‘Social engineering’ scammers

It is with extreme apprehension to learn the lack of literacy in technology is a weakness that makes potential victims easy targets. The cyber scammers and other criminals prowling the internet highway are “evolving” with various tricks of their illegal trade to avoid detection. Thus, they can continue plying their criminal activities with impunity despite the laws and so many safeguards and sophisticated security measures already put in place to catch them.

“It’s really a cat-and-mouse game,” Department of Information and Communications Technology (DICT) Secretary Ivan Uy told us in our Kapihan sa Manila Bay news forum last Wednesday. DICT Secretary Uy shared in particular the government’s experience in the passage into law mandating the registration of subscriber identity module (SIMs) used in mobile phones, tablets and other digital devices. This is Republic Act (RA) 11934, or the SIM Registration Law aimed at reducing, if not totally stamping out cyber scams.

Jocel de Guzman, co-founder of ScamWatch Pilipinas, could not agree more that the “low literacy” on digital knowledge exposes many people to become victims of cyber crimes. Joining us in our Kapihan sa Manila Bay news forum, De Guzman expressed their group’s support to the efforts of the government in stepping up the campaign against cyber crimes through Hotline 1-3-2-6. The Hotline is an inter-agency call center where the public can directly report or complain against cyber scam and other digital crimes.

De Guzman announced the ScamWatch Pilipinas joined forces with the National Cyber Crime Hub in handling the Hotline 1-3-2-6. Led by the DICT, it is run jointly by representatives from the Commission on Information and Communications Technology (CICT); the National Telecommunications Commission (NTC); and the National Privacy Commission (NPC).

On the part of ScamWatch Pilipinas, De Guzman offers public services to educate and guide users of gadgets and platform on information technology to enable them to safely navigate the internet highway. Having worked in the past with Globe Telecom, De Guzman has co-founded this advocacy group along with Art Samaniego, Tech Section editor of The Manila Bulletin.

The DICT Secretary confirmed how cyber criminals have become steps ahead from being caught by the long arms of the law. He urged stakeholders and multi-sectoral advocate groups to help the government in informing the public at the widest scale possible about the different methods employed by these cyber crime syndicates.

Although curtailed to a large extent by the SIM Registration Law, Uy disclosed the DICT is currently studying proposals to amend its implementing rules and regulations (IRR). He mentioned the proposed limit to the number of SIMs that an individual can register as done in other countries. As allowed by existing laws, corporate accounts can buy SIMs by the bulk.

Uy admitted the need for the DICT to “cleanse” the list of registered SIMs.

Offhand, Uy said the proposed limit to the number of SIMs can be compared to car ownership in Singapore where citizens must pay for a “certificate of entitlement” just to buy and own more than one vehicle.

The proposed restriction of SIM acquisition got rolling after a police raid of a suspected illegal Philippine Online Gaming Operation (POGO) company led to the confiscation of “bulks of SIM cards” that were allegedly pre-registered before the SIM Registration Law ended last July 25. According to Uy, initial investigations by law enforcement authorities estimated as much as P1 billion worth of crypto-money in various amounts were allegedly found in 25,000 SIM cards seized and contained in the e-wallets of their victims.

Citing the police report, Uy narrated, 200 of the 600 POGO workers arrested in Pasay City last month were Chinese and Indian nationals victimizing their own countrymen while operating their cyber scams in the Philippines. While the rest of those arrested were Filipinos, a number of them claimed being “alleged victims” of love scams. But further investigations of the police, Uy disclosed, showed that the supposed victims turned out to be involved in previous cyber crime activities here in our country. But police records established their identities that they were caught in the past.

More worrisome, Uy alerted us about the discovery that these syndicates are obviously “very well organized and very well funded.” They even hire and employ psychologists to do their own “social engineering” modus operandi, he added.

As defined in Google, “social engineering” refers to all techniques aimed at making a target victim reveal private information, or perform a specific action for illegitimate purpose. Because “social engineering” uses psychological manipulation and exploits human error, or weakness rather than technical or digital system vulnerabilities, it is sometimes called “human hacking.”

“They are not just social engineering scammers. They are also into other crimes all the way down to money-laundering,” DICT Secretary Uy warned.

Originating from this one POGO company, Uy related to us, the police investigators found “layering operations” of these cyber syndicates passing on their illicit activities from one syndicate to another. One syndicate creates “fake IDs,” then sends them to another group engaged in illegal transfer of money and bank accounts, and then passes on their loots to a money-laundering syndicate.

Uy also warned the cyber criminals have noticeably shifted their nefarious trade to other social media platforms like Facebook, Google, Instagram, online gambling links, the various Apps, and even accessing the one-time-passwords (OTP). Another favorite cyber scam is “phishing,” a form of email scam where someone sends an email claiming to be from a person or company you know or deals with.

“Cyber criminals evolve like technology. So we must also evolve,” Uy urged.

The DICT Secretary reminded the public to remain alert and vigilant because these “social engineering” scammers can breach even the best digital protective system.