“I am calling you from Windows”: A tech support scammer

I was still on dial-up and I don't think any of my credit cards offered virtual numbers at that point, but I should have set up a card with a $0.00 or $0.01 limit and given that to him, and then sicced fraud services on 'em.

I'm not advocating for his actions, just offering another point of view. Is it always correct to assume that the guy who xut you off in traffic is just an asshole, or does he really really need to be somewhere right now (eg. a hospital)?

They probably imagine you as some affluent white guy with servants and sports cars who wouldn't miss a few K from his bank account.

Pretty much everyone universally reports that these aren't skilled workers. They're given a script, and they read it out. Their job is to deal with branches effectively and direct the conversation back on the script. They've been told that the person they're talking to has a virus--as reported by the company's skilled team of real elite computer gurus who claim to have fancy degrees from IIT or something--and they're apprentices who have the ability to help out those poor souls who probably have actually been downloading viruses of one sort or another.

There's no reason for them not to believe that the procedure that they've been given is something that will help their marks. The list of phone numbers? They definitely don't generate that themselves. I can imagine a workflow that insulates them from anything that reveals that they're pawns in a scam. Combine that with the fact that the job is probably relatively decently paying and "white collar" and the natural human aversion to thinking that you're doing a bad thing, and we've got an explanation.

Modern companies rely on abstraction as much as they can. If you build a service oriented architecture for your company, you decouple the explicitly evil part of what you do that requires a uniquely sociopathic personality from the more banal customer service oriented part that can be fulfilled by commodity labor.

I envy your innocence.

Let my try to explain this with evolutionary algorithms. People have been running simulations of social life for many years. That's how we know that social contract "cheaters" naturally evolve. The same type of simulations have shown how "punishers" also evolve. And how complex group dynamics become long terms stable with all of these roles and then some.

Is there something in a culture (besides wealth discrepancy per se) that makes this sort of thing more OK?

No, this is universally true of humanity.

Operating/creating a machine that causes death is quite often reframed as "defend" or "save lives" in certain situations that stretches this definition. This happens is a "large scale" everywhere.

I think implying that it is something inherent to the place (or the culture) where the scam is taking place is utterly wrong. The reason in this case for the scam to come from India is not cultural - it is simply a case of economics.

Then I went for the guilt trip: "how do you feel trying to destroy people who don't know how to protect themselves", etc etc.

The guy did the whole "I don't know what you mean blah blah blah" for a while, and then said he'd get his boss.

I heard him talking to the boss for around 30 seconds, and then the phone hung up.

I came out of it convinced (in this case at least) that the person on the phone really had no idea they were running a scam - they were just given a list of numbers to call and a script to run.

Once a few these are processed, that merchant account can be shut down... it's a fraud.

It's not at all. Very few end user support tools are VNC or RDP based. Most of them use services like LogMeIn or GoToAssist. I've received a few of these calls where I strung them along and they were all using one of the two listed above (most used LogMeIn). I did encounter one that was using an off-brand tool, but it was commercial and not VNC or RDP based.

Even if they were using something like VNC, you couldn't run a custom server to troll them, because the connection is initiated in the inverse of what you're used to when controlling a remote computer. They don't connect to your machine, you run an executable, which initiates a connection from your computer to their server.

It's not just fun, it's a very responsible thing to do. Every minute they spend with you is a minute they don't spend screwing over someone else.

But don't end with "Ubuntu doesn't have that" or "I only have a Mac, sorry" or some other snarky comment. Just fake stupidity until they give up. They are constantly tuning their scams based on successful and unsuccesful cons, and if they realize you're screwing with them they'll just filter you out of that. Or worse, they'll realize that "calling from the windows" tipped you off and change it to "Microsoft Support Associate" or something.

If you instead come across as someone who believes the "calling from windows" bit, but for some reason aren't able to open the remote control software ("i try to download it but the screen moves?" or "when i click RUN, it says dotnet could not complete the operation?"), you will reinforce the stupid parts of the scam, and possibly have them waste time trying to research the technical difficulty you "experienced".

http://blogs.msdn.com/b/securitytipstalk/archive/2010/03/09/...

Obviously there's a fine line to tread between playing dumb enough to keep them on the hook and playing too dumb to be useful.

(Haven't had one of them call since, alas: refining your technique is hard if you don't get enough practice calls.)

For me, the most frustrating part of the experience is that regardless of what you say, they follow their script to the letter - they're like method-actors which never get out of character. Just once I wanted them to say "ok - you got me!" but alas - apparently not having a PC or Windows is not enough to sway them.

Some of these spoof there CLID, and use VOIP dialouts alot as well, so you need to log time and duraction of the call as well as the CLID presented. Any other details you can obtain from them like pretenting you want to do a instant BACS transfer of money to them or need to call them back etc to get more details the better.

You get a scammer, they've sent their [spoofed] number, you ring it and get 'boo-boo-boop this number is not recognised'. The phone company knows the numbers that aren't taken because they use that list when you set up a new phone line.

Though it does just strike me that it's possible the number actual did terminate but the scammers pretend it didn't; but that seems a long shot.

One time the Asian guy on the other end (who couldn't pronounce what he said was his name) accused me of wasting his time and said that they were going to invoice me! That was probably the funniest.

After a couple of goes around it gets boring. Now I just go along for the first bit and then say I have to put the phone handset down to type and leave the phone on the side until it screeches at me that I've forgotten to put it 'on the hook'.