The Anatomy of a Scam: The Smarter You Are, The Harder you Fall

scam, hacker, security

 “How stupid/greedy/retarded is he/she to fall for such a scam?”

So you think.

Take this from a magician. I'll let you in on a little secret. Actually, quite a big one, and I hope the community can forgive me for this because I'm doing a good thing for the general muggles.

You are amazed by magic (or shall I reluctantly use the term “fooled”) because you think and behave like a normal human being. I can't amaze (or fool) you if you are an idiot. But if you are smart enough, I stand a pretty good chance. And you shall see why.

Consider this real case: Jane received an automated call from a prominent bank, with a voice recording delivered in perfect English, telling her that her credit card payment was overdue. She didn't have any credit cards with the bank, so she pressed 0 for customer service. The customer service personnel told her when the card was issued, and details of recent transactions. It seemed like her identity had been stolen. Then she was advised to contact Bank Negara for assistance. She was lucky that the contact number given was busy. She got the real phone number of Bank Negara from the web site, called the real thing and was told that she was almost scammed. If she had called the fake number, she could've been duped into diverging vital bank account information, and her money stolen.

Contrary to the recent “you-have-won-jackpot” scam which was often conducted by Chinese calling from China, this one is cleverer. The jackpot scam exploits the victims' greed, but it was so poorly designed that it invited suspicion almost immediately. Why would some China company which has nothing to do with you suddenly offer you a prize? But someone did fall for it big time, 6 figures, and it was in the . The victim said, “They brought up so many details about the company procedures and transactions. They introduced several managers. How could I not believe them?”

The victim was not stupid. Most stupid people probably don't have 6-figure money to be scammed. The biggest mistake that he made was he let the con artist talk. Hence, the con artist had the chance to use a technique that magicians call “subtlety” or “convincer”. The technique probably has some other names in the con business, but that's what we call it. We use it to entertain people instead of conning. It is a way of indirectly conveying a “truth” to the audience, bypassing the usual defense mechanism of the audience's mind because they are made to believe that they've concluded that “truth” themselves. For example, if I turn over a cup casually and nothing falls out of it, you would automatically assume it is empty, though I've never shown you so and I have never said so. It might not be. Perhaps a ball is glued to the bottom of it. If I say it's empty, you will doubt it. But when I employ a subtlety, you simply assume so yourself.

The con artist from the jackpot scam didn't say “I am legit”. Instead they introduced their managers and company standard operating procedures. That's indirectly telling the victim that they were legit.


In the bank account phishing scam, the convincers came much earlier. A dummy voice response system called the victim. Who install this kind of systems? Banks, real banks. But in this case, the “system” on the other end was most probably as advanced as a tape recorder. The victim bought it immediately, making the “bank officer's” subsequent effort much easier.

The “bank officer” did not phish for the victim's information immediately. Instead, he introduced the “authority”, i.e. Bank Negara, and made the victim call them. Another “automated machine” would answer the phone, serving as another convincer. This particular con exploits fear and anxiety. Instead of the con artist asking for information, the victim is making the effort to initiate the call now. She is asking for help. Whatever “help” that the con artist maybe offering, she is most likely to cooperate.

So you see, the victims aren't stupid. They are just human. We are all pre-programmed to accept certain things as true without questioning. There are too much data out there for your five senses to process. It is impossible to scrutinize everything. You catch a glimpse of smoke rising from a bowl, and you will naturally assume that it contains warm food. You pick up your bag and it's heavy, so you believe your notebook is intact. That's how we survive. We need to jump to conclusions, or our brains will overheat, your eyes roll backwards and white foam oozes out of your mouth. Con artists study this, and therefore are able to anticipate and manipulate human behaviors.

The fake phone number of Bank Negara is now widely publicized. Did the police catch the crooks? I'm pretty sure by the time they get there, all they can find is an empty room. The phone was probably applied under another fake identity. You don't call them con “artist” for no reasons.

I have encountered “possible” con men with more bravado, face to face. I say “possible” because there are certain things I can't prove. One claimed to be working for the association of ex-police. The Police Department is our customer. Assuming they are real, I have to entertain them. For a one-time-only, almost-bite-your-head-off membership fee, I am invited to become their member. And they will do me favors like recommending me for “datukship”, recommending my company for government projects, etc. I will get discounts at hotels. Ahh, of course I'll be given a emblem to be stuck onto my car number plate to demonstrate my newly-earned status.

I consulted an elder partner to confirm my suspicion. He said he had encountered similar requests, and advised me not to offend them, but reject the offer anyway. When the pair of “ex-police” personnel came to my office to elaborate the “terms and conditions”, they had the receipt for the membership fee already written even before I issued any check. Even the certificate of membership had already been printed in my name. Notice the psychological subtlety here. They tried to make it harder for me to say “no”.

I said “no”. It's not an easy thing for me because I am not comfortable at rejecting people. But the hard-sell technique was a mistake that gave them away. It was too blatant. And it forced me to decide my money was worth more than saving their faces. That concluded the polite encounter.

So was that a con? Let's say I decided to join. The check would be made payable to the association. Perhaps the pair of “salesmen” would be paid a (un)healthy commission. And then, nothing ever happens. No “datukship”, no government projects, nothing. But I do get this emblem that I'll proudly display on my car saying “Oops I'm an accidental idiot”. Was there any criminal offense? Nothing provable, I'm afraid. I merely paid a fee to join an association. That's how they can boldly show their faces, paint their pictures of bright future and collect their money legitimately. Legitimately.

Furthermore, you can never be sure whether they are really ex-police. You would think thrice before reporting the ex-police to the police. They are taking advantage of that fear too. The amount of the membership fee is carefully crafted so that it is not worth further trouble.

In another case, a man claimed to be working for the association of ex-security force. He invited me to join as a member and his association would recommend my company for government projects, with a solid one already in mind. Ahh, I'd also be given a emblem to be stuck onto my car number plate to demonstrate my newly-earned status. He would need my company profile and product brochures. Of course, there was a one-time-only, almost-bite-your-head-off membership fee. I didn't know if he's really a government officer. Being in business, I dared not offend him, and he knew that, I'm sure.

When we met up at a 5-star hotel restaurant, he dressed up like a government official, but wore the “gold”est watch and rings. He flashed his four cell phones, one of which was a gold-plated Motorola and one a Diamond Vertu. I smiled. The combined value of those phones, if they were the real deal, was more than a Kenari. He eventually “divulged” how they channel money, bribe money, via their “syndicate”. If only you were a member. I smiled. He told me about a road equipment deal he was involved in, and I did the math in my head. He collected RM20 million a year by doing nothing but making a recommendation. If only you were a member. I smiled. He paid for the restaurant bill. And he showed me his RM20 million beat-up at the valet service as he was leaving. That too, he got it cheap from connections in custom. I smiled.

When he called again, I still smiled over the phone, but I said, coldly, “no, we don't do that”. He sounded really agitated, “Ok, forget it.” and hung up.

This gentleman too made the mistake of being too blatant. The convincers are not “subtle” any more. He looked too eager. Again, if I do sign up, it's just me joining a legitimate association. I can't complain if no good ever come out of it. There's nothing unlawful that's provable. But I do get this emblem that I'll proudly display on my car saying “Oops I'm an accidental idiot”. Nowadays, many cars on the road display such emblems. Now you know better what they mean — there are more fish fed to the good business of the “associations”.

Oh but what do I know? Maybe everything he said was true, but I am just too ignorant and inexperience to realize it. But I'm fine and happier being me. I make money my own, slow, way. And I sleep very, very well at night.

2009.12   (If you copy and forward this article, please link back to http://www.zhouruopeng.com)

 

Like this? Please share!

Chiew Ruoh Peng

Follow me on: