Postcard from Bishkek

I have to admit that, although I understand why they were developed and people use them, I hate spam filters.

Please, don’t misunderstand me – I hate Spam!, but I probably hate spam filters even more!  They are like computers and technology in general … they offer so much and when they work they appear to be wonderful and really useful … the trouble is that they don’t always work – or, at least don’t work well, and do what they are intended to do.

Not long ago, for example, we received a booking at the hotel … by email … and responded with a confirmation.  Then we received a message asking for a response to the earlier message.  We didn’t understand – we had responded and replied accordingly with another copy of the confirmation.  A little while later, our first message was returned to us – it had been rejected by the receiver’s server which “thought” it was spam.  So we sent it again with a cover note from a different address … this one apparently got through because the client replied – apologetically – thanking us for the reply but saying that, as he hadn’t heard from us he had since booked with another hotel.

If it had been “snail mail” the postman wouldn’t have filtered the communication, he would have delivered the message and it would then be for me to decide what to do with it … read it, act on it, reply to it or file it – for example in the waste bin.  It would only be “returned to sender”, (as Elvis Presley put it), if the address proved to be wrong or for some reason it was rejected by the recipient (although that might involve a special “return fee”).

There is of course, a difference between the postal service and email.  The customer who posts a letter pays for the service – he concludes a contract with the postal service who have an obligation to deliver it to the address they have been given.  In the case of email, the situation is not so clear cut … but it seems to me that, in principle, it’s the same … the internet providers have an obligation to deliver the message if at all possible.

In this particular case the recipient – or his Internet Service Provider – had installed a filter which not only marked a message as “suspected spam”, but actually rejected it.  The one good thing about the filter used in this particular case is that it bothered to tell the sender, (that is, us), that it had been unable to deliver the message … so that we could, at least, try to do something about it.

Now, my email engine comes with an automatic spam filter … and I can’t turn it off … but, at least it receives the messages and siphons them off to a special folder.  That means I can then, at least, look at the messages and decide what I want to do with them … and, to be fair, most of the time – that is more than 50% or the time – the messages can indeed be considered spam … BUT … a number of them are not.  In my opinion a substantial number … OK, in my opinion, even one message is substantial … in the example above it actually cost us business.  Depending on the content of the message – it could be even worse.

As I said … I hate spam … and I get a lot of spam – but, to be fair, it’s not as much as 90%.

For the record: it is said that the first email spam, was an advert for a presentation by Digital Equipment Corporation and was sent out to all users on ARPANET (several hundred users) on 3rd May, 1978.  It wasn’t until the 1990s that the use of the internet for mass advertising really took off … and it’s estimated that nowadays something in excess of 90% of email messages constitute spam.  It is also said that most spam is received in America and Europe – which isn’t all that surprising … but we get our fair share of it here in Central Asia as well.

I go through the messages in my spam box and look at each one … and, although as I said, some of the messages are not in fact spam, most of them are … and are duly ignored or deleted.

Amongst the spam messages … there are a number which are particularly galling.  Not the adverts that are trying to attract my attention … they are unsolicited emails so in one way count as spam but because sometimes – just sometimes – they contain interesting or useful information – so they don’t really qualify under the definition as being “unwanted” emails.

The ones I am thinking of are the “scams“.

 

I recently came across an interesting feature article: Internet Scams That Still Fool People.  They weren’t all email scams, but the vast majority were … and I have received, (and ignored), examples of most of them.  Included among them were:

The so-called “Nigerian” scam:

This is one of the most common all Internet scams and the name refers to the fact that it first came to prominence in messages claiming to come from Nigeria.  The scam apparently has a history that long predates the internet … by maybe a hundred or so.   

It is often claimed that the author is something like a “rich Nigerian prince”, who want to share some of his fortune for philanthropic purposes, or as an investment; or maybe it’s a banker who gain access to a large sum of money in a frozen account, … or well, you have probably received several of these so I don’t need to enumerate the various versions that I have see.  The catch is that, in order to receive your share of the money that he is offering, you have to cover various fees – for example, in order to transfer it into a new account.

In the days before the internet, of course, such messages were delivered by post … and apparently, some people are still using the post.  Some time ago now, I received a visit in the office from an acquaintance, a lady of some age and experience, intelligent and well connected – by no means a simple person – who was in charge of a small charity which had only recently opened and been registered.  She was in a somewhat “excited state”.

After we had completed all the customary pleasantries without which a meeting cannot start, she reached into her bag and pulled out an envelope … and somewhat breathlessly handed it to me read.  I was somewhat taken aback … it was in English, which is why she had brought it to me … although she had tried reading it, the only thing that she had seemed to have registered she really understood was the mention of “1,400,000 dollars”.  It seems that one of her relatives knew a little English and had said something about the sender wanting to share it with her charity.   What, she asked me, did she have to do to get the money?

I have absolutely no idea how the sender had got the name and address of the charity – as I said, it had only just started work and been registered.  I felt really sorry for her as I explained that it was 99.999999999…% certain to be an aphorism - a con trick or scam …  showing her copies on my computer of similar letters that we had received by email.   Even faced with this evidence and agreeing with me about the dubious nature of the missive, I could see in her face the reluctance to accept, after all – as they say here: Nadezhda oomeraiyet posledniye  – “Hope is the last to die”.

Incidentally – I have also seen a similar letter in Russian…

Similar to this are the “inheritence” scams … someone I have I have never heard of has died and left me lots of money … yeah?, really?  Is that likely?

Some of the scams are honest enough to admit that, no … the legacy is not for you, but they want you (or me) to pretend to be a long lost relative and claim the inheritance.  I suppose that if someone agrees to go along with this and participate in such a scheme it makes it more difficult to back out (having already made themselves a potential hostage to blackmail) or complain to the authorities when somebody starts asking for payments to pay “fees” and make the necessary arrangements.

The “Congratulations – Your a Winner!” scam

A congratulatory email will land in your inbox stating that you’ve won a prize … maybe a large jackpot in a foreign lottery, and inviting you to claim your prize.  

The catch is that all you need to do is pay a “processing fee” …

For the record: Lottery holders are pretty clear about who is eligible to win the lottery and how they have to win it. Usually, foreigners cannot win national lotteries, and Lottery organizers would not contact winners via email – even if they knew the address – to inform them that they have won.  

I first came to Kyrgyzstan I had a UK lottery ticket which was still valid after I had left the country … so I left it with a friend, (trusting, of course, to his honesty and fairness), because, if it did win – I wouldn’t be able to claim the prize.

You may never have bought a ticket … but that doesn’t matter because, perhaps,  it’s you’re email address that has won, having been selected at random … and, I suppose, that helps to explain how they got your email. 

Similar to that is the:

“You’ve won an award” scam

This is sent to businesses … and they’ve obviously got the address from a business directory somewhere.

We often get, for example, letters that we have won an award as “Gold Star” hotel … perhaps based on reports, nominations and recommendations from previous guests.  It’s all free – there is no charge … no administration fees … but we have to go and attend the ceremony in some far flung place … well, it is for us … the costs of transport, accommodation, meals and the various events at the function do mount up – and are presumably inflated by hidden fees and commissions..

It’s not exactly an internet scam, but here there has been a spate of SMS telephone scams … and another acquaintance told me how they had received a call saying that such and such a company is running a promotional campaign … a lottery competition in which their number has been drawn as a winner …  but to receive the prize they had to pay “the tax” which they could do by paying it into a special account and when they  had done that, then their telephone account would be credited with the “prize”.

There was always the added pressure that the campaign was about to close … so they had to do everything that day … yes … right … and the “tax” account would be cleared out before anyone realized that their phone account hadn’t been credited with the prize money.

As I often tell the kids, as a general rule – and not just for the Internet – anything that claims you’ve won, when you never entered in the first place, is a scam.

As the saying goes: If it seems too good to be true – it probably is!

The Lucrative Job Offer:

Apparently many scammers are using popular job sites to find potential scam victims – but it seems that they’ll also send out messages to anyone on a list on the off chance.  They send a message claiming they have an unbeatable job offer … for you … but the catch is that in order to be considered for it, you’ll need to give money up front and provide your personal information for “tax purposes”.

Yeah!  Right! that sounds likely doesn’t it.

Phishing expeditions

Phishing is a common form of scam that uses fake websites and credentials to try and trick someone into providing personal information – like account numbers and passwords.  These mimic messages from real websites or firms … banks, ebay, on-line stores and so on.  They look exactly like the “real thing”, using all the logos, graphics, layout and so on … except that the links you are invited to click on take you to a phoney site where, once again, everything looks real … but the information that the user types in goes straight to the scammers, (who then use it to change the password on the real site, empty the account and steal the person’s identity to use elsewhere).

I really hate getting these pretending to be ebay or some other site that I don’t use … it’s so obvious that it’s a scam.

Once I did get one from someone pretending to be a bank that I do use … but it seemed so strange that they would use email to contact me like this by email, (especially as they have an extremely convoluted security system for their internet banking service), and so the first thing I did was to check the links … and sure enough, they were fake … so I sent the bank a message along the lines of, “I thought you would like to know that I received this …”, together with a with a copy of the email.  I am not sure what surprised me most about this incident, that a phishing expedition would be mounted on customers of a Kyrgyz bank here in Bishkek – or that the bank never even acknowledged the email – yet alone, as far as I am aware did anything about it.

The plant:

The article also mentioned the fake virus scan that, instead of identifying and eliminating viruses on your hard drive,  actually installs a virus on your machine … perhaps an example of Ransomware  which threatens to trash your datafiles if you don’t cough up the dough … I understand that there are sites that manage to do this by getting the surfer to click on particular links that then download and run the programme.  Although that’s not strictly on topic as it’s an on-line scam … we do seem to get a lot of strange files sent as attachments … and many of them are more than just a bit suspect.

I once received a notice to appear in court in the United States, purporting to come from a firm of lawyers who were acting as the “clerk to the court” with the warning that if I didn’t turn up then the judge would decide the case in my absence … the relevant paperwork about the case was in the “attached file”.  If I had any questions I could “get in touch” and was given an address to contact.

As I sat wondering what on earth it was talking about … a court case? … in Texas? … and ignoring the temptation to open the file I moved down the inbox to read the rest of the mail.  By the end of the list I had two more similar emails … from the same email address … but with different cases being heard on different days … and “signed” by different people.

Unlike the ordinary Phishing attacks, the email address and the links quoted in the message all looked fine … until I did a Google search on the firm … and discovered that it was a good, well established, reputable, large firm – with an office in the appropriate city – the web address for the home page of the site was correct, but the signatories were all probably phony in that they weren’t listed on the site and there was still something wrong with the email address …   and then, when I got the hotel, I found two more similar, but slightly different, messages waiting for me …

I decided that I was being shouted at … loud and clear … SCAM! SCAM! SCAM! (… “and what I say three times is true”!!!)

… but, the interesting thing about ths incident (an the reson I am writing about as a plant and not a phishing attack), was that one of the messages on one of the three computers which received the messages … was picked up by one of the virus scanners installed as “infected” … oddly enough the other messages all passed the malware scans – even when tested with the same scanner.

I write to the law firm because I thought they would like to know that their name was being used in this way … and someone apparently found a way to attach a fake email address to their server … interestingly enough they was no response – not even an acknowledgement.  And this is a firm where a former President of the United States apparently used to work as a student intern.

 

The article went on to list a number of other scams, but as they basically operated on line and didn’t involve emails, I’ll pass over them here.

I think, however, that they missed some  … perhaps one of them was supposed to be number 15 on their list, (it said there were 15, but there were only 14 – I checked … several times).  One is what I call the:

Help me! scam

You receive an email apparently from someone you know who claims to be somewhere away from home and have been robbed, maybe they are in hospital, and they are totally devoid of funds, credit cards and any other visible means of support.  Can they borrow some money which they will repay you when they get back home.  Please send them by Western Union or some other service $x.  If you reply then they provide you with some tidbits of personal information to prove that they are who they say they are … but it’s not true … maybe their wallet has been stolen … maybe an on-line account has been hacked … and maybe they know enough to know that you cannot contact them in any other way (maybe the person is away from home, traveling).

Then there is what I call the:

Credit card order:

This is something that we get two or three times a day … a booking or request for services … usually quite a valuable order … and to make it more attractive the “client” offers to pay in full … by credit card.  The trouble is that if you take the booking then either:

1.) they’ll cancel and ask for a refund – but ask for it to be sent to a different bank account – maybe their is a problem with the credit card they used originally and the account has been closed …  or …

2) can we do them a favour and pay a bill for them – add the cost to our bill and add a commission to pay ourselves for the trouble – and … or …

Well, you get the idea … they’ll want you to do something … so that they can get their hands on the money which is presumably coming from a stolen credit card.

 

Fortunately, the banking rules here are quite strict … although exceptions can be made, the banks basically want the card holder present during the transaction, whilst the card is swiped through the terminal and to sign the slip … and they tell us that refunds can only be made to the same source … and payments to third parties abroad attract a stinging “non-residents” tax (unless you have the relevant paperwork … which, of course, is not available) … so even if we manage to get past the initial stage of the correspondence … we’ve got a fairly easy let-out … without actually having to tell someone that we think they are a crook.

I say, “if we get past the initial stage” … it is actually getting harder to spot some of these scams early on … as the perpetrators are getting cleverer and cleverer.  It used to be, for example, that:

• when a message was typed in UPPER CASE LETTERS that was a sure give away that something was amiss … but nowadays they seem to have found the caps lock key,
• they used to refer to “your country” or “your place”, or order tickets for a flight between Johannesburg to New York via London – and back (… why on earth they would they want to order those tickets for that itinerary from a travel agent in Central Asia????), but nowadays they actually customize the messages to refer in some way to Kyrgyzstan …
• they used to have email addresses from a generic free provider like gmail or yahoo, but now thy use other addresses which are either not so obviously from such a general third party server, but they even manage to hijack addresses off real servers …
• they used to tell you up front the whole story – “we’ll pay in full in advance by credit card” … but now they may not say anything about payment in the first email … but wait for a reply and then confirm “Yes, that’s fine … please charge my credit card … here are the details …”

… and so on …

These days I am even getting these messages in Russian … but not yet in Kyrgyz  although I suppose that this is probably just a question of time.

 

Although a lot of these scam messages are detected by the spam filters … unfortunately not all of them are … a fair number get through to the regular inbox … and then I still have to go through the spam box to see if any messages have been wrongly identified … to I can’t escape these scams altogether anyway …  so, perhaps you’ll understand why I say that I hate spam filters as much as, if not more than the spam itself.

Tags: internet, Marketing