- Category: Adversary Intelligence
- Industry: Hospitality
- Motivation: Financial
- Region: India
- Source*: A - Reliable; 1 - Confirmed by independent Sources
Executive Summary
THREAT
- Threat actors are uploading images showcasing their phone numbers on google listings of hotels.
- When an unsuspecting user contacts these phone numbers they are asked to make an advance payment for reservation confirmation.
- ~71% of the targeted audience fell prey to these scams.
IMPACT
- The fake custom care numbers are being misused by scammers to lure customers of hotels which is resulting in a monetary loss for the victim.
- Brand image loss to the hotel.
MITIGATION
- Run aggressive awareness campaigns to educate users about the ongoing scams.
- It is recommended to identify and immediately suspend or takedown such google accounts spreading Fake Customer Care Numbers.
- Book only via trusted channels and avoid putting upfront deposits.
Analysis and Attribution
Information from the Post
- CloudSEK’s researchers found several google accounts posting similar-looking photos on hotel listings.
- Multiple sets of these images had the same background but different phone numbers were written on them.
- These phone numbers are written in such a way that OCR could not read them but are readable by humans.
![](https://cdn.prod.website-files.com/635e632477408d12d1811a64/641d25267e9ef832366ec649_B03laLnztkwrVMrESCKJUQF_fe9LwePVVXLvpPCjSq6CSAyRtXtOBmwsWe4rZAbqAkfIg1yhhI4PQBAk4XrIBSo7xf_Bwm8AyEvti9x3b4sveSJD0fzqcoXr5BZRY_bHTYWQHH7tT28gi2KvLWotjiI.png)
![](https://cdn.prod.website-files.com/635e632477408d12d1811a64/641d2526ccbf2f1fe8f30cb8_XR5ZTieIHuQUkt7Lt-pHTiIRdBkdTi4fGfkfqLI-uZN2OQfNTtv1o5kt9X_yec9emNEmDHEcrMacfZn7iJkXFNTLEk0my-sycRxDTdkYUngK667YEoY_zjBMBMpF8WY9Gfp3FQCnRvh1e2DIp26XUXs.png)
Analysis of the Numbers
An in-depth analysis of the numbers suggested the following points were observed in this campaign:
- Threat actors are not limited to any geographical area and have posts across various states in India. A major concentration of this campaign was observed in the pilgrimage cities (Jagannath Puri, Ujjain, Varanasi).
- Hotels and homestays from all price categories are being targeted in this campaign.
- Threat actors are regularly creating new google accounts and using new phone numbers to keep the scam running.
- It remains unknown whether this campaign is operated by a single actor or a group of people, however, our research was able to uncover multiple google accounts advertising different numbers.
![](https://cdn.prod.website-files.com/635e632477408d12d1811a64/641d25277e9ef8f2876ec6f0_LOCqU31qLuTwaK_7FxC3RLHUE13GfiXf4D-49Mqtr74zo1xJAlFdpptu7-ZFgHmRjWZF8d12h43LZ-P3CJkpg0XHN62GQ4Hst4bwo-L6FhctC5VQEN8jC2MzKJUK2xDbY_jgrgRUxjsCOt3LUkPbepI.png)
- Truecaller records indicate that around 71% of the calls from the 19 fake numbers discovered during our research were answered by individuals who could become victims. On average, 126 calls were made from each number.
- Notably, the names associated with the scanned numbers on Truecaller profiles did not match the names linked to their Google accounts.
- Multiple google accounts were observed advertising different phone numbers in a single hotel listing. (For more information please refer to the Appendix section)
- As observed in previous instances of fraudulent customer care schemes, the perpetrators, in this case, employed a combination of the three primary telecommunications providers, with the majority of the registered numbers originating from the eastern and northeastern regions of India.
List of Google Accounts & Phone Numbers Used by Scammers
References
- *Intelligence source and information reliability - Wikipedia
- #Traffic Light Protocol - Wikipedia
- An Analysis of the Fake Customer Care Numbers In India | CloudSEK
Appendix
![](https://cdn.prod.website-files.com/635e632477408d12d1811a64/641d2528620f21810f72f4fa_p_FXdLLjFO_4v0H-eKebOfuyw4GP1s3FzOCtm6tVf9BRrwKNA73K3VesHj5e8AGkg7vh9OdEvq1oVE0auehExDaUUjwFKadOe3K3QD4LQ2ATxonKbIe0YfQo5v_Js5FhXxYMNjTZh0z6pgnO3QiZc1g.png)
![](https://cdn.prod.website-files.com/635e632477408d12d1811a64/641d2527ccbf2ff635f3150c_dmc6CyubcVM35bEH5GhMotp86YXPRpTbgTQgAfalddvXelLStUWt0NkNThbPBZGj9vwwpjdyk-3VF4sjxwoQRNOBDvXJeyNDnyQ39kMTO4m6FTWeRKcnOOVMFncP8jiHrpkKhwoWZH-DoIgrsMC9JqM.png)
![](https://cdn.prod.website-files.com/635e632477408d12d1811a64/641d2527426ba3ac5517290a_JOLh1560cD5tf8A8iu_2Us9ZrvqiyFXSwyppFg18cIh2gXEv4YHYRo_t2dQ0M-WXcEJcTRGqoT2JykmejzXX70x-VFsdVxJFtwu8GmBkcZKZeYVuMAo8Duh0gfTlT8T4U0I3l7siIyHvgUpWTILvQcI.png)