Three tech-support scammers charged with ripping off the elderly

Three alleged tech-support scammers have been charged with bilking the elderly out of at least $1.3 million for tech support services they didn’t need and never got.

The US Attorney’s Office for the Southern District of New York announced on Friday that the three had been arrested the day before.

According to a complaint filed by FBI Special Agent Carie Jeleniewski, the trio would allegedly cold-call their victims, running through the standard tech support scammer’s ruse of claiming to be from one of the big computer companies and warning the victims that their computer was infected with a virus. This went on for years, starting at least in 2013 and continuing on up until this month.

In fact, while investigators were interviewing one of the defendants, Gurjet Singh, at his home in Queens, New York, a carrier truck pulled up to deliver a check made payable to NY IT Solutions Inc. – one of the companies the alleged fraudsters set up to deposit money mailed in by their victims. According to the criminal complaint, Singh had been in the midst of explaining to officers that he collected checks and then wired the money to Gunjit Malhotra, from India. Singh’s cut of the allegedly swindled funds: 8%.

The defendants are Malhotra, 30, of Ghaziabad, India; Singh, 22, of Queens, New York, and Jas Pal, 54, also of Queens. They’ve each been charged with one count of conspiracy to commit mail fraud, which carries a maximum sentence of 20 years in prison. They’ve each also been charged with one count of conspiracy to access a protected computer in furtherance of fraud, which carries a maximum sentence of five years in prison. Maximum sentences are rarely handed out.

Singh was also charged with aggravated identity theft, which carries a mandatory minimum prison sentence of two years in prison.

You have a virus! That will be $662.99, please

The first victim described in the complaint reported to police in March 2018 that her computer stopped working. She got a pop-up that instructed her to call a phone number for repairs, so she did. She was connected to someone who claimed to be from a well-known tech company and who told her that she needed extra security. A private carrier would drop by her New Jersey home and pick up a check for approximately $662.99, she was told.

Then, somebody remotely took over her computer and, purportedly, “repaired” it.

When the woman gave investigators her supposedly infected, the supposedly repaired computer, they saw no repairs. What they did see was a “Google search engine” saved to its desktop… except that it wasn’t a search engine. Rather, when investigators accessed it, it popped up the phone number to call for “repairs.”

The scammers got to other victims by cold-calling their targets and telling them their computers were infected with viruses. Sometimes, they laid it on thick by throwing in the specter of Russian hackers who had planted “multiple viruses.” You’d best download our software so we can remotely “fix” your problem, the victims were told. Plus, we should set up a service plan in order to keep this “service” (and, of course, the victim’s checks) coming.

Sometimes, the victims called the scammers, after having hit upon fake tech support ads that came up when they ran searches for help.

The fees varied – $225, $350, $399, or 5-year “plans” for $799.99. One victim sent in eight or so checks that added up to the shocking sum of $65,810… and then sent in yet another 10 checks that totaled about $70,805.

The typosquatting/malvertising tool kit

Pop-up windows, cold calls, malvertising and fake ads are all well-known tools in the tech-support scammer’s kit. In 2017, researchers at Stony Brook University rigged up a robot to automatically crawl the web searching for tech support scammers and to figure out where they lurk, how they monetize the scam, what software tools they use to pull it off, and what social engineering ploys they use to weasel money out of victims.

What they found describes how the victims in this recent swindle got caught.

They found that users often get exposed to these scams via malvertising that’s found on domain squatting pages: the pages that take advantage of typos we make when typing popular domain names. For example, a scammer company will register a typosquatting domain such as twwitter.com.

Studies have shown that visitors who stumble into the typosquatting pages often get redirected to pages laced with malware, while a certain percentage get shuffled over to tech support scam pages.

Once there, a visitor is bombarded with messages saying their operating system is infected with malware. Typically, the site is festooned with logos and trademarks from well-known software and security companies or user interfaces.

A popular gambit has been to present users with a page that mimics the Windows blue screen of death.

The frequency of fake blue screens of death has over the years turned “Microsoft” into a red-alert word. According to Microsoft’s 2018 global survey, three out of five Windows users had encountered a tech support scam in the previous year. The number’s dropping, Microsoft said, but not fast enough: the scams are still going strong, targeting all ages and all geographies.

And no, you’re not immune from the siren call of tech support scammers if you don’t use Windows. The wolves pull on plenty of other sheepskins, such as pretending to be calling from Apple or other big-name tech companies, and festooning their sites with such companies’ logos.

But Microsoft has waged a particularly long-drawn-out battle, having been at war with these scammers since 2014, when it dragged multiple US companies into court. That’s also when it began to collect customer complaints about the scams via its Report a technical support scam portal.

What to do

Many elders are sitting ducks for these fraud slingers. Two years ago, when the Federal Trade Commission (FTC) launched a crackdown on tech support scammers, it released a 48-minute scam call featuring an actor portraying one of these scammers’ preferred prey: a tentative, gullible, easily sweet-talked, elderly man.

As part of its Operation Tech Trap – a broad crackdown on tech support scams both in the US and elsewhere – it passed along these tips on what to do if you get an unexpected tech-support call or pop-up:

• Hang up on callers. They’re not real tech-support staffers. And don’t rely on caller ID to prove who a caller is. Criminals can spoof calls to make it seem like they’re calling from a legitimate company or a local number.
• If you get a pop-up message that tells you to call tech support, ignore it. While there are legitimate pop-ups from your security software to do things like update your operating system, you shouldn’t call a number that pops up on your screen in a warning about a computer problem.
• If you’re concerned about your computer, call your security software company directly – but don’t use the phone number in the pop-up or on caller ID. Instead, look for the company’s contact information online, or on a software package or your receipt.
• Never share passwords or give control of your computer to anyone who contacts you. Doing so leaves your computer open to malware downloads and backdoors.
• Get rid of malware. Update or download legitimate security software and scan your computer. Delete anything the software says is a problem.
• Change any passwords that you shared with someone. Change the passwords on every account that uses passwords you shared.
• If you paid for bogus services with a credit card, call your credit card company and ask to reverse the charges. Check your statements for any charges you didn’t make, and ask to reverse those, too. In the US, report it to ftc.gov/complaint.

Tips are all well and good for those of us who have the wherewithal to absorb them. But the elderly, all too often, don’t have that capacity.

With great power comes great responsibility: If you’re one of the tech-literate, please do keep an ear out for any friends, relatives and neighbors who get flustered with technology and bewildered by pop-ups. Let’s all try our best to protect loved ones from scammers who are more than happy to sweet-talk or techno-babble-bedazzle their life’s savings out of them.