WARNING! - Youtube Content ID Phishing SCAM! - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: May 26, 2017, 02:38:34 am
content: Youtube content creators, beware of this nasty and clever phishing scam that tries to get your Youtube login name and password using a fake content ID claim on your video.Note: I was going to only upload polished on-topic numbered content to EEVblog from now on, but I figured this is important enough that it needs to be shared with as many people as possible. So my 2nd channel didn't cut it.

author: Bud
author_rank: Super Contributor
timestamp: May 26, 2017, 03:16:58 am
content: You could check in the browser which Certificate Authority issued the https certificate to them and report to that CA that their certificate is used by their client for illegal activities.

author: edpalmer42
author_rank: Super Contributor
timestamp: May 26, 2017, 03:41:54 am
content: WMG = Warner Music GroupThis is doubly sneaky because if there was any music playing in the background - even a radio, WMG might be the owner and would kick up a fuss. Vbloggers have been caught in that trap. Makes the email seem even more legitimate.Ed

author: mdszy
author_rank: Unknown
timestamp: May 26, 2017, 03:42:38 am
content: Regarding the bad spelling/grammar/caps: The reason scammers do this is because it weeds out people who are too smart to fall for the scams. If you catch the spelling/grammar, odds are you won't get scammed. If you fail to catch it, you're more likely to be someone who'll fall for the scam.

author: P90
author_rank: Frequent Contributor
timestamp: May 26, 2017, 03:56:32 am
content: Quote from: mdszy on May 26, 2017, 03:42:38 amthat's why most Americans get scammed... lol

author: mdszy
author_rank: Unknown
timestamp: May 26, 2017, 04:00:37 am
content: Quote from: P90 on May 26, 2017, 03:56:32 amHilarious and original.

author: Electro Detective
author_rank: Super Contributor
timestamp: May 26, 2017, 04:02:00 am
content: Quote from: P90 on May 26, 2017, 03:56:32 amThe'one born every minute'thing must be running rampant there.Scammers deserve their own island resortpeace and quiet..no internetand a one way ticket

author: P90
author_rank: Frequent Contributor
timestamp: May 26, 2017, 04:05:19 am
content: Quote from: Electro Detective on May 26, 2017, 04:02:00 amScammers deserve public hangings... No pity for those scumbags...

author: Terrius
author_rank: Contributor
timestamp: May 26, 2017, 04:46:29 am
content: Quote from: EEVblog on May 26, 2017, 02:38:34 amThanks for posting this Dave!I never trust dubious e-mails, but there are certainly a lot of people that would see the familiar YouTube fonts and appearance and just blindly click, especially if they were a bit panicked due to the notice. Going forward I will certainly take your advice if I ever get a YouTube e-mail and go directly to the source rather than trust any embedded links.

author: Fungus
author_rank: Super Contributor
timestamp: May 26, 2017, 07:08:50 am
content: 'Muted' means they disable the sound on a video.(because you put copyrighted music on it or something)

author: cdev
author_rank: Super Contributor
timestamp: May 26, 2017, 03:14:56 pm
content: "secureserver.net" is GoDaddy, so they do handle email for a lot of people. Also, the Youtube address they sent it to is likely the "address of record" they are supposed to use?By and of themselves, if secureserver net was in the headers (and not the return address) that wouldn't raise suspicion for me. However, the other issues you brought up would.

author: Richard Crowley
author_rank: Super Contributor
timestamp: May 26, 2017, 04:30:46 pm
content: Quote from: Fungus on May 26, 2017, 07:08:50 amThe issue was not the meaning of "muted".The issue was that it is not the normal verb used by official communication from YouTube.i.e. another clue that the message is not genuine.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: May 26, 2017, 05:06:54 pm
content: Quote from: Richard Crowley on May 26, 2017, 04:30:46 pmThey also tell you where they found the copyright material in the video. I heard this from a friend...

author: jnissen
author_rank: Regular Contributor
timestamp: May 26, 2017, 06:55:54 pm
content: Yeah recently had an email from Netflix reporting my payment didn't go through. Same thing...I didn't follow their link but instead went into my payment system and saw the payment went through no problem. Under closer examination the link was to some nonsense URL. I hate scammers.

author: mikerj
author_rank: Super Contributor
timestamp: May 26, 2017, 08:33:46 pm
content: Quote from: mdszy on May 26, 2017, 03:42:38 amThat makes no sense. If smart people realise it's a scam before they get to the point of entering passwords, what does weeding them out with bad spelling actually achieve?IMO the reason scammers do this is simply because English is rarely their first language.

author: Hensingler
author_rank: Regular Contributor
timestamp: May 26, 2017, 10:11:52 pm
content: How deliciously ironic it would be to find your Youtube account liking and commenting on Batteroo videos.

author: Richard Crowley
author_rank: Super Contributor
timestamp: May 26, 2017, 10:38:34 pm
content: Quote from: cdev on May 26, 2017, 03:14:56 pmIt would most definitely raise suspicion for me. If a mega-website like YouTube isn't sending email from youtube.com, they will have a tough time convincing me the email is genuine. Same with ANY of the URLs linked in the email. If they don't go to youtube.com/whatever then I'm not clicking it.

author: Richard Crowley
author_rank: Super Contributor
timestamp: May 26, 2017, 10:40:52 pm
content: Quote from: mikerj on May 26, 2017, 08:33:46 pmIt saves their bandwidth for the truly gullible.QuoteI have considered more than once how much worse things will be when they start getting a clue and using proper grammar and spelling.

author: P90
author_rank: Frequent Contributor
timestamp: May 27, 2017, 12:55:05 am
content: Quote from: jnissen on May 26, 2017, 06:55:54 pmI've got several similar scam emails recently claiming to be from amazon, saying my order has been canceled, with a link that directs you to some website other than amazon.It's a scammers world out there... BE CAREFUL!

author: Red Squirrel
author_rank: Super Contributor
timestamp: May 27, 2017, 02:21:04 am
content: I had a really interesting Paypal one a while back. My site has a donate button and every now and then I actually do get a donation. I got a real donation, and then not that long after I got an email that looked like it came from Paypal, it was something along the lines"Hi this is customer support and [person who donated] asked if they could get a refund. Could you please do so by going to your account?"There was no links or anything, and the person was actually the person that donated for real. What made this seem fishy is that I doubt a refund request would involve someone from Paypal actually writing a personal email to you. You'd probably get an automated email or something. I logged in to my Paypal account to see if there was any kind of notice that would pop up and also emailed the person that donated asking if they did ask for a refund and I never got a response back. Ended up forwarding it to Paypal asking about it and they said it is a scam. Really not sure what the point of that scam is though, like if I issued a refund, the original person would just get it back, not the scammer. Unless the person that donated was actually the scammer and there was some kind of trick they can do? Like maybe it refunds more money or something?

author: P90
author_rank: Frequent Contributor
timestamp: May 27, 2017, 02:35:02 am
content: Quote from: Red Squirrel on May 27, 2017, 02:21:04 amstrange... usually there is a fake link in the scam email...

author: mdszy
author_rank: Unknown
timestamp: May 27, 2017, 03:00:52 am
content: Quote from: mikerj on May 26, 2017, 08:33:46 pmIt saves them bandwidth and time. They want to spend as little money as possible to get the people that will DEFINITELY fall for these things.

author: Fungus
author_rank: Super Contributor
timestamp: May 27, 2017, 08:25:31 am
content: Quote from: cdev on May 26, 2017, 03:14:56 pmSure, but nobody puts it as their email address.

author: Fungus
author_rank: Super Contributor
timestamp: May 27, 2017, 08:33:45 am
content: Quote from: Red Squirrel on May 27, 2017, 02:21:04 amThat's got to be your email reader not showing the full singing and dancing email.Maybe there was javascript in the email or something like that.

author: cdev
author_rank: Super Contributor
timestamp: May 29, 2017, 05:05:15 am
content: Its in their headers..

author: rs20
author_rank: Super Contributor
timestamp: May 29, 2017, 06:53:32 am
content: Just a suggestion, it would have been nice to suggest using two-factor authentication as well. Because with my two-factor authentication, even if I gave someone my password, theoretically they couldn't log in. At the very least, seems like a sound second level of defense against those late night link clicks.