On Telegram messaging, “CRN” has an important message to convey to its subscribers. He will be “totally unavailable until the beginning of March”. “I don’t take any orders,” adds the owner of this profile, who sells online scam training, lists of mobile numbers and packages for launching phishing attacks via SMS. And for good reason: the day he posts his message, the February 2023 vacation has just started in zone C. This young man with curly hair is a 16-year-old Parisian high school student. Since arrested, he sold kits allowing people to get their hands on banking information.
This type of profile has become commonplace in online scams. A highly organized criminal chain, with its specialties and jargon. The kits are called “scama”, the telephone lists are called “NL”, and the supports for collecting stolen information are called “rez”. This world is the dream of young people looking for easy money. “It’s almost a game, a windfall to buy an iPhone or finance your outings, without any awareness of the trouble generated,” deplores Commissioner Fabrice Billot, head of the brigade fighting against cybercrime, the one of the services of the Paris police headquarters which follows these cases with the payment fraud brigade.
It all starts with the theft of personal data following phishing carried out by SMS or email. In short, these messages allegedly sent by Chronopost, Netflix or by public services such as Health Insurance or taxes. The data is then sold in package form to criminals called “allottors”. After using a “spoofing” service, a program allowing people to spoof a telephone number, these scammers call their victims and make them believe that they must provide their double authentication bank code to avoid a scam.
A procedure that is easy to learn thanks to training sold in the form of a tutorial, or even sometimes offered. “We are seeing a real explosion of complaints around “Allô” scams,” warns Hadrien Aramini, magistrate at the Paris public prosecutor’s office. The Parisian justice system has just caught a very active group. These young people picked up their phones every day, for daily earnings estimated at several thousand euros. “I sleep soundly,” one of them said when his targets unmasked him, unaware that he was wiretapped.
“Kids who think they’ve found a good plan”
This uninhibited delinquency is carried out, according to justice, by two types of perpetrators. First of all, low-level fraudsters, without a record or only known for trifles. “Kids who think they have found a good deal on a social network,” explains Hadrien Aramini. “They want to rub shoulders with the Dark Web, attracted by its shady side,” adds criminal lawyer Alexandre Lazarègue. But this inexperienced delinquency also rubs shoulders with more structured groups. Like these gangs specializing in the sale of narcotics who are now turning to this very lucrative illegal business.
On a French-speaking scammers’ channel hosted on Telegram, requests and offers follow one another, for lists of numbers or fresh “ground” addresses. “Available”, “Serious spammer”, signals one of the scammers. Questioned by L’Express, one of the little hands in this traffic claims to be a high school student who is looking for “the jackpot”. The young man explains that he was inspired by an influencer who shows off, with huge wads of cash, on TikTok and Snapchat. His peregrinations allegedly began with the resale of fake, stolen PayPal accounts, before continuing with “Hello”, initially targeting “people born before 1985”. He says he buys “cc”, credit card numbers, then orders an item on a merchant site so that his victim receives a notification to validate the transaction. Worried, she then becomes more receptive to the supposed phone call from a bank operator. “Before making the call, you need a spooferit’s completely legal,” he asserts, wrongly.
These online scams have been monitored for a long time by Thomas Damonneville, an IT security specialist who launched a platform, StalkPhish, to spot ongoing phishing campaigns. “Around ten years ago, they were more the work of students who had certain technical knowledge,” he observes. Now, they boil down to buying different services: lists of credit card numbers, the infrastructure to send emails or SMS, access to a Telegram channel where the stolen data will land… No need to have any skills particularly advanced computing.
“We have already experienced a rejuvenation of cybercrime in the past,” notes Jean-Jacques Latour, expert at the Cybermalveillance awareness platform. But with the provision of turnkey tools like these, the phenomenon is taking on more importance. ‘magnitude.’ Consequence: a “completely amoral” fauna proliferates, praising for example a retirement bonus scam “which works really well on little old people”, reports, indignant, Romain Basset, the director of customer services at the cybersecurity company Vade.
From victim to perpetrator, there is only one step
Although well identified, the modus operandi of these crooks is still difficult to hinder. In addition to the anti-scam filter promised for this summer by the government, and supposed to pull the rug out from under the feet of phishers, telecom operators are working on a new standard. Expected for the fall, it should prevent scammers from stealing bank telephone numbers. “Some calls may be blocked, but not all: we know that fraudsters are innovators and that new ways of proceeding will emerge,” warns Romain Bonenfant, director general of the French Telecoms Federation.
An association, Génération digital, attempts to demystify this criminal industry among teenagers. Its awareness campaigns are initially focused on the risks of digital technology, such as the alienating relationship with screens, online harassment or overconsumption of video games. But they also make it possible to send messages about scams. “Our idea is to tell them that there is another reality behind the smoke and mirrors,” explains Cyril di Palma, the general delegate. “And to deconstruct the myth of easy money, which we also find both in the figure of the influencer and in that of the scammer.” “We need to make young people all the more responsible because we can easily go from victim to perpetrator,” underlines Johanna Brousse, the magistrate who heads the cyber section of the Paris prosecutor’s office.
If these budding thugs think they are untouchable, they are sometimes caught by the patrol. “They think they have a certain digital expertise, but in reality, it is not that sophisticated,” notes lawyer Alexandre Lazarègue. One of his clients, who had launched a Telegram channel dedicated to phishing, was easily identified: he used the same nickname on the encrypted messaging as on a video game forum. In another case, the 13th criminal chamber of the Paris judicial court sentenced nine young men specializing in “Allô” last year. Prosecuted for having robbed nearly 700 victims in 2021, they attracted the attention of the police after defrauding a well-known personality: the former director of the International Monetary Fund, Dominique Strauss-Kahn.
Justice also relies on more systematic operations. The fall of the British phone spoofing service iSpoof in the fall of 2022 allowed the opening of a cascade of legal proceedings. “In this type of business, the one who takes the most risks is the end user,” summarizes Commander Dominique Bogé, in charge of prevention issues at the national cyber unit of the gendarmerie. And remember that if tools like VPNs, these virtual private networks supposed to make Internet users untraceable, can slow down investigations, “this does not prevent them from being successful”, warns the gendarme. Even if it means picking up the thugs when you return from school holidays.
.