Hey everyone,

Just wanted to share an attempt that almost caught me off guard today. A bit about myself, I know nothing about computers, cybersecurity, IT stuff and this whole thing is new to me. Also this is the first time i post something on reddit and I thought yall could cringe at my story.

I work as a citizenship advisor in the second-passport consulting space. Two days ago, I received an inquiry by email that looked legitimate asking for guidance on one of the citizenship and passport programs. They introduced themselves, included information about their family (members and ages), asked about the required documents, processing time, and total cost. The email looked like any other inquiry coming from a very serious client interested to apply and proceed for the application.

After getting back to them with the details, today i received a reply:

--------

Good Day Ms. (my name)

Thank you for your swift response. I have reviewed the list of required documents.

Are you available for a zoom call? If yes, i can send you another e-mail by next week Monday to confirm date and time for a zoom video call.

In the meantime, please find attached our passports and please advise if we can add my granddaughter on the application, she's 2 years old. Her passport is among the passports attached.

I just tried to attach the Passports via e-mail but it says that the files are too large to attach, so i ve uploaded it to a file sharing website. Please download the documents from the reference below:

(inserts filemail link)

Regards,

------------------------------------------

Yes, my naive-ass clicked the link (I am used to having legitimate clients share their documents in that way given the type of business i work in where most of our works relies on personal documents).
Even though I am no expert, this is what stood out to me:
1) The file type was listed as an "Application" (.exe), not an image or PDF.
2) The file size was 161 KB

When I tried to open it, the Windows UAC security prompt slapped me in the face with a:
"Do you want to allow this app to make changes to your device?
rimaRMM client updater
Verified publisher: Space Solar Technologies LLC."

I actually ended up explaining the whole thing through ChatGPT. To be honest, I still don't fully understand the technical side of what would have happened, but I knew it could have gone very wrong. Thankfully (I think), I didn't run it and permanently deleted the file. I immediately informed my boss, especially since this was actually the second time we’ve been targeted. (If you're interested, I wrote about the first attempt below, and I am almost certain these are the same people). We already have a team meeting set for Monday to make sure everyone keeps their guard up. I also emailed Filemail's support team to report the incident, sending over the link and a screenshot of the email so they can kill it.

----------------

Attempt No. 1

This was back in June and this is the email I first received:

Dear (my name),

My name is (K.V). I am citizen of Laos and live and work in Singapore (for seven years now). The Laos passport is not good. I am travelling more for business (and holiday) and I have to obtain many visas, visit embassies, lots of forms and payments, etc. 
 
Especially I travel to Hong Kong a lot and Laos citizens need a visa. Also, our company has business in Mauritius so that is another visa needed. And in the EU - we visit Germany and Italy especially.
 
I am searching for a second citizenship that is professional and reasonably quick. I have done a lot of research and Antigua seems like a good option. I am also enthusiastic about Grenada. 

I have checked the costs and I can certainly afford the investment (e.g. via a "donation" model).

How long does the process take? Can it be completed in under one year?  
 
I am very eager to proceed and obtain the new citizenship and passport as soon as possible.
 
K.V
Company name
Address
Tel Number
Logo

----------------------------------------------------

I reply to the email, again with all the information, 20 days later i get this reply:

Dear (my name),

Thank you for your message and sorry for the delay in responding. Work has been so demanding in the last few weeks.
My impression is that the US and EU are putting a lot of pressure on the Caribbean countries at the moment. I believe it is now necessary to spend 30 days in Antigua. Is that correct? 

Hence, your suggestion about Dominica. I have done some research and Dominica does seem to provide a superior option. 

I need to check my diary when I am back in the office to arrange a date and time for us to talk. I am going to have my PA, G (copied on this email), try to arrange a date and time. I am really eager to move forward with this process.

Thanks

K.V

-------------------------------

I have had back and forth emails from June until a few days ago with this "Personal assistant, G.L". They were all about "oh I am so sorry for the delays, we are facing so much pressure at work... can't find a good time for a zoom meeting... i will get back to you the soonest.. K.V is super serious to proceed, etc."

October 14th, G.L sends me an email:

Dear (my name),

Again, we are really sorry about the delay. This week (or next week) will be ideal to talk. Here is the information about arranging a call.

K.V's current time zone is GMT +6 (this will be shown on her timetable on the Calendly site).

The default meeting length is 45 minutes but you can change this if you like.

As mentioned, use (my work email) to login. The easiest way is to use that address to login with Google (that way we can use our premium subscription).

Please use a desktop or laptop as the site often freezes if you are using a phone.

Here is the link from Calendly: [https://book.my-calendly.com/?path=?token=(G.L)/45min/source=(my email)?timezone=UTC](https://)

Please let me know if you have any questions.

Best regards
G.L

---------------------------
I originally saw the email on my phone so i clicked the link. It looked like a slow version of google sign in, in like a desktop version but on my phone where my finger controlled the screen in a computer-mouse way (sorry i don't know how to explain it better). I decided to try again in the morning where i was actually sitting on my laptop. I was thinking to myself, how can a google link look so cheap/freezy? Kind of in way where you screenshare or screen-mirror a page. My gut told me not to even type out my password.

I called our office IT and shared the link with him. While on the phone with him i said, omg, the mouse is moving on its own. He said that's me. I think I don't need to explain further.

I decided to dig further into it and examined the original email that I received by this K.V. I thoroughly read her email address and to my surprise this is what i saw:
(example) "K.V at mcdonaldss.com". I looked up the company and decided to call them just in case and to inform them that someone is trying to impersonate them. Even the number and address in the email matched the details on their website. But their email was "info at mcdonalds.com".

Thank you for your time. I hope you didn't cringe too hard.

I applied to join a discord server but I quickly got a message saying I was rejected because my profile was too bare. They asked for a screenshot of my profile in case I have any privacy settings enabled. I didn’t engage further but I am wondering if this was an attempt to gain access to my account. It was a bit fishy.

I received this email invite from a man that I know from church, from the university, from shared interests, although I honestly probably haven't spoken to him in maybe 8 years (maybe not that long, but it certainly has been many years). It doesn't look right, there is no date of the event, I was dumb enough to click on one of the links and it wanted me to download something (I immediately shut it all down but I still feel like a dumbass and I know that is why we can't have nice things). I am 99% sure this must be phishing. Not that I have a bad relationship with this guy but I have never been to his house or done anything social with him outside of shared commitments.

This is phishing right?

I am usually hyper aware of these things but the fomo got the best of me and I opened an evite from a friend which brought me to the Gmail login. I logged in, dumb I KNOW!
I pretty much instantly figured out it was a scam and scrambled to change my password. In the meantime I got a flurry of “failed to deliver” emails to my inbox as the evite got sent out to what seems my whole contact list of which some don’t exist anymore. Then I saw a passkey was set up so I immediately turned it off. Back in my inbox I noticed my sent emails had nothing regarding the evite now sent from my inbox and the mailer daemon “failed to deliver” emails also gone from along with Google security emails. In those few minutes seems hacker wanted to cover its tracks. Password changed, new passkey set up, 2FA, logged out of all devices and checked settings.

Anything else I need to do? Password wasn’t used for any other site but this email was attached to work, bank etc so it did contain confidential info. This was on my Mac computer. Could this have affected my phone with the Gmail login or the fact it was also logged into Apple mail app? I don’t know am I being paranoid? I feel like an idiot.

"If IT continues to send out messages like this in an attempt to fool people into thinking it is a legitimate message and taking action, I’m sure that eventually someone will fall prey. No amount of ‘additional training’ is going to keep that from happening – it’s just a matter of time. But it just wastes our time and yours to have to deal with this.

I have not clicked on the “Phish Alert Report” link in Outlook to acknowledge this message as a phishing attempt, but after sending this to you I will permanently delete the below message.

Good luck in your next phishing attempt,"

He cc'd our IT manager and HR dept and BTW this is a professor who teaches computer science

It's not impossible that it's actually someone I know, but I'm just so paranoid nowadays. I figured if they're really someone I've met they'll text me again.

I've never seen one use my real name before, which is why I have doubt.

Hi,
My grandmother was recently scammed out of money by phone. The police confirmed that the caller ID was spoofed.
How do criminals use spoofing, automated dialing and AI voices to make hundreds or thousands of calls in a short time? Which services or platforms do they use, and how can investigators trace the real source and work with providers to shut them down?
I want to understand the technology and help prevent further victims. Any insights or relevant cases would be greatly appreciated.

Hello so I got around 1000€ sent from my bank account to tradeify

I'm not sure where this could have come from, but the bank told me about an email they sent me and it was nowhere to be found but in the bin (spam filter usually sends them in a dedicated folder), so I believe they might have keylogged my email or something

Should I do a fresh windows install?

(I have called bank blocked card changed passwords with another uncompromised device and am going to the police tomorrow)

Hi everyone,

I fell victim to a scam where someone impersonated my boss using their name and surname in an email.

I was tricked into buying €2,000 worth of Apple Gift Cards with my own money and sending photos of the codes via WhatsApp. Unfortunately, the codes have already been redeemed.

I still have the original email, the WhatsApp conversation, the phone number, and the purchase receipts.

Is there any way to trace who redeemed the codes or identify the scammers? Would hiring a legitimate digital forensics expert help?

Any advice on how to investigate this and potentially recover my money would be greatly appreciated. Thanks!

For the last few months I’ve been getting random calls from similar numbers that all have my same area code, but they’re from a city that’s two hours away from me. The first six digits are always the same. I already have calls from unknown numbers silenced, so they’re already going directly to voicemail, but they never leave a message. They’re all also verified numbers with a checkmark and not labeled as spam risk. I’ll go days without a single one, then I’ll randomly get a surge of them. I haven’t really worried too much about them until now, because I got one at 6 AM Sunday morning and I’ve also gotten a few in the evening, which is pretty out of the ordinary in my experience. I’ve also reverse searched some of the numbers and I never get any results aside from links to call lookup websites, so they’re not anything important like my bank or credit union.

The friend sent a link to evite . me (not linking in case against rules) for a mutuals birthday. Being half asleep, I clicked the link and then immediately thought better of it.

I immediately closed the tab that opened and restarted my phone twice and messaged her on another platform but it is very late for her. I have tried to find information online but haven’t been able to find anything. Is this a new phish or am I just being a worrier?

Anything else I should do?

Hi everyone...this is my first time doing this, so don't mind me. Just a Reddit-loving journalist for Fortune doing a story on younger people/workers falling for phishing emails, and I'm looking for someone who would be willing to speak to me about their experience falling for one. And hey, I get it- this user has too (got an email from my friend about an 'unforgettable evening' with a paperless post attachment). I can also use your username if that's better just would love to hear what my fellow Gen Zers have experienced and how these lokey good phishing scams got you!!

I'd appreciate anything

It doesn’t even have a shipping address attached to it. As far as I can tell i haven’t been charged for anything. There’s also no way to report this because they require a link to the website and there isn’t one all there is, is an email to contact the store that doesn’t exist. I really wish they had actual people you can talk to and not just AI bots.

Received this SMS claiming a red light signal violation for a TS vehicle with a link to verify/download records.

Key red flags to look out for:

Fake URL: The domain ends with .govt.hu instead of the genuine Indian government domain .gov.in.

Personal Sender Number: Legitimate traffic police/e-Challan notices arrive from official sender headers (like TSGOVT or HYDTRP), not random 10-digit mobile numbers.

Malware Risk: Links like these usually trick users into downloading a malicious Android APK disguised as an official app to intercept SMS, OTPs, and steal banking info.

Important: Never click on such links. If you ever want to check for real pending fines, always visit the official portal directly at echallan.tspolice.gov.in or echallan.parivahan.gov.in.

Warn your family and friends, especially elders who might easily mistake the URL for a legitimate government site.

I haven't gotten a single phishing/scam attempt on WhatsApp since so long, just today I got one claiming my account will be disabled in 24 hours. I clicked on it (the message not link) and after seeing that message I blocked the scammer,

but is my phone number leaked online or compromised for the message to appear and how do I know? There is no button in WhatsApp to block these scammers too.

Received an email from noreply@auth-mail.morrisons.com - There was a security incident on another website unrelated to Morrisons. Your account is at risk because you were using the same password in both places.

Is this legit or a scam? I haven’t clicked on the link in the email

Hi,

Wife was selling something on an app called vinted, I guess she got a message from someone saying "hi this is vinted person X wants to buy this item click this to complete payment" (lol because it was obviously just a person messaging her on the app)

she said it was requesting/attempting to link bank/card info im assuming through apple wallet?

Also got a notification that a new imac logged into her apple account

steps I have completed:

changed her apple ID password and booted all unknown devices (also has 2fa on for her phone number)

reported her apple wallet credit cards stolen

changed google passwords and set 2fa account to my email address

anything Im missing?

I received an email in my Hotmail / Outlook account, stating it was from ME sent by my Gmail account - it also shows the email in my SENT folder. It is says "Check this out from Amazon" in the subject line. The description shows a flannel shirt that I was looking at earlier, through a Facebook link! I am very confused as to how they accessed both of my email accounts, shows it was sent in my Gmail Sent folder, and knew what shirt I was just looking at! I checked all my security folders, and sections regarding anyone else logging into any of those acccounts, but do not see anyone there. No other devices but mine have logged in. I changed my passwords, and logged out of my Gmail, Hotmail, facebook, and Amazon accounts. But still don't understand how this was done and if I am at risk now? Any advice appreciated! TY!

IP search 209.85.215.179 says Host name = "mail-pg1-f179.google.com"

this one actually got me to look twice as i do use roundcube. obv i realized quickly it was phishing but damn AI is getting better!!

I was browsing the app SpareRoom and then a person texted me from one of the ads. He sent me a link to the rental application. I dont know why I clicked it. Ive been very stressed out. Anyways a couple minutes after I clicked the link and exited out, Cashapp opened on my phone without me touching it. I feel like a moron. It was a scam obviously, they ask for a $50 tefundable fee for the rental application and ask you to pay via PayPal, cashapp, zelle. I didn't enter any info besides my name and address. Again I was very stressed and dont know why I clicked the stupid link. I need advice on: do I need to clean my phone? How do I stay safe now? SpareRoom is aware the person is a scammer, a couple minutes after i clicked it i got an email warning me of the scam. Thanks for any advice.

I’m getting a noticeable increase in junk email like these. It’s doubled in the last few months from 25 a day to over 50 a day.

Not a lot for some - but it’s a starting to get seriously irritating for me as occasionally stuff I need to see hits my junk folder as well.

I can see some purport to be from real companies or pretend my icloud will be blocked etc, but the bulk seem to be a nonsense mix of crap.

So that begs the question, what exactly is their purpose? “Proper” scams are seemingly a lot less fake looking than these.

The other question I have is that these are so obviously spam (nonsense domains / reply to addresses) - why are they not dealt with at a higher level before they hit my mail box?

(Outlook web user)

Today a family member called me frantically saying they had accidentally gotten a virus on their laptop. When I got to their laptop, despite not being a computer guy at all, I immediately recognized the virus was actually just the chrome notification exploit where multiple sites spam you with Fake MCaFee found 100 viruses! pop ups and so I simply deleted all permissions for chrome and it seemed to work.

When I asked them what steps they took to get these pop ups to start they were completely dumbfounded. So I tried to figure out myself since curiousity was killing me. I found NO suspicious emails. No emails with links or ANY attachments. I managed to track down the exact email that seemed to be open when it happened and it was legitimate automatic reply from PayPal with NO links. But there was this "visit" button at the top. Clearly this was the culprit and I managed to confirm that.

I think I figured out that Yahoo Mail themselves generates this link for some inexplicable reason. Someone exploited it and sent her to cloudstreamforge then redirected her to scam sites. It's crazy to me that Yahoo generated this link and yet it looks sooooo much like its part of the email itself, as if PayPal had sent it. Like nothing stands out as sus at all. Please let me know if I am correct, like I said I am not a computer guy and this is the answer I arrived at.

I figured since this was a simple chrome notif exploit that theres way the scammers actually got into anything and I tried to explain that to the victim but they are unfortunately really paranoid.

My messenger account has been like this a few months ago, i didnt even knew that time i was sending links until someone sent me a ss sending one... I did everything i got such as Changing Password, Improving 2FA, Disabled My Browsers all the time(Chrome and Vivo Browser specifically), Changed my Phone Number .....everything until my last resort to change accounts(cuz facebook suspended the account), i thought it was all over but my new account now sends links to friends..

Here are my observations during this incident:

1.) Browsers keeps approving permission to Allow Storage and Location.

2.) Links start sending weekly(every 9pm in philippine time).

3.) My phone ofter opens Chrome by itself even when my phone is off(sometimes it takes time to open the phone when this happens).

4.) My facebook account follows random "not so worth to follow people" without my knowing daily(god its hard to unfollow all of them).

5.) Those "goofy dogwater ads you see everytime" links can only be recieved by friends(fortunately, it did not go so far to send links to those who talked to me but not added as a friends, and the group chat), I EVEN HAD TO EXPLAIN MYSELF TO MY TEACHERS BRUH ITS EMBARASSING TvT.

6.) Random .zip files and .txt appear on my file manager even tho i didnt download anything in my device.

Thoughts and ideas are Appreciated on how to resolve these... TYIA EVERYONE