social engineer – Pickpocket Bob Arno

Deception in Thievery

Trust me…

The gentlemen thief of the strategist variety is a consummate con man. By design, he thwarts suspicion and earns his intended victim’s confidence by his dress and demeanor. He puts on respectability and trustworthiness as if they were a jacket and tie, then garnishes the look with manners and decorum, like cufflinks and a spit-shine. But his garments are mere costumes, uniforms donned for gainful occupation, flimsy facades contrived to trick us into allowing him access to our spheres.

How can one beware the wolf in sheep’s clothing? It’s our nature to trust first, suspect later; and it’s darn difficult to overcome our nature. We almost always give the benefit of the doubt, assume one is innocent until proven guilty. Especially in a foreign country—where we’re ignorant of the local customs—we hesitate to doubt a motive for fear of offending.

Cynicism is an unnatural state for a traveler who has come far to experience a new land and unfamiliar traditions. We arrive prepared to embrace our local hosts, however alien or exotic they seem to us. After all, it’s their country. We want to like them. Yet, we don’t know how to read these foreigners, even though they may seem just like us. We can’t always interpret their body language, their facial expressions, their gestures. Neither do we recognize their outsiders. We’re at a distinct disadvantage as tourists and travelers, due to our nature as much as our innocence. How then, can we be alert to that insidious impostor?

Deception in Thievery; The claveleras use whatever aggression is required to give their flower gifts. — The claveleras use whatever aggression is required to give their flower gifts.

Bob Arno and I are loath to imply that strangers cannot be trusted; most can. Yet, for every crook and scoundrel we meet, for every victim’s story we hear, we feel ourselves harden. Our antennas get longer, our trust diminishes. We advise: protect your sphere. Don’t let a stranger penetrate your personal space. Suspect the unknown person who suddenly wants to be your friend—the stranger who wants your confidence.

The strategist pickpockets are clever. Unlike the opportunists who wait for a lucky chance, the strategists create their own opportunities, and make participants of their victims. You, the savvy traveler, will simply refuse to participate.

That requires the intentional cultivation of your under-developed kernel of cynicism, growing it until, at least, it is large enough and accessible enough to kick in when needed. That would be just when the deal-that’s-too-good-to-be-true finds you; the moment you are offered a free flower, and when approached by pseudo-cops (fake police), bucket bandits, and sandwich thieves (who do not steal sandwiches). “Look over there!” Ha-ha, got your goodies!

Deception in Thievery

Deceptive pickpockets and con artists are skilled in the art of social engineering. They develop (and clone) strategies to trick you into making your valuables available. They perform tiny plays, micro-choreographed from intricate scripts, in which you are a participant. Meet the smartphone thieves, magicians in their class. The whole act is over in an instant or two. There’s no applause, but if the thief has done well, he’s got something better. And then it’s “exit, stage left.”

Especially devious are those I call the pigeon poop perps. These thieves surreptitiously dirty their victims, empathetically point out the stain, then volunteer to clean it off. Unsurprisingly, they’re armed with a bottle of water and tissues—tools of their trade. As they clean them off, they clean them out, in one variation or another. And the victims? They allowed that stranger to touch them all over—brilliant!

There’s nothing like a thieving good samaritan to erode one’s faith in humanity.

Deception in Thievery; Pinstripe-wearing pickpocket works while his accomplice in the background, looks into our camera. — Pinstripe-wearing pickpocket works while his accomplice, in the background, looks into our camera.

Birds and their excrement seem to figure frequently in the world of street thievery. While pigeon pooping is unrelated to pigeon dropping—a scam in which greed trumps logic over found money—both require a gull, someone easily tricked or cheated, a dupe, a person who is gullible. When we hear about people taken in pigeon drop scams, Bob and I wonder how anyone could be so naive. Yet these swindles proliferate relentlessly, constantly reinvented to suck in the greedy. Beware: someone, somewhere, has devised a pigeon drop just for you.

Con artists who practice the pigeon drop and the bait-and-switch and all the many variants of these scams are the epitome of their label. They are the ultimate confidence men, both seeking and pretending to offer the trust of a stranger. We’re in this together, they intimate. It may be wrong, but it’s you and me against the bad guys. Pavement wager gamers who run the three-shell game and three-card-monte rely on their shills to inspire confidence while they promise the chance of easy money. As the victims of these con artists count cash into the hands of their covert tricksters, they expect to receive value for money. They expect to get rich, get a killer deal, win big.

The moral of con artist story might be if it seems too good to be true, run! But greed drives the victims of these cons, and greed trumps reason. For the con men, that spells advantage: because a gull blinded by greed is a victim indeed.

Deception in thievery is an intentional act. It’s why you can’t spot a thief in a crowd. Picture a grandmother, a trendy teen, an older gentleman, an adorable child…. A pickpocket could be anyone. That good samaritan who wants to help you heave your bags onto the train, or sell you an iPad, or fix your flat tire—they’ve all got thievery on their minds.

Poor us—we’re pretty much trained to trust first, doubt later. We have a definite deficit in the cynicism department. And that’s no contest against the deceptive thieves.

Beggars in Stockholm

Beggars in Stockholm—everywhere!

Just a few years ago, one never saw beggars in Stockholm. Today, one never sees Swedish beggars, but beggars from Romania seem to be on every corner, at the door of every shop, and at every subway station entrance. It’s an orchestrated invasion; just like the organized Gypsy begging that has been investigated and documented in the U.K. However, in Stockholm, I haven’t (yet?) seen child beggars. Not even babes in arms. I suspect the kingpins are smart enough to realize that Sweden wouldn’t stand for that.

The Swedish government periodically debates the possibility of banning begging, but then, what would happen to the few homeless and drug-addicted Swedes who beg, and the few alcoholics out on the street? Where would they get cash?

Well then, let’s ban begging by foreigners! Good idea, but unlikely to happen any time soon, I think. Everything in Sweden happens by committee, and happens slooooowly.

When border control within the European Union went soft, it didn’t take syndicate leaders long to take advantage of the new freedom of movement. Transnational criminal activities increased, particularly human trafficking.

For now, EU citizens are allowed to come to Sweden and stay without permission for up to three months. The Gypsy bosses know the rules. They transport the poor Romanian villagers, house them, feed them, and ferry them to their assigned begging spots. They come along and empty the cash-cups periodically.

Like the employees of a global theme park, all the Romanian beggars in Stockholm seem to be clones, all carbon copies of a model with a signature style. They all sit, they’re all wrapped in a blanket, they all hold a paper cup, and they all show photos of children. They all have a number of plastic bags near them, stuffed with things. They all block the flow of traffic.

Sweden is perfect…

Sweden is an excellent venue for this racket. Its citizens are wealthy, compassionate, and to some extent naive. The government is hamstrung and afraid to act. Tourists are rarely the budget type. I see people contributing to the cups (to the bosses’ riches); I’ve never seen meanness or complaint toward the beggars, not even hey-you’re-blocking-the-way.

The issue, the poor-Romanian-beggar, abused-victim-or-system-abuser conundrum, fraught with racial implications, is a bush to be beat around. In Sweden, there’s a ubiquitous fear of “what others think.” Everyone’s afraid to appear incorrect.

We spoke to a couple just after we saw them hand over a hundred crowns (about US$15) with a kind word and pat on the beggar’s arm. They give often, they said, whenever they can. They know these people are poor and need the money to feed their children. The couple buys into the scam hook, line, and sinker. Oh, I believe the beggars are poor and, since they don’t work, need help to support their families. But even the Romanian ambassador to Sweden thinks begging should be outlawed (and acknowledges that the beggars are her countrymen).

The beggars’ bosses* keep track of time. When three months are up, the gang is packed up and moved on for another stint elsewhere. Meanwhile, those at the top of the organized hierarachy build palatial houses back in their dumpy Romanian villages, and poor Romanian parents who “rented out” their children to begging and pickpocketing rings likewise see relative wealth.

Bob and I strolled through Kungsträdgården, a central park area in Stockholm, while a street performers’ festival was in full swing. Magician Charlie Caper, surrounded by a good crowd, was mid-routine when one of these Gypsy beggars actually waddled on stage and joined him.

Atypical for her type and oddly gregarious, she seemed to thrive on the magician’s reflected attention. The brazen beggar gestured, she pointed, she ta-da’ed. And when the crowd applauded for the magician, she soaked it up all-smiles and headed into the audience with her cup and photo, as if she were collecting for her talented son. The audacity!

Is it good to give?

Let’s say for a moment that the gypsy beggars in Stockholm get to keep all the cash they collect. I know—but just for arguments’ sake. Then subtract what they must pay for transport from Romania and in three months, to some unknown point (by crowded bus?). And subtract what they pay for food, lodging, and local transportation (which is not cheap in Sweden). They must be gathering a pretty penny, to make their long days on the cold pavement (Sweden, winter…) worthwhile. Citizens and tourists fill the beggars’ cups and the Gypsies (often seen talking on their mobile phones) call their friends and relatives back home and urge them to hop on the next bus to Stockholm, the deal’s great.

Or let’s say it’s not like that at all. The beggars are basically slave labor, trafficked humans, forced to sit on the pavement all day, forced to follow company protocol behaving just so. Strict overseers collect the beggars’ takings periodically and they are given a small wage. Most of the money donated by good samaritans goes into the pockets of the ringleader who—it’s well-established by now—builds palatial mansions (relatively speaking) in Romanian villages otherwise full of wood shacks.* The whole enterprise is a social engineering stunt—one huge scam exploiting public empathy and generous social services.

Either way, depositing funds into the cup-accounts of bundled beggars on the street is not a smart way to help. It rewards the begging enterprise, feeds the criminal organization, and ensures the continuation of the practice. Donors are kindhearted patsies.

Of course Stockholm isn’t the only city under siege. In fact, all of Sweden, even small towns in the frigid north, has been invaded by organized Romanian beggars. Denmark made headlines when Trine Bramsen, justice police spokeswoman for its governing Social Democrat party, said “We don’t want to make Denmark a hotel with a reputation across Europe for free food and board.” She wants them to “choose another country, for example Sweden, where they know they have better possibilities.” Looks like that’s working.

Some parts of the Austria, for example Tyrol and Salzburg, tried to ban begging altogether. But the Constitutional Court overturned outright bans, ruling that begging is a human right.

Dublin has been cracking down on organized begging for years now. In Spain, almost 100 people have been arrested for running human trafficking rings in last three years. “Most of the detainees are Romanian nationals, as are their victims, who are brought to Spain by the rings. In nearly all of the cases the victims were promised well-paid jobs in Spain, but once here they were made to beg on the streets in exchange for a sandwich and a bed inside a shelter.”

The European Union is desperate for a solution but the problem is huge—far bigger than organized begging, even though these rings fall within the realm of human trafficking. “The problem of human trafficking in the European Union” is good read, freshly presented by the European Parliamentary Research Service.

A tool to combat trafficking, is knowledge of its causes and vulnerabilities of victims. This Romanian study of trafficking in persons for forced begging provides such a picture. It highlights the vulnerabilities of potential victims, the characteristics of traffickers and outlines recommendations on combating both these aspects. This study will assist in facilitating ongoing campaigns and cooperation to fight against this heinous crime, to fight for the protection, assistance to, and dignity of the victims and most importantly, to prevent trafficking.

Trafficking in Persons for Begging — Romania Study

Well-meant donations to beggars enrich the criminal syndicate leaders and further enslave the individuals forced into begging. Giving to beggars is misplaced kindness. The gift does not remain in the hand that receives it.

*Edited 7/29/14 to add support and sources:

“The leaders of a child-trafficking operation that put hundreds of beggars on the streets of Britain were targeted in a series of raids today in a remote Romanian town where opulent mansions have sprung up since the country joined the European Union. … at least 17 people were arrested after the raids on 33 homes in Tandarei [Romania] by a small army of organised crime investigators, assisted by 26 Metropolitan Police officers and two observers from Interpol. … Firearms, jewellery, luxury cars and large sums of money were found at the homes of suspects, according to local media, which said that 320 Romanian officers were involved in the operation. Tandarei, with its population of 12,000 people, 150km east of Bucharest, has undergone a seemingly miraculous economic boom in the past few years.” Police in Romania arrest leaders of child-trafficking operation in UK, The Times, April 8, 2010

If you don’t have a subscription to The Times and do not want to pay £1, the text is also here. Underline above is mine.

Also see the BBC documentary “Britain’s Child Beggars.”

Edit: See follow-up article after our fact-finding trip to Romania.

Edit: Finally, 10/4/14, Sweden admits out loud that the beggars are organized and pay big bucks to bosses. Beggars are Forced to Pay, in Dagens Nyheter, Swedens biggest daily paper. Here’s a Google-translation of the page.

Edit: It is mid-December, mostly dark and freezing out, and I see just as many beggars as in the summer. Perhaps more are in the subways and inside the entries of grocery stores than out in the streets, but they’re in full force. Well-bundled, at least.

Edit: See Stockholm beggars incite political daring about the controversial anti-begging ad prominently placed in a Stockholm subway station.

Edit: Over six days walking all over London in August 2015, I saw exactly two beggars. Police tell me they are removed from the streets immediately and given food and shelter.

Edit: Sweden’s making progress! Now the official word is: “Stop giving money to beggars.” Here’s a Google translation of the article.

beggar gypsy organized crime Roma Romania social engineer stockholm sweden tiggare

Ghost in the Wires

I thought Kevin Mitnick was a friend of mine—but that was before I read his forthcoming book, Ghost in the Wires. Kevin’s the consummate liar, it seems. He’ll say anything to get what he wants, going to extreme efforts to research, then set up support for elaborate cons. He’ll claim to be a cop, a utility employee, or your colleague from a remote office, if it serves his purpose. A faceless voice on the telephone, he’ll sweet-talk one minute, and command with authority the next. At least he used to do this, before spending five years in federal prison…

To become the boldfaced name in social engineering, Kevin honed a natural knack for people-reading from childhood. He was a telephone Zelig who rarely needed to get out of his sweats. He always found a plausible pretext for his capers and pursued them with outrageous chutzpah. Rarely would he fail to obtain the information he sought.

Can one retire a talent like that? I doubt it, but as I can’t think of what use Bob and I are to Kevin, I prefer to think that we really are his friends.

Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker is Kevin’s third book, to be published in August 2011. I love that title. The book chronicles how Kevin, from an early age, tinkered with communication devices: ham radios, telephones, cellphones, computers, and the software that runs them all. Although he was obsessively compelled to dig deeper and deeper into the gizmo-code, he never tried to make or steal money from his exploits. He did it out of his own curiosity, to learn more, and to challenge himself to do what seemed impossible.

Sometimes, in his relentless pursuit of knowledge, he simply had to break into a company’s computer to get the software, the code, or the user names and passwords that he needed. In an electronic sense, that’s breaking and entering. And when he copied that proprietary information for his own use, well, that’s stealing.

Once he’d gained access to his target computer, he’d usually fiddle with its inner settings just enough to plant a “backdoor,” an easy way in for his next visit. He might read his target’s emails and even copy them, but he never destroyed the files.

Imagine an intruder who breaks into your house, sneaks around and looks into your secret hiding places, rifles your files, and picks through your drawers. Satisfied, he then backs out quietly leaving everything just as it was, sweeps up his footprints and, oh yeah—copies your house key on the way out.

I’ve heard Kevin call himself a “non-profit hacker.” Sure, he got himself free phone calls, but throughout his hacking career, he was always gainfully employed. With the information he had at his fingertips, he could easily have enjoyed a life of leisure from credit card fraud. He could have sold proprietary source code in the hackers’ underworld. But no; Kevin lacks a vital attribute. He has nerves of steel and gigantic balls, but he does not possess a criminal core. He was simply educating himself.

That is, until he got himself in trouble for snooping. Then he needed that information to protect himself, so he could make untraceable phone calls, so he could listen in to others. As the Feds closed in on him, he needed to know how much they knew about him, too.

Many times while reading Ghost in the Wires I wanted to smack Kevin. I wanted to shake him and say “you just got out of juvenile detention for doing just this—why are you doing it again?” He makes it clear that his hacking was his idea of fun and entertainment, to see if he could get to the next level. Like an addicted gamer.

It turns out, after all, that Kevin was busy educating himself. From “the world’s most wanted hacker” he has become one of the most wanted security experts in the world. He’s now considered the ultimate social engineer and an “ethical hacker,” one who’s challenge is to break into his clients’ systems, whether electronically or by social engineering. In other words, as Mitnick Security, he’s now paid to do what he loves, and he no longer has to look over his shoulder.

Social engineers are an ominous bugbear to security. A company (or you!) can have the tightest security system in place, but humans are its weakest link. For a hacker like Kevin, it’s easier to simply ask for the key to the front door than to steal it. He simply has to ask in the right way. Because social engineers are basically skillful actors playing a role, they’re an invisible threat and a daunting challenge for businesses.

I’m no hacker, that’s for sure, nor even a programmer. Yet, I found it fascinating to read exactly how Kevin finagled himself into systems and tweaked them to his advantage. Kevin wanted to include more of the nitty-gritty hackery in the book, but his co-author, Bill Simon, saved us readers from too much esoterica. I think they struck an excellent balance. I never felt bogged down by the technical bits.

In fact, some might worry that Ghost is a hackery cookbook, complete with lessons in how to get others to spill their secrets. I worried about this aspect with my own book, Travel Advisory: How to Avoid Thefts, Cons, and Street Scams.

Does an exhaustive explanation of theft techniques actually teach the thieves? Kevin and I obviously came to the same conclusion: no, there’s more to gain by putting all the details out there, the better to protect yourself.

I feel a little sorry for all the good people whose trust Kevin exploited. They bought into his ruses in a good-faith effort to be helpful. No doubt that he used them, and probably got many of them into big trouble. Well, in my line of work too, thiefhunting and training the public to avoid theft, a kernel of cynicism is not a bad seed to plant. Kevin’s patsies will think twice before giving out sensitive information.

Ghost is 400+ pages of tension, broken only by Kevin’s sentimental musings about his mother and grandmother, who are constant supportive figures in his life, and the heartbreaking side-story of his brother. It’s fast reading—a tribute to the clear writing and exciting story.

Yeah, yeah, you think I’m all positive because Kevin’s my friend. He gave me an unedited galley copy of the book (littered with typos), but didn’t ask me to write about it. If I hadn’t liked it, I wouldn’t have written a word.

Or maybe I would have. After all, Kevin might not be a real friend of mine…

computer fraud friend kevin mitnick review social engineer

Phone phishing

If you read this blog, you’re probably already security-conscious. But this reminder is worth repeating. Don’t trust anyone.

Sorry.

It’s a shame that’s what the world has come to. Even the good samaritan has to be looked at sideways.

Scammers are now blasting entire towns, phone number by phone number, telling residents that their debit card has been restricted. They target customers of a specific local bank or credit union, name it, and give the customer an 800 number to call in order to correct the situation. If you have a debit card from that financial institution, you just might believe it. Well, other people are believing it. After all, their caller-ID proves that it really is the bank calling.

Or does it? The scammers are able to “spoof” the phone number, so it only appears to be the bank calling. You have no inkling that you’ve been targeted by overseas phishers. If you aren’t a customer of that bank, you probably just hang up and forget it.

If you follow the scammers’ instructions, you’ll give them your card number, pin, and all the other juicy data they need to rack up the charges.

So the tired old reminder worth repeating is this: If you suspect a problem with your bank account or debit card, etc., call your bank’s main number. Call the number on the back of your card or on your bank statement. Especially don’t call a number given to you by the bearer of the news.

bank credit debit financial fraud identity theft phishing phone scam social engineer

Hotel room safe thefts

How safe is the safe in your hotel room? Not safe at all, it turns out, unless you factor in the odds. Odds are, your safe won’t be broken into. But the fact is, the crackin’s easy. Of course it is—hotels must be able to rescue valuables from faulty memories (forgotten codes, departed guests who forgot to empty their safes), lost keys, dead batteries, and power outages.

Hotel management and/or security can always access room safes. But how? Depends on the kind of safe. Does it open with a metal key? By swiping a magnetic card, or punching in a code? Does it use a plastic key card with a pattern of holes punched in it?

Is the safe safe?

Bob and I have long endorsed the use of safes in hotel rooms, as long as they are electronic. We’ve shied away from metal- and plastic-key safes, concerned about how many copies float around. But there are other ways to enter safes, and an untold number of people who have access, authorized or otherwise.

A deluge of thefts from hotel room safes in Palma de Mallorca, Spain, led to an investigative report by Burkhard Kress for Extra, a news show on German RTL TV (unfortunately not online).

Kress booked a room there and mounted a hidden camera, then called hotel management for help opening his safe. The hidden camera footage captured the code that management punched into the safe’s keypad, which ended with the room number. With the permission of the guest in the room next to his, Kress tried the same code appended with the other room number. The neighbor’s safe opened. Anyone with the master code could open every safe in the hotel.

And anyone with a hidden camera could capture the master code.

Kress had his cameraman stake out a different room for a week, waiting for a safe break-in. Alas, he was never hit. Eventually, Kress found out why. The thefts occur in rooms booked by two or more friends staying together. When a theft is reported, front desk staff insist the theft was committed by one of the “friends.”

Guests are required to pay a fee for the use of the safe. This, along with the fact that the only rooms hit are booked by two or more friends, leads me to suspect that these safe thefts are inside jobs. Who but front desk staff know both those facts? Of course the thieves might also be former employees, or individuals in cahoots with an employee.

According to Eric Fischer, a tour leader interviewed by Kress, these thefts have been going on for years at this and other hotels in Palma. He’s kept a log of them. He himself had â‚¬14,500 stolen from the safe in his room. When the Spanish police investigated the theft without much interest, Fischer suggested that they take fingerprints. “The police responded no,” he said, “you must be watching too much German TV—we don’t do that.”

What about those plastic key cards with a pattern of holes punched in them? They can be copied onto cardboard by anyone with a pencil and a hole punch. Safes that open with a keypad or your own magnetic card (credit card, grocery store card, or anything swipeable) often have a visible keyhole for a tool held by hotel management or security. Or, the safe may have an innocuous-looking panel that simply snaps off to reveal the keyhole. Whose got that key?

Bob and I have also come across safes screwed to loose shelves in closets.

In our book, we wrote:

Safe-cracks are extremely rare, although a man was recently arrested in Palma de Mallorca and charged with a spate of hotel safe robberies. Somehow, he had come into possession of a master tool which hotel security uses to open certain jammed electronic safes. (Other electronic safes can be opened by security using numerical bypass codes.) Presumably then, the man also had the tools to get into the hotel room itself. The burglar posted his female accessory at the elevator. They each had a cellphone and kept an open connection between them. When people came to the elevator, the woman would delay them for one minute. The burglar would hear the conversation, tidy up, and get out of the room.

Travel Advisory: How to Avoid Thefts, Cons, and Scams While Traveling
Chapter Four, Hotels: Have a Nice Stay

The “international conman” captured last September social-engineered his way into guest rooms and tricked hotel staff into opening safes. Hotel management, meanwhile, walks a fine line, compromising somewhere between providing real security and reluctance to inconvenience guests.

So how does Mr. International Conman get into your safe? Or—maybe not your safe because, obviously, he’s going to target a “whale,” or some other affluent hotel guest. First, he needs to get into your room—when you’re not there. Like any good con artist, he knows that front desk staff at most hotels will ask for ID, so he’s prepared. Here’s how. First, he follows you to learn your room number. Later, he goes to the front desk and, giving your room number, asks for a printout of “his” charges to date. Bingo. He’s now got your name and address. Next job is to whip out a fake ID, right in his car in the parking lot. Sounds like a lot of trouble, doesn’t it? But look at the payout.

Halliburtons for luggage security; hotel safe theft — Our usual set of old, beat-up Halliburtons.

What should you do, then, with your million-dollar bauble? Carry the stuff and get pickpocketed or mugged? Leave it in the hotel safe for the safe-cracker to burgle? Put it in the front office safe? Often, Bob and I choose to lock our stuff into our largest hardsided (aluminum) luggage.

This is a good moment for intuition, or at least for some conscious reasoning. Bob and I stay some 200 or more nights a year in hotels and, though we don’t always use the safe, we’ve never had a problem with one. YMMV. The practical danger in using the hotel safe is remembering to empty it before you check out. When I expect a hurried or groggy, pre-dawn check-out, I scrawl a bedside note to myself.

What kind of joints do you stay in? What do you carry?

hotel safe Security social engineer spain Travel

Beware hotel phone scam

Heads up, travelers. Beware the clever new scam happening in hotels now.

In order to thwart it, proactive properties are placing notes like this one into guest rooms:

Dear Guest:

Lately, scam artists are attempting to secure credit card numbers from guests in hotels. They’re calling guest rooms at random and claiming to be hotel employees needing to verify credit card information. For your own protection, please do not give your credit card number over the telephone while staying in the hotel. …

Hotel phone scam

My regular readers know that I stay in hotels more than 200 nights a year, and I research scams and cons. Yet, even I could very easily have fallen for this perfectly believable trick. It falls into the “pretexting” and “social engineering” categories. I got a chill reading this hotel management’s note, having just received a similar phone call in a different hotel a few days before. It took me a moment to recall that the request was for my frequent stay account number, not my credit card. Whew!

I’ve confirmed this ruse’s widespread existence with police and hotel security chiefs in several countries. Although aware of the ploy, not all properties believe in taking a proactive approach. As always, it’s up to us travelers to look after ourselves.

“Somehow they get the guest’s name, call the room, and explain that they are from either room service or the front desk and need the credit card number again,” the security director of a major hotel group told me.

“We never connect calls if the person calling can’t say the name of the guest he/she is looking for,” said the security manager of another hotel chain.

But a phone-pharming data-miner can sequentially call every room in a hotel once he knows the phone number convention. Most of us, as generally trusting (and/or oblivious) humans, will miss the fact that the data-miner on the phone fails to address us by name. If he’s any good, he’ll get “the name on the card” just as easily as he gets every other useful tidbit, and I’d bet he gathers quite a few “profiles.”

credit card fraud hotel scam social engineer

A typical ATM skimmer scam

A tiny skimmer removed from an ATM way back in 2006.

A reader wrote of an ATM experience which, soon after, led to $9,000 in fraudulent withdrawals. He was abroad, but this happens at ATMs everywhere; and so frequently that I think it’s worth posting as a reminder.

As I was using an atm at a money exchange kiosk, I received the cash I wanted but was unable to get my card back. The man in back of me told me I had to enter my pin number again in order to have the card returned. He even reached in front of me and hit some buttons and told me to enter my pin. I did so and after a slight wait, the card came back. The experience was unsettling because I had never heard of entering a pin number a second time to get your card back after a transaction and no one had ever brazenly reached in front of me to assist me at an atm. Since I received my cash and finally my card, I felt everything was fine. But that was the day the mysterious withdrawals began.

I called my bank as soon as I realized there was a problem. The woman I spoke with immediately closed the credit card account linked to my atm card. Within a couple weeks, the bank had deposited the total of the disputed withdrawals into my account.

There are two essential goodies the card fraudster needs: the info on your card and your PIN. Info on the card can be gained in many ways. A snapshot can be taken of it with a cellphone camera, an imprint can be made, or a skimmer can be attached to the ATM itself. Nowadays, skimmers can be tiny and imperceptible. The vital PIN can be easily obtained by the crafty thief’s strategy. The example above is a classic: the false samaritan. The fraudster offers help in order to gain what he needs. Sometimes these “samaritans” even make cellphone calls to helplines, handing the phone to the mark; but the person on the other end of the phone call is the fraudster’s colleague, who pretends to be a bank official.

To protect against these scams, first, don’t use an ATM that looks suspicious in any way. Unfortunately, they usually don’t look suspicious, even if they’ve been tampered with. Second, shield your PIN with your hand as you enter it. A wireless video camera may be mounted to capture the entry of your PIN. The illicit video camera, which is only the size of a sugar cube, might be in front of you, so your body won’t block it. Use your hand. Third, if your card gets stuck, get suspicious! Do NOT accept help from a stranger. Walk away from the card if you must, but do not give up your PIN. And lastly, always suspect the stranger who enters your personal sphere. That’s just not natural. He or she is after something—of yours!

It’s sad that we must suspect a friendly stranger, but a look at identity theft statistics is enough to convince anyone that it’s better to be safe than sorry. Ruthless, creative scammers specialize in benevolence, and they’re darn convincing. CONvincing, as in gaining your CONfidence. That’s why they’re called CON artists!

credit card fraud scam skimmer social engineer

Shoulder-surfers and pseudo-cops in Sweden

A shoulder-surfer in Stockholm gets seniors' PIN, then steals their ATM card.

I want to wail even in Sweden, because the country has long been perceived as enjoying a relatively low crime rate. And it did. But not any more.

The day I arrived in Stockholm, the paper featured a spread on thieves lurking at ATMs who preyed on the elderly. The scam stars a shoulder-surfer lying in wait for seniors to come use a cash machine. He watches them enter their PINs, then tricks them into allowing their bank card to be physically stolen in one way or another. The thief may ask to change a ten crown note, or may meet the mark at the parking meter and ask for a small coin. Anything to get the mark’s wallet out.

Then what? “Magic arts,” one victim said. “Finger magic,” said the police. Hard to believe that a bank card can be stolen from a victim’s wallet right under his nose. Yet, Bob and I recognize the trick we call the “flower gift lift,” as practiced by women in Palma de Mallorca (and I’m sure other places, too). It’s forceful, brazen, devious, and it works. I’ve written about that here.

The Stockholm shoulder-surfer was part of an international gang from Romania. He and one other were sentenced to a few years in prison. Police say they’ve operated all over Sweden, targeting the elderly and handicapped. ATM surveillance photos show victims in wheelchairs and using walkers.

At around the same time. a community newspaper warned of “false policemen” also targeting seniors at ATMs. The thieves convinced the seniors that they needed their bank cards and PINs in order to control illegal withdrawals. Police report additional ploys: door-to-door police impostors warn of burglaries in the neighborhood and want to photograph jewelry and valuables. Whatever the ploy, the thief gets in—cash and valuables go out.

As I was writing this, the evening news came on. Seems some scammers are knocking on seniors’ doors to give them tips about H1N1. Rather, one scammer knocks and talks. While the senior is occupied, the other slips in and robs the resident.

Meanwhile, last month, police saw for the first time credit cards being skimmed at gas pumps. “So far police have no suspects and haven’t been able to determine how the skimming operation has been carried out.” I have advised them!

Skimmers have been found attached to ATMs at Ikea and a Stockholm Toys R Us store. There was a home invasion in the sleepy suburb where my family lives.
What has Sweden come to?

credit card fraud pseudo-cop scam senior crime skimmer social engineer stockholm sweden Thieves

Scams at restaurant tables

A restaurant table is a good place to be had. The latest in low-tech scams happened last month in Hoboken, NJ, when a man appeared tableside to collect cash after diners had received their bills. He took their money and walked out the door. Pretty clever.

Why didn’t the customers question the new face? I can answer that, as one who visits restaurants some 200+ days a year. Sometimes we just don’t pay attention to who’s serving us. We’re seated by a host, served water by a busboy, solicited by a sommelier, finally the waiter comes, and sometimes we’re greeted by a manager. The meal might be a business meeting which demands our attention more than faces.

Last week, I had a long, late lunch at Postrio in Las Vegas. When our waiter’s shift ended, she did what customer service people call a “warm hand-off:” she introduced us to the waiter who would continue with us. She could have just left, and when the replacement waiter showed up, we’d have just accepted him.

So the Hoboken bogus waiter simply took advantage of our innate trust. He manipulated his victims by presenting himself as the person they expected; he didn’t even have to say anything. Hand out, money in, bye-bye.

So what did the restaurant do when the customers told the real waiter that they’d already paid someone else? Management did not make them pay again. Which invents an entirely new scam: diners claiming they already paid the bill (even though they haven’t). Perhaps the bogus waiter plans that as his next trick.

In the case of the bogus waiter, the victims were not out-of-pocket due to the goodwill of the restaurant management. Other potential losses while dining out:

swiped right off your lap

con Restaurant scam social engineer Thieves