Dozens of criminal gangs are posting fake ads on popular online marketplaces to lure unsuspecting users to “fraudulent” shopping sites or phishing pages that steal data . Some of the brands that cybercriminals to carry out their scams are extremely popular in Europe and include LeBonCoin, Allegro, OLX, Sbazar, FAN Courier, Lalafo, Kufar and DHL. The scam was first discovered in Russia by security researchers from Group-IBin the summer of 2019. This scam, which the researchers named “Classiscam”, grew from 280 scam pages to around 3,000 in less than a year.
However, this malicious "operation" was not limited to Russia, but has also spread to other countries such as Bulgaria, France, the Czech Republic, Poland, and Romania.
At least 40 gangs are running Classiscam, 20 of which are linked to Russia. The most profitable of them earn over $500,000 per month. Group-IB estimated that gangs operating in European countries have an average monthly profit of $61,000. Furthermore, it is estimated that the scammers earned more than $6.5 million in 2020.
The scammers post ads on popular marketplaces and classifieds claiming to offer various products (cameras, game consoles, laptops, smartphones) at low prices. When an interested party contacts them, the scammers transfer the conversation to a third-party messaging service. Group-IB also reports that the scammers use local phone numbers when speaking to the potential victim.
It is worth noting that scammers can pose as both sellers and buyers. When pretending to be customers, they send a fake payment form that is received by a Telegram bot that “spoofs” a purchase. The seller then receives a fake form requesting card details to receive the supposed payment.
According to Group-IB, Classiscam does not require technical knowledge, as Telegram bots provide a complete phishing kit. The scammer simply needs to send the chatbot a link to the “bait” product.
Researchers note that there are more than 10 types of Telegram bots for brands in different countries. Operators also provide scripts that help scammers connect to foreign sites and speak to victims in their local language. By observing the Telegram bots, researchers were able to see the details of the deals made by the scammers. They found that the administrators take 20%-30% of the stolen money, while the partners who carry out the fraud take the rest.
The scam sometimes involves callers pretending to be customer support specialists. They take the smallest cut (up to 10% of the stolen money).
By the end of 2020, Classiscam involved more than 5,000 scammers.
Group-IB has attempted to directly contact all brands that were abused by Classiscam’s phishing activities, but despite the scale of the scam, there has been no response, Dmitriy Tiunkin, head of Group-IB’s Digital Risk Protection Department in Europe, told BleepingComputer. The researcher also said that they are not aware of any law enforcement investigations into these thefts in Europe or the US. This may be explained by the fact that Classiscam has only just begun to expand in these regions. However, Russian authorities are monitoring the scam and have already arrested fraudsters who were posting fake ads.
Finally, Group-IB suggests that users take certain measures to protect themselves from Classiscam and other fraud attempts:
- Check URLs for payment details before providing information, especially if the link was received through a messaging app
- Keep the conversation on the official platform that mediates the transaction, so that it can serve as evidence in the event of a fraud attempt
- Don't agree to deals that involve a prepaid transaction. Pay only after you receive the products you ordered
- Be careful when you see big discounts or incredibly low prices, as they may act as "bait" for a phishing page
