CleverTap Scam: Can I Scam the Scammers?
Mark Honeychurch - 16 October 2023
Last week I wrote about how I had been texted asking if I would like a job earning US$6,100 (around NZ$10,000) per month for simply clicking on a few buttons every day in a mobile app that was apparently testing other mobile apps. Of course, no testing was actually going on, and the process I was walked through by Anna, my scammer, was just a way to hook me in and gain my confidence, before the scammers attempted to extract cash from me.
At the end of last week’s article, I’d been working on my first set of tasks, but had hit a snag - a fortunate snag, as I had apparently chanced upon a rare “combination task” where my commission was going to be tripled. However, the snag part of this was that the trainer’s account I was learning on had temporarily gone into the red, with a balance of less than $0. This was causing a blockage where I was unable to continue clicking the buttons that constituted the entirety of the fake job I had been employed to do, and I needed to complete the job to earn the commission.
My trainer/scammer helpfully described the issue for me (as with last week, the scammer’s messages are left-aligned, and mine are right-aligned. This time I’ve also italicised my messages):
If you still don’t understand this combination task, I can answer it for you
Please do.
This combination is generally not encountered,. If you touch it, you are very lucky, it is 3 times higher than the commission of ordinary tasks
_What are the chances? First I manage to get the username Mark, which somehow hasn’t been taken already.
And now I have a lucky combination on my first try!
This seems almost unbelievable._
…
Because I have a deposit of 1500, this combination task may be encountered if the deposit is large, and there is nothing we will not encounter
…
All we have to do is to make up the negative amount as a deposit. I will make the deposit because this is my account
…
You have to help me contact customer service to get the details for me, after that I will make the deposit
…
Tell customer service that you want to fund your anna5216 account and then forward the details to me when you get them.
_Don’t give them any money!
When you work for a company, you don’t pay them - even temporarily. They pay you.
…
What a silly thing to do. Why would a company ever require you to give them money when you work for them?_
Yes, this is a temporary advance payment. After you complete the 40/40 task, I will withdraw the money to my wallet. You can rest assured that I have been in this company for more than a year. very safe
I’ve been assured that transferring my money is “very safe”, and that she’s been doing this for over a year now. And, after all, this wasn’t going to be my money on the line, at least not this time. She’s going to transfer her own money to clear the blockage, rather than me transferring anything. It seems that this was another part of the work they were doing gaining my confidence. Presumably if I’m shown someone else performing this task, and doing it with confidence, I would be more likely to do it myself when the time comes.
We then started talking about the specifics of making this transfer, which required a TRC20 address that I had to retrieve from the fake company’s Customer Care department:
Now I need you to help me contact customer service to ask for the TRC20 address, and I can make a deposit after completion
Yes, because we are colleagues, and I am still your recommender, and I will always be with you
_Great!
WTF is a TRC20 address?
Okay, so this is weird. Not only are you messaging me from an NZ mobile (+64 22 300 2843), but for some really weird reason, the customer support numbers are also NZ mobiles (+64 22 594 3802 and +64 22 439 2586).
I don’t mean to sound paranoid, but can you get me a landline number to call, something official?_
This TRC20 address is the address of our cryptocurrency wallet
Now, this is one of the many red flags in this scam. There’s no legitimate reason why an established company would use anonymous crypto wallets as a way to receive money. Scammers, on the other hand, love crypto, as it allows them to take money in a way that’s irreversible, fairly anonymous, and easy to launder by using a “tumbler” - a service where lots of people’s crypto funds are mixed up and then, over time, transferred out to one or more new crypto wallets, potentially with different currencies.
I mentioned my concerns, both about the crypto transfer, and the weirdness of a company using WhatsApp accounts for their customer service:
_Companies usually don’t have a mobile as their customer support number.
Right, so you’ll be transferring money into a crypto wallet rather than a bank account. Uhuh._
We first withdraw money from the working platform to the wallet. After completion, withdraw money from the wallet to the bank
I’d also suggest you get a bank account to transfer money to, as well. It’s much safer than transferring to someone’s crypto wallet. I’ve heard that loads of scams use crypto to steal people’s money, and you definitely don’t want that happening to you.
Yes, I have been using the Binance cryptocurrency wallet, it is also very safe, and the money I earn every day will go to my wallet.
_Okay, well I just want to make it clear that I will absolutely not be transferring any of my real, hard-earned money into some random crypto wallet. And I’m definitely not calling a mobile number for “Customer Care”.
Do you have a landline number I can call for customer care?_
Why, the phone number I marked for you just now is the customer service phone number, you can send a message to get the TRC20 address
_Yeah, but it’s a mobile number. What kind of half-assed company uses a mobile for customer care?
And routing a call through WhatsApp as well, rather than just making a phone call.
Actually, hang on, maybe I’ll just call the first number there a sec…_
I tried calling both the numbers that were listed for customer care, but neither of them were active. I’m guessing that the scammers have someone in NZ buy a bunch of off-the-shelf SIM cards, register them for just a single month of pay as you go, and use them to setup fake social media accounts for WhatsApp and other services. After that it doesn’t matter if the SIM card expires, as the account has already been created - just so long as they don’t forget the passwords to these accounts, they’ll be able to keep using them.
Having unsuccessfully tried to call both numbers, I followed the instructions I’d been given and text messaged the accounts through WhatsApp instead. I decided to have a little fun with them while asking for the TRC20 addresses. Here’s my conversation with the first one:
Hi, I’ve been asked to get an ID10T number. Can you help me.
Ok, please be patient while we confirm the merchant’s cryptocurrency wallet address for you
Possibly a FUR-Q as well.
TUYxpkrCWJozF6Z6o3vPGB5Qsu5hmW7Le9
❗️Please note
Before each transaction, please contact us to confirm the merchant’s cryptocurrency wallet address.
If you do not complete the deposit within 30 minutes of receiving the merchant’s cryptocurrency, please contact us again to confirm
Please provide a screenshot of your prepayment record after you have successfully prepaid so that your prepayment can be verified
Thanks!
And here’s my conversation with the second. It looked suspiciously similar at first:
Hello?
Hello, how can I help you?
_I’ve been asked to get an NCC-1701 or something?
Sorry, might be an R2D2?_
Ok, please be patient while we confirm the merchant’s cryptocurrency wallet address for you
TUYxpkrCWJozF6Z6o3vPGB5Qsu5hmW7Le9
❗️Please note
Before each transaction, please contact us to confirm the merchant’s cryptocurrency wallet address.
If you do not complete the deposit within 30 minutes of receiving the merchant’s cryptocurrency, please contact us again to confirm
Ah, okay, thanks!
Please provide a screenshot of your prepayment record after you have successfully prepaid so that your prepayment can be verified
Awesome, thank you.
However, this time I added an animated gif to inject a little levity into the conversation:
From here I decided to have a little more fun with this scammer:
Hello, what can I do to help you, I suggest you contact a customer service staff
You are customer service.
Hi, how may I help you
You can’t.
Hello, are you having any problems?
Nope.
OK
_Everything’s tickety boo.
Anyway, how’s your day been?_
Hello, if you have questions that you don’t understand on the platform, you can ask me. If you don’t have platform-independent questions, I’m sorry, I don’t have time to chat with you
_Oh, okay, sorry, I thought you were customer care.
I’m a customer, so I was hoping you’d care about me.
I just want to know that you’re living your best life, as my daughter would say._
I am the CS of the platform. I can answer you what problems you have encountered, but I can’t answer you without the platform. I’m sorry
Oh, okay, in that case I have a problem.
hello, what’s your question
Are you living your best life?
Hello, if you have no work problems, I can’t reply to you, please don’t affect my normal work
As this was going nowhere I figured I’d call them out and see what happens:
But your normal work is trying to steal people’s money - surely it’s a good thing if I affect it.
Hello, if you feel that there is any problem, you can not do this job
No, it’s all good, I’m doing the job. I’m just not sure how you justify your job to yourself.
Hello, all the rules and terms on the platform explain the nature of this job, if you have any doubts, it is recommended that you do not do this job
_Yeah, I’m okay with it - I’m talking about your job, not my job.
My job is to be scammed out of my money.
Yours is to be a part of the scam.
Which is risky, right, knowing that maybe you’ll eventually get caught and end up serving a jail term.
I certainly wouldn’t like to live that kind of a life._
ok i’m waiting
For what?
Hello, I have already said, if you have any questions, please quit,
Après toi
I do not have any violations, I can sue you for defamation
Can you?
Hello, this is my job, it has nothing to do with you whether I do it or not, please take care of yourself
At this point, they stopped responding, so I jumped back into my conversation with the scammer and gave her the TRC20 address:
Anyway, the wallet number is TUYxpkrCWJozF6Z6o3vPGB5Qsu5hmW7Le9
Wait for me, I will make deposit now ok …
Done, I deposited money, please send this screenshot to customer service and let me know when customer service updates my account.
Wow, good work.
Was the deposit successful? How does the customer service reply you
…
Hang on…
I pasted the screenshot from the Customer Care rep that I hadn’t accused of being a scammer. My presumption is that a single genuine cryptocurrency transfer was made at one point, which they screenshotted, and now the scammers just keep using the same screenshot for each new scam they run. I quickly received a confirmation that the “transfer” was successful, and that I would be able to carry on clicking my buttons:
Your deposit has been made successfully! You can withdraw your entire deposit and earnings after completing all tasks!
I relayed the message to my scammer, and she gave me instructions on how to continue:
OK, you can now go on to complete the tasks you have just left and let me know when you have completed 40 tasks
So now the app will work again? Shall I finish those tasks?
You now return to the home page and click on Record in the bottom right hand corner to submit the task you have just left unsubmitted and then continue to click on Optimise 40 tasks
Once I was done, with all 40 tasks completed, I was asked to post a screenshot of the results:
I was then told that I was going to receive 20% of this, which was underwhelming given that I did all the work of pressing buttons 80 times:
Thank you for the profit you’ve made for me 242.3usdt
…
Now please log out from my account and log in to your account and shoot your balance for me, I have a little surprise for you
_Oh, awesome!
Doing it now…
Oh, that is little.
I just earned you 242.3USDT, and all I get is about 20% of that?_
Yes
_Seems like I’ve been ripped off already!
Okay, so how do I cash this out?_
It’s just that I recommend you to join this job and I can get a referral fee of 20% of your account commission
Looking forward to spending my earnings on booze and fags.
That was the process of optimizing app and upload data. Now you just have to do it in your account like you did mine. Complete 40 tasks then you will be able to withdraw.
CONGRATULATION ! that is your commission you earn from doing task for my account. You deserve it
You can now well do the 40/40 task for your personal account. I am now logging into my training account to withdraw funds, let me know when you have finished and I will teach you to withdraw all funds from your account and unlock the reset 2 sets of tasks again.
Yay!
I will teach you how to withdraw when you complete yours.
Okay, thank you.
So, I wasn’t going to get to cash out my money until I had completed a run of 40 tasks under my own account. I was skeptical, and figured that I would probably hit the same snag with my own account, and be expected to deposit a few hundred US$ in order to complete my set. So I spent a while pressuring the scammer, asking for assurance that this wouldn’t happen, or that there was a way of cancelling the job if I ended up in this situation. After being reassured, I walked through a set of 40 tasks (80 more button presses!) and earned a whopping $65:
By this time it was midnight, and I was keen to get my money. But I was told I had to wait until the next day:
Okay, how do I cash out?
Okay, you earn 65USDT after completing this group, now I tell you to download the Binance cryptocurrency wallet, and tomorrow I will take you to withdraw money to the bank
You can register one exchange account to get crypto wallet. Go to AppStore to download Binance, download it, create one personal account and verify your identity until secondary level, then you are ready…
Once you’ve registered and verified, let me know and I’ll show you how to find your TRC20 address, which you will use to receive your salary and commissions for your work at CleverTap.
Good night, I’m going to rest.
_Awesome!
Thank you._
The next morning, I had to consider what I would do if I actually managed to scam the scammers. It seemed unlikely, but there was a possibility that a small payment could be a loss-leader for the scammers - the ultimate way to gain my confidence, and a risk worth taking for them, as the pay-off would be much more.
However I knew that any money that I might manage to get my hands on would have ultimately come from other people who had been scammed, so I definitely didn’t want to keep it for myself. And donating it to the NZ Skeptics didn’t feel right either. So, after a little searching and a conversation with a couple of friends, I decided that I would donate the money to a group that actively battles scams in New Zealand - possibly NetSafe.
However, this was not to be. I messaged my scammer in the afternoon while I was in the pub with a friend, and we walked through setting up a Binance account (and, honestly, it felt a little dirty to be opening a cryptocurrency account, given my low opinion of crypto). But, just as I was about to get my payout, she went silent:
Click here to take a screenshot for me.
Is that my TRC20 address?
This was the last message I received from my scammer - she suddenly went silent, in the middle of our conversation, as if she’d been raptured. Several hours later, and over the next couple of days, I kept messaging:
_Damn, I was hoping to get this done, but you seem to have disappeared!
Hey, are you there?
Hello?
I really need to transfer my funds out of my account, and you suddenly went quiet. You’re reading my messages but not responding. What’s happening?
Hello? I’d like to be able to access my funds please.
It’s been two days now and you’ve not said anything to me._
But alas there was no response. For some reason I had suddenly been dropped. Maybe the scammer had been warned by the Customer Care person that I knew it was a scam? Maybe they realised they weren’t ever going to get me to hand over any money, and they’re smart enough not to give away their own money.
So, I lost a few hours of my time doing this, but the scammers also lost a few hours of their time - and neither of us made any money from the other. But, for a successful scam, it appears that the scammers would expect to make around $1,000 NZ or so - not a bad pay out for maybe 6 hours work shared between three scammers. This scam very much reminds me of the age-old Nigerian 419 scams, but obviously a lot less grandiose than being told I’m going to inherit $48 million. But the method seems to be roughly the same - entice the victim in with the promise of money, but then place a small obstacle in the way of a few hundred or a thousand dollars. In the case of a 419 scam, the obstacle was usually a clearance fee, bribe, or administration charge. In the case of this scam the obstacle itself is part of the carrot they’re dangling in front of you. Yes, you have to transfer some money temporarily, but the reason you have to do this is because you’ve just hit upon a higher commission task, one that will triple your earnings. It always seems to come down to blinding people with greed.
These scams are known as advance-fee scams, and despite having been around for many years they’re still very popular, I guess because the greed motivation is strong, they continue to work. Usually, the first payment you make won’t be the end of it. A scammer will continue coming up with reasons why you need to transfer more money to them, and they’ll keep going until you either run out of money or come to your senses. Sadly, though, as I’m not going to throw any of my money at these scammers, I’m unable to document this part of the scam for you all. But you can see examples of this in the Wikipedia page for advance-fee scams, as well as in stories online like this one from Westpac.
In my next newsletter, you can read about another scam - the “Publisher’s Clearing House”, where I’m promised a boat load of money, if I can just help them with a “clearance” fee. Hmmm, maybe that’s why they chose the name!