0203 290 8987 (aka 02032908987 or in the international form +442032908987) and form303.com are being actively and heavily used in online banking calls scams today. All the victims I know of were called around 11am this morning.
Sadly the telephone number is no longer answering and the domain is just a forward to TeamViewer along with privacy protection applied to it.
The scammers call their victims and in the instance I experienced twice today – told their victims they were calling from BT (a british telecommunications company and broadband provider) and the victim’s computer was infected.
The first call to one victim simply asked them to visit a website, run a remote control program and then showed the victim supposed screens on their computer that claimed they were infected.
When the victim refused to pay the caller got malicious and told them that their phone line and broadband will be suspended for 9 months and then proceeded to syskey (password / encrypt the registry) their computer so it would no longer startup. After that they brought up the victims webcam.. at which point the victim pulled the power out of the computer and hung up the call.
In the second, more worrying and less common, call to a different victim they were given the initial crap about the computer being infected. Talked the victim through connecting via supremofree (a remote control / support application) and then also used form303.com to load teamviewer (probably to steal some documents or files from the victim’s computer).
However they didn’t take the track above. This victim was asked to fill their online banking details into a dos box to “secure their online banking”.
Shortly after the victim had an automated call from their bank with a One Time Password code normally used to initiate a funds transfer. The victim was told, by the scammer, that the code had to be given to the scammer in order to “test the security on the account”.
Sadly this code was repeated down the phone to the scammer and a funds transfer of IRO £4,500 was initiated.
(It turns out the bank actually did further examination on this transfer and it got held or otherwise didn’t actually reach the destination.. VERY lucky for the victim.)
I’m waiting further details from a third victim.
The telephone number used as the caller ID of the scammers, 02032908987, is allocated to Vodafone Ltd. As far as I understand from previous contact with law enforcement – this Vodafone allocation normally means the number is a “Skype In” number.
This caller ID has been associated with similar “BT” scam calls since at least September 2015