Weird Twist on a Refund Scam

original number: 747-212-2158

callback number: 855-420-2443

cell number: 325-701-6446

https://bobrtc.live/phonebook/dial/17472122158

rather than doing the ole "oops I put too much money in your account" these guys didn't even do anything involving the bank account. they said that their third party company was going out of business, so they'll mail you a refund check in a few days. in the meantime, they can sell you a new support software through apple for half the cost of the old software. payed for of course by eBay or best buy gift cards. seemed like it would be waaayy more convincing than the bad acting job they usually do.

also while I was out "getting the cards" the guy started doing something on my computer, sending pings to my network or something. not sure what he was doing, if you guys know anything about that I'd be really curious to know what he was trying to do.

they called two of my different numbers who are different “people” time to investigate!

3155641630 they said hackers were using my identities for illegal videos (cp) for I will be arrested

How did they connect ? Did they ask for ID or provide ID ?

Were they pinging your local addresses ? 192.168.0.1 for example
Letting them connect to you vm, even if nat'd, can still expose your local network, any SMB shares can be seen/scammed for.

Chances are, if they know how to do that, they wouldnt be doing the dumb script job they are doing.

Had them use Goto Assist got a bunch of numbers from them I have been hitting with BobRTC.

My network is pretty isolated so they cant ping out of the vm's

They want gift cards and even offer support with out connecting.

855-470-0695
800-212-4448
315-804-6299
817-281-6661
315-840-5559
747-212-2158

@drone2001#110225

Are you using VirtualBox or VMWare ?

And which results do you get if you ping your local addresses of the host machine and router/default gateway ?

I use VB and there isnt an option (I know of) to fully isolate network, other than host only which is loopback

vmware the worst they did was deleting stuff from regedit

@drone2001#110271 but if you into your vm now and ping your router, what response do you get?

@wirushunter#110131 here is the video of what happened, he starts doing the pinging thing at 20:10

https://www.youtube.com/watch?v=XY_cgTk1QJo

So I have been calling these scammers for two weeks under the name Robert Miller. I have gained some information below and hope you help out in this effort.

Phone number:(747) 212-2158

Hours: Monday - Friday 12-6ish EST

Reps:
Walter: Gets pissed easy . Says his last name is Megan and so that's what I been calling him.

Robin: I trolled him by calling him Derek and he hates it. I even got his co-scammer Mike to call him it. He smokes Cigs. I know this because he went on a smoke break and couldn't take my call. When I did reach him. I told him how bad smoking is.

Mike: You can tell he is the young guy in the office and will humor you. He even transfered me to his co-scammer a to troll them and not him.

When trolling them tell them Robert Miller sent you. Keep em going for a long time. Enjoy and Happy Hunting my friends

I’m still getting automated calls from them a few times a day