By Jamie Rigg From engadget

Kitboga’s made a career out of wasting time.

“Well, my grandchildren were over and it’s something about a pornography virus,” says the soft voice of an elderly woman over the phone. “I unplugged my computer right away,” she continues, and after she explains her worries in a little more detail, a female voice on the other end of the line replies, “That’s all right. Don’t worry, let me assist you with this. And may I know, is that a desktop or a laptop?” The PC has apparently been hacked, as confirmed by allowing the support team remote access, but resolving this comes at a cost. Nearly two hours and 20 minutes — and several transfers between call center staff — later, Kitboga drops the vulnerable-old-lady act.

“Can I be honest with you a second. I’m not actually a grandma,” Kitboga says as he turns off his speech manipulator and begins talking in his normal, male voice. “I’m probably your age,” he admits to the woman currently on the call, “and I’ve known the whole time that this was a scam. And the lengths that you went through to try to take advantage of her are … it breaks my heart.” By “her,” of course, he’s talking about the elderly woman the call center workers think they’ve been passing around. “I’m angry, but I’m trying really hard to just be honest and nice with you,” he says. A few words into the next sentence, the scammer hangs up. And to think, 40 minutes earlier they were singing Sia’s song “Cheap Thrills” to each other over the phone.

Scams come in many forms. Sometimes it’s a cold caller claiming to be a government employee. You owe the IRS money for unpaid taxes, they say, and will face criminal charges if you don’t pay immediately. Another, relatively new confidence trick preys on the allure of cheaper airfare. (For the record, a legitimate American Airlines agent won’t accept Google Play or Steam credit as payment.) Tech support scams are one of the easiest to stumble across. A pop-up will scare you into believing your computer has been hacked or infected, and provide a number for a Microsoft technical support center. There is no virus, of course, and the person on the other end of the line has no Microsoft affiliation. They will fix the entirely fabricated problem with your computer, though, for a fee.

It’s impossible to know exactly how much money tech support scams bring in. Microsoft estimated in 2015 that in America alone, 3.3 million people would be defrauded that year, to the tune of $1.5 billion. This April, the company said it had received 153,000 reports worldwide regarding support scams in 2017, up 24 percent from the previous year. Victims of these scams weren’t taken for insignificant amounts, either, often paying between $200 and $400 to peace-of-mind peddlers. You may think the call centers, the vast majority of which operate from India, prey primarily on elderly and vulnerable people. But a Microsoft survey in 2016 found that millennials were actually the generation most likely to be duped. So much for growing up on the cusp of the internet age, it seems. Being generally tech-savvy doesn’t mean you can’t get got.

But just as there are scammers, so there are scam baiters. These real-life vigilantes make it their business to deceive the deceivers. A common strategy is to simply call fraudulent support lines and waste as much of their time as possible before the person on the other end realizes they’re the one being tricked. Every minute spent with a scam baiter is a minute that call center worker isn’t spending with someone who might be talked into paying up.

Some scam baiters take it further. Part of the fake support routine is to talk the caller through granting remote access to their machine. The caller can then see the “expert” fiddling with their computer, pretending to run diagnostics to make the whole pantomime look legitimate. Few, if any, of these call center workers are genuinely computer literate, though. In the most extreme cases, scam baiters use this to their advantage, hijacking the remote connection or provoking the scammer into running a file that allows them to hack and infect the scammer’s computer and/or wider network.

Kitboga takes the lighter approach. His goal is to keep scammers on the phone for as long as possible, testing their patience while demonstrating the lengths to which these people will go to extract a few hundred bucks from their victims. He uses different personas and voices, namely an elderly grandma type who goes off on irrelevant tangents that can drag the conversation out almost indefinitely. Sometimes he encourages the scammers to sing down the phone to him. He’s honed the art of stalling.

It’s scam baiting, but it’s also entertainment. Kitboga streams his time-wasting sessions live on Twitch, where he has more than 5.5 million views, 260,000 followers and thousands of subscribers who pay a monthly fee to support his channel. Edited versions of his calls, which can go on for several hours, are uploaded to YouTube, where he has more than 100,000 subscribers. He’s become the face of scam baiting, a celebrity of this unique form of vigilantism. And yet, 18 months ago, he was oblivious to it all.

Kitboga has a background in software development. One day, he was looking up something to do with virtual machines — emulated computers that behave just like the real thing — when he came across “Lenny.” Lenny is a bot that plays a succession of pre-recorded messages with just enough smarts to get the timing of the clips right, so the conversation appears to flow naturally. Lenny’s responses are vague, designed to trick any telemarketer or scammer into believing they’re talking to a real person. Kitboga thought it was fake, but funny, and down a YouTube rabbit hole he went.

He was surprised by the persistent and sometimes aggressive nature of the scammers he heard in these videos. He wanted to know more. “I was instantly drawn to it because I come from tech — I’m always on the computer. I started doing all this research and realizing this has been going on for years now and that there are people, every single day, who spend 10 hours a day or more calling,” he told me. He was reminded of his grandmother. “As she got older and dementia set in, you get really reliant on people and you have to trust people. There are people who took advantage of her.”

She had several phone lines, internet packages and satellite dishes, though she never watched TV. She would believe every telemarketer. “There was a lady that came every week to her house — to her house! — to clean the viruses off of her MacBook that she never used.” Kitboga saw how easy it was for people to be sucked in by scams and started researching everything about them. “I gotta do something about it,” he told himself.

He already had experience with virtual machines — you don’t want to grant a tech scammer remote access to your actual computer, for obvious reasons — and knew not to use his personal network. To this day, Kitboga won’t share anything about his real identity, so as to deter any form of reprisal from scammers (they are criminals, after all). When he was comfortable enough with his setup, he called his first fake tech support line.

“I remember being blown away by how they picked up the phone immediately and told me they detected viruses on my computer. And I’m thinking, You don’t know! How do you know? They connected to it so willingly, and within 15 minutes they were sitting there telling me I had all these viruses and I need to pay, and I was just beside myself, thinking, This is true, this is easy. They were so willing to scam me.”

“I was just beside myself, thinking, ‘This is true, this is easy.’ They were so willing to scam me.”
Kitboga
For a few months, he spent some free time here and there learning about different types of scams and how to report them. He shared his initial experiences with friends, and one suggested he stream a call or two on Twitch so they could listen in. A private scam-baiting party, as it were, because Kitboga was already becoming skilled at killing time on these calls. “Just goofing around,” he called it. On one call, he played a silly guitar song through the phone to a scammer. Someone picked it up and posted it to Reddit.

“The next time I streamed, all of a sudden there was 10 or 15 people watching,” he recalls, “and it just grew from there. I started streaming once a week, and 15 people became 50 people became 150 people, and it kinda blew up after that.” Kitboga’s popularity grew, and the nature of his work as a software engineer allowed him to wind down the hours he spent on his regular job and dedicate more time to streaming. Eventually, he was making enough money from Twitch and YouTube to pay his mortgage, and less than six months ago, he made the jump to streaming full-time. In a bizarre, somewhat ironic twist, he now makes a living scamming scammers.

These days, Kitboga’s viewers tend to send in scams they come across. He receives a handful of submissions every day, an endless supply of material. When he first started, though, he would seek them out himself. He would misspell the names of popular websites intentionally, hoping that opportunistic domain squatters would have sold the redirection traffic to a tech support scam that day. If he did encounter a virus-warning pop-up encouraging him to contact “official” Microsoft agents, he would report the scam and then add it to his to-do list.

He would also try to mimic searches a less tech-savvy person might perform — “How to remove viruses off my computer for free,” for example — and find fake antivirus software claiming that a brand-new virtual machine was compromised. Naturally, there was a phone number attached to this warning. He would sometimes simply search for Microsoft technical support and find scams listed as early as the second page of results. There’s an inexhaustible supply of targets, it seems.

Kitboga likes to challenge a variety of scammers. IRS scams are fun, he says, because they’re very aggressive and know nothing about tax law. “I’ll ask them questions anyone that actually works for the IRS would know how to answer and they just can’t respond. It makes me grin.” Those calls can last only so long, though. “It’s weird to say ‘enjoy,’ because you’re talking to scammers, but … Tech scams are my favorite, just because you add more depth to the conversation when they’re on the computer.”

His elderly grandma act is the perfect cover. She’s not good with computers, and scammers spend forever just talking her through granting them remote access to her machine. And that’s just the beginning. “Even though they’re going to go through their script, when they get on my computer, now it’s my world. It’s my little playground,” he tells me. “I put them through all kinds of little traps and silly ways to waste their time.” The scammers all like using Notepad to type out the nonexistent diagnoses and the cost of repairs. Kitboga has coded his own Notepad for his virtual machines that purposefully changes letters, ignores keystrokes and randomly crashes.

Tech support scams offer the most opportunities to extend the conversation and make each interaction unique. “My current record is three hours and 52 minutes, I think,” he says. Kitboga doesn’t just do it for the laughs, though, or the views. “I’ll have some fun and I’ll do these personas to waste their time, but I think it gets the word out there and gets people talking about it, and that’s what I’m more excited about.”

While every conversation is different, the formula doesn’t change. Toward the end of the call, there’s always the reveal, where Kitboga tells the scammer he knows his virtual machine hasn’t been hacked and the whole tech support angle is a ruse. He asks them, gently, why they do what they do and whether they ever think about who they’re hurting. Some hang up immediately; others plead ignorance, maintaining that they are legitimate tech support workers to the very end, even when they’ve asked for payment in iTunes gift cards. On occasion, the scammers are angry; sometimes they even say the joke’s on him, because there are “stupid” people on hold right now just waiting to get scammed.

Senior elderly lady at home using her new laptop computer and its technology

Kitboga is never aggressive toward them. That’s just his style. The way he sees it, it’s like a parent talking to a child. Getting angry isn’t always the best approach — telling a child you’re disappointed in them typically has more impact. He doesn’t think there’s any right way to approach the end of these calls, though. Perhaps scammers who might shrug off his softer line of questioning would think harder about their work if the last call of the day ended with a scam baiter shouting horrific things at them in Hindi. He hasn’t always been so stoic, though. “If I look at some of the older calls — a lot of them aren’t on YouTube or anything — I said some stuff that I don’t say now. I was just upset and I was like, How on earth can you do this to people?”

He pays attention to a few other scam baiters, like The Hoax Hotel and Jim Browning, but he doesn’t consider himself part of any wider scam-baiting community. “There’s a lot of different opinions that scam baiters have. How we handle the calls at the end, what we say to the scammers. Sometimes that’s deterred me from reaching out to more people. I don’t know if we’re aligned or like-minded,” he tells me.

Kitboga’s never considered using his technical background to hack scammers, as some scam baiters do. “Technically, it’s illegal,” he says. “I don’t really want to fight it that way. Two wrongs don’t make a right,” not to mention it would go against Twitch’s policies. Sometimes scammers even log into their payment-processing services through his virtual machine. He simply takes note of the important information and reports it to the relevant services and authorities.

There are plenty of people who can’t relate to a hacking demonstration, he feels, even though he would find it interesting personally. He believes his old grandma persona is more relatable to a broader audience. Having read up and spoken to people about how these call centers operate, hacking a scammer’s computer has little value in the grand scheme of things. “It is very, very easy to spin up one of these call centers. A lot of times, they’re using virtual machines or junk computers,” he explains.

Keeping cool and being non-combative isn’t always easy, though. “Sometimes I lose sight of one of the main goals of the stream: to have fun and raise awareness about what’s happening.” After a two-hour call, he often craves that the scammers acknowledge their wrongdoing. But they work for criminals. The calls may be recorded. “Hopefully they think about it,” he says, even if they don’t say anything.

“I try to remind myself every day that I am talking to another human being … As much as sometimes I wanna yell and I wanna scream, I think I would rather have someone talk to me honestly and say, ‘I hope that you can find a way out.'”

A handful of times, the scammer has actually shown remorse. Whether that too is an act, however, is another question. “One guy in particular, he was pretending to be, I think, Malwarebytes,” he says. Kitboga revealed himself and the scammer became upset but stayed on the line. He transferred the call to his cell phone and left the call center. He was no longer being recorded. “He was talking a little more about what it was like to work over there,” Kitboga tells me, “how little they get paid and how hard it is.” The pair exchanged a few emails after the call, before the scammer stopped responding, but he did seem genuinely remorseful.

Other stories tell of people getting trapped in the role of a tech support scammer. An employer might move them and their family into accommodations, buy them a computer to do their work on, and suddenly they’re indebted. Some people believe they have landed an actual tech support role, only to discover the reality of the position later. “I want to be careful to say I’m not excusing what they’re doing. I will say that it is wrong 100 percent of the time,” Kitboga clarifies. In the end, there are still vulnerable and gullible people falling for these scams, so there’s only so much sympathy he can have for the people hard-selling nonexistent technical support.

Plus, there are new types of confidence tricks popping up all the time. “Sometimes it makes me sad,” Kitboga says. He’s built a following now, and not all his streams revolve around scam baiting. Occasionally he plays games or codes live, often writing software for his virtual machine. He actually has to spend hours building new virtual machines for scam baiting these days, installing the kind of software and creating the kind of desktop you’d expect an elderly lady to have, for example. A fresh install is too suspicious now — the scammers are catching on. “I’ve been really excited about doing the code streams. It’s another thing I’m really passionate about, and I want to encourage people to just try and learn.”

There are other things he could see himself streaming. Figuring technology out interests him. It’s the whole reason he got into scam baiting in the first place. “Something like virtual reality, for example, is still really, really new. I think a lot of people just don’t understand it,” he says. “I could see it being really fun to take a topic like that and say, ‘Let’s code some virtual reality stuff, let’s mess around with virtual reality and let’s figure it out together.'” Kitboga doesn’t think he’ll ever get tired of scam baiting, though, even if putting a funny voice on takes its toll on his vocal cords, so that he can only stream for around four hours at a time.

“It’s the unknown,” he tells me, talking about what continues to draw him to scam baiting. “There’s always something a little bit different. There’s always another thing to learn.” He enjoys entertaining people with his antics and hopes that he’s doing something to raise awareness. For every scam he shows on stream, there are five others waiting to catch people out. Getting people to think critically about whom they’re talking to and what they’re being offered is the ultimate achievement for him.

Though it’s unlikely to happen, if everyone got so savvy about scams that they ceased to be effective, then he could well be out of the strange job he’s managed to create for himself. “I would be happy to know I played a part in getting rid of these scams, even if that meant I go back to software development. Or if the stream became more about talking just general tech stuff, and maybe writing code and playing games together, I would be okay with that.” Kitboga chuckles. “Because humanity would be in a better place, right?”

Images: Facepunch forums (Internet Explorer error); Ian Shaw / Alamy (Grandmother at computer)

For more on this story and video go to: https://www.engadget.com/2018/07/30/scamming-tech-support-scammers/