Death Threat Fraud SMS in Australia

Newspapers in Australia, such as the Sunshine Coast Daily, are reporting a massive fraud scheme using SMS messages

The Federal Government’s SCAMwatch sent out a national warning.

“These hoax death threats typically involve SMS text arriving out of the blue from what appears to be an international number. In some cases the number appears to be blocked,” SCAMwatch said.

“A typical message reads: ‘Someone paid me to kill you. If you want me to spare you, I’ll give you two days to pay $5000. If you inform the police or anybody, you will die, I am monitoring you’.

“Some of the messages are long and contain all the text, while others are broken up into shorter messages.”

The Daily understands the scam started spreading over the weekend and was sent out again yesterday morning.

Reports indicate the requested amount varied from $1000 to $50,000.

Police urged members of the public not to be alarmed and not to respond in any way to the message.

The police should urge the public to forward to the messages to an official abuse desk for free.

Phone providers can assign a SMS abuse reporting number (e.g. 8888) so it funtions like reporting email abuse (e.g. abuse@providername.com). The SCAMwatch form for reporting abuse is so big I doubt most people could fill it out in less than five minutes, which means it won’t be used.

Providers also could be a lot smarter about their blocking services. If the official response was to forward fraud messages for free to the providers then far more pressure would be felt by providers to stop fraud and SMS abuse.

Bike-cams Help Catch Hit-and-Run Drivers

As many of you know I’ve ridden cycles most of my life including racing, commuting every day in large cities and long tours. It wasn’t until I moved to San Francisco that I personally experienced a hit-and-run accident.

A van exceeding the speed-limit crossed the white line, side-swiped me and knocked me over. It amazed me that despite many people standing nearby watching traffic no one could describe anything other than a white van. I was hit at the corner of Pacific and Hyde where people were waiting at the bus stop, sitting outside at the cafe, standing on the corner waiting to cross…plenty of witnesses but no help. In fact, they just stood and watched while I picked myself up, checked my bleeding injuries and moved my bike off the street.

StreetView on Google, strangely enough, shows a white van speeding away from the scene where I was hit.


View Larger Map

The NYT writes that this risk equation is changing with use of cameras on bicycles.

“It’s a fact of life that on American roads that you get punked, cut off purposely, harassed, not once but on a regular basis,” said Bob Mionske, a former Olympic cyclist who is now a lawyer representing bicyclists in Portland, Ore. “If motorists start to hear about bikes having cameras, they’re going to think twice about running you off the road.”

A video by Berkeley cyclists, mentioned in the NYT article, provides a good example of how this can work. At 2:35 a black Acura Integra suddenly side-swipes two cyclists and then speeds away, exactly as it happened to me.

The video, which shows the Integra’s license plate, led police to the owner. The owner then apparently claimed it was stolen at the time of accident.

Of course the police should ask the car owner “do you have video to prove that it was stolen?”

A recent decision on “undisclosed recording” (Maryland v. Graber) suggests “video taping of public events is protected under the First Amendment.”

Here is a year of video by a cyclist, as presented by CNN:

PFGBest and Audit Red Flags

The bankruptcy of PFGBest and attempted suicide of its founder have reporters writing some interesting stories. New York Magazine says there were obvious red flags such as this detail posted by Reuters:

Jeannie Veraja-Snelling has been certified in the state of Illinois since 1999.

However, she does not list having any public company clients in her 2011 annual filing with the PCAOB.

On Tuesday night, she came to the door wearing a green sleeveless shirt and blue denim shorts. A stack of cardboard filing boxes was sitting just inside the door.

Why should we accept that the size of an audit firm or the clothes of an auditor are red flag signs?

I mean you always have to account for (pun not intended) the Enron fraud fiasco taking down the entire 85,000 employees of Arthur Andersen. And you also have to consider applying the same logic about size to other professionals such as doctors or dentists. An exit from large headquarters and staff to run a small practice is not necessarily a step down.

The future, ever more fueled by social network tools, could be argued to be headed towards umbrella firms of peer relationships between independent but small practitioners. Lower overhead yet more personalized service is a trend. Peer respect or presence in the market is not set by size alone. The age of “giant” corporations made sense when you were talking about smelting iron but in the information age a small firm may be superior to large ones in many ways.

Large firms, meanwhile, tend to face pressure to make money to cover their overhead. That pressure can often lead to fraud. PFGBest, for example, was very large. We know that the founder of the firm confessed to fraud and was known for excessive displays of wealth. The external auditor’s appearance pales in comparison, in terms of signs of fraud, to the corporate jets, giant gifts, large construction projects of the PFGBest founder.

That being said the true worry in the story is the independent auditor’s lack of records and lack of awareness. Also of concern, although I haven’t seen anyone report on it, is a lack of a peer network with other auditors or professionals in her area of expertise. Regulators definitely could have picked up on that, especially if they tested her annually. Did her skill and reputation match her responsibilities?

The PCI SSC regulates its auditors closely by regular tests and reviewing the reports on compliance. It’s a decent model for other regulators to follow. The quality assurance program for assessments and assessors is one of the primary factors that makes PCI DSS so much more rigorous than other regulations.

Another aspect of the PFGBest story is how the founder managed to hide his crime, as revealed by New York Magazine.

“I was able to conceal my crime of forgery by being the sole individual with access to the US Bank accounts held by PFG. No one else in the company ever saw an actual US Bank statement. The Bank statements were always delivered directly to me when they arrived in the mail. I made counterfeit statements within a few hours of receiving the actual statements and gave the forgeries to the accounting department.”

[…]

Later in the note, Wasendorf detailed how he had falsified bank documents “using a combination of Photo Shop, Excel, scanners, and both laser and ink jet printers” in order to fool regulators into believing that his firm, which is now bankrupt, had adequate money in its accounts.

Sole control? Financial companies usually force annual vacation, as explained by businessfinancemag.com, to let others run the numbers and verify controls.

Job rotation/mandatory vacation ranked second in effectiveness; companies with this control in place experienced a median loss 61 percent lower than the median loss incurred by the other organizations in the sample.

Source: Association of Certified Fraud Examiners

How did PFGBest avoid that time-honored practice? The excessive displays of wealth coupled with dictatorial control — accumulation of wealth coupled with lack of transparency — are the common red flags for corruption. Denim shorts and low overhead may not inspire confidence on their own but they tend not to show up in anti-fraud research.

2012 BSidesLV: Big Data’s Fourth V

I will be presenting at the 2012 BSidesLV conference:

Big Data’s Fourth V: Or Why We’ll Never Find the Loch Ness Monster

When: 1400, Wednesday, July 25, 2012
Where: Breaking Ground
Cost: Free (as always!)
Link: http://bsideslv.com/talks.php#bg104

Variety, Volume, Velocity and Vulnerability. We know many different types of data are being generated at high speed but how much do we know about the new weakness they introduce? Security is often an issue in Big Data but rarely understood or discussed openly. This presentation brings forward the giant elephant in the room and offers the audience some real-world puzzles of big data to solve. Examples of humorous failures as well as some success are presented as examples. You might think your security problems are big until you are asked to help find some solutions for Big Data’s Fourth V.

Video of the presentation:

Some of my other BSides presentations: