I've been sharing this discussion with my husband because he has been involved in Security angles of his profession in various degrees (I.T., disaster preparedness and business continuity, and so on) for years now and finds this sort of thing interesting. I, also, as some of you have expressed, find myself amazed that such tactics are used as we have seen described in today's discussion, because it seems so obvious that simply asking for the fax in question or asking for the details or for that matter saying, "Why yes, let me transfer you to our attorney right now, just one moment," (and see if they can hang up before you complete the transfer button-pushing!; if not, let them stammer their way through getting off the phone with the attorney---if you even knew how to transfer them to said individual; if not, I might say I was transferring them to the attorney but really transfer them to in-house security or some such) would stop the whole thing in its tracks . . . but my husband just remarked to me about why such "social engineering" (as he has called it for years; that or "social hacking") tactics do succeed: "As crazy as it sounds, large institutions are still vulnerable to this simplistic attack. Meek receptionists or students manning phones on the front lines are easily cowed by this attack, (unless properly trained - a generally lacking component). Then the invoice comes into a overburdened Accounts Payable department which in my experience will immediately pay invoices under a certain amount (~$1,000) and find out more about it later. (When it's too late.) This is the kind of situation these scam artists are counting on. Unfortunately they are more successful than not. Security Awareness is NOT just about IT - with viruses, worms, etc. It will teach people, especially those on the front lines taking these kinds of calls, what they need to know to properly handle them." Rick Anderson's book probably addresses that very thing for that very reason. -----Original Message----- From: SERIALST: Serials in Libraries Discussion Forum on behalf of P V Picerno Sent: Fri 12/17/2004 12:45 PM To: SERIALST@LIST.UVM.EDU Cc: Subject: Re: [SERIALST] Scam alert: Watch out for phone calls from "Mrs. Larson"/American Directory Listing Cindy, I also can't imagine what scam artist would try to bilk an institution by threatening a lawsuit as the opening line of a conversation! My first reaction would be to ask "Mrs. Larson" to send (fax) me a copy of the fax in question so that I could check what it was about before proceeding to take any action about it. I would think that if she were unable to send a fax of the fax that that would end the conversation right there. The other tack (which might also stop things dead in the water) would be to ask what the fax was about because if it was an order or regarding an invoice, then I would have the original copy of the fax which was allegedly sent and therefore could address its contents. As scams go, it sounds like these folks have some things to learn -- I mean, if they want to trump up a non-paid invoice or phony order, then the business office would be the place to go to to resolve that (if not the acquisitions department itself). Furthermore, in any kind of legal action, THEIR legal counsel talks to YOUR legal counsel and if things have gone that far, their lawyer already knows who your lawyer is. Maybe we should send Mrs. Larson a list of other known scam-agents so that she could get some mentoring!! Peter Picerno Dr. Peter V. Picerno Scarborough-Phillips Library St. Edward's University 3001 South Congress Ave Austin TX 78704-6489 512.464.8825 fax 512.448.8737 Please note that my new e-mail address is: petervp@admin.stedwards.edu -----Original Message----- From: SERIALST: Serials in Libraries Discussion Forum [mailto:SERIALST@LIST.UVM.EDU] On Behalf Of Lafferty, Cindy Sent: Friday, December 17, 2004 11:15 AM To: SERIALST@LIST.UVM.EDU Subject: Re: [SERIALST] Scam alert: Watch out for phone calls from "Mrs. Larson"/American Directory Listing Rick, Thanks for warning us about this scam. Could you clarify exactly what these people are trying to accomplish? I'm aware of the scam involving callers asking for the model of your copier/printer/fax so they can send you toner with inflated prices in the hope that you will pay it assuming that someone else ordered it, but I'm not sure how these people plan on making money off of haranguing people. Cindy -----Original Message----- From: SERIALST: Serials in Libraries Discussion Forum [mailto:SERIALST@LIST.UVM.EDU] On Behalf Of Rick Anderson Sent: Friday, December 17, 2004 10:44 AM To: SERIALST@LIST.UVM.EDU Subject: [SERIALST] Scam alert: Watch out for phone calls from "Mrs. Larson"/American Directory Listing Hi, everyone -- I just got off the phone with someone who identified herself only as "Mrs. Larson", and said she was calling because of a fax I had sent to a directory publisher. (She said the name of the publisher very quickly, and I didn't catch it.) She said that she wanted to speak with our attorney. I offered to give her the name and number of the appropriate office, but first I wanted to ask her a few questions of my own. I asked for her full name, which she refused to give me. I asked for the name of the company she works for. She said her "office" was called Pentium Capital. I asked whether it was a law firm, and she said yes. When I asked for her phone number, she gave me (514) 693-5171. When I tried to ask another couple of questions, she got very indignant and asked if I was refusing to give her the name of our attorney. I said no, but that I wanted to know a little bit more about what was going on. She told me she'd see me in court and hung up. I looked up "Pentium Capital" on Google and found an Asian financial company or two, but nothing else. Since she had given me a phone number, I decided to call it and see what happened. The call was answered by an automated attendant that said "Welcome to our corporate offices." When I dialed zero I got a live person who said the same thing, so I asked what company had its offices there. She said that several companies did, and when I asked her to list them she did so quickly and nervously; one of them was American Directory Listing. When I asked her to repeat the list more slowly so that I could write them down, she got very uneasy and said she was just a receptionist; then she said she was just an answering service. When I said "That's okay, all I need is the names of the companies," she told me to hold. Then she transferred me to another phone line, which was answered by none other than "Mrs. Larson." When I asked "Mrs. Larson" the names of the companies she represented, she got very huffy indeed and asked me who I thought I was. I told her I thought I was the person she had called and threatened with legal action just ten minutes earlier. Strangely, she didn't seem to remember me, but she got very angry and started yelling, and told me never to call that number again. The reason I'm telling you all this story in such detail is that ADL is a company we've all had dealings with before, and I know of at least one other librarian who has gotten a call from "Mrs. Larson" recently, so we (and our staffs) all need to be on the alert. She is very aggressive and probably capable of bringing someone on your staff to tears if she gets the right person on the phone. (I'm fairly experienced in dealing with these people, and even I was a bit shaken after our initial conversation. The second conversation was so off-the-wall that it was actually quite comforting -- there was no longer any doubt in my mind that I was dealing with a scam artist.) Be strong and wary... ---- Rick Anderson Dir. of Resource Acquisition University of Nevada, Reno Libraries (775) 784-6500 x273 rickand@unr.edu
