Description

1) I recently had my computer serviced and was wiped clean by Geek Squad. I needed to put my webroot anti-virus program back on and from emails knew I renewed back in Sept 2023. 2) I tried to access webroot website through e-mail showing product key but link had expired. 3) I googled website login and went to a site and put in my email and product key but would not accept/could not access product and asked for my phone number and email for verification. It indicated, "we may give you a call". 4) Chat box showed up in corner by a "Peter" asking how can I help? As I was typing, a call came through my phone from 803-232-9509, I assumed it was "Webroot support" I answered it. A person identified only as "Paul" said he was a Webroot support technician and asked what problem I was experiencing. (Paul had a thick foreign accent, I was assuming East Indian or Middle Eastern.) I mentioned that I was responding to Peter via chat box and he responded, "Don't worry, we are all here together". 5) I explained I needed to put my webroot anti-virus back on my computer and need a product key. He said he could help me solve my problem but needed me to accept his access to my computer through a program so he could assess the problem. I realized he would be able to look at my computer and drive - as I thought he was with Webroot, I allowed him access. 6) He said the problem was that I had "IP Address conflict" which I had never heard of. Because of this, the webroot software could not be downloaded onto my computer. He explained that my computer has been hacked and possibly all my devices in the home. 7) I was able to tell that he went into DOS and C prompt, ran some numbers and showed where there was also (3) porn sites and asked if I ever went to porn sites and "Please respond honestly". I told him I did not and no one else used my PC. He said then that someone is accessing porn using my IP Address Network. 8) Additionally, his scam showed "Trojan" and said that it indicated that I had been hacked and this is something Geek Squad could not help me with and it is on my computer. (whatever he did, it actually showed "Trojan" plus "porn sites"). Paul went on to explain that security has changed since COVID and hackers have gotten much wiser .... In fact, he said to remove the Trojan, it would require a "Level 7 technician" as recognized by NSA (National Security Administration). He also maintained that Geek Squad had only Level 3 technicians. 9) also scan showed "foreign address" listed which according to Paul, someone was hacking into my computer. 10) Also, initially he said "we (assuming Webroot Support) do not employ Level 7 technicians" - leading me to believe that he or Webroot could not offer a direct solution. 11) When I asked for advice on what I need to do, he opened my Notepad and typed the following (a description of what I needed): a. Network Identity Firewall (to protect network identity) b. Anti-Trojan tool (Network shield) c. Network Utilities Pro (encryption tool) d. Essential Identity Protector (automated tool) NSA - National Security Agency Online Network identity Securities Stores certified Level 7 Network technician (Microsoft certified) Merchant partner with Webroot 45 - 60 minutes Documents and CASE ID from Webroot (by the way, I took pictures with my work phone so as to get it correct) As he further explained, this is an additional network identity firewall and that since COVID, the NSA has become involved, as the Government is taking steps to be sure a Level 7 technician, Microsoft certified installs the additional network identity firewall and anti-Trojan tool. This is a merchant partner with Webroot and it takes 45 to 60 minutes to install. 12) In order to protect myself from future hacking and remove trojan and other threats, I must have this Level 7 tech do the work and the cost as shown as follows (on notebook): (I did not take screenshot because I was astonished at the prices.) the costs ran from $299 (for manual, 1 year protection) upwards to around $899 for 5 year automated protection. 13) I responded to Paul that I could not afford this and he was quick to offer an alternative for $59.99, which would essentially remove the trojan and other threats, clean up my computer (and please note: I just had it serviced at Geek squad for complete cleanup!) and then he would put the webroot back on and ran a scan. (Note: he spoke as if he was going to do, but then wait - he says there's a Level 7 technician on stand-by to do it!) 14) Paul sent me an invoice to my gmail. I opened gmail and it was not in my inbox and discovered in spam folder. He marked it "not spam" but continued to have problems getting it into my inbox, so he ended up closing out my gmail which forced me to log back in (but my password did not show). 15) The email was from a Pay pal service (looked legit). It was actually for 99.99 but it showed Paul was giving me a discount of 40% or 59.99. It showed as "WEB sent you an invoice for $59.99 USD". He showed me through the Pay Pal to pay the invoice ("Pay here"). additional details from receipt of paid invoice from Paypal: Transaction ID ***************** Transaction date November 20, 2023 Invoice number **** He asked that I pay the invoice immediately, which I did using a credit card (Note: he was able to see my entire credit card number, etc. as he could view everything on my computer. this made me extremely uncomfortable that I was trusting this person.) Then he deleted the original email/invoice, "so as not to get confused that you would pay again". I also thought this was strange and I wanted a receipt, but luckily, Pay Pal did send me a receipt email showing paid. He also was emphatic that when it shows up on my credit card statement as "PAYPAL "GARMENT SER" to make sure I know this is to legitimate and honor the payment transaction. 16) He told me that he would get the Level 7 technician and it would take about 30 minutes for him to scan clean my computer and put the Webroot back on. (which it did) He still had control of my computer and asked that I keep my computer on for the next 30 minutes or so until complete. he would call me back when complete. I was in my office and continued to watch the activity on my personal computer (I was also on my office computer at the time). It looked like a series of numbers were running through at DOS C prompt. Then I was able to see that he was installing Webroot Anywhere on my computer and scanning for threats. It actually looked legit if not for the other red flags 17) So, he told me the $59.99 was for the "Level 7 technician" not for the webroot software (which was already paid for as I had a current subscription) I have no other reason to believe that it was anyone but "Paul" who did the work. He gives me information on Notepad in the event of any future problems to contact "Charles Foley" at HIS phone number: 803-232-9509, email: [email protected]. (obviously not a webroot address) Also, I wanted to check the website that started everything to be sure it was legit and he had erased my search history. 18) the following morning after a restless night of sleep, I called Webroot Support (and I made sure I called the correct number). The person at the other end said that their records showed that the last time I contacted Webroot Support was back in 2019 (obviously, first install). There were other earmarks that I was scammed: Webroot does not call you, you call them, they do not have a Paul, Peter or Charles Foley; there is no such thing as a "Level 7 technician" but described Tier 1, Tier 2 or Tier 3. Webroot would never have you pay from an Invoice in e-mail - one would be directed to their website and they would not be able to see your entire credit card number.