I just got a scam email supposedly from Bob Franzen of Steam Services. I have never had any interactions with them and am wondering how the scammers got my email address. If someone knows Bob perhaps they could alert him that this is happening.


Good Morning,
How are you doing? My regrets for this sudden request, On our trip to Athens. My family and i got mugged and all our belongings cash,cellphones and credit cards were all stolen at gun point, it's such a traumatic experience for me.We need your help flying back home as i am trying to raise some money, the embassy has just issued me a temporary passport but i have to pay for a ticket and settle my hotel bills with the Manager.
I have made contact with my bank but it would take me 3-5 working days to access funds in my account, the bad news is my flight will be leaving very soon and but i am having problems settling the hotel bills and the hotel manager won't let me leave until i settle the bills, i only have access to the internet. I need your help/loan financially and i promise to make the refund once i get back home, you are my last resort and hope. Please let me know if i can count on you and i need you to keep checking your email because it's the only way i can reach you.
Kind Regards,
Robert Franzen
Steam Services of America

.

FYI these "spam" problems are not *necessarily* directly related to the computers or e-mail accounts seen in these spams.

What typically happens is the the virus or malware raids the attacking computer for any and all e-mail addresses, and at times signatures, stored in its e-mail systems, in some cases going as far as addresses in received e-mails. I've routinely had e-mails "returned" to one of the many e-mail addresses/etc. I monitor as "return to sender, addressee unknown" that I/we never sent out in the first place, because the spam-sending malware or system substituted my/our e-mail in question as the "sender" of the spam, and sent it to a random shut-down or "dead" address.

So, the heads-up might be warranted, but the odds are actually quite good that his computer and/or account is an innocent bystander.

Sounds to me like all the other 1 trillion scam emails sent since the dawn of email, it's very cookie cutter. Could have had anybody's name and any company tagged on it. His name and company were probably a random grab.

This scam normally occurs with dormant SENDER accounts that become compromised. The answer is for the sender to kill the account, although that can be problematic (difficult to do; forgotten passwords, etc)

Remember the wording. This is a long running scam, as others have mentioned, it grabs e-mails from dormant accounts.

When you see the same wording, or something close to it, that's your first clue that it's bogus. Sure, check with the friend in question if you have doubts, but it's 99.9% sure to be a scam.

I was on the phone this morning with Robert about this.

It 'appears' to be related to the April 2014 security hack into AOL that took contact lists, among other things. I got two of them, its pretty obvious that the scam was directed at Roberts entire contact list.

He's checked - his actual account was not hacked and was not dormant, either, and passwords were changed. And I've seen others like this where the users account was never compromised, although at the AOL level information was obtained. Nothing, but nothing, is on the client machine as a Trojan or virus, and nothing, but nothing is actually seized from the account. What they got, they got directly from AOL. I had a chance to really do a forensic on one with the same approach, and there was just nothing there.

This one was interesting. If you actually dump the header code to the email you'll see that the reply address in the scam is "ssoa20001" instead of "ssoa2001", (see the extra zero?) the hacker created a new account in AOL that mimics his, and that's where the response would be going to. The email was actually generate (or relayed) through an email server in New Hampshire, may even be a college campus from what I could track.

I turned the entire mess into AOL for him this morning.

These don't work when you actually know the person, and it's a pretty tight fraternity here.

While I've got your attention - beware of bogus electronic invoice scams out there right now - with links to a charge, invoice, or whatever - either on a Dropbox account or on a Google Drive link. Many of them directly contain the Cryptolocker virus, and that's one of the worst things ever - encrypts your files and you have to pay to get the key. If you don't recognize the charge/invoice/etc., and it's pushing you to a link to see it.... DON'T GO THERE. Your antivirus 'might/should/shoulda' caught it, and you 'might' be able to get a tool to release your files... but it's a lot easier to just not be curious. Some of them can self-detonate just by hitting the link - world of hurt.

Dropbox has been very aggressive on going after these guys, Google also has a place to turn them in.

My oldest son (some of you have met him as a kid) is now working with a major computer software developer in the east and is the ultimate tech support tool for Dad now. He's all over this stuff in security applications.

Good for him. I quit supporting PCs 15 years ago because I finally threw up my hands and realized I could not possibly keep a PC secure and have enough time left for a life. As for family members etc. where I am the propellerhead obliged to support their PCs, it was cheaper to buy them Macs than spend every Tuesday night on the phone. Now, my #1 support hassle is routers.

As far as Cryptolocker, it is irrelevant. It changes nothing about the basic equation: if you suck at backup, you risk data loss. And if you have data loss, you'll have to pay either way for a shot at recovery. Scarcely makes a difference whether it's a hard drive failure necessiating a forensic recovery, or a virus requiring a ransom. Either way it's a tax on bad backups.

This recent scam is a variation of one that has been floating around for a number of years. See:

http://www.snopes.com/fraud/distress/family.asp