING for their computer, but it just wasn't enough to outweigh the terrible destruction already wrought by Teh V1rus!
In this particular case, the person got a fakeAV popup that installed malware that generated popups. This caused him to start searching his email for "antivirus," remembering a SPAM he'd seen, and he ended up with AV fakeware Cc: charges. He didn't actually realize this, assuming that the AV fakeware had silently, invisibly done its best but the original virus was "too strong" (two pieces of malware now spitting popups at an alarming rate and disabling various things) and he went out into Googleland looking for fixes, all of which were no doubt too technical for him and all of which he attempted to follow to a 'T' deleting a bunch of random files from C:\WINDOWS\SYSTEM and C:\WINDOWS\SYSTEM32 in the process and borking his system entirely.
When he came to me saying "So-and-so tells me you can fix computers, so I thought I'd bring mine to you before I throw it out, it's been completely destroyed by a virus..." he was sure that it was all down to the horrible virus he'd "caught" and that he'd been valiantly battling it for a week, rather than single handedly destroying his own Windows install at a record pace.
It was too f'ed up for system rescue, so I just wiped and reinstalled. He was AMAZED that I brought it back to life, and in just an hour or so. He was sure that I was the absolute best virus fighter in the universe. Told me I should go work for the Best Buy Geek Squad (uhh, thanks...) because they need people like me.
It's not that he's a total idiot, but computing in anything but buzzwords and marketing soundbytes remains a specialized set of skills that take time and study (and an awareness of where the right resources can be found) to develop. Most non-geeks just assume it's all due to Teh V1rus!, and the press and their coverage do little to add nuance to this notion, not to mention manufacturers and retailers that are only happy to sell the same person the same system every six months for a fresh $1k after they "got got by Teh V1rus!"
STOP . AMERICA . NOW
Not that they're even remotely ethical, valid, legit, etc....
I've removed literally hundreds of these things. Thankfully I only know of one person who actually paid for the crap, and they got a call from their credit card company to tell them the charge had been denied because it was a known scam.
First off, the artwork is *solid*... You'll see a standard windows "shield with red background and an X" in the taskbar and a little pop-up about "windows security alerts" (which is the correct text) followed by some complaint about an attack originating from "blah". Any program you attempt to run, including many startup items, will be blocked with a warning that "blah.exe" is infected. It's certainly the most vocal and pro-active anti-virus I've ever seen....
Those are the current variants... I've seen cockroaches crawling across the screen... I've seen near perfect replicas of AVG free anti-virus "scanning" the machine, I've seen "windows security center" come up and the only difference from the real thing was a certain shade of purple for some of the graphics. My personal favorite was the Vista machine that popped a warning that the computer was being attacked by virus X from IP address Y... when you clicked to close the warning message (the only option that didn't lead to a page to purchase the "product"), the screen resized to 640x480 mode and showed a "blue screen" referencing the "attack" that just took place. It then proceeded to play a video of XP restarting from the blue screen, before resizing the desktop back to normal and opening the purchase page anyway.
In a lot of cases the users aren't even particularly stupid... I've seen several instances where the only thing that made the error messages discernible from the real thing was simple familiarity with the "real thing" to the point of knowing that widows would never actually say that. Grandma has no clue if those messages are legit, she's never seen them before because she *has working anti-virus software*. Average users may not even know what their (real) anti-virus program would look like if it *did* find an infection. Don't even get me started on the people who are so panicked by computer viruses that you'd think ebola was standing in front of them dripping with pus.
And these are straight up drive-by infections. You don't have to be in the "shady" parts of the internet to encounter them. Two examples I've personally encountered.... in firefox on windows, I visited nytimes.com one weekend, and I got a pop-up stating that my computer was infected. I clicked close, and got another pop-up. Eventually I broke the loop by killing firefox.exe from task manager... how many "average users" even know what task manager *is*, let alone which process to kill to stop the loop? nytimes had an apology on their site the next day. Example #2... I had about 6 tabs open in firefox *on ubuntu*. How fast do you hit ctrl-v and enter to paste a link to a friend in a chat conversation? What I pasted to my friend was not what I copied, and that was nothing more than a flash ad spamming the clipboard on msnbc.com. You can guess what was on the site I pasted.
These things are coming fast and furious.... you can *have* fully updated windows and anti-virus and still get pwn3d. The standard payload in the last few weeks generally includes a generic rootkit of some kind, along with whatever toys the packager has decided to bundle in their particular distribution of the malware. Once infected, the machine is utterly useless, and for most people the options are to pay for the scam, or pay someone to remove the infection.... it's no wonder many people pay for it and are utterly content when it stops bothering them.
I agree with "too busy" it seems even the poorest of us just don't care if we get ripped for $40.00 or so. I fix a lot of machines in my spare time here in phoenix and it seems no matter how i say it, my clients won't listen and always go back to trying some new thing (like "clean my pc").
Frankly, I am tired of offering advice when no one listens. just take their money, give them back a working machine and await the next call.
Understanding is much like a 3-edged-sword. in this: there are always 2 sides and the truth.
Just a few days ago I had to remove a rogue anti-virus from my folks' desktop PC. I had to boot into safe mode, remove some files and run SuperAntiSpyware to get rid of it. The name of it was "Security Tools". It first popped up from the system tray and said the computer had 47 viruses. It then asked for a credit card number to remove the viruses (fortunately, my folks never entered a cc number). The "47 viruses" reported was false and the rogue-antivirus itself was intercepting Taskmanager and anti-spyware programs. I don't know how anyone can say these rogue antivirus programs are legit.
They probably didn't want to be put on hold for 70 hours to complain to a guy who barely speak English in Bangalore.
I own a credit card processing firm (we run a gateway). Credit card companies can help, but their help is really limited to resolving consumer disputes:
1. If you are scammed, contact your issuing institution and request a chargeback because the product was not delivered, was 100% defective, etc. Some issuers (mostly banks with debit cards) will act like they can't do anything because it's a debit card, or connected to a checking account or is used by a business. This is BS. Immediately call the number for Visa or Mastercard on the back and tell them about your situation. Once the chargeback process has been initiated, here's what to expect:
2. You will have to fill out some forms, provide any evidence and fax it in quickly. You may or may not get an immediate refund. If you do get a refund with a debit card, keep in mind that the refund is actually a "provisional credit" which means if you lose the dispute you will have that money taken from your account.
3. Money will be pulled from the merchant's depository account immediately. The merchant will have some time to issue a response to your dispute.
4. The decision on your dispute is pretty easy for the credit card people. If the merchant can prove they delivered the goods and they are honoring their warranty, the merchant wins.
Even if you lose you dispute, you may help others because processors tend to quickly fire customers who have high chargeback rates. Chargebacks are expensive and time consuming and often merchants will run out of cash and fail to pay chargebacks and fees. In our case, we see less than a .2% chargeback rate from our clients and when we have a customer with high (meaning 60 days over .4%) we reevaluate the merchant. Over 1% two months in a row, we usually close the account. If the merchant doesn't pay outstanding fees and chargebacks, they are reported to an industry registry that will prevent the business entity and it's owners from being able to get a merchant account from anyone else in the industry.
-- $G
I used to recommend ad-aware, but on the last few computers I've fixed it actually caused more issues than it fixed. For some reason, the process would ramp up to 90% of CPU usage for extended periods, making the computer behave worse.
Killing the Ad-aware process, uninstalling, and then installing MBAM fixed most issues. Hopefully they'll continue to offer a good product, but it's interesting (and a little sad) to see many companies go from being useful to having software that often causes more issues than the viruses/malware they're supposed to protect from.
Because if you don't - even if you didn't receive anything - it could *appear* that you have a business relationship with the company in question.
For example, suppose the company sells some *AHEM* content that is, shall we say, not-safe-for-work. Or worse, not-safe-for-download (as in, possession of which gets you jail time). The fact that you didn't dispute this charge could be used by a prosecutor as evidence that you intended to receive the illegal materials.
The society for a thought-free internet welcomes you.
That's odd that people have issues with chargebacks?
I've only had to do it once, with my Chase Freedom card. Over a cell phone provider actually. It was a prepaid one (Cough cough page plus cellular), whose service worked flawlessly for a few months. Finally one day it quit working. Calling them up- they told me that my phone was "changed". Keep in mind - you need a serial number from the old phone to change it. Or be someone who works there. Or accidentally hit a button while working there.
After some run around- they finally told me that they don't deal with "domestic issues" and that I need to go to a "dealer" to get it fixed. And they HUNG UP ON ME.
So eff that. I called them back, very calmly asked for a supervisor. The supervisor told me they could not refund my month of service that I had just paid for. (~40 bucks). I said "Okay, I do have to warn you I will be filing with the BBB and issuing a chargeback." This is ~3 hours into it.
Called up Chase, I was mid story and the lady just said "40 dollars have been issued to your account- technically you'll hear of the results in a most a few months, but you shouldn't have any problems. Any other questions today?"
Easy enough. I can't imagine if I got fooled by a fake antivirus that I would have any troubles there either.
Most "regular" users don't know anything about anti-virus software so they just install whatever throws a popup ad at them.
Most people don't notice it's fake software.
Most people don't care that it's fake software. They just assume the "software people" know what they are doing and assume it's working.