I miss being able to internet search email addresses.

[corbden@defcon.social]

I miss being able to internet search email addresses. Modern search engines simply refuse to do it.

For suss interactions that aren't obvious scams, but that could be a more subtle or target scam, it was a quick way to verify.

[corbden@defcon.social]

Update on the book promo offer.... SCAM

I had asked him for a website, and uhm, yeah, it looks legit on the surface, kinda, but tons of hinky vibes were popping off. The type of mixed messages that still *could be* legit, especially for a small business, but only caused more confusion. No sense of confirmed, "Oh yeah this is good" or "DEFINITELY SCAM" feeling that I'm used to getting after this much research.

But there was an image of the founder of the firm. Which seemed off, but she had the right number of fingers. I screengrabbed it and used an AI detector.

YUP.

Apparently you can just tell an LLM to make a whole-ass website for you? Which is why I got so many mixed messages. It's basically throwing a bunch of different deception techniques that defy the pattern recognition for lies I've come to expect.

But an AI-generated image of the owner of the company, well, that's a smoking gun that this guy is up to something. And if he's using AI, then the effort to spear-scam me with this level of detail is actually quite low, and totally worth just a few hundred bucks.

I'm updating my mental threat model.

If I had infinite energy, I could do an analysis of the website and our email interactions to explain what felt right, what felt off, and what I tried to dig into to verify, so that others know what to look for. (Anyone want to pay me to do this in case the job offer is also a scam? 😂 )

I'm currently thinking about what to do at this point. I could scambait him with great ease lol. Waste his time. (I did that with a sugar daddy scammer way back on Twitter... Wasted so much of his time over many weeks, plus it was really fun.) But that isn't without risk.

I'll be thinking about it.

For now, I sent him a short email to keep him on the line until I decide.

[corbden@defcon.social]

I study cult leaders and con artists for fun and profit. Yeah, you're gonna have to try harder than that!

Thing is though, there are so, so many hopeful authors who would fall for this. Who are falling for this. I want to warn all of them.

It remains to be seen about the job offer. If they so much as ask for a single nickel....

[corbden@defcon.social]

Update: Sadly, BOTH are scams.

Even the job. So I'm back on the job market.

Classic cashier's check scam, which is the one I suspected. She wants half the payment back now, under the pretenses that her sponsor has changed their mind about the scope of the project.

My credit union, aside from taking notes, isn't going to do anything about it. They suggest filing a local police report, just to have a record in case a pattern (that no one is looking for) emerges.

The check was issued by a Utah credit union. There are several names and addresses (all real – the one I dug deep into is a real business since 1979 with property associated with the real name) within the US that could be investigated. Likely, they have all been "borrowed," and "Karen" might not even be based in the US. So, I get it.

But like...

The guy on the phone, I know he couldn't do anything. But the logic he gave me is incoherent:

1. They don't investigate fraud crimes this small. ($2500.) It's just not worth it. They go after the million dollar fraud crimes.

Counter: But shoplifters? Drug dealers making $50 a week? We'll go after those!

2. The problem is way too big to solve. There are just SO MANY DAMN SCAMMERS that no one can tackle it.

Counter: Maybe the problem is so big because nothing is being done about it. We've made this easy.

3. These guys are just hitting so many people at once, especially now with AI.

Counter: See point 1 FFS. The more people they hit, the more evidence there is against their ring.

4. But DO report it to local police so that if a pattern is established (by who?) they'll (who?) have evidence (how?).

If law enforcement is too busy jerking off for the whims of the Epstein Class, it seems like it would be in the BANKS' best interest to get together and solve this. It seems like they'd be losing a lot of money from victims who can't afford to pay it back.

(When the big issue was credit card skimming and other forms of CC fraud, they DID get together and solved a large swatch of that problem.)

This seems like low-hanging fruit for them. Get together, form a finance-backed vigilante fraud squad, document everything, connect those patterns, and do something!

My "bank" is actually a very large credit union. So if the for-profit banks won't do anything, it seems like these little guys could make a big dent.

🧵

[corbden@defcon.social]

"Karen" might not even be in the US. But there is a CRIME IN PROGRESS that I reported the moment I confirmed it was a crime. The check hasn't even cleared yet. (It won't.) I have her pending in email waiting for my reply, waiting for me to send a cashier' check to a REAL US address! (It's residential.) I could say or do anything to keep her on the hook while more evidence is gathered, that between these two financial institutions, at least has a chance to make "her" job more difficult. And at best, could catch someone picking up the drop.

I could even do half this investigation myself. I already have with the low-hanging OSINT data! It's not *hard,* just no one has the will.

Hell, under these circumstances, "Karen" wouldn't even need to disguise the names and addresses. Because no one cares. It's just open season out there when it comes to fraud.

🧵

[corbden@defcon.social]

I will not be investigating further on either of these two scams. (The other guy is also still on the line, just emailed me today wondering why I'd ghosted him... I could still mess with him.)

I could still contact the issuing bank of the check. Someone wrote a bad check using their institution, and clearance is still pending. The crime is still in progress.

But the thing is, I don't have access to complete the case. The banks and LE DO. I don't have the power to do anything with any information I do dig up, and any problems I could cause these two by scambaiting them, risks retaliation that I can't protect myself from because they know who I am.

Further, I don't have the time and energy to do this. I'm disabled and looking for work (again). I have wasted enough time on these as it is.

I'd be eager and willing to offer my full cooperation to an investigation if I had the backing of institutions bigger than me. I've got some skills even (unlike the seniors the CU said had the worst end of it, which is true.)

But I can't go all Kitboga rogue on their asses. That's a full time job.

Meanwhile, .gov will put up a website!

https://www.helpwithmybank.gov/help-topics/fraud-scams/fraud/check-fraud/fraud-cashiers-check.html

Anyhow, I've covered my own ass by making the call and lodging a record with my bank. I wasn't any part of this scam. I won't spend the money, and I won't finish the work.

I guess I'll reply to her telling her I will not be sending her any refunds, as we have a contract (I have her signature, even if it's fake). I will not tell her she is suss. Let's see what she does.

I'm placing my bets on escalation to heavy manipulation and verbal abuse? As if I didn't have enough to worry about.

🧵

[edelruth@mastodon.online]

@corbden

We used to be able to look up a phone number in the phone book. Now, if we try to find out who was calling from that weird area code, we run into a paywall.

[corbden@defcon.social]

I know the difference between this and credit card fraud... why they care on the latter.

Because they felt competitive pressure to offer fraud protection to make the consumer only liable for $50 or less, and that means fraud losses come out of their pocket.

Bad check losses though, fall to the consumer. It transforms into consumer debt. Yes, some consumers might default, but that gets folded into the risk calculation of normal debt (I'm guessing), and we know the shell games they play with THAT risk (hi 2007). So they have zero motive. It doesn't hit their bottom line in a way they can't leverage to their benefit.

The invisible hand of the market can move mountains, if it's under pressure to. But if it's diverted that pressure to the consumer, well, it's free to stroke itself.

https://www.helpwithmybank.gov/help-topics/fraud-scams/fraud/check-fraud/check-fraud-fdic.html

I love how the opening paragraph on this article about if the account holder is liable for fraud says "Not necessarily..." and the rest of the article is "But yes, actually. You are."

https://www.helpwithmybank.gov/help-topics/fraud-scams/fraud/check-fraud/check-fraud-liability.html

On the upside, there's a link to file a fraud complaint at the FTC. I will do that. (It'd be nice if my CU had told me that.)

🧵

[davidtheeviloverlord@mastodon.social]

@corbden

Maybe report him to Virginia Strauss at Writer Beware?