Fraudsters net a fortune in Facebook scam

Published on Saturday 12 April 2008 19:37

A SCOTTISH businessman had almost £30,000 stolen from his bank account after revealing details of his affluent lifestyle on a social networking site, Scotland on Sunday can reveal.

The victim's account was raided within hours of him bragging online about driving his luxury German car, relaxing in his boat and skiing in the United States.

It is the latest example of a growing trend among cybercriminals to turn away from direct attacks on relatively secure bank accounts and to exploit social-networking sites, such as Facebook, Bebo and Myspace. Fraudsters routinely try to persuade users to give away apparently innocuous personal details that can be used to devastating effect.

A Strathclyde Police source said that in another recent case, a young woman in Dumfries revealed on Bebo she was about to attend a school reunion. A fraudster posed as an old school friend and was able to get her date of birth and eBay password. According to the source, the information was used within hours to steal 3,000 from the woman's bank account.

"The victim was lured into a false sense of security by a series of innocent questions, the answer to one of which simply opened the door to her savings," the source said. "Many people think they are too smart to be conned and would recognise the scams, but they do not have any idea about how professional these (scams] are. They have come a long way since the days when they were mis-spelt, amateurish and clearly made up."

In the case of the businessman, which occurred last year, he wrote on Facebook about driving his BMW coupe and spending time relaxing in his boat or "skiing in Colorado".

The police source said: "The description clearly indicated an individual with wealth and it would have leapt out of the pages to the gang. He may well have just written: 'I'm loaded.' The fraudsters then just send him a bogus e-mail, purporting to be from the networking site, asking him to confirm certain details such as his name, date-of-birth and e-mail address, which he subsequently provided and that was enough to see him ripped off for about 30 grand.

"This is becoming a real problem because many people who use Bebo or the such like are not on their guard as they would be if they were checking their bank account online."

It is estimated that one-in-four online social networkers – around 11m in the UK alone – has posted details that fraudsters could use. Fraud experts say almost 90% of users register their full name. Details about where an individual went to school or college and even which football team they support can all be used to help the gangs hack into accounts.

Part of the problem is that many computer users only have one password which they use for everything from a social networking site to a bank account. Some sites allow users to recover a lost password by answering a standard security question, typically "what is your mother's maiden name". A fraudster who can get the answer to that – plus a few other details – has the potential to raid a bank account within hours.

"I've seen e-mail addresses posted, dates-of-birth, property details, even home phone numbers," said the source. "Just one of these pieces of information can be used to extract more personal details, but all four is just giving these people an open invitation to steal. If a stranger came up to you in the pub and asked for that information, there's no way you would give it to them, so why stick in online for everyone to see?"

Online security company Symantec, has just published its latest survey on internet crime, looking at instances across the globe over the past six months. It says the UK is fourth in the table of countries worst hit by crime gangs. Some gangs will use the information they glean to rip off unsuspecting customers; others will sell the details to other fraudsters through instant messaging sites, which may only run for a few hours. It is here that credit-card numbers can be bought for 5, while passwords are on offer for 20p.

The Symantec report states: "Underground economy servers are black market forums used to advertise and trade stolen information and services, typically for identity theft. Their locations is constantly changing due to the nature of these servers, which are often hosted as channels on internet relay chatrooms."

How to stay safe

Protect yourself against identity theft:

• Buy a shredder;

• A classic scam is to redirect your mail to a "dead letterbox". If your mail stops coming, contact Post Office;

• If you live anywhere with a communal hall, make sure your letterbox is secure;

• If you go away, even briefly, tell your bank, credit card firm and the Post Office, in order to stop mail gathering at door;

• Never let credit cards out of your sight when paying;

• Never post your home number, address or personal e-mail on networking sites