Tech Corner: Scam Edition

Happily, so much of the rest of the world is writing about Trump and the Mid-Terms that every once in a while I feel that I can comfortably deal with other topics. And today we're going tech. Well, sort of. Mainly we have a scam alert. Again.

Readers here will likely recall a few weeks ago, I wrote my two-part epic article on a scam I was hit by over a problem I had with a Brother printer. (The short version is it started with a spoofed Brother website -- and that, bizarrely, I think they fixed the problem...though also claimed my computer had been infected by a virus, and fixed that. For $295.) The good news here with this new tale is that I was not scammed. But it was such an extremely cleverly done email scam that I thought it important to let people know about it, so they can be aware and protect themselves.

But it's also the "how" the scam was done that is an utterly fascinating part of the story, because it was eluding me how they could have pulled it off, even knowing it was a scam. For that matter, knowing how it was done helps spot that it's a scam. I'll get to all that at the end.

As for the scam itself to watch out for -- Yesterday morning, I received an email confirming an order for an Epson printer. (What is it with me and printers??) It was an extremely good fake, from what appeared to be a real Epson email address.

Here's the email --

As impressive a fake as the email was, I knew immediately it was a fake. For two reasons. One, that I was sure I had never ordered an Epson printer. And two, if you look at the date of the order (October 8), yesterday was October 8, and I absolutely was 100% positive I hadn't ordered an Epson printer within the previous hour!

At first glance, it was such an obvious scam (I mean, who would forget that they didn’t buy an Epson printer 60 minutes earlier?) that I just rolled my eyes – after a moment of PTSD, given my recent printer scam hell.  What I wasn't sure of was whether someone had ordered a printer in my name, and if my credit card had been charged.

It was then that I realized the whole point was to be so obvious that you'd know it wasn't your order -- and make the order form so realistic looking that you'd call the number on the form.  They'd say they would process a refund, but first needed your credit information card and...well, if you give it, game over.

But it's how they did this "real" fake that is so devious. After all, it turns out that the email address which sent the order confirmation was Epson's. I'll get to how it was done in a moment. But first, this is what my immediate actions were --

Just to confirm my theory, I did a search for the phone number listed, and it was not for Epson. I also checked my credit card account to make sure I hadn’t been charged anything.  I hadn’t. And I then tracked down Epson’s actual Customer Service to report it.

Epson checked the order number, and (to my surprise) they saw it in the system – though they could also see that all the information provided for the order was not me and fraudulent.  So, they cancelled it.

At this point, I wrote to my tech guru friend Ed Bott, who I often refer to. I figured he'd be interested in the scam. (Ed writes a great tech column on ZDNet here, which I highly recommend. And in just a few weeks, Microsoft Press will be publishing Ed's official magnum opus for them on how to use Windows 11, volume 2, since a major update of the operating system is coming -- and you can pre-order the book here.)

To start with, Ed said he was well aware of this kind of scam -- in part because he himself had recently received a similar one from American Express.

But it was what Ed said about how the scam worked that was most fascinating. He said that the reason the order confirmation form looked so real is because...it was real and actually from Epson!

"Lots of variations on this scam going around," he said. They use real commerce sites to make purchases with fake credit card numbers, fill out the form and then have the company send order confirmation replies to your email address. "They don't have any other information about you," Ed noted, "nor do they have your credit card; it's all automated from big databases. You get a reply that looks official because it's from the legit company. What they want is for you to call that number so they can offer to 'reverse the charge,' for which they will need your card details..."

(Though the best thing Ed wrote was, "You did all the right things.") Still though, I was bewildered by how the scammers were able to get their fake "call us" number on what is a completely real order confirmation sent by a completely real business. And that's where the devious cleverness kicked in.

"If you look carefully at it," Ed wrote back, "you will see how they're doing it. They often put the scam text in a field intended for something else, so that it gets copied to the reply." And I checked the original scam form...and, yes, just as Ed said, there it was. When looking back at the form, I noticed that the “Is this you? If not, call us at...” appeared in both the Shipping Address and Billing Address fields.  And that was the giveaway.  IF one looks close enough.  A big "if",  because I'm sure most people skim past that. But after all, what order confirmation doesn’t have the shipping and billing address??! Yet this doesn't! Instead of filling in an address, they fill in the "Call us" text. There's zero personal information about me at all.

If you check the form above, you'll see that.

In looking at it more closely, I also belatedly noticed two easy-to-miss mistakes in the confirmation letter – they list their phone as being in “Redmond, Washington,” but Epson is actually in Los Alamitos, California.  My guess is, though, that it might possibly be an intentional “mistake,” since a) who would know at first glance that Epson is not in Redmond?, and b) the scammers might assume that most people will recognize “Redmond” -- where Microsoft has long been based and, in fact, the company is often just referred to as "Redmond" -- and therefore think it’s more believable.  (That said, at the very bottom – since remember, this is a real form from Epson – it does say there “Los Alamitos”. But how many people read to the bottom? And if they do, they still might assume Customer Service is based in Redmond, with a lot of tech companies.)

The other giveaway.  It’s sent to “Dear Order.”  Not at all what a company would write. Though as weird as that phrasing is, it's still semi-believable enough (since something like "Dear New Subscriber" is not all that uncommon in emails) that I can see some people accept it.

Again, if you scroll up, you can see these giveaways.

"This is a complete numbers game for these people. There's no cost to send a message — it's all done with bots..." Ed noted. "They know that 99 out of 100 of these will be filtered, ignored, or deleted, but the 1 in 100 that calls the number becomes a prospect for scamming."

In the words of NYPD Blues -- "Be safe out there."

And that's today in Tech Corner: Scam Edition.