Wally Happy Scammer

[carlislemike]

Wally Happy used to be involved as organiser and in selling at the Herne Hill Velodrome but gave up due to old age, etc., long before Covid. Yesterday I received an email purportedly from WALLY HAPPY, asking for Urgent Assistance! Wanted me to buy a gift voucher on my Amazon account for a seriously ill friend. His own Amazon account was frozen, not accepting his credit card payment. Offered to refund me himself after I’d bought the voucher. If you get this scam email, block / reject it.

[Jdsk]

Do you have a way of letting the real person know that this is happening?

Jonathan

[Chris Jeggo]

I've just phoned him. He knows.

[Jdsk]

Well done.

Jonathan

[thirdcrank]

Isn't this a reincarnation of an old scam? Going back to my earliest dial-up freeserve email I received something like this claiming to be from an old friend stranded in France needing urgent funds. I twigged it was not written in his style and so ignored it. A bit more recently, my late sister-in-law's computer was infected with a virus and everybody in her contacts list received a begging email

[simonhill]

Very often they just overlay the friend's name over their own email. You can see the underlying address if you click on the name.

Very rarely has it come from the actual email address.

I get lots of emails purporting to come from people I know. I report as spam or scam (a simple click) then ignore it.

It's why your email address has some value to scammers.

[carlislemike]

Aye I agree but not everyone is up to speed on this type of scam

[Jdsk]

Aye I agree but not everyone is up to speed on this type of scam

Exactly. Let the victim know. And help them understand what's happening, or recommend someone else who can.

Jonathan

[bikepacker]

Thanks for letting us all know about the scam and as I hadn't seen him for many years glad to know he is still with us. Used to regularly see him at Mildenhall and the Semaine Federal but age curtailed his attendance. Spent a few days at his place in Normandy many years ago he led some very interesting tours of that area, especially if you like French food and wine.

[carlislemike]

A man well respected & loved by those who met him.

[AndyK]

Very often they just overlay the friend's name over their own email. You can see the underlying address if you click on the name.

Very rarely has it come from the actual email address.

I get lots of emails purporting to come from people I know. I report as spam or scam (a simple click) then ignore it.

It's why your email address has some value to scammers.

I've seen several of these Amazon scam emails lately. The scammer has been cleverer than usual, and in this wave it does come from the actual email address. Common factors seem to be:

• The real person has a Yahoo email address (or one managed by Yahoo: Sky outsource their email provision to Yahoo, for example).
• The initial scam email does come from Yahoo mail servers and has all the signs of originating from the real account.
• The victim is in the real person's address list or has exchanged emails with the real person at some point in the past.
• The initial email's content is fairly innocuous - something like "Sorry to bother you, but do you ever order from Amazon?" followed by the real person's first initial (neat touch) and a kiss (x). (The initial warning sign for me on the first one I received was the kiss: he's a good friend but not that good. Also he'd spelt "favor" the American way in the subject line and I knew he'd rather die than do that.)
  However...
• The reply-to address is the real person's account name but attached to a newly-created Hotmail account. So for instance if the real person is Xavier Bloggs and has a xavierbloggs123@sky.com account, the email's reply-to address will be xavierbloggs123@hotmail.com.
• So even if you do a quick check on the reply-to address, it's possible you may not notice it's different.
• This is doubly important because Xavier still has access to his Yahoo/Sky account. He doesn't realise anything is going on because he doesn't see the replies from the victims: those replies go straight to xavierbloggs123@hotmail.com, an account set up and owned by the scammer. The scammer can then implement stage 2 of the con, continuing the conversation via the Hotmail account.
• Xavier remains blissfully unaware until one of his friends asks how his "terminally-ill niece" is doing - by which time it's too late.

So, the scammer has been able to gain access to a number of Yahoo-managed email accounts, then has run an automated check to see which account names don't already exist on Hotmail and have set up a Hotmail accounts with matching names. That gives the initial list of unwitting accomplices.
This may not be a new breach of Yahoo servers: they've had a number of break-ins in the past, files of hacked accounts hang around on the dark net, and some people don't change their passwords for years.

It's not just that your email address has value to scammers: email addresses that look a bit like yours but haven't been claimed by you also have value to scammers. There's not much you can do about that other than go round registering loads of accounts with every free email provider... but that way madness lies.

The best advice to the person whose email account has been hijacked in this way is to (1) change their password immediately and (2) report it to their email service provider.

[As far as I'm aware, Xavier Bloggs is a totally made-up name. Apologies to any Xavier Bloggses out there.]

[carlislemike]

So marking it as Spam should be effective then?

[AndyK]

So marking it as Spam should be effective then?

Marking it as spam won't make much difference to you, but may improve the chances of spam filters blocking similar messages in future. Of course it may also increase the chances that genuine messages from the real person may be flagged as spam. Again, with this particular scam, the initial message comes from the real person's email server, even though they don't know it's happening. And the initial message is phrased in such an innocuous way that it's not immediately identifiable as spam or scam.

[simonhill]

Andy, I read what you wrote and am not sure if it is the same, but I would be notified if anyone else logged into my Hotmail email account.

I normally use the app on my phone but occasionally I need to log in via the chrome browser (on phone). Did it today.

It recognised this as unusual even though on my own phone and it told me unusual login, details on what and where (Thailand, correctly).

Before it would let me in I had to complete my back up email address (different provider) and give last 4 digits of my mobile.

It then sent a text code to input.

Finally logged in on my own phone!!

Oh and warning email to Hotmail but I suppose that could be quickly deleted if someone had the account, but also warning email to my back up email account.

Not sure how easy this lot would be to get around for a scammer. It was hard enough for me and it's my bl**dy account!

[AndyK]

Andy, I read what you wrote and am not sure if it is the same, but I would be notified if anyone else logged into my Hotmail email account.

I normally use the app on my phone but occasionally I need to log in via the chrome browser (on phone). Did it today.

It recognised this as unusual even though on my own phone and it told me unusual login, details on what and where (Thailand, correctly).

Before it would let me in I had to complete my back up email address (different provider) and give last 4 digits of my mobile.

It then sent a text code to input.

Finally logged in on my own phone!!

Oh and warning email to Hotmail but I suppose that could be quickly deleted if someone had the account, but also warning email to my back up email account.

Not sure how easy this lot would be to get around for a scammer. It was hard enough for me and it's my bl**dy account!

Just to be clear, in the examples I saw, the scammer obviously had a list of people with compromised Yahoo or Yahoo-managed email accounts (e.g. edwardbiscuitbarrel@yahoo.com). From this they narrowed it down to those who didn't already have Hotmail accounts with the same name. (In this example, there was no edwardbiscuitbarrel@hotmail.com account yet in existence). Then the scammer would set up a brand new Hotmail account with the same name and use that to receive replies from victims. So the scammer genuinely owned the Hotmail account and was the only one with access to it. The scam depended one using the real person's Yahoo account just once, to send out the initial email, setting the "reply-to" address to ensure that any replies came to a Hotmail account that was owned by the scammer but had a deceptively similar email address. The scammer didn't break into anyone's Hotmail account, they simply set up a new Hotmail account where one didn't already exist under that name.
But we digress.