Inside the TalkTalk 'Indian scam call centre'

http://www.bbc.co.uk/news/technology-39177981

by dberhane • 9 years ago

130 91 9 years ago

bbc.co.uk

bhouston2• 9 years ago

Key point - because they outsourced a call center to India, the customer data of TalkTalk was stolen along with their customer care scripts. This was then used to setup a fraudulent call center in India that has been scamming their customers - brutal:

In 2011, TalkTalk outsourced some of its call-centre work to the Kolkata (Calcutta) office of Wipro, one of India's largest IT service companies.
Last year, three Wipro employees were arrested on suspicion of selling TalkTalk customer data.
A source in Kolkata, who did not want to be named, alleges the same data was obtained by a criminal gang, with USB sticks full of data trading hands at parties.

djhworld• 9 years ago

It's quite a clever and elaborate social engineering scam, especially using the stolen data to use as a tool to get the mark to believe the call is genuine.

willvarfar2• 9 years ago

If they had been TalkTalk employees, in India, it could still have happened.

If they had been TalkTalk employees, in the UK or any other country, it could still have happened.

It doesn't seem that its because they outsourced a call centre to India, or even because they outsourced a call centre, but rather because three call centre employees were corrupt.

Anyone following the UK news knows there are plenty of insider-jobs happening on-shore too.

cmdrfred2• 9 years ago

Certainly you agree that its easier to get something like this done in India though? Roughly half of the population[0] there has paid a bribe at some point in time.

[0]https://en.m.wikipedia.org/wiki/Corruption_in_India

lostboys672• 9 years ago

True but only up to a point do this to say BT and you will have the Feared Investigations Branch" / Security Directorate down on you like a ton of bricks.

BTW SD is like the auditors in the laundry files but not as nice.

Also perception is key here if you get a reputation for scammers if unfourtunelty it has nagtive impact on the whole country

mattbrewsbytes• 9 years ago

I think there is a higher chance of data theft because it is outsourced to a different country and to a different company.

There is less risk and/or maybe more mental space to rationalize the theft of data. Maybe their company treats them poorly, maybe they believe they can't get caught as easily. If they were in-house in the same company, there is more risk/punishment, right?

bhouston2• 9 years ago

It is much harder to try and prosecute this across international lines, especially in India where corruption is much more rampant (India has a much higher corruption index than Western nations like US, Canada, UK, France and Germany.)

Your argument that it could happen is basically saying that in India the chance of this happening is > 0% and in the UK the chance is > 0%, but that doesn't mean that the chance of it happening in India is the same as it happening in the UK.

My home get calls from Duct Cleaners and Windows Support and it is always from India and Pakistan and its gone on for years. There is clearly less than effective means of controlling these types of scams.

DanBC2• 9 years ago

But there are criminal prosecutions for this stuff in the uk.

https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

etc etc.

calvinbhai• 9 years ago

So true!

When those sounding like brown people do it, for some 'reason' the news bubbles up as "Indian" .....

Sadly, such racist simplification only lets the offending company (TalkTalk in this case) off the hook, and diverts attention towards hating Indians.

Only way to fix this is make such breaches so expensive to companies that they'd think twice before outsourcing either within the country or to a company in an another country (which will lead to stronger procedures at outsourced location).

raverbashing• 9 years ago

But being in a far away country makes it easier to go unpunished

drzaiusapelord• 9 years ago

Go ahead and start one of these businesses in the US and UK and see how long you last. There are several reasons why this happens mostly in India, but the main one is that there's a jurisdiction barrier that benefits criminals. We know the voip resellers know who these customers are, and law enforcement finds out through these providers, but now what? You can't just call the Indian embassy and demand the arrest of hundreds of people. There's a lot of diplomatic finesse that needs to happen and by the time it does, assuming its even possible, these groups have moved on to different locations, different providers, different staff, etc after cashing out.

Worse, India is notoriously corrupt, much like Russia, another hotbed of cybercrime, so sharing your cybercrime spoils with the local government goes a long to to prosecution immunity.

I understand HN has a lot of prideful India and Russian nationals, but ultimately one shouldn't go against the facts. Pretending these countries aren't safe havens for cybercrime is just asinine.

agnivade• 9 years ago

My friend worked in Kolkata center of TalkTalk. He was asked once by another common friend of ours to leak customer data to him. And get about 1 Lakh in payment. He quickly refused and never talked to him again.

desireco422• 9 years ago

I've been repeatedly called with 'Support Scam' where they trick you into installing sw that lets them monitor and control your computer. I don't remember this being as prevalent as before. Clearly it is profitable and they are finding enough targets to warrant operations.

zaphar• 9 years ago

It's a lot easier to pull this off when you have customer records to do it with. That raises the chances that you can convince them you are legitimate.

ben_jones• 9 years ago

It could go even further then that. If the TalkTalk data included normal company data you would have the names of previous support members, and from there social media accounts and so forth.

chiph2• 9 years ago

My father fell for this scam. As you get older, you lose patience with computers, so he developed a tendency to click on anything to get browser popups to just go away. One of them was a "Your computer is infected and we have the cure" scam. His info was passed to their "customer care desk" which took him for $300 to supposedly clean his PC. They would regularly call back for subscription renewals (more $$$).

I didn't find out until it had been going on for a few years, because dad didn't want to bother me with his computer problems. Make sure you inform your parents about this - they're easy marks for these assholes.

desireco422• 9 years ago

Sorry to hear for your dad. Definitely majority of population is not capable to handle all the details modern tech is requiring.

I do blame modern tech for that.

ikeboy3• 9 years ago

Dell support has a similar issue. Relatives of mine have been contacted by people claiming to be from Dell support soon after the person actually opened a case with support (so someone has ongoing access to the Dell database). The scammer had the tag of the computer, which I confirmed was correct.

They basically said to check the error log of Windows with instructions. There are always some benign errors, which they'll tell you are proof there's something wrong, and then try to get you to download software to fix it.

Edit: see https://arstechnica.com/security/2016/01/latest-tech-support... and https://krebsonsecurity.com/2016/02/dell-to-customers-report...

Already__Taken• 9 years ago

The only bit of fake delivery tracking scam I've received was suspiciously right after I ordered a Dell XPS back in 2013. It had some details close enough that I had to message dell to confirm a tracking number and they hadn't shipped it yet.

BoorishBears• 9 years ago

The Event Viewer seems to be a common element in all these scams, maybe MS should add a warning to indicate most errors are harmless?

jeena2• 9 years ago

I've been called by some "Windows support" three times during last month. The first time I didn't have the time to talk to them but the second time I took the time to do so.

Somehow, even though I don't have a windows computer, I was able to fake it for about 10 minutes that I am following his instructions and doing what he tells me. First I had to press Win+r, which I didn't really know what it did, but I suspected it opened the CMD, so I told him that a new window opened, a black one. Then he spelled to me what I should write (I don't remember what, I didn't have anything to write with me).

Then he asked me if I had Chrome installed, I said yes and he spelled a website url to me. I told him that it loaded and there was a "Download" button and asked if I should click it. He said yes. Then he talked me through how to install it, from his description I got that it was TeamViewer.

He told me to start it, bare in mind that this was painfully slow for both of us because I had to come up with plausible mistake to make and had to think of some plausible but generic answers on the way because he always asked me what I'm seeing on the streen now. After I "started" it I had to tell him that in fact I didn't have a computer in front of me, but I only was playing along with his script.

He stopped for a couple of seconds and then he asked me:

"How is this possible ...? Why are you waisting my time??"

Klathmon• 9 years ago

I've had them curse and scream at me for wasting their time.

One time after a few minutes on a call he asked me what I saw on the screen and I just said "My wallpaper, with the word Ubuntu across the back" and he started shouting "fucking kill yourself" and hung up!

ceejayoz6• 9 years ago

I'd love to do this, but they have my phone number. I really don't want to have to get a new one if they get pissed enough to make it unusable.

ssharp2• 9 years ago

I've only answered the phone once with these scammers. I told them I was using a Mac and after confirming three times that it was a Mac, he said "you're a liar!" and hung up.

M_Grey• 9 years ago

Same here... it was my cue to laugh and hang up.

pwython• 9 years ago

"How is this possible ...? Why are you waisting my time??"

That's actually not so bad. I got a different, more hilarious response when a scammer realized I was stringing him along. Which I recorded.

I received a call just last Thursday from a professionally recorded American sounding female voice saying it was my credit card company. "Nothing was wrong with my account" but there was an opportunity to reduce my interest rate on EITHER my "MasterCard" OR "Visa." I knew this was going to be fun so I played along, pressed 1, and got connected to a guy from India. He began by asking for my credit card number to verify my account.

I started recording half way through, hoping to keep him on longer but failed. Here's the short clip from when he realized I was giving him random credit card numbers (NSFW language):

https://instaud.io/Niz

chrisper• 9 years ago

I received a call just last Thursday from a professionally recorded American sounding female voice saying it was my credit card company.

I get those too. Also ones that say they are from Mariott Hotel or something. They always use local phone numbers, so I always pick up :(

But I hang up right away anyway.

amyjess• 9 years ago

I received a call just last Thursday from a professionally recorded American sounding female voice saying it was my credit card company. "Nothing was wrong with my account" but there was an opportunity to reduce my interest rate on EITHER my "MasterCard" OR "Visa."

I've gotten phone calls where the recording introduced itself with "Hi, this is the credit card holder rewards center for Visa Mastercard."

Can they be any more obvious they're a scam?

And then there's the generic "Hello, this is Rachel from Cardmember Services". Or "Cardholder Services" or whatever name they're using at the moment (it keeps changing names as the feds keep going after them).

it_learnses• 9 years ago

I wonder why he claimed he was from Afghanistan.

giis• 9 years ago

Few months back, I posted this https://www.youtube.com/watch?v=ri8TN2sHcM4&t=0s here and it got flagged. Your approach is similar to this guy :)

thisisandyok• 9 years ago

That's awesome. It does make me wonder though, do the people working in the call centers realize that they're scamming people or do they think it's a legitimate business?

Naritai3• 9 years ago

I would guess (and I'm trying not to make any value judgement on this) that they view it as a job, and the sales commissions help pay for their lives and their family, and they don't think about it much more deeply than that.

I recently read some comments from a Timeshare salesman in the US, whose attitude was similar. Asked "don't you feel bad that your job is basically to operate a large-scale real estate scam", he replied, (I paraphrase) "hey, at the end of the presentation, you have the contract right there in front of you, and if you choose to sign it, it's on you. My job is just to convince you to sign, and if I do, I get a good commission."

st3v3r4• 9 years ago

There is no way in hell they cannot know what they are doing. They know they're not from Microsoft. And given this scam has been in the news for a while now, they don't get to plead ignorance.

aedron• 9 years ago

The easiest way to waste these guys time is to just tell them "OK, just hang on one second, be right with you", then put the phone down and leave them there waiting.

GordonS• 9 years ago

I did this recently, while leaving the phone next to speakers playing an annoying, high pitched sound I found on YouTube - surprisingly he stayed on for just over 10 minutes!

MichaelApproved• 9 years ago

There's a guy who setup a call capture bot with several soundbites of an old man ready to reply to call center scam calls.

It's pretty funny to hear how well random stories and comments from a confused sounding older man does to keep them on the phone.

https://www.reddit.com/r/itslenny/

verelo• 9 years ago

Wow, this is amazing. Thanks for sharing.

mhw• 9 years ago

I'm a TalkTalk customer, and was on the receiving end of this scam last year. I'm savvy enough to know that all the machines on our network were unlikely to be suffering from the problems they tried to describe (only one Windows laptop, and that was dual boot with Linux and carefully used).

The most annoying thing (for us) was that they repeatedly called the home number at random intervals through the day until we actually picked up, and then you'd get complete silence most of the time. When they finally managed to get someone on the phone on their end it was easy enough to tell them they were scammers and get rid of them, but I can see how those who are less confident around technology could easily be taken in by them.

acomjean• 9 years ago

"you'd get complete silence most of the time"

This is caller software. They figured it was too wasteful to have operators waiting for the phone for you to answer, so a machine dials you and when you answer its supposed to patch you into an operator. Obviously if they're are more calls then operators, you wait, or just hang up....

eric_the_read• 9 years ago

My (least) favorite variant of this is the telemarketers who wait for you to say "hello", then, after they quickly conference in the actual operator, they say, "Oh! Sorry, I was having a problem with my headset. Anyway, I'd like to ask you about..."

bjourne2• 9 years ago

Someone tipped me about "Lenny": https://www.youtube.com/user/ToaoDotNet/videos?view=0&sort=p... I'd love to know if it is possible to route calls from outside the US to him!

chaser7016• 9 years ago

That needs to be a service... if a phone call is received not listed in your contacts send them to Lenny.

iicc• 9 years ago

https://www.reddit.com/r/itslenny/

Instructions for use:
Transfer, conference, or forward your telemarketing calls to 1-347-514-7296 or sip:13475147296@in.callcentric.com. If you conference Lenny in, be sure to mute your phone. The rules: Lenny is for incoming, telemarketing calls only - not for annoying people, even if they deserve it.
Testing/experimental calls are fine, as long as they don't bother anyone.

bjourne2• 9 years ago

I tried it and the recording says Lenny doesn't accept international calls.

neilwilson• 9 years ago

I happened to have the 400 series http errors open when one of these chappies rang up. I think I got to 'Request, Time Out' before he twigged.

mpswardle• 9 years ago

I got called by these guys last month. It was immediately obvious something was amiss as the line quality was absolutely dreadful, like virtually inaudible.

The lady on the other end said i had been identified as someone from TalkTalk who would be having problems with my internet speed and they could help.

She then asked me what OS i run, when i said OS X she hung up.

greatartiste• 9 years ago

My wife used to be a Talk Talk customer in the days of dial ins. Anyway 5 or so years back they suddenly started billing her credit card again monthly for the service she had cancelled years before. We couldn't stop this online as their system claimed no knowledge of her so I had to call the support numbers listed on the Talk Talk website. These went through to the usual Indian call centre but what went on there was very unusual. The first operator wanted my wife to post him her VISA statements to his home address (as they would get lost in the post if we sent them to Talk Talk). Another call brought an operator who said he could only trace what had happened if my wife gave him her VISA number and CVV over the phone !! I tried to call their Fraud Prevention office but got another Indian who wanted a VISA number before we could proceed.

After multiple calls one day a call was answered by an Irish voice who was very apologetic and arranged a refund which arrived a few days later. Attempts to tell Talk Talks UK office about this went no where as all calls seemed to go to the same Indian call centre.

Since I have read that Talk Talk had closed their Irish call centre for reasons of cost and now all support is from their Indian call centres. Avoid this company at all costs.

codedokode• 9 years ago

I wonder is not it bank's responsibility to refund the money that were stolen from customer's account? And don't they use SMS messages to confirm outgoing payments?

But this case shows also that Internet banking UI are too complicated for some people and they don't realise what they are doing when following scammers' instructions.

user_rob2• 9 years ago

TalkTalk need to do more to fix this issue as they were responsible for not keeping customer information secure. Admittedly they did give out free stuff last year as a sort of compensation. However if this annoyance is not resolved soon TalkTalk's reputation will slide further.

siddharthdeswal• 9 years ago

So yeah, I knew someone who worked at a place like this in their previous job. For him, it was just a job that paid really well. He frequently made more than Rs. 1 lakh per month, which is kind of a big deal in India when you're just a year or so out of an average, run of the mill college.

Generally, these 'call centres' train employees to think that Americans are really stupid people who can be scared & fooled easily. Given the commissions he made, they were damn good at it, specially with the older people who would pay fairly large amounts every month or so to keep their computers virus free.

He never thought he was in some scammy company though. For him, the callers were 'virus' hit users who were calling to get their computers repaired, and these guys just had to make quick, easy, FUD driven upsells.

Oh, and these guys are unhappiest when they are made the manager, who get a very small commission from their team's upsells. I guess this meant that no one was looking for 'career growth'.

EJTH• 9 years ago

Tech scamming is an interesting phenomenon to say the least...

I have been binge watching scambaiters on youtube recently. I can highly recommend it if you want an introduction to how these scammers work.

st3v3r4• 9 years ago

We need to find this place, and issue drone strikes as soon as possible. If that is the only thing that Trump does with the rest of his presidency, he will go down as a better president than Obama.

duracel• 9 years ago

I can't believe how these companies do not get busted ever ? Englang is really unfair country for small business owners. More bigger corporation, less they pay tax, less they care of customers, less they protect your data...

Inside the TalkTalk 'Indian scam call centre'

Related Stories