Scammer security

1

I got the craziest email from a client wanting to update her name the other day. No mention of why, like divorce. Typically, I see these as obvious phishing scams, delete, and move on. This one, while it sounds like it was written by a malfunctioning AI having a psychotic break, had the clients real SIN and birth date in it. That startled me.

For this client, my phone number on file is disconnected, so I’m just not emailing her and won’t do anything on her account until I see her in person. I don’t want anything to get diverted by whoever these jerks are and wouldn’t trust replies were from her. Ongoing, before these things get good, I’m trying to think how to get ahead of it.

What do you all do to verify anything you receive or calls you get are actually from your clients when something feels off?

This is the email:
Hello

I am looping everyone in FYSA

Effective immediately I am no longer {client’s full legal name}. My new legal name is {gives new last name}. Due to extremes brutality, identity stolen, scars, death, pictures, video etc. I will be including all original hard certified copy documents and training received,with confirmation of fraud all of Manitoba businesses including my mothers death. I will be travelling to the states to report and due my due diligence to report with paper trail, pictures and supporting documents including recommendations.

I can’t delete my Facebook and all social media. I have submitted my legal name to {full name with new last name}. Date of birth {real DOB}, SIN {real SIN}. Please mark all records with my name highly urgent.i have a heart birthmark: I trained with USA Homeland security and have confirmed records With RCMPP and my (worked for RCMP) all identification is stolen. I have submitted the appropriate documents with incidents and evidence. I can confirm with records, pictures, witnesses and life in general. They trashed all my houses!! I was from {small MB town I have no idea if she has ever even been to} from the valley, RCMP and other law enforcements in all government levels. They created DNA and authorities advised me a copy cats m. When I was 3 years old (from what I confirm with my eyes) I saw names, faces including the confirmation of 911 and Boston marathon cats. Confirmed animal rape and my own family murdered.

If you have any additional questions please let me

I am Princess {client’s first name} and my mom is Queen {no idea if it’s her mom’s real first name or not}.

Confirmed with all of the world! Copycats! They said I was dead! Signing off leaving for the states, I hope you find this email suffice. FYSA!

Sent from my iPhonek

2 Likes
2

My first inclination would be to hit delete. My second would be to directly contact the client, in person.

1 Like
3

You can play the role of the helpful idiot.

I did that two decades ago with so guy from Pakistan asking for money via WesternUnion. I foud a piece of WesternUnion payment slip and sent a blurred version to him and he called uncle. I unblurred it a bit and he started getting impatient. I unblurred and he went #$%^&*()_.

They are there to waste your time and you can waste their time too….if you time to spare or seek a bit of entertainment.

4

Any chance that it was your own system that was hacked and that the client’s information was gleaned from there? Might be worth double-checking?

5

That’s a very good question! I didn’t think of that. I’ll have my IT guy go through everything to be sure.

I did try to contact her, but her number no longer works.

I didn’t just delete and forget it because of the real information it had. It’s that next level that worries me here. I’ve never seen a phishing scam that already had info like that in it before.

I’ve done that too tedlemcpa! I had a guy trying to help me with my phone once. Started out asking if it was a Galaxy or something else. I told him I wasn’t sure what brand it was. It took him half an hour of fake trouble shooting before he finally thought to ask if it was an android. I told him again that I didn’t know what brand it was, but it had a picture of an apple when I turned it on. It was very entertaining when he called me some choice names and hung up.

6

The phone scams are quite simple and really because people put everything or too much on the phone. The are basicallly looking for things on your phone or what it connects to.

I have a few phones. By accident, I left my authenticators on the phone that does not have a card and have been doing it for years. I did buy one of those antennas from Japan to infiltrate phones but never got around playing with it like my lock picking kit. Lock picking does not seem all that easy even with the tool or I was sold some dumb kit.

7

Ditto @obhorst

If I couldn’t get a hold of the client by phone, I wouldn’t act on an email like that. Too likely a phishing scam. I’d expect the client to phone me or come to me in person with that kind of information. If you don’t want to delete it, at least don’t reply to it and don’t click on anything in it. Wait for the client to contact you by more verifiable means…though AI is now getting good at copying a person’s voice, so you have to beware of strange phone calls now, too.

8

There are many ways that a “real” DOB and SIN can be found…generally via a third-party hack and posting on the Dark Web, pastebin etc. That you are connected to that indicates only that someone has also (probably) compromised her email account. Either that or she’s a bit mentally struggling (the email is…um….strange).

For what it’s worth, when anyone contacts me about something…I either phone them directly, or contact them via a different method. ie if it comes in email, I’ll phone or text them to confirm.

9

Consider snail mail…