Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anatomy of a Rental Phishing Scam

jeffreyladish.com

Post reply on HN
Print view View original

41–50 of 153 posts

Re: Anatomy of a Rental Phishing Scam

#41

Post by Scoundreller »

nkozyra wrote: post #37
nkurz wrote: post #22

The Craigslist ad is still up (or up again): https://sfbay.craigslist.org/eby/apa/d/berkeley-two-story-3b... The house appears to exist as pictured at the claimed address on Google maps. Oddly, although Jeffrey's emails about the place were from a couple weeks ago, this current ad says "Posted a day ago". It also says "Call Laurence", although as before there is no phone number. Personally, I'm still not completely s…

As for edit 2, might that not leave too much of a paper trail for the scammer?

Could be a fraudulent booking with a stolen credit card or cracked account.

Leaves too much of a human trail though. But I could think of a few ways around that too. But I’m not your fraud architect ;)

Re: Anatomy of a Rental Phishing Scam

#42

Post by Scoundreller »

imglorp wrote: post #38
walrus01 wrote: post #27

Earlier quoted context omitted.

Copying photos and the body text of a legitimate ad would certainly be a lot less time and effort on the part of a scammer than writing new custom scam ads every time.

Oh boy, story time. I encountered the opposite scam. I was selling a house myself. I took photos, paid to have it listed, posted a sign out front, and posted ads in various places including CL. Someone contacted me to say they responded to an ad on CL for a rental house. The prospective renter was told by the scammer he was out of town and that they could go to the house and look around the property. He would transac…

VoIP can be “backtracked”.

Takes a bit of effort, but the DOJ got providers to do it for the fake IRS/SSA/INS calls.

There’s a standardized process for it.

Might lead to a deader-end, but “it’s VoIP so we can’t do anything” is a cop-out.

Re: Anatomy of a Rental Phishing Scam

#43

Post by nkozyra »

peteradio wrote: post #4

There should be simple highlighter on the domain name in the browser so you can easily see: airbnb.com.rooms-040349.town vs airbnb.com Or some kind of script that can recognize likely b.s. for common domains. Now that I say it, it probably already exists.

And the people who would install it are already aware it's a thing and are more security conscious than most. In other words, preaching to the choir.

Re: Anatomy of a Rental Phishing Scam

#44

Post by Scoundreller »

55555 wrote: post #2

I'm assuming there is a Stripe/other payment form behind the button, and not a login form for phishing. This seems like a lot of work for just phishing. It would seem amenable to actually taking payments because people are booking months in advance, giving you months of no complaints or chargebacks or fraud reports so the criminals can cash out.

Maybe it “fails” and then they ask for WU or something non-repudiable.

As you get more committed, the more of a length you’ll go to get the place?

Re: Anatomy of a Rental Phishing Scam

#45

Post by nkozyra »

endorphone wrote: post #20
RcouF1uZ4gsC wrote: post #8

This is the one downside of Let's Encrypt. They made running https scam sites cheap and easy. I still think having https everywhere is worth the trade off, but the downside should be acknowledged. I wish there were an EV certificate like alternative for sites where actual money is involved (banking, hotels, etc) which cost a decent amount of money, so that at least the cost of running these scams would go up. For exa…

That isn't a downside of L.E. though because HTTPS by itself was never meant to imply trust in the site, and any notions to that effect should rightly be dispelled. Sounds more like a benefit of LetsEncrypt if it brought more awareness to this. And FWIW the EV cert that sites like AirBNB buy cost in the range of $500. The cost isn't what makes it prohibitive, though, but instead it's the corporate and personal identi…

> but instead it's the corporate and personal identity that they (should) do as a part of the process.

And often that isn't nearly as intensive as you might think.

Re: Anatomy of a Rental Phishing Scam

#46

Post by patio11 »

cissou wrote: post #11

What I'm left wondering is: what is the payoff for these scams? These aren't easy to scale, as you need to be manually writing plausible looking, personalized emails, waiting for someone to take the bait, "nurture" them over days or weeks, etc. Also you need specific, valuable skills: between the social engineering, the actual engineering, the perfect grammar, the creativity, someone who can pull this off can definit…

I think you’re missing professionalization. Writing mortgages would sound implausible, too, if each were the product of an artisan, but there is (effectively or actually) a company here, plausibly with an office, payroll, quarterly targets for on-target compensation, etc.

(This scam has unit economics strikingly similar to being a mortgage broker, with lower capita requirements, minus all the pesky compliance bits.)

Also note that a lot of the folks working for this economy don’t have high-quality access to the legitimate side of the software industry, because they live somewhere we don’t/can’t hire.

One of the best things we could do to drain the swamp is outcompeting Evil, Inc for some of their lynchpin specialists and managers.

Re: Anatomy of a Rental Phishing Scam

#47

Post by sjf »

pmiller2 wrote: post #35
Pharaoh2 wrote: post #3

This scams are very common and fairly easy to detected even without contacting the person. I have been looking at apartments since november and finally found a place in January, and this is the third apartment I have rented in SF over the last 5 years. I believe this one would have been caught by point 2. Detecting a SF craigslist rental scam: 1. Is it too good to be true? Its a scam. What's too good to be true you a…

Points 2 and 3 are not sure signs of a scam. Some landlords use “stock” photos that may be the same as the ones on Redfin/Zillow/MLS. And, there are “management companies” that amount to an 80 year old guy, his 2 sons, and one of his grandsons, that don’t have a website because they only manage their own properties. These 2 scenarios describe my current and previous apartments, respectively.

Yes, but if the photos obviously unprofessional, badly light and taken with a phone- it is definitely _not_ a scam.

Similarly, no dogs/no cats- almost definitely _not_ a scam. Every scam listing I've seen has had pets OK.

Re: Anatomy of a Rental Phishing Scam

#48

Post by somehnguy »

The scammer almost immediately sending a bunch of photos of 'himself' is very interesting to me.

I've noticed the same technique on dating apps. 9/10 times if the person you're talking to is not real they'll send a 'casual' looking photo after 3-4 back and forth messages, completely unsolicited.

Like the author of this article it seems to be a misguided attempt to prove that they're real somehow and immediately gives away that they're not. When this happens on dating apps I like to give them my Google Voice number and play along for a bit to waste their time. They usually end up pretty angry and it makes me laugh.

Re: Anatomy of a Rental Phishing Scam

#49

Post by sjf »

It makes me deeply depressed that real estate is huge right now, many more people than ever are renting and we still have to deal with Craiglist scams to find a place to live. Ignoring the fact that the last ten years of UX seems to have passed Craiglist by, it's unbelievable that such a huge site has the absolute minimum of fraud prevention. There are so many comments on here about various kinds of CL scams, why does a trusted marketplace for rental housing not exist?

Re: Anatomy of a Rental Phishing Scam

#50

Post by stickfigure »

peteradio wrote: post #4

There should be simple highlighter on the domain name in the browser so you can easily see: airbnb.com.rooms-040349.town vs airbnb.com Or some kind of script that can recognize likely b.s. for common domains. Now that I say it, it probably already exists.

That seems like a great idea!

Why doesn't the url bar highlight the domain? Given how security-critical it is compared to the rest of the URL, why is it not bold and obvious?

It seems so easy for browser vendors to implement...

Post reply on HN