19

I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do.

After realizing, I scanned everything for viruses but there where none. I used Macscan and ClamXav. I changed all of my passwords. Unfortunately I gave them a copy of my passport. Not sure what they can do with that. I did go to the police, but all they said is that they will contact me if any criminal activity comes up under my name. Didn't use any kind of card, but am wondering if they somehow could have gotten to that information. I did answer their calls, and I don't know if they could gain any other information from it.

I know I am a naive fool. Please, if you can help me protect myself at this stage It would mean a lot.

Thank you.

eternalidiot
  • 209
  • 2
  • 4
  • 4
    Which password(s) did you gave them? What type of other information do they have, beside your e-mail address? – martinstoeckli Aug 23 '13 at 07:57
  • 2
    I just want to say you do not have to be hard on yourself. Shit happens and good thing that you learned from this and managed to figure it out before it's too late. –  Aug 23 '13 at 09:48
  • The only thing they have is my e mail address and a copy of my password. – eternalidiot Aug 23 '13 at 10:53
  • 9
    @eternalidiot: First of all you are not a fool but they are just a little more smart than you. By the way, What you have written in your question is you have given them a copy of your PASSPORT and now you are saying a copy of my PASSWORD. – Sankumarsingh Aug 23 '13 at 12:30
  • @Sankumarsingh Agreed, those are extremely different situations. This needs to be clarified. – xdumaine Aug 23 '13 at 12:57
  • 2
    sorry, my bad. i gave them a copy of my passport. – eternalidiot Aug 23 '13 at 13:17
  • Burn me once, shame on you, burn me twice, shame on me. Life is full of lessons like that. If you've not come up against a really skilled con man (confidence trickster) before, now you know some of the tactics used. Learn to recognize them and develop your BS filters. It's a life lesson all of us have to learn. PS: They prey on naivety and inexperience, self-education is your most powerful weapon. – Fiasco Labs Aug 23 '13 at 14:47
  • @eternalidiot - Why do you think your computer could be compromised? There are two ways to become infected, either you opened an email attachement, or you clicked a link they sent to you. Did you do either of them? – martinstoeckli Aug 23 '13 at 15:10
  • Yes. there were e mail attachments- pictures that I have opened. nothing else. didn't click on any link. – eternalidiot Aug 23 '13 at 15:26
  • @eternalidiot - So then you could check, whether they are real pictures you opened. On Windows systems, the file extension is important, normal pictures have an ending like `filename.jpg` or `filename.png`. Executeables have an ending like `filename.exe` but can try to hide this with `filename.jpg.exe`, because Windows will hide the last part. I don't know how experienced you are, but this is a check i would do, it is very unlikely that real pictures are harmful. – martinstoeckli Aug 23 '13 at 19:31
  • I have a mac. and you could say I am inexperienced.did check on "get info" to see what extensions these pictures have and whether there are any hidden- no, just jpg. Unless there are other ways to hide/check this, these seem clean. – eternalidiot Aug 23 '13 at 19:48
  • @eternalidiot - Macs are handling the file type separately as far as i know. If opening this pictures is the only thing you did, i wouldn't worry too much about your computer. Opening pictures is what a browser does all the time. – martinstoeckli Aug 23 '13 at 20:01

5 Answers5

23

First of all go to the police. Tell them your story, tell them you sent them a copy of your passport. Alert your bank and credit card suppliers as well. The biggest problem with sending a copy of your passport is that they can easily do identity theft.

I wouldn't use an AV for your computer, I would just re-install your computer from scratch. As we always say:

Your system is compromised now. Nuke it from orbit and restore from a trusted state (backup).

Lucas Kauffman
  • 54,169
  • 17
  • 112
  • 196
  • I did go to the police. They didn't want to hear my story. Just took my information and laughed about it -.- How easily can they steal it if that is all they have? – eternalidiot Aug 23 '13 at 09:44
  • 3
    very easy, talk to a cyber crime unit, obviously the police officers you talked to have 0 clue about cyber crime and identity fraud. – Lucas Kauffman Aug 23 '13 at 09:51
  • I am not from the USA. Should I still contact them? – eternalidiot Aug 23 '13 at 10:51
  • @eternalidiot I'm not sure where you live, but I'm pretty sure they have a similar cyber crime organization as well. – orlp Aug 23 '13 at 12:37
  • 5
    @LucasKauffman: i'd change the last sentence to `Your system is compromised now. Format it, install OS and applications from CD/DVD, and then restore DATA only (no executables!) from a trusted backup.` (I love the "Nuke it from orbit" reference, but it's not very clear for the very people we talk to when citing it...) – Olivier Dulac Aug 23 '13 at 14:25
  • 4
    @OlivierDulac Let us hope no-one takes it *too* literally. – Thomas Aug 23 '13 at 14:41
  • @Thomas: indeed ^^ But I'm more concerned that they don't get at all what it means (iow, if they do, they probably also know already the answer...) – Olivier Dulac Aug 23 '13 at 16:04
  • 1
    "Police" isn't always a reliable organisation intended to serve and protect the people, especially if you're in developing countries. I'd say reporting to Police only applies if you're lucky enough to live in developed countries – gerrytan Aug 27 '13 at 06:45
16

As scary as it sounds, I do not think they can do much with your passport copy. I think they intended to steal other stuff like credit cards or passwords but since thy found nothing else they took the passport copy.

What can they do with a passport copy?
What information is there in the passport? Passport number, photo, name, date of birth, issue date, expiry date and issue place. All of these information are useless except the birthdate because it is used as an extra security measure in many websites during a password reset especially in old websites. One more thing, the barcode in the first page of the passport may contain a national ID number in some countries, but if you report to the police this will protect you.

What steps to take to be safe?

  • Report to the police, now if something happens in the future you will have a solid excuse.
  • Cancel your current passport and issue a new one. So you will have a new passport with a new number.
  • If you have valid visas to other countries in your passport, report the matter to the concerned embassies and cancel these visas.
  • If any of the information in the passport are used to access any accounts you have (emails, subscriptions, .etc) change that.
  • As suggested in other answer, format your pc and install it from scratch.
  • If you have a facebook, twitter or any other social network account, make a small announcement to your connections that your passport copy was stolen. This will be useful in case the attacker managed to steal your accounts and did something with it in the future and also it could be used as an extra excuse in case of ID theft.

Remember, as long as you reported the matter to the police you will be in the safe side. If they used your information to do suspicious activities (like opening an account for money laundering or whatever) you will have a solid excuse. You did good by reporting the matter to the police once you knew it was a scam.

  • 8
    With a passport copy, you can get a new bank account in some countries, for example. That can end in getting a credit card. The information in the passport is not sensitive but it can be used for identity theft. – Sulthan Aug 23 '13 at 10:43
  • Yes, you are right. I mentioned this at the end of my question anyway.. Plus, if reported to the police u'll be in safe side. Especially if the account was opened abroad and no records of entering the country... –  Aug 23 '13 at 10:44
  • 3
    Thanks. I do have a visa but they don't know I have it. Should i report it to these embassies. I asked at the police if I should ask for a new passport- they said no. I asked about a fraud alert if someone uses my identity( either me or someone else) they said- no. I only have Facebook where I have changed my password, and made a two step verification. I will format my computer. – eternalidiot Aug 23 '13 at 10:47
  • 3
    I wouldn't take the police's word on whether on not you need a new passport. Contact your country's passport-issuing organization and ask *them*. – Mark Bessey Aug 23 '13 at 16:58
  • @MarkBessey - I would get a new passport even if the somebody from an issuing organization says you don't need it. The important thing to do is make the current passport invalid. Once that is done the electronic signature of the passport will be useless. I am pretty sure most of the EU nations use passports with a digital signature. – Ramhound Aug 26 '13 at 12:08
  • Well, they only have a *copy* of the passport. I'm not sure how useful that is as a travel document. Other people have pointed out that it has enough information on it for identity theft to be a worry, though. In which case invalidating it is probably still the right thing to do. – Mark Bessey Aug 26 '13 at 18:08
12

To easy your concerns, I recommend looking into the following interesting article: http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf

Basically, the scammers send out an immense number of e-mails, and they get money only from a very small percentage of targets. The number of people who reply to them, but figure out half way through that it's a scam (like your case) is very large compared to those people who completely fall through and send the scammers money or credit card info, etc. Sending out the first e-mail does not cost the scammers much. However, keeping up contact with those who answer has a large cost (in man-hours, telephone bills, etc.) for the scammers. They must do it for a large number of people, very few of which will generate income for them. This means, trying to "work" on a lost case (someone who figured out it's a scam) is not worth their time. It is more profitable to focus on the thousands of other, more gullible people who might generate easy income for them.

Reporting it to the police, and renewing your passport is a sensible thing to do. If you have run any computer programs they sent, or visited any webpages they linked to, etc., it's also a sensible thing to clean your computer. Otherwise, it is highly unlikely that the scammers would try to do anything further in your case. You can contact your bank and tell them about it, it can never hurt, but I doubt that the scammers would try anything, you are most likely on their list of millions of similar cases who are not worth keeping up contact with anymore.

vsz
  • 707
  • 1
  • 8
  • 19
  • it did ease my mind, thanks. and the fact is as soon as I said I am reporting this to the police ( which was two days ago) haven't heard of them. But I must add, they did put a lot of effort into this scam. everything was almost perfect, except I couldn't find their Zenon Corporate firm that apparenty does finance in Madrid and was on Madrid stock exchange for 20 years. Nothing about that firm, neither on Bolsa de Madrid and the page that they gave was property of some firm in the USA. I sad this is wrong. And the guy says to me" my word is my bond. -.- I can't believe I almost fell for that. – eternalidiot Aug 23 '13 at 16:28
5

Did you use any information from your passport in your security questions (ie. the ones used to reset your account passwords? If so, you may wish to change them ASAP. Also, you should inform the admins of any other accounts that have your personal information that you have identity compromise (eg. your bank). Otherwise, you've done everything possible.

Nasrus
  • 1,250
  • 12
  • 13
5

Prevent your identity theft by renewing your passport. Your old passport should be made invalid. All bigger institutions should chceck your ID according to the database of lost ID documents.

Let this be known to your banks... If you did write / sign some papers, including your old passport, change your signature pattern on your bank accounts to look differently from your regular signature. Otherwise they can go to your bank and transfer your money. (As some banks allow to send account to account transfers without the presence of the account holder.)

Peter Mortensen
  • 877
  • 5
  • 10
Dee
  • 202
  • 1
  • 7