Quarter of adults have been targeted by fake call centres

The cold-callers usually claim to work for Microsoft and get the user to run common system tools, using the results to 'prove' that viruses on installed on their computer. The next step is to trick the user into giving them remote control of the computer, followed by instructions on installing fake anti-virus software.

 

In the best-case scenario, the fake AV software merely reports that it's found lots of viruses. The user is then asked to pay a nominal fee (around £30) to activate the software to remove the 'malware'. However, the worst case scenario is that the fraudsters take a lot more.

 

This can include stealing the credit card details used to provide the initial payment. However, it's what the hackers do to the target computer that's often worse. Using remote control software they often install other malware, which can be used to steal private data such as bank account details, or use the computer to launch attacks against other systems or even send spam email.

 

"Given that our latest research indicates 80% of UK internet users have never heard of these ‘IT helpdesk’ scams, yet almost a quarter have been approached by them, it is vital that we make people aware of this threat," said The Rt Hon Baroness Neville-Jones, Minister of State for Security.

 

The fact that the warnings are now coming shows how big internet crime has come, with fortunes being made illicitly by well-organised gangs of criminals.

 

"This is big business. In recent cases, we have seen gangs employing 300-400 people to run their operations and using call centre-scale set ups to target victims en masse. They can also be paying out as much as $150,000 a month (on a pay per download basis) to individual webmasters who are unwittingly advertising their fake software – this level of investment from criminals indicates that the returns are much heftier than this," said Sharon Lemon OBE, deputy director of Cyber Crime at the Serious and Organised Crime Agency (SOCA).

 

What's particularly galling about these attacks is the way that they use social engineering and well-known tools to bypass security software. Typically, in our experience, the hackers trick users into installing a version of LogMeIn for remote control. As this is legitimate software, the hackers can get remote control of a computer without causing any warning messages to go off. Once they have remote control, they can install fake AV software and prey on our fears and knowledge of viruses to extort money.

 

"The general public is more internet security-aware than it was five years ago - malicious AV scams are an indication that criminals are now tapping into this. Rather than exploiting our ignorance – the basic premise of common scams such as phishing - they are actively using our knowledge and fear of online threats to their advantage," said Dr Emily Finch, criminologist at the University of Surrey. "The one-to-one nature of the telephone calls also signals a more invasive approach. Whereas tactics such as the Nigerian 419 garnered success by being ‘faceless’, telephone calls use the personal touch to gain trust. By knowing just a little bit of information about someone (e.g. date of birth, full name, address – easily obtainable by fraudsters who know where to go), criminals begin to sound credible and plausible in their approach"

 

Get Safe Online recommends that people ignore unsolicited calls from a company, regardless of how many private details they know - it is impossible for any company to know if your computer is suffering from a problem or not. Do not install any software that a cold-caller tells you to. Ignore all pop-up Windows when you visit a website telling you that you have a virus; a website cannot know this. Finally, install a recognised anti-virus application.