What's the worst scam you have seen / heard of?

[Bismut]

Someone has recently tried to scam me by sending a fake AirBNB link, which I luckily spotted before actually doing anything (other than checking with AirBNB themselves whether it was a scam).
My mother thought that the whole thing was legitimate when I told her about it, which kind of worries me about how easy it would be to scam people like her, who do not care about tech.

What are some of the most egregious, sneaky or otherwise impressive scams you have seen, both online and IRL? It would be nice to have some examples to tell to non-techy people in our environments so they can protect themselves a bit better.

[Needfuldoer]

The unending robocalls for reverse mortgages, credit card scams, and Medicare this-and-that are the most insidious, because they prey on old people who don't know any better. No, grandpa, "Visa Mastercard Discover" will not call you to magically lower your rate.

[Dedayog]

My favorite is the "IRS has locked your social security number" type ones.  

 

 

[Rarity]

the one where something is downladedd (usaully going like , you first have to download this app to acess services etc ) on the phone , and it steals ur id passwords etc ..

[da na]

I got a genius one. Fake UPS one, said a package couldn't be delivered, so give us your full name and address and we'll send your package.

[Bismut]

5 minutes ago, da na said:

I got a genius one. Fake UPS one, said a package couldn't be delivered, so give us your full name and address and we'll send your package.

I got a whole bunch of calls for UPS packages, I tried messing with them but they never responded when I talked

[cmndr]

One of my favorite youtube channels once had Elon Musk on saying you could double your bitcoins by sending BTC to some wallet. 

Surely a scam. 

[Bismut]

9 minutes ago, cmndr said:

One of my favorite youtube channels once had Elon Musk on saying you could double your bitcoins by sending BTC to some wallet. 

Surely a scam. 

I wonder which one that was ^^

[cmndr]

8 minutes ago, Bismut said:

I wonder which one that was ^^

I bet the channel owner has hapa children. 

[EJOE]

Cutco Knives

[Nagaram]

I used to work at a medical facility and we got calls all the time from people trying to lie to old folks about their Medicare being expired/faulty/cancelled. And they were in this weirdly authoritative tone trying to scare vulnerable people into sending mail orders or whatever to fix the issue.

 

Also, fake kidnapping/imprisonment scam. My grandma got a call from some who spoofed part of my cousins voice to say he's been imprisoned in a Mexican jail and needs money to be bailed out. But regular money transfers don't work so she needed Amazon gift cards. Fortunately the Kroger cashier called the scammers bluff.

 

Worst scams are the ones preying on good nature or vulnerability. 

 

Funniest ones are sending fake invoices to Google.

[SteveGrabowski0]

RTX 4060 Ti being 8GB

[Lurick]

Scammers using Paypal to send actual invoices to bypass spam filters.

They'll put some bullshit/scary reason in the requirements and a phone number to call but it's actually sent via paypal using scraped/stolen accounts so it's a legit email (in that it's not a spoof) but a scam.

[paul_bace]

Apple.

Worst example; "Fusion Drive".

[NobleGamer]

If some other posts in this same forum are any indication, evidently AI and GPUs with 8GB or less are scams.

 

I personally think that NFT that are very vulnerable to rug pulls and touting themselves as a way to "play games and win money" are troubling to me.

[YellowJersey]

Life. 0/10. Would not recommend.

[tkitch]

Bitcoin & NFTs and most "Blockchain" tangential innovations

[Jarmas087]

I bought an RTX 3060 on Amazon, and instead of receiving a GPU the seller sent an iPhone camera cover.

The return is still in progress, hopefully I didn't lose $350 to AMEISEYE (The sellers on Amazon that scammed me)

[rrats]

Any kind of ransomware

[Neroon]

There are so many, and definitely worse ones than this.

 

But 1 of the weirdest one, has to be a wall plug that will reduce energy used. The light will turn on to show you that you are saving energy.

[CerealExperimentsLain]

The scam where someone steals two unactivated gift cards from a store, then copies the barcode off one, prints that barcode to a sticker, and adheres it to the other card, thus replacing it's barcode and creating two cards with the same bar code.  They then return ONE of the cards to the store and wait for the customer to purchase it and for the cashier to activate it.  Once activated they now have a card of their own with the same barcode, and can use that card before the customer can use their own, draining it, and the customer finds the card they just bought is already used up.

 

When I learned about that I was like 'Woooooooooooow... That would have never occurred to me to check.'

[Bismut]

8 hours ago, CerealExperimentsLain said:

When I learned about that I was like 'Woooooooooooow... That would have never occurred to me to check.'

I would never have thought of that as well, that is eeevil.

[CerealExperimentsLain]

8 hours ago, Bismut said:

I would never have thought of that as well, that is eeevil.

That was my reaction.  The execution is actually super simple but I'd never had thought about it till I was told about it.  I could literally execute this scam with materials in my own home, I have printable adhesive sheets and a photo printer for other projects.

[Radium_Angel]

"Governmental Accountability Office"

[Allfather]

Working for MSPs for over 13 years, I have seen some good ones, but this one takes the cake.

 

BEC attack where the realtor's account was used against the buyer of a property to wire $250,000+ to an outside actor's account. By the time it was caught, they were unable to recover any losses. Agent was using a non MFA gmail account for communication with at least 8 breaches listed. The buyer received a spoofed email (gmail) appearing to be from my client, the title company with the wire instructions. Names, information, and email signatures were all gathered through the realtor's account. I was tasked with providing proof showing no BEC had occurred in our O365 tenant. Realtor probably lost their job, got blacklisted, and the buyer was SOL. Outside actor probably spent a total of 1 hour to pull off this attack, monitoring the agents account to creating the spoofed gmail and sending the email to the buyer. Seeing these types of attacks and the sophistication needed to pull it off, makes me feel like I am on the wrong side here.

Bonus: Another funny one was a new marketing employee receives a spoofed email using gmail posing as the president of the company wanting $10,000 in gift cards in her first week. Wanting to get on the good side, this employee proceeds to go to Target, buy the gift cards on their personal credit card, scratch them off and send them to the actor. I think they were able to get back around $250 in Amazon credit out of the total sent as the rest had already been spent.

 

I was later asked by another client to provide some additional security training and used the above example to show how fast it could be pulled off. During the presentation to the company, I pulled the president's email signature out of an email they had sent, created a new gmail account using their name, went to their webiste and gathered employee names and contact information, drafted and sent the spoofed email in about 5 minutes to a few critical staff. (Based on listed job titles) I feel they left that meeting scared straight or at least a little more knowledgeable on the subject.

 

You really can't make this shit up. The shotgun method has proven successful since it only has to work once to be profitable.