THE LONELY HEARTS SCAM

The lonely hearts scam involves fleecing a rich victim by dangling the promise of love and affection. In the old days, the con artist had to physically meet and talk with the potential victim, but nowadays, con artists can use the Internet to fleece victims from afar.

The con artist simply contacts potential victims and claims to be a beautiful woman currently living in another country, such as Russia or the Philippines. After sending a potential victim a photograph (which is usually a picture of someone else), the con artist steadily gains the trust and confidence of the victim through email, faxes, or letters .

When the con artist believes he has gained the victim's trust, the con artist makes a simple request for money to get a visa so the woman can leave the country and meet the victim. Inevitably, if the victim sends the con artist money, complications arise, and the victim needs to send more money for bribes or additional fees.

Sometimes the victim realizes he's been fleeced and stops sending money, but other times the victim honestly believes that the con artist is a woman trying to get out of another country, and keeps sending the con artist money in hopes of eventually meeting the beautiful woman in the photograph. The longer the con artist can maintain this illusion, the more money he can fleece from the victim.

PACKET SNIFFERS, WEB SPOOFING, PHISHERS, AND KEYSTROKE LOGGERS

Many con games have been around for years ; others are brand new to the Internet. The prime con game on the Internet involves stealing your credit card number so the con artist can rack up charges without your knowledge. Con artists have several ways to steal your credit card number: packet sniffers, web spoofing, phishing, and keystroke loggers.

Packet sniffers

When you type anything on the Internet (such as your name , phone number, or credit card number), the information doesn't go directly from your computer to the website you're viewing. Instead, the Internet breaks this information into "packets" of information and routes it from one computer to another, like a bucket brigade, until the information reaches the actual computer hosting the website you're viewing.

Packet sniffers search for credit card numbers by intercepting these packets of information. Typically, someone will plant a packet sniffer on the computer hosting a shopping website. That way a majority of packets that are intercepted will contain credit card numbers or other information that a thief might find useful.

Packet sniffers intercept information on the Internet in much the same way that a thief can intercept calls made with cordless or cellular phones. If you order merchandise over a cordless or cellular phone, a thief could intercept your call and steal your credit card number as you recite it over the phone for the order taker. After the packet sniffer intercepts a credit card number, it copies it and sends the credit card number to its final destination. Consequently, you may not know your credit card number has been stolen until you find unusual charges on your next bill.

To protect yourself against packet sniffers, never send your credit card information over the Internet. If you still wish to order merchandise online, only trust websites that encrypt your credit card number (a tiny lock icon appears in the bottom of the screen when you're connected to a supposedly secure online shopping site).

While the threat of someone intercepting your credit card number through a packet sniffer is fairly remote, the biggest threat to your credit card is actually a company storing it on their (usually insecure ) computer. Hackers can break into that computer and steal all the credit card information stored there, and there's nothing you can do about it.

Web spoofing

Web spoofing is quite similar to packet sniffing, but instead of secretly installing a packet sniffer on a computer host, web spoofing involves setting up a fake website that either looks like a legitimate online shopping website or masquerades as an existing, legitimate website (see Figure 9-4).

click to expand
Figure 9-4: Web spoofing tricks you into visiting a phony website masquerading as a legitimate website.

Fake websites often have URLs similar to the website they're spoofing, such as http://www.micrsoft.com (misspelling Microsoft), so victims will believe they're actually connected to the legitimate site. When you think you're sending your credit card number to a legitimate firm to order merchandise, you're actually handing the thieves your credit card number.

{% if main.adsdop %}{% include 'adsenceinline.tpl' %}{% endif %}

To protect yourself against web spoofing, make sure you can always see the website address in your browser. If you think you're accessing Microsoft's website (http://www.microsoft.com), but your browser claims that you're actually accessing a website address in another country, you might be a victim of web spoofing.

Phishing

The boldest way to get someone's credit card number is just to ask for it. Naturally most people won't hand over their credit card numbers without a good reason, so con artists make up seemingly valid reasons.

Phishing involves contacting a victim by email or through a chat room. The con artist may claim that the billing records of the victim's Internet service provider or online service need updating, so would the victim be kind enough to type their credit card number to verify their account? (See Figure 9-5.) Phishing is especially popular in the chat rooms of America Online or CompuServe.

click to expand
Figure 9-5: Phishing means sending potential victims seemingly legitimate messages, asking for passwords, credit card numbers, or other confidential information.

Obviously, no legitimate business has any reason to ask for your credit card number through a chat room or by email. To protect yourself from these scams, make sure you never give out your credit card number to strangers through the Internet or any online service.

Keystroke loggers

A keystroke logger is a special program or piece of equipment that secretly records a user 's keystrokes, such as the keystrokes that person uses to type a password or credit card number. If a con artist has access to your computer, he or she can secretly install a keystroke logger on your computer to record everything you type. Then when you're gone, the hacker can return to retrieve your captured keystrokes.

Software keystroke loggers hide in memory, while hardware keystroke loggers either connect between the computer and the keyboard or hide inside specially disguised keyboards. Visit KeyGhost (http://www.keyghost.com) to view examples of both types of keystroke loggers.

If a hacker doesn't have access to your computer, he or she can still install a keystroke logger on your computer remotely by using a remote access Trojan horse or RAT (see Chapter 8.) The con artist simply contacts potential victims through email or chat rooms and convinces them to download and run the Trojan horse. Once the victim runs the Trojan horse, it opens a port and contacts the hacker. From this point on, the hacker can read any files or watch the keystrokes on the victim's computer without the victim's knowledge.