Phishing Phone Call Claiming from Virgin Media

[MrB999]

I have just received a phone call claiming to be from Virgin Media saying my internet is running slow and he is calling to correct it. This was received on our Virgin Media landline from telephone number 0121 525 6998.

I played along for a while to see what he was after - he wanted me to open Windows > R and type in eventvwr.  I was not progressing any further to changing any details as I am not falling for it.  I asked him to confirm that he was Virgin Media and he said he could confirm by providing unique data on my computer.  He said to again run Windows>R command prompt then assoc - he gave me the number 00c04fd7d062 and told me to check this again .ZFSendToTargetCLSID which obviously matched.  I can see that someone without knowledge may fall for it.

I had no intention of following any further instructions and told him I would ring Virgin Media IT help to solve any issues.

I am aware this is a scam (Virgin Media never do anything before confirming your details and letters from your password!) - I am just posting the details in case the number can be traced/blocked on the system and to warn other customers.

[RF_Marple]

I'm getting bombarded by such calls today - exactly matching the methodology you describe.  I bailed out when they refused to tell me where to find the code on the router's web page and insisted that I typed in at a command line.  The problem is, that the VM web site says that there is a problem with my broadband (and boy do I know I have a problem - any internet call at the moment is painful, and I have lots of calls to do) and that an engineer is despatched and the problem should be fixed today - but I have no other information about what VM is doing.  This makes such calls very compelling.  Why is there no mention of such scams on the VM web site?  Why no information about what VM are doing to fix a known problem?  Why is it impossible to contact a real person at VM to get guidance when they already admit that they have a problem which affects me?  Hoping that one of the VM moderators picks this up!!

[RF_Marple]

Chris,

The information that VM only call from that number is really helpful.  Many thanks.  I don't understand why I can't see such information front and centre of info to VM customers.  See my frustrated post from just now in this thread.  The guidance on the web site is terrible for those of us trying to work out if we are being scammed, at the same time as VM are telling me that my broadband has a problem that they will fix imminently.  It strikes me that the scammers know full well that there is a problem in my area and are bombarding us.  My neighbour has the same problem.  It is just not good enough from VM.  Premium package, premium price, shocking support.

Rich

[Hayley_S]

 Hello @RF_Marple,

Welcome to the community page, thank you for posting on here.

I am sorry to see you have been getting calls from scammers.

Due to this not being us calling you we are limited to what we can do about this, you can report any scam calls you get here.

Many thanks,

[nodrogd]

---

@RF_Marple wrote:

Chris,

The information that VM only call from that number is really helpful.  Many thanks.  I don't understand why I can't see such information front and centre of info to VM customers.  See my frustrated post from just now in this thread.  The guidance on the web site is terrible for those of us trying to work out if we are being scammed, at the same time as VM are telling me that my broadband has a problem that they will fix imminently.  It strikes me that the scammers know full well that there is a problem in my area and are bombarding us.  My neighbour has the same problem.  It is just not good enough from VM.  Premium package, premium price, shocking support.

Rich

---

The scammers have no idea you have a problem in your area. They are calling you from a scam call centre set up in India. They assume you are a VM customer as your number is included in the block of numbers allocated to VM in your local dialling code area, details of which are readily available on the OFCOM website. It is likely EVERY customer in your dialling code area is getting these calls at the moment, as the robot diallers the scammers use work through the blocks of numbers in sequence & cover every number on an exchange.

[RF_Marple]

Thanks Hayley,
That is not really addressing my point. For sure, VM cannot take responsibility for scammers. I merely suggested that the info Chris gave that VM calls only come from this number xxxxxxxxxx, is really useful information for VM customers like me to know. Given that VM have told me (are still telling me) that my broadband has a problem and an engineer is despatched (though absolutely no other info nor updates despite me registering to get them) I was genuinely taken in by the scammers until it became clear that they wanted me to run some software and then I found Chris' message and bailed out. As I wrote, Chris' info needs to be front and center on the web site not hidden in a dark corner of a forum. Hope that helps you understand where I am coming from. Rich

[RF_Marple]

... and sorry to add, that the link you gave me is exactly where Chris' info should go. I read that page very early in my search. It was really unhelpful! One line in particular really annoyed me :"and calling us directly to validate the call" - do you know how difficult this is?

[davidcamm]

I Had one today June 8th, 2021 saying people had broken into my router and Virgin needed to make my router more secure. They asked what PC or Phone I was using and the browser as they can scam anyone on any connected device.

The first thing to remember is never to give anyone information that calls you out of the blue and especially if you don't know them, always call the company they say they are from to check them out. I asked a few questions like - what is my account number - which Country is my address in - what town do I live in, how many connected devices do I have on the VM router, etc they will always have a smart answer but not be able to give you any information about you as they have none.

They were very convincing in getting me to use using event viewer on my PC to show alert warnings, luckily I work in IT so know what their true aim is.

The next step was to get me to type in the name of a remote access site on my browser which was called security12.screenconnect but they can use many others. Once at the site it all looks legitimate having an https secure address. then they ask you to type in the security code that they tell you, that gives them access to everything on your PC, the code is virginmedia to make it sound authentic but then again that passcode is very insecure when you think about it. 

If anyone presses the send/arrow button the scammer/thief will have full access to do anything they like with your PC, such as take over your bank and other accounts and email addresses and even lock your PC and demand a ransom.

Unless like me you want to waste some of their time for 30 minutes by pretending to go along with all of their scams, then it's best to keep it short and sweet by saying I will call Virgin immediately thank you for the warning and slam the phone down. Virgin said you would be calling as you are a scammer, works very well too, and gets them worried. There are millions of these scams happening every second so it's not worth reporting this to the Police or Virgin as that takes time. The last time I reported one I got a call from the Victim support at the Police more than 6 weeks later.