Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anatomy of a Rental Phishing Scam

jeffreyladish.com

Post reply on HN
Print view View original

91–100 of 153 posts

Re: Anatomy of a Rental Phishing Scam

#91

Post by fphhotchips »

acangiano wrote: post #85
peteradio wrote: post #4

There should be simple highlighter on the domain name in the browser so you can easily see: airbnb.com.rooms-040349.town vs airbnb.com Or some kind of script that can recognize likely b.s. for common domains. Now that I say it, it probably already exists.

1Password makes it very easy to spot these. If you click on the 1Password icon in your browser and you don't see your account, you're not on the official/right/real domain name.

This works if the website never switches domains based on location or product or what have you.

Re: Anatomy of a Rental Phishing Scam

#92

Post by uoaei »

alteria wrote: post #89
michaelkeenan wrote: post #72

Earlier quoted context omitted.

> $4.5k will get you a 1 BR in the Bay Area Average one-bedroom rent in San Francisco is $3,520, and two bedrooms is $4,550. It's much cheaper elsewhere in the Bay Area. In Oakland, average one-bedroom rent is $2,470, and two bedrooms is $3,050. $4,300 is very plausible in Oakland. Source: https://www.zumper.com/blog/2020/02/zumper-national-rent-rep...

I saw a 1 bedroom for $4,700 in the Peninsula recently, which explains why that complex has so many 1BR available.

And somehow, that's still the profitable option and not actually filling the apartment.

Re: Anatomy of a Rental Phishing Scam

#93

Post by fphhotchips »

333c wrote: post #78
stickfigure wrote: post #50

Earlier quoted context omitted.

That seems like a great idea! Why doesn't the url bar highlight the domain? Given how security-critical it is compared to the rest of the URL, why is it not bold and obvious? It seems so easy for browser vendors to implement...

I think you may be saying this sarcastically, but in response to the comment you replied to, at least my browser (Firefox) does do this. On this page, "ycombinator.com" is highlighted in white.

I'm in Firefox right now, and it took me four looks to notice that. The contrast could definitely be higher.

Re: Anatomy of a Rental Phishing Scam

#95

Post by rmtech »

nkurz wrote: post #70
randycupertino wrote: post #63

Same scam (and probably same scammer? - same backstory) posted on reddit a few months ago a few towns over: https://www.reddit.com/r/bayarea/comments/czfr3m/warning_cle...

And deep within that thread are links to a couple other scams by the same person for an NYC apartment and a car for sale. What would need to change so that serial scammers like this are arrested rather than allowed to continue preying on people?

You could have some digital technology that allows a person to credibly prove that they own a particular property, that is resistant to hacking techniques.

Alternatively you could have a legal rule that requires the seller to turn up in person with ID, and police could search for scam listings and then go arrest the scammers, and fine lazy legitimate sellers who want to break the rule.

Re: Anatomy of a Rental Phishing Scam

#96

Post by 14 »

michaelkeenan wrote: post #72
jameslk wrote: post #69

From the screenshot, the scam is actually pretty easy to spot if you know what to look for. Here's some clues: 1. All accomodations are available (w/d in unit, pets ok, wheelchair accessible, furnished!) - eliminating listings with all of these checked will nearly eliminate the scam listings. 2. The description doesn't include any information about who's the renter. Usually the landlord or property manager will menti…

> $4.5k will get you a 1 BR in the Bay Area Average one-bedroom rent in San Francisco is $3,520, and two bedrooms is $4,550. It's much cheaper elsewhere in the Bay Area. In Oakland, average one-bedroom rent is $2,470, and two bedrooms is $3,050. $4,300 is very plausible in Oakland. Source: https://www.zumper.com/blog/2020/02/zumper-national-rent-rep...

That is really mind blowing to me. I just looked at the local rental website for my small town and the first 2 bedroom duplex I looked at had a nice yard and looked good on the inside and was only $900/month. That is in Canadian dollars too I may add. That $4550 would be about $6000 Canadian and you would have people begging you to move in if you agreed to pay them a portion of that.The highest rental I see on the site right now is about $1800Cad.

Re: Anatomy of a Rental Phishing Scam

#97

Post by pmiller2 »

robbintt wrote: post #84
roel_v wrote: post #59

Earlier quoted context omitted.

Yeah that's the one that stuck out to me. An apartment as nice as the one described wouldn't allow pets, at least not if they're as experienced as they claimed to be here.

That’s not really accurate or else I would only get junk apartments. There’s usually a pet deposit, about 80% are no pets.

More like 90% if you have a dog over 30 lbs. :(

Re: Anatomy of a Rental Phishing Scam

#98

Post by rmtech »

peteradio wrote: post #4

There should be simple highlighter on the domain name in the browser so you can easily see: airbnb.com.rooms-040349.town vs airbnb.com Or some kind of script that can recognize likely b.s. for common domains. Now that I say it, it probably already exists.

Browsers should flag .com.

It's pretty unbelievable that in 2020 your browser just les this through

Re: Anatomy of a Rental Phishing Scam

#99

Post by rmtech »

It's pretty amazing that modern browsers don't flag .com. as a scam.

Is there any legitimate use for addresses like this?

It's also amazing that email software doesn't highlight fake link texts. There should be a rule that if the text looks like a URL then the actual URL has to match it exactly.

Re: Anatomy of a Rental Phishing Scam

#100

Post by megablast »

cissou wrote: post #11

What I'm left wondering is: what is the payoff for these scams? These aren't easy to scale, as you need to be manually writing plausible looking, personalized emails, waiting for someone to take the bait, "nurture" them over days or weeks, etc. Also you need specific, valuable skills: between the social engineering, the actual engineering, the perfect grammar, the creativity, someone who can pull this off can definit…

Are you kidding? They copy the stuff from other ads, have email templates. You could set this up including the fake airbnb website in a few hours, quicker if you get good at it. All from your own home, little chance of getting caught, and the possibility of $1000s.

> can pull this off can definitely get a high-paying, honest job pretty much anywhere.

This is just ridiculous.

Post reply on HN