Click Here, Not There

by Don Webb

Beware the gift-card scam
and shun
the clever “click here” info-snatch.

— with abject apologies
to Lewis Carroll’s “Jabberwocky”

“Wherever there’s money, there are people trying to get their hands on it.”
— a Bewildering Stories motto

One of the nice things about the Internet is that its crime is mostly polite. Racketeers have to ask your permission to burgle you. And yet we must beware of them and divine in advance what they’re up to.

Surely, everyone remembers the “Nigerian Prince” scam. But we don’t hear much of it lately, possibly because the scammers have been justly reprimanded — or disposed of — by real Nigerians.

A related swindle is the “sign for delivery” scam. You may receive a “shipment delivery notification” that appears to come from a courier such as DHL, UPS, Purolator, etc. The e-mail is usually well designed and looks official. Do not “click there.” If you expect a real delivery, sign for it when you receive it. And the same goes for reminders about e-mail services you don’t remember signing up for.

“Get rich quick” offers were followed by an opposite: the “mugged abroad” scam. An attorney — of all people — once purportedly e-mailed me that he had been robbed in London while traveling and needed money to live on while his passport was being reissued. Not only did I know where the gentleman actually was, I also knew he was the size of a professional basketballer. Any apprentice crook assigned to mug him would have turned and fled.

Today, the elderly, in particular, are being preyed upon by the “grandchild in distress” ploy. An editor of Bewildering Stories reports semi-humorously: “I got phone calls from men and women purporting to be grandchildren and asking for emergency money via Western Union. Enjoyed asking them awkward questions.”

Quite so; grandparents need protection, too. Let us prepare awkward questions of our own. Unfortunately, telephone scams have proved successful in swindling elderly who were unaware of “modern” fashions in fraud and were too easily swayed by crooks purporting to be government officials.

Related to the “distress” theme is the “gift-card scam.” Two varieties:

• Many different gift cards from many enterprises can often be bought in such places as grocery stores. These cards sometimes bear false numbers that have been substituted for the real ones. It may be possible to detect such counterfeits upon very close examination.

• The e-mail version is more elaborate. E-mail distribution lists were commonly used by discussion groups in the late 1980’s and 1990’s. And multiple e-addresses in the “To” line are still used today by organizations both formal and informal. Two examples:

1. A nice lady sent an e-mail message to about twenty fellow high-school alumni. A scammer obtained a copy of the names and addresses and, by reading the e-mail, became superficially familiar with the sender. The scammer then sent a message to the entire list individually, alleging an illness and the need to send a gift card to a relative. At least one person fell for it.

I wrote to the nice lady, saying that she might prefer to send “blind copies” (Bcc) to multiple recipients. That’s how Bewildering Stories sends a preview notice to the contributors in the forthcoming issue every week. If the recipients need to know how to contact each other, she could simply include the list of e-addresses in the message.

How could one detect that the lady’s e-mail had been counterfeited?

Her e-mail account is with gmail; the fake came from a Hotmail address.
Her name in the “From” line was written from a faulty memory. She uses her full name and does not spell it in full caps.

2. Second example: The Bewildering Stories Review Board is a discussion group straight out of the last century. We can’t use Bcc because, in our discussions, we need to do “reply all.” Someone managed to copy the distribution list. The Review Editors received individually a fake plea purportedly coming from one of our members:

[The putative sender’s wife, by name] and I just tested positive for Covid-19. and I need to get a Nike gift card for my nephew who is sick with cancer. It's his birthday but I can't do this now because I'm seriously ill, at the health center, and my doctor said I should stay indoors for some reason. I have tried purchasing it online but unfortunately, no luck with that. Can you get it from any store around you or try to order it online for me if you'll have any luck? I'll reimburse you as soon as possible. Let me know if you can handle this.

Our analysis shows first that the scammer is above average in his trade, but it concludes by pointing out a huge blunder:

Citing the wife’s name is a note feigning authenticity. And it reveals that the scammer has read more than one e-mail.
The choice of the “Nike” brand sounds authentic, too.
The nephew and illness look authentic to anyone who doesn’t know the family very well, but it’s actually standard scam.
The real person’s colleagues know that the illness attributed to him and his wife is impossible; it reveals the limits of the scammer’s research.
The name in the “From” line is accurate, but the scammer’s e-address is cw583271@gmail.com; the real person’s e-address is entirely different.
Finally — and here’s the blunder — the scammer chose to impersonate someone whose entire working career has been devoted to almost all branches of U.S. law enforcement.

One would expect colleagues ranging from the Secret Service to the CIA and to police departments generally to band together to unmask and defrock someone so infamous as to attempt, however obtusely, to sully the shoes of one of their own. Take a lesson from the “real Nigerians”: go get him, guys.