Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anatomy of a Rental Phishing Scam

jeffreyladish.com

Post reply on HN
Print view View original

21–30 of 153 posts

Re: Anatomy of a Rental Phishing Scam

#21

Post by walrus01 »

RcouF1uZ4gsC wrote: post #8

This is the one downside of Let's Encrypt. They made running https scam sites cheap and easy. I still think having https everywhere is worth the trade off, but the downside should be acknowledged. I wish there were an EV certificate like alternative for sites where actual money is involved (banking, hotels, etc) which cost a decent amount of money, so that at least the cost of running these scams would go up. For exa…

The fact that domain verified TLS/SSL is possible for free now, compared to a token payment of $7, doesn't change the fact that domain-verified SSL has never been, and should never be a verification of legitimate corporate identity.

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Re: Anatomy of a Rental Phishing Scam

#22

Post by nkurz »

The Craigslist ad is still up (or up again): https://sfbay.craigslist.org/eby/apa/d/berkeley-two-story-3b...

The house appears to exist as pictured at the claimed address on Google maps. Oddly, although Jeffrey's emails about the place were from a couple weeks ago, this current ad says "Posted a day ago". It also says "Call Laurence", although as before there is no phone number.

Personally, I'm still not completely sure this is exactly the scam that is being described. I'm wondering if there might be another layer here --- maybe someone who took over an existing Craigslist ad? It does seem very well crafted for a plain rental scam.

Edit: There is also a listing for the same house with same pictures on VRBO with 172 positive reviews: https://www.vrbo.com/564881. Given all the reviews, I presume that one is the real one. Maybe the Craigslist ad is a just a straight copy of this?

Edit 2: Ooh, I wonder if the reason that the scammer is willing to meet people at the property from February 14th to 16th is that he has it reserved for those dates from VRBO. Might be interesting to cross-reference.

Re: Anatomy of a Rental Phishing Scam

#23

Post by walrus01 »

The very first email from the "landlord" would tell me it was a scam. Maybe it's just because I've been doing things on the internet from before the web was a thing, but that's a pretty obvious scam.

The whole "I'm working away from my usual home city on oil/mining/gas projects in (HARD TO REACH LOCATION)" thing is at least 20 years old now for scams.

Re: Anatomy of a Rental Phishing Scam

#25

Post by walrus01 »

outworlder wrote: post #6
Pharaoh2 wrote: post #3

This scams are very common and fairly easy to detected even without contacting the person. I have been looking at apartments since november and finally found a place in January, and this is the third apartment I have rented in SF over the last 5 years. I believe this one would have been caught by point 2. Detecting a SF craigslist rental scam: 1. Is it too good to be true? Its a scam. What's too good to be true you a…

> Even if they let you see the place, IT MAY BE A SCAM. Proceed with caution and make sure the person actually own the place/has the right to rent the apartment. This part was mind-blowing. I would never considered that someone would show an apartment they don't actually own.

This has been a thing in Vancouver for a while now. Scammers would rent fully furnished luxury apartments on airbnb for a couple of weeks, and "show" them to potential tenants as if they were the owner or a person needing to sublet, signing leases, collecting first month+deposit payments from like a dozen different people.

Of course this only duped the most gullible, since nobody should be paying rent+deposit for a $3000/month apartment in cash. Then of course when it came to be end of month and time to move in, the scammer would be long gone.

Re: Anatomy of a Rental Phishing Scam

#26

Post by JoBrad »

nkurz wrote: post #22

The Craigslist ad is still up (or up again): https://sfbay.craigslist.org/eby/apa/d/berkeley-two-story-3b... The house appears to exist as pictured at the claimed address on Google maps. Oddly, although Jeffrey's emails about the place were from a couple weeks ago, this current ad says "Posted a day ago". It also says "Call Laurence", although as before there is no phone number. Personally, I'm still not completely s…

Many times they are a copy of a legitimate ad.

Re: Anatomy of a Rental Phishing Scam

#27

Post by walrus01 »

JoBrad wrote: post #26
nkurz wrote: post #22

The Craigslist ad is still up (or up again): https://sfbay.craigslist.org/eby/apa/d/berkeley-two-story-3b... The house appears to exist as pictured at the claimed address on Google maps. Oddly, although Jeffrey's emails about the place were from a couple weeks ago, this current ad says "Posted a day ago". It also says "Call Laurence", although as before there is no phone number. Personally, I'm still not completely s…

Many times they are a copy of a legitimate ad.

Copying photos and the body text of a legitimate ad would certainly be a lot less time and effort on the part of a scammer than writing new custom scam ads every time.

Re: Anatomy of a Rental Phishing Scam

#28

Post by outworlder »

cissou wrote: post #11

What I'm left wondering is: what is the payoff for these scams? These aren't easy to scale, as you need to be manually writing plausible looking, personalized emails, waiting for someone to take the bait, "nurture" them over days or weeks, etc. Also you need specific, valuable skills: between the social engineering, the actual engineering, the perfect grammar, the creativity, someone who can pull this off can definit…

> you need to be manually writing plausible looking, personalized emails,

They are not so personalized, are they? Look at the huge email with the pictures and everything. Most of it could be a template. Some of them could be one off, but they are small.

They can also just write once and copy and paste relevant sections as needed. Doesn't sound like such a big deal.

Packing up shop after you have racked in enough profits also doesn't seem like a big deal. Heck, you could be preparing your next 'camp' even as your current one is returning profits.

> and the very real risk of prosecution

May not be so real depending on where the scammer lives.

Re: Anatomy of a Rental Phishing Scam

#29

Post by starpilot »

cissou wrote: post #11

What I'm left wondering is: what is the payoff for these scams? These aren't easy to scale, as you need to be manually writing plausible looking, personalized emails, waiting for someone to take the bait, "nurture" them over days or weeks, etc. Also you need specific, valuable skills: between the social engineering, the actual engineering, the perfect grammar, the creativity, someone who can pull this off can definit…

> someone who can pull this off can definitely get a high-paying, honest job pretty much anywhere

Who's saying he hasn't already? Some Amazon guys got busted building a prostitution website here in Seattle a few years ago.

Re: Anatomy of a Rental Phishing Scam

#30

Post by nemothekid »

cissou wrote: post #11

What I'm left wondering is: what is the payoff for these scams? These aren't easy to scale, as you need to be manually writing plausible looking, personalized emails, waiting for someone to take the bait, "nurture" them over days or weeks, etc. Also you need specific, valuable skills: between the social engineering, the actual engineering, the perfect grammar, the creativity, someone who can pull this off can definit…

Given some of the absolute insane move In requirements I’ve seen for some places in SF, if you can get one sucker per month, you can easily net 10-15k/mo

I’ve seen places asking for first, last and deposit as rent and a half for 4000/mo places.

Post reply on HN