S2
Tuesday, 23 October 2018
SBC
Index
EXCLUSIVE
Friday 8 June 2012

Mobile Phone Users Targeted by Dodgy PPI Scam

Slough residents complain about junk text messages
advertising highly suspicious PPI reclaim service


Local residents have received annoying text messages urging them to go to www.ppinow.org and get help claiming compensation from High Street banks.

PPI means 'Payment Protection Insurance'. Some banks sold bad PPI policies to some of their customers. A compensation scheme has been set-up.

The government's financial services regulator the Financial Services Authority (FSA) says claiming compensation is easy and individuals can do it themselves.

The FSA is offering free advice and a claim form on their web site at http://www.fsa.gov.uk/consumerinformation/product_news/insurance/payment_protection_insurance_/claim-back-ppi

This is one of several messages received by local residents

From : +44 7752 262029
Date : Wednesday 6 June 2012

We have been trying to contact you regarding your PPI, We now know how much you are owed, please visit www.ppinow.org to confirm your details


+44 7902 905598 used for the identical message on 3 July 2012.

Please report these SPAM messages

Dynamoo's Blog has an interesting article, written in October 2011, about the instigator of this particular scam and his activities with www.loanslineuk.co.uk (details of loanslineuk.co.uk are shown at the bottom of this web page.)

Also on the Dynamoo Blog is this advice on how to forward these annoying text messages to your own mobile phone provider.

  • T-Mobile, O2 or Orange users, forward the spam to 7726 ("SPAM").
  • Vodafone users, forward it to 87726 ("VSPAM").
  • 3 users, forward it to 37726 ("3SPAM").
  • Do not forget to include the Sender's number.

How to be Aware of the Frauds

A knowledgeable person told the Slough Times the scams tend to work by:

  • Inducing people to provide personal information that may support identity theft activities at a later time. See
    www.identitytheft.org.uk
    www.actionfraud.police.uk
    www.cifas.org.uk
  • Phoning the person and passing themselves off as being bona fide [a similar method involves pretending to be a bank or credit card fraud department] and stating [in PPI scams] that you're owed money by a bank or financial institution but need to pay a release fee [in advance].
  • This is usually explained away as being an admin fee to cover research and lawyers costs.
  • They reassure the person it is refundable after the monies are released.
  • Inevitably, people like the idea they are owed money by a bank and are [presently] being told to pay the fee using Ukash vouchers [see www.ukash.com ]
  • Once a person has paid the cash, the fraudsters realise they've hooked another unsuspecting and gullible victim. The fraudsters then phone their victim and states the payment has not yet been received and that double the fee needs to be paid immediately or the compensation funds will not be cleared and the victim will lose their only opportunity to get paid a lot of compensation.
  • Amazingly, people continue to be duped, until eventually they come to realise they've been scammed. By then, it is too late. They have paid money to the fraudsters and received nothing in return.
  • Victims have been know to spend money they don't have in a vain and desperate attempt to gain thousands of pounds in promised compensation.
  • These crimes are called 419 scams. They are seemingly endless. The fraudsters always prey on the gullible, vulnerable and weak. A search on Google shows
    www.met.police.uk/fraudalert/419.htm

A Slough Times investigation has revealed:-


  1. Telephone number 07752-262 029 is allocated to telephone provider:-
      Telefonica UK Limited
    which operates in Britain as O2 Telecommunications. It rents landlines, provides landline and radio broadband and operates BT's former Cellnet mobile telephone system.
  2. www.ppinow.org has IP address 199.59.161.58
  3. That IP address has no host name
    • Host 58.161.59.199.in-addr.arpa. not found: 3(NXDOMAIN)
      indicating very sloppy Internet set-up, at best, or something dodgy at worse.
  4. That IP address was allocated on 2011-10-10 to:-
    • Web Commerce Communications Limited
      Lot 2-2 Incubator 1 Technology Park Malaysia Bukit Jalil
      57000 Kuala Lumpur
      Wilayah Persekutuan
      Malaysia
  5. When accessing www.ppinow.org the user is automatically diverted to
    http://217.23.3.166/myppi.info/default.php
  6. IP address 217.23.3.166 belongs to a Internet hosting company
    • WorldStream
      Honderdland 111F
      2676 LT Maasdijk
      Nederland
  7. The Internet host name for IP address 217.23.3.166 is:-
    customer.worldstream.nl.
  8. No where on the so-called www.ppinow.org web site is there a street address or telephone number which indicates a potentially fraudulent operation.
  9. On web page
    http://217.23.3.166/myppi.info/default.php
    there is, in the source coding, several references to "writeoffppi.com" including
    • © Writoffppi.com, all rights reserved
  10. Domain writeoffppi.com was registered on Thursday 3 May 2012 to:-
    • John Peter
      Leadmasters
      MANCESTER
      Fallow Field
      Manchester
      M14 6GH

      Technical E-Mail: gary@tetr.us
      Technical Tel: +44.1614083744
  11. Postal code M14 6GH is actually 2-52 Whitby Road, Manchester (even numbers only).
  12. Email address domain "tetr.us" is not actually registered to the USA government or to the USA state authorities. It was registered on Tuesday 6 October 2009 to:-
    • gary mcneish
      Tetrus Ltd
      42 whitby road
      fallowfeild
      manchester
      lancashire
      m14 6gh

      Registrant Phone Number: +66.838273350
      Registrant Email: info@tetrustelecoms.com
  13. Telephone country code +66 is allocated to Thailand.
  14. Domain name tetrustelecoms.com was created on 16 October 2008 and is currently registered to:-
    • mcneish, gary
      466/47
      majestic residence
      pattaya, chon buri 20107
      Thailand

      +66.838273350
      gary@tetr.us
  15. Domain name tetrustelecoms.com is currently suspended and is not hosted (meaning it is not operational).
  16. Company Tetrus Limited:-
    • TETRUS LTD
      (registered office)
      SUITE 72 CARIOCCA BUSINESS PARK
      2 SAWLEY ROAD
      MANCHESTER
      LANCASHIRE
      M40 8BB
      Company No. 06424187

      Status: Dissolved 22/03/2011
      Date of Incorporation: 12/11/2007
      Company Type: Private Limited Company
      Nature of Business (SIC): 6420 - Telecommunications
      Last Accounts Made Up To: 30/11/2008
      Last Return Made Up To: 12/11/2009

      List of directors available.
  17. Also on that same web page (http://217.23.3.166/myppi.info/default.php) in the source coding is reference to:-
    • www.myclaimuk.com
  18. Doman myclaimuk.com is not currently registered.
  19. Interestingly, from the redirected web address of
    http://217.23.3.166/myppi.info/faqs.php
    is a reference to myppi.info
  20. Domain name myppi.info was registered on 6 April 2012 to:-
    • Domain Administrator
      Fundacion Private Whois
      Attn: myppi.info
      Aptds. 0850-00056
      Panama
      Zona 15
      Panama
      Registrant Phone:+507.65995877

      myppi.info has address 111.90.152.95
      myppi.info mail is handled by 10 mail.myppi.info.
  21. IP address 111.90.152.95 is registered to an Internet hosting company:-
    • PIRADIUS NET
      Unit 8.2, 8 Floor, Menara Aik Hua
      Changkat Raja Chulan
      50200
      Kuala Lumpur
      Malaysia

      phone: +603-20318850
      fax-no: +603-20318851
  22. There is currently no web site on 111.90.152.95 or on myppi.info or on www.myppi.info
  23. The Daily Telegraph has an article on Mr McNeish's business activities including the selling of mobile telephone numbers and personal data.

Extras

  1. Domain name loanslineuk.co.uk was created on 11 June 2010. It is currently registered to:-
    • gary mcneish
      flat 3 11a whitworth street
      manchester
      lancashire
      M1 3GW

      loanslineuk.co.uk has address 91.204.209.118
      loanslineuk.co.uk mail is handled by 0 mail.netchemistry.info
  2. Domain name netchemistry.info is no longer registered.
  3. IP address 91.204.209.118 is not currently hosting web sites, but
    http://ip2web.web-max.ca/index.php?byip=1&ip=91.204.209.118
    states that same IP address has previously hosted mydebtgone.com
  4. Domain name mydebtgone.com is no longer registered.
  5. Additional research shows:-
    • mydebtgone.com - 111.90.152.95 - this is the same IP address as item 22 above.
      mydebtgone.co.uk - 212.227.119.65 - not registered.
      mydebtgone.net - 173.201.169.1 - registered, see below.
  6. Domain name mydebtgone.net was created on 22 July 2010 and is currently registered to:-
    • Private, Registration
      Domains By Proxy, LLC
      DomainsByProxy.com
      15111 N. Hayden Rd., Ste 160, PMB 353
      Scottsdale, Arizona 85260
      United States
      (480) 624-2599 Fax -- (480) 624-2598

      mydebtgone.net has address 173.201.169.1
      mydebtgone.net mail is handled by 10 mailstore1.secureserver.net
      mydebtgone.net mail is handled by 0 smtp.secureserver.net
  7. Web site mydebtgone.net has, in the web page's source code, these references:-
    • mydebtgone.com
  8. Domain name netchemistry.co.uk was registered on 29 September 2005. It is currently registered to:-
    • george miller
      The registrant is a non-trading individual who has opted to have their address omitted from the WHOIS service.

      netchemistry.co.uk has address 213.5.176.135
      netchemistry.co.uk mail is handled by 0 mail.mylifecoveruk.com.netchemistry.co.uk
  9. When one seperates mail.mylifecoveruk.com.netchemistry.co.uk into 2 domain names, one gets mylifecoveruk.com and netchemistry.co.uk. Searching mylifecoveruk.com .....
    • No match for "mylifecoveruk.com" in the registrar database.
      mylifecoveruk.com has address 111.90.152.95

      Interestingly, 111.90.152.95 is the same IP address mentioned at 22 above.