Robin O'Connor says a friend has paid �200 for computer support after someone called her 'out of the blue'. Is that a risk?
A friend received a phone call out of the blue yesterday from a company claiming that her computer showed a number of problems which they would be able to fix remotely. My friend doesn't know a great deal about computers and was persuaded to part with �200 for a four-year contract, allowing the company to access her machine to fix any problems. She told me she was thrilled to see her cursor moving around the screen "all by itself", which seems to indicate the company had, indeed, gained control of her computer. I looked up the company on the net and they do seem to have a solidly-based operation, in business since 2007 with a money-back guarantee. Two questions: How did they get her phone number and know she was a computer user? And surely letting anyone have access to your computer remotely isn't a good idea. They may be in there to fix problems, but what's to stop them having a rummage around your private information while they're there?
Robin O'Connor
You don't mention the name of the firm or the website's address, but I'd be worried, and I strongly recommend making further checks. Although the UK's Advertising Standards Authority (ASA) now has the power to police marketing on the web ? as from 1 March ? it's not going to have much if any impact on sites that are not controlled by UK firms. Claims that the firm has been in business since 2007 and offers a money-back guarantee may not be true. Spelling mistakes and bad grammar often give scam sites away, but even a solid-looking website is no guarantee, because the design could easily have been stolen from a reputable company.
In the answer to a question about Unwanted support calls in 2009, I pointed out that: "There's nothing fundamentally wrong with remote support: it's a service built into Windows, and offered by, for example, the very reputable Geek Squad in the UK." However, I also warned against companies "cold calling", possibly from India, who "may seem to imply they are calling from Microsoft, but they aren't".
These companies claim there is something wrong with your PC and offer to fix it remotely. Since your PC doesn't have anything wrong with it as far as they know (they make the same offer to Mac and Linux users), and they don't actually fix anything, this amounts to fraud. They may install legitimate anti-virus software, but they could just as easily install "back door" programs to collect personal details or install malware. As you say, this puts personal data at risk.
You ask: "How did they get her phone number and know she was a computer user?" I suspect they got her phone number from leaked data sold cheaply on the black market, or leaked from an Indian call centre, though they could be working from phone books. Nowadays, the majority of UK homes have at least one Windows PC, so it wouldn't take many calls to find a potential victim.
Either way, this "cold calling" approach has grown dramatically over the past 18 months, with scammers frequently offering Windows services. (Other pitches seem to include replacement Sky boxes and Dyson maintenance.) We have covered the story in depth, and I recommend that you get your friend to read at least two of Charles Arthur's excellent reports: Virus phone scam being run from call centres in India (18 July 2010) and 'Microsoft support centre' scam continues, and takes turn for worse (1 March 2011). Ask her if anything in those sounds familiar. Microsoft absolutely will not phone anyone out of the blue, and reputable computer service companies don't "cold call" home users, so I suspect it will.
If your friend has been scammed, she could try the company's money-back guarantee. (The UK's Distance Selling regulations provide at least a seven-day cooling off period, if that applies.) But often the best approach is to contact the credit card issuer and get the transaction reversed. This may involve getting a crime number from her local police station. Cancelling charges has an impact on credit card suppliers and makes them less likely to deal with the companies set up by scammers.
She should also report what happened to Action Fraud, the UK's national fraud reporting centre, if only to get the sum added to the �4bn defrauded from British citizens, according to National Fraud Authority (NFA) estimates. Your friend can call Action Fraud on 0300 123 2040 or use the fraud reporting form on its website.
Unfortunately, but perhaps understandably, the "Windows service" scam does not appear to be a high priority at Action Fraud: it's probably a small part of the �38bn in losses just announced in the Annual Fraud Indicator. However, searching its site finds an advisory note from 10 November 2010 with the headline Identity theft scam warnings. This says: "People are being warned to be on the look-out for scams designed to trick them into divulging their personal details, following an increase in the number of complaints to Consumer Direct and Trading Standards."
Consumer Direct and Trading Standards have also reported a recent increase in complaints about a scam using Microsoft's name that targets internet users. Victims receive a phone call from someone claiming to be from Microsoft. The customer is directed to a website that allows the caller remote access to the customer's computer. The fraudster then appears to make a number of "fixes" to their computer. In fact, they gain access to the victim's personal information, often by installing malware. Again, this personal information can be used to commit fraud.
If everybody reported attempts at "Windows service" fraud ? and there must be thousands every day ? that would raise its profile.
Sad to say, as things stand, I can't see anything affecting the few hundred people sitting in an Indian call centre, using internet connections to call UK numbers at negligible cost and sell unwanted services. Still, tell all your friends. The calls will stop when everybody knows it's a scam and they can't get any takers, though I expect they'll just switch to a different scam instead.
No comments:
Post a Comment