Caller: “I calling from technical support. We found issue with your PC.”
Me: “What company are you with?”
Caller: “CSA is the name of my company.”
Me: “What’s our business relationship?”
Caller: “We found issue with your PC. Our technicians found your PC is running slow.”
Me: “Do you realize I wrote the book about PC performance? No, really, I wrote a book about it. I guarantee my computer is faster than yours. I also possess multiple security certifications.”
Caller: “Go on.”
Me: “You need to find someone else to social engineer.”
The caller stammered a little bit, tried to assure me it wasn’t a scam and wasn’t going to cost me money, then hung up.
Friends, someone from “technical support” isn’t going to call you about your computer at home. I WISH your legitimate Internet provider would, if they found something strange, but they probably won’t either, and they’ll certainly identify themselves as something other than “technical support” from some acronymed company you’ve never heard of.
While part of me wishes I’d taken him up on his “offer” and turned the tables on him, the legality of that would be questionable, and who knows what he would have gotten before I turned the tables on him. Besides, I have much more important things to be doing than waging cyberwar with some random guy who calls me up out of the blue from halfway around the world. It’s much better to just end the call.
Although, if you have the presence of mind to do it, and your state has a no-call list, be sure to mention that you’re on the state’s no-call list and will be reporting him. The unfortunate thing is that the number on your caller ID is probably spoofed, so your state attorney general will probably have a difficult time chasing down and suing the offender. It’s a long shot, but if he gets used to hearing the phrase “no call list” from people in your area code, then maybe, just maybe, he won’t call your neighbor. And that would be a good thing.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.
Last year, the bad guys contacted another security guy who played along with them – in a virtual machine. It’s written up here http://www.darkreading.com/end-user/security-expert-fools-records-fake-antiv/240001025 and the security guy has a screen recording with his later voice-over analysis here http://www.youtube.com/watch?v=jb69H7l0vJA
I wish we all had the skillz and time to string these bad guys along for as long as possible – make it expensive for them to do their evil activities.
I’m all for reporting them to the authorities, and I am not in favor of any illegal/immoral activities against them (like launching a DOS if you happen to pick up an IP address from them). I do think a market-based solution (making it expensive) would work faster than going to the authorities.
My wife received a similar call the other day. She responded with “My technician is right here, I’ll hand the phone to him.” He hung up as soon as I spoke.