Hacker News new | past | comments | ask | show | jobs | submit login
3500 arrested in global cybercrime crackdown (scmagazine.com)
148 points by LinuxBender on Dec 22, 2023 | hide | past | favorite | 74 comments



I find it mind blowing how at one point I was getting scam texts almost daily because it seems like the easiest criminals to capture. Registering a number will eventually lead to a bank account. They can social engineer the criminal. They can trace where the call is coming from. Yet it seems they barely do anything.


> because it seems like the easiest criminals to capture. Registering a number will eventually lead to a bank account. They can social engineer the criminal. They can trace where the call is coming from.

If only it was so easy as running a trace on the criminal and then driving down to their location to arrest them, just like the movies.

The people running these scams are several layers removed from the people sending the texts. The big ones are careful to do some or all of it from another country. It's not as simple as tracing a number and then arresting someone.

The crackdown in the linked article involves 34 different countries. Just imagine the global police coordination required to trace that all and pull it off.


I can't get my local police to investigate home invasion crimes, so it is absolutely flabbergasting to imagine 34 countries coordinating to do anything other than eat a donut.


They did a pretty good job of shutting SF down for APEC last month while they met behind closed doors. But that's on behalf of rich people, not the scammed.


It was impressive. I was definitely blown away by how quickly the city and the peninsula was cleaned up. Really made me wonder why they don’t do it for the rest of the time if it could be done so easily.


It seems like police are heavily YMMV. I reported a felony theft and my local police referred it to my state's equivalent of the DoJ, and they are actually investigating. I was surprised.


In my experience, the bigger the city, the less police seem to care. Or perhaps they are busier and have to prioritize differently, but to the victim it's the same effect.

My brother recently had success in having small town cops go to a person's house to retrieve his lost+found IPhone, even. I was sure they'd tell him to sod off as a civil matter, but they retrieved it and even drove it to his house a solid 20 minutes away.


We're gonna need a bigger donut.


> home invasion crimes

If it happens when nobody is home thus nobody is hurt, they will most like dust for prints and you will have to clean their mess as well.

They got more important things than "they stole my laptop and €500 cash". If the thieves steal amounts/treasures that are terror-funding-amounts, and/or they physically hurt someone, then they will most likely find them (someone will snitch on them as police applies pressure to they-know-who-most-likely-did-it).

I remember 20(?) years ago in the UK someone broke into an old man's home, beat him severely, and stole his (olympic game) medal(s). The thieve(s) were then severely beaten up by fellow criminals and handed to the police. I cannot remember details, and asked ChatGTP but couldn't find more information (but I swear it was a case like that).

I also know enough police officers that will tell you to your face that for petty crime without physical harm they will never go after the perps. Unless they catch them for something bigger, and by running their prints they discover/can pin on them more stuff.


Home invasion specifically means while someone is home, otherwise, it's just a burglary. I should know. I was home. So what ever the rest of your lengthy retort says, I'll never know because it's clearly started from an ill informed position and would be a waste of anyone's time


Mark Rober's video on going up against some scammers based out of Calcutta very strongly implied (without outright saying for what I assume are liability reasons) that the scam call centers they were trying to take down were paying off the Calcutta police for protection.


>The people running these scams are several layers removed from the people sending the texts.

A guy who sent 17 million messages to Australian numbers lives 12kms from me and was only arrested last week.

Even if he's used false identities, it literally is "drive down the street to where these texts are coming from"

Cell triangulation is incredibly easy and accurate, especially when the average phone is pinging dozens of towers in cities with timing advances like mine is now.


Youtubers literally do this kinda stuff.

You're not wrong about the bureaucracy involved in getting this done but the fact a few guys making videos for fun can make a living off doing this exact kind of thing as content suggests to me that well-resourced law enforcement should be able to do much more.


> Youtubers literally do this kinda stuff.

YouTubers make entertaining videos, not criminal cases.

It takes more than some YouTube-level detective work to put together a case with proper evidence gathering and to coordinate across countries.


Perhaps, but just revealing the identities of the scammers to the police goes a long way.

https://timesofindia.indiatimes.com/city/kolkata/police-bust...

Police are overworked and have low case closure rates. If their incentives align with the case+evidence, a “YouTuber” (or any other non-expert investor), the additional steps to build a legal case can move pretty quick.


> Youtubers literally do this kinda stuff.

YouTube has notably different due process protections, rules of evidence, and standards of proof than criminal law in reasonable systems of government, however.


go after the texters and then suddenly they no longer have an easy avenue for texting.

This is how you resolve these sorts of issues.


> If only it was so easy as running a trace on the criminal and then driving down to their location to arrest them, just like the movies.

There's Youtubers that find call centers, hack into their network, watch them on their camera systems and mess with them[0]... surely the authorities could do more

0. https://www.youtube.com/results?search_query=hacked+call+cen...


If you want to throw out due process sure. "The authorities" can't just hack networks. While entertaining, what these YouTubers are doing is very illegal.


It's probably also all staged


You’re not buying into this, are you?


Can’t you at least close the bank account?


My wife got scammed. They opened a bank account in her name tied to her email address. She contacted that bank right away. For 2 months she received messages about other people transferring money into this account. These were other people getting scammed. The wheels turn too slowly.


Arrest the people sending the texts


If this worked they would have caught the Gilgo Beach Killer a decade before they actually did. He contacted his victims with burner phones that cops were never able to trace back to an individual. They were able to figure out which towers they pinged, which they later used to identify the person by matching it against which towers his personal cell phone pinged (and they could only do that because they had a witness identify his truck).

And that's when police actually care about catching the person.


> Registering a number will eventually lead to a bank account.

Not at all true in many places. It is very easy in the states to get a phone number with cash.


In a bunch of places (including the UK), you can get a phone number without any money and without any postal address. Just buy a 'free' esim. And you can top up with cash if you want.


On the other hand, proofing your UK address to the council, bank or literally anyone, is one of the most mind numbing things ever... speaking as a German.


And not very secure either. In my experience you can send a pdf of a utility bill and those are quite easy to edit.


Where? I'm curious how easy it actually is, so please let me know where one would go for this.


WalMart, unless things have changed.

Here's a whole guide: https://lifehacker.com/how-to-buy-a-burner-phone-1843905326


Um, any place they sell prepaid phones and prepaid cards? Walmart, Kroger, Meijer, etc.


How does this work?


Nope, you can just spoof numbers. No need to register anything with anyone. It's a trivial as spoofing an email address.


Facebook Marketplace has/had a huge problem where nefarious persons from Africa sending you a Google voice verify code. They says the code is to verify you are selling the item. The scam works by getting the code back and obtaining a google voice number. They use the numbers for the real scams, FB marketplace is just the starting point.


And you really want “them” to put their energy and time into finding some guys who send you text messages instead of finding guys who abuse children or kill people?


I remember when scamming in the late 90s was people setting up 'adult s3x lines' and the owners would get people to blue box the lines, I think people could make $30,000USD per line. People also used pbxs to ring the lines. People also used to sell international calls via hacked pbxs.

I read in the New Zealand press that most phone crime is unprotected pbxs, Now that the telphone infrastructure has become unbundled Telecom New Zealand doesn't care about international toll fraud if you are not using telecom, and they won't contact you if there is a sudden spike of international calls like they would when they had a monopoly upto the 90s.

I don't know why people would still fraudulenty call overseas because of fibre optic cables and high speed internet, the only reason I can think of is that they want it to be harder to trace the call. If you used a stolen card and rang a home country direct and got the operator to place the call, your voice is still being recorded so your still being busted.

I have a strong dislike for scammers, I worry about elderly and the vulnerable (my parents) but I don't know the conditions that led them to that place.


SMS / MVNO carry and international voice call / IRSF fraud is alive and well. Probably bigger than ever.

Apps which use SMS 2FA and voice 2FA are highly vulnerable - scammers will create fake accounts and request recovery over and over, either to pump SMS into MVNOs they partner with, or pump voice calls through to international premium rate numbers they control.

Since the whole thing is a legacy system built with little mind to hostile actors, most phone networks aren't well equipped to distinguish from these uses and legitimate use, even though it doesn't seem like it should be particularly hard.

Unfortunately, one big-hammer solution is often to just ban countries outside of an application's target market from the auth flow, which isn't great from a sociopolitical standpoint.


"I have a strong dislike for scammers, I worry about elderly and the vulnerable (my parents) but I don't know the conditions that led them to that place."

Greed.


to your final point I wonder what things I might be vulnerable to when I’m old, it seems hard to imagine right now


To me the most interesting part of it, as well as a note to self, is how quickly scammers have adopted AI for targeted voice cloning, deep fakes, and as a tool in their scams in general.

Can’t trust anything these days.


The top guys are operating from Myanmar, they have a deal with the military junta there.


Also a lot of cybercrime seems to go back to Russia where they seem to have a semi official policy to leave them to it.


Overgeneralization. Also article has list of countries.


Has anyone ever done a study on the profitability of spam calls?

E.g., what’s the average return per phone call when the scammers phone me to let me know that my business isn’t being “properly listed” on google and bing. All I need is to give them my cc info and they’ll fix it for me.

I get that one nonstop.


Depends if it’s a robocall.

Even if it is, when I press 1 and string their human along for a minute, that’s gotta be catastrophic to their ROI.

“Don’t hang up!!!” is my advice (and the opposite of various anti-fraud groups)

Even letting the line sit open for an extra 30s until the robocaller hangs up can multiply their costs.


I do this. Often they hang up when they hear my voice, so I’ve found speaking slowly and like I was confused person but taking them seriously seems to be the sweet spot. From there, continuing to act confused and get their instructions wrong constantly keeps them on the line. If you mention the word “scam” or any implication they are criminals they hang up immediately and move on. They also don’t have patience for “not being able to hear/understand them.”

I think if I can take as much of their time as possible that’s less time they have to scam vulnerable people. And it’s often good for a lark and quick break from the day.


One of my favorites is "hold on one second i need to grab something from the oven, be right back!" then mute the phone and forget about it.


It doesn't have hard numbers but it does discuss how to analyze mass spamming strategies. I found it very eye opening.

https://www.microsoft.com/en-us/research/wp-content/uploads/...

"False positives cause many promising detection technologies to be unworkable in practice. Attackers, we show, face this problem too. In deciding who to attack true positives are targets successfully attacked, while false positives are those that are attacked but yield nothing."


$300M seized, 3500 people, that's only $80K each. There's a lesson here kids: cybercrime doesn't pay unless you're top of the teepee. For the real money, you want to be classified as 'fintech' or 'white collar', instead.


Seeing the list of countries participating in the operation, $80k actually matters in many. And that's the amount seized, which may vary a lot from the amount they actually made over time.

> The countries participating in this year’s operation were: Argentina, Australia, Brunei, Cambodia, Cayman Islands, Ghana, India, Indonesia, Ireland, Japan, Kyrgyzstan, Laos, Liechtenstein, Malaysia, Maldives, Mauritius, Nigeria, Pakistan, Philippines, Poland, Korea, Romania, Seychelles, Singapore, Slovenia, South Africa, Spain, Sweden, Thailand, United Arab Emirates, United Kingdom, United States and Vietnam. Hong Kong also participated.


$80KUSD in Maldives, Mauritius and Seychelles would be quite nice, especially if you could get a cheap all inclusive resort.

$80KUSD in Goa/India would be fun tool :), scam all day then rave all night \o/


Median income in Laos is 2k. So yeah 80k is a big deal in many of these countries.


It really depends on what they're promising.

Even in a country like Canada, the median income is only something like $40K CAD

Hey, work for me for a summer and I'll give you $80K? Sounds like a good deal if you're broke, or desperate, or young.


That’s just what they seized in virtual/physical currency.

There would be further assets laundered in, for example, whoever the heck is paying $5m for a house in Vancouver that sits empty.


$300M seized means the actual money victims lost over time is likely multiple times higher - wouldn't be surprising if it's closer to 10x than 2x.


It's at least $300M. Arresting 3500 perpetrators averts future loss.


fintech?

Like just hacking the stock market with signals and information intelligence?


I’m saddened that Canada wasn’t on the list of participants, as we’re no stranger to scam calls and texts.

> seizing a total of $199 million in hard currency and a further $101 million worth of virtual assets.

Bitcoin, etc. looking rough these days as a store of value for criminals at just a 33% share.

> HAECHI

Seems to be a TV Series name in South Korea.

Also: “ Haechi is a symbolic mark that represents Seoul, developed to portray the historical tradition and unique cultural image of Seoul while giving hope and dreams to Seoul citizens. The dictionary definition of Haechi is “a mythical creature that distinguishes good and bad, what is right and what is wrong.” It is the etymological name of the more commonly used “Haetae.” In addition to being a moral being with a righteous temperament, Haechi also is believed to be a divine creature that guards people against fire and other natural disasters. It is also implied that Haechi is a guardian of Seoul that blocks all types of bad energy and brings fortune and happiness.”

https://english.seoul.go.kr/seoul-views/seoul-symbols/3-symb...


Where did you read about Bitcoin related to this case?


I’m assuming “virtual assets” is some soup of crypto assets.


It said NFT's, I can't find what exactly (or non-exactly) they got. They can make up any price for NFT's and say it's real. Of course, it also said "hard currency" which I have no idea what that means since it was almost certainly digital.


They talk about an NFT scam. Presumably they exchanged worthless NFTs (aren’t they all?) for more valuable/liquid cryptocurrencies.

But yeah, virtual vs hard currencies could be interpreted as bank account vs paper dollars/dinars/won/baht/pesos/whatever.


That's great, but it's what, a single call centre? Hope they keep going


Yea, it's like a form of warfare. Governments need to take these things seriously.


What would taking it seriously (or more seriously) look like in your opinion?


Something laser-guided if you ask me.


does anyone know how much of a dent this actually makes? would also think that gambling would just be state regulated at some point, seems silly to keep just a prominent thing illegal


State regulation more or less means creating classes of illegal acts.

There are no regulations on how you should sit on a chair within your home, therefore in so much as you are not breaking other laws while doing so, there is no such thing as illegal chair sitting in your own home.

There are regulations on driving on public roads, therefore there are such acts like 'illegal driving'. Things like driving without a permit for example.

If there are legalized forms of gambling, then as long as there are any restrictions at all, there will exist illegal forms of gambling.


A relative of mine works in cybercrime and is astounded at the amount of money that's in online scams. He says he wouldn't be surprised if they made more money than the drug dealers- less risk too. With a description like that I expect this isn't a very big dent.


Well, the margins gotta be better when you’re selling a product with zero acquisition cost because there is no product.

The tough part in cybercrime is the selling part. Drugs sell themselves, scams don’t.


3,500 *suspects* arrested


Missed me again boys! cracks knuckles/fires up edex-ui/runs top





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: