Scam - Remote access of Laptop

Ballard

I'm posting this as a warning to others. I'm sure that I had mentioned this type of scam to my father but he was taken in so please make sure that your friends and relatives understand this type of con. My Dad was so convinced that his dismissed my Mum's concerns at the time.

My father tried to update his TomTom but he received errors of some sort and googled TomTom to search for assistance. The site he ended up with was a fake site and after an online discussion he was told that his laptop was riddled with trojan viruses but that they could fix it for him if he gave them remote access, which he did. They also charged him £250 for this 'service'.

Unfortunately I was unable to take his call at the time but called him back within the hour and told him that it was clearly a scam and to turn his laptop off (and leave it off)  and call the bank. He followed my advice and his bank have put a block on his account and cancelled his card so I'm hoping that we have a happy ending on that front. I've asked him to bring the computer to me and I will take it to work and ask the IT security guys to look at it for me. I'm okay with computers but I wouldn't feel confident that I'd got rid of everything and there are a couple of dedicated IT security guys in the office who I'm sure will assist.

A quick Google shows that this is a very common scam with TomTom. My father has learnt a lesson but please make everyone who you may feel could fall for this fully aware. 

masonic

Have a look at Jim Browning's channel on Youtube. There are lots of variations of this scam exposed there and the videos are pretty informative.

Tildaplum

The IT guys sound as if they will know what to do, but the best way is to re-install the operating system as you really don't know what they put on the laptop, ie:

copy off your data 
format hard drive - reinstall Windows (IOS, Linux whatever) - reinstall apps
copy back data

How did he pay the £250?

Tildaplum

By the way, in order of increasing paranoia, if someone has access to your laptop this is what the remedy is:
1 low paranoia - run virus scan
2. medium paranoia - format HDD and re-install
3. high paranoia - remove HDD (changes could be there that format won't remove eg MBR) - buy new HDD - proceed as (2)
4. super mega paranoia - what did they do to the bios? - replace laptop for new one.
5. extra super double mega paranoia - I'm being spied on by Microsoft anyway - switch to Linux

Ballard

Tildaplum said:

The IT guys sound as if they will know what to do, but the best way is to re-install the operating system as you really don't know what they put on the laptop, ie:

copy off your data 
format hard drive - reinstall Windows (IOS, Linux whatever) - reinstall apps
copy back data

How did he pay the £250?

My IT guys are pretty good and they make a point of offering free advice to our customers so I'm hopeful that they will sort it out for me.

I don't know for sure how he paid it but he did mention also contacting PayPal for assistance so I assume that he went that route.

Neil_Jones

This is not unique to TomTom.  The other variation is "Hello, my name us <some noise that is presumably a foreign name>  and I'm calling from Microsoft."

The solution in all cases of these is:  Hang up.

Tildaplum said:

By the way, in order of increasing paranoia, if someone has access to your laptop this is what the remedy is:
1 low paranoia - run virus scan
2. medium paranoia - format HDD and re-install
3. high paranoia - remove HDD (changes could be there that format won't remove eg MBR) - buy new HDD - proceed as (2)
4. super mega paranoia - what did they do to the bios? - replace laptop for new one.
5. extra super double mega paranoia - I'm being spied on by Microsoft anyway - switch to Linux

The remote software used is usually something that doesn't need installing, usually something like aamyy is the common one.  The software is legit, its what its used for that is the problem.

Realistically number 2 is the highest you need to go, you can't do much if anything in the BIOS on modern hardware without being physically present and all the MBR does is tell Windows where to boot from on the drive.  The most damage there is to corrupt it, and its relatively easy to fix anyway.

Ballard

I didn't make it clear but I do realise that there are many other companies who's name is used to try to scam people. I've had 'Microsoft Support' ring me a couple of times. One time I kept him talking for 5 minutes, clicking the keys on the laptop just to keep him going. Eventually I got bored and told him that I knew his game and he got abusive.

I did work in IT but left that area in about 1994 so my knowledge isn't exactly up to date. In fact most of my work was on mainframes rather than PCs so I'm happier to let someone trained have a look at it. My biggest concern is that they may well have dropped a trojan or similar into the system.

Tildaplum

Yes it is true the remote access software is built in - I was referring to what people could do once they have access.
You can update the BIOS by downloading an .exe file, executing it and re-booting.
You can put a virus / rootkit into the MBR
You can create a hidden partition containing malware
I have no idea who the people who access the laptop were or what their motive was, but it's not as simple as just hoping nothing was done to the system.

Ballard

It since transpires that the bank haven’t stopped the £250 payment as my father authorised it so their hands are tied. I am not surprised at this but the company give a 30 day cooling off period so he’s going to ask them to cancel and when they don’t he plans to present this to the bank to try to recover the money. 

Realistically he’s lost the money and it’s not going to be returned but he might as well try. 

masonic

So the payment wasn't made via Paypal? How was it made? Surely not a Faster Payment?

Ballard

I’m still not entirely sure but presumably using PayPal would request funds from his bank. He’s tried to stop that payment and will continue to chase PayPal to stop it their end.

I have a PayPal account but rarely use it so I’m not at all familiar with it.