Over the last few years, casinos around the globe have been using increasingly high tech slot machines, but with high tech slot machines come the usual bugs. And that raises some interesting legal questions. In the past, we've noted numerous examples of casinos blaming software glitches for slot machine awards, and refusing to pay them out. And, usually, they're being allowed to do this. That seems a little troubling, but it can get a bit more complex, as in one case a few years ago, where a guy used a slot machine that had faulty software -- and was arrested for doing so. Each time he put in $1, it was credited as $10. Now, once he realizes this is happening, perhaps you can consider that fraud, but it does seem a bit dangerous to blame the guy for what was really a software glitch by the casino or slot machine vendor.

The latest such case, found via Slashdot, might not be quite as troubling. In this case, a guy more or less figured out a software glitch in a variety of slot machines that would enable a series of button presses that would lead to larger awards, and then he used that to win a lot of money. Now, I can definitely see the case for fraud here (and the guy has now been arrested). He didn't just spot a machine with a glitch, but he then actively exploited that glitch, knowing it was a glitch, and took steps to enable that glitch on various machines (to make it work, he apparently had to have casino staff change some settings on the machines, which they would do since he was a "high roller.")

Given that he was knowingly abusing this glitch, the fraud claims seem much more reasonable. However, there is still something worrying about charging someone for a crime for doing what a computer system allows them to do. He didn't technically hack the system -- he just figured out a bug in the software and used that to his advantage. There is at least some gray area, concerning whether or not some of the liability should fall back on the maker of the slot machine for leaving such a glitch in their software.

If you've seen those hologram-adorned wristbands advertised that are supposed to give you "balance" or some other such nonsense, you probably were smart enough to know that they were the modern equivalent of snake oil. However, for the gullible folks who believed in the claims of the manufacturer, Australian officials have forced the company to admit publicly that there's no scientific basis for their claims about the properties of the wristbands, and that the company "engaged in misleading conduct." What amazes me is that anyone believes the claims in the first place. The idea that a bracelet with a hologram improves your balance, enhances muscle response and increases stamina and flexibility just seems so obviously ridiculous. Even if you believed it might work via a sort of placebo effect, you'd have been better off believing in the magic powers of a basic rubberband and wearing that on your wrist. Nice to see regulators (in Australia, at least) forcing the company to admit that its product claims were based on nothing but a desire to sell cheap bracelets at a tremendous markup.

Slashdot points us to a recent story about a guy who lost his lawsuit against a bank, over a variation on a classic Nigerian email scam. The scam is one we've discussed many times in the past: somehow the victim gets a big check, which they're expected to deposit in a bank. After the check "clears," the victim/recipient is supposed to transfer a large chunk of that money to the scammer, on the belief that they get to keep whatever is left over. What really happens is a few days after the check "clears," the bank finds out it's fraudulent, and tries to void the transaction. But, by then, the victim has already transferred out a big chunk of money (and the scammer has already taken all that cash out of the bank and disappeared) -- leaving the victim footing the bill, with the bank expecting them to come up with the missing cash. In this case, the scam took on all the familiar facets of this scam:

In March 2009, Brian Peters received an email from someone purporting to be a citizen of Malaysia. The e-mail informed Peters that certain third parties in the United States and Canada owed the purported Malaysian money, but that "they can not transfer the funds to any bank account outside America continent due to their new company policy [sic]." He asked Peters to "assist me in receiving the funds and forward to me." He offered to pay Peters 12 percent of the money. Peters agreed after apparently negotiating an increase of his fee to 15 percent.

Peters deposited the $808,988.90 in checks received from the purported Malaysian at Chino Commercial Bank. After the bank notified Peters that the checks had cleared, Peters wire transferred $468,000 to Hong Kong. Shortly thereafter, the checks were dishonored after the bank detected that they had been altered. Since Peters was personally liable for any overdrafts on the account, which had only a few thousand dollars, the bank sought to attach property owned by Peters to collect on the overdraft. The trial court granted the bank’s motion to attach against Peters in the amount of $458,782.60.

This certainly isn't the first such lawsuit. We wrote about a similar case two years ago, which involved some scammers tricking a law firm (who really should have known better). The reason this scam works over and over and over again is pretty simple: most people have no idea that when a check "clears," it's not actually been validated. This is apparently due to various laws that require banks to make money from checks available within a very short period of time. So the way banks deal with this is to just make the money available, and if they later find out that the check was fraudulent, they pull back the money. But, of course, most people don't know this and assume (somewhat reasonably) that if a check "clears" and the money is listed as "available," the bank has made sure the check is legitimate. This is a somewhat unintended consequence of laws to make paying by check work better, but it leads to a huge opening for these types of scams.

So if they need to do that, shouldn't it make sense for banks to at least put forth pretty clear warnings on money that has not really been validated yet? Or to at least proactively warn anyone seeking to withdraw money that hasn't really been validated that if the check fails to validate, they may be liable? It seems like there must be better ways to deal with this kind of scam than to just let the scammers keep taking advantage of this knowledge gap.

Shocklee points us to a story claiming that a group of teenagers in the UK uploaded some of their own songs to iTunes, then used a bunch of stolen credit cards to download the songs thousands of times, and then collected approximately $773,000 in royalties. The article notes that this would be "an easy enough crime to commit," but something in the reporting on this story doesn't make much sense at all.

First off, something appears to be way off in the numbers. The reports claim that the teens downloaded their own songs approximately 6,000 times over the course of a year and a half. Yet, they claim they made $773,000 (£500,000) in royalties? I know that Apple now allows slightly higher prices on some songs, but they're not that high. The math doesn't add up at all. iTunes songs in the UK cost £0.79 per song, so 6,000 songs would mean £4,740 spent in total. Take Apple's (approximated) 30% cut, and you're left with £3,318 -- a far cry from £500,000. Even if you assume these songs got the "premium" pricing of £0.99, we're still orders of magnitude off (hat tips to Dave W & Stephen for UK iTunes pricing info). I've gone through the news reports -- and a whole variety of press reports and blogs all report the story exactly the same way: 6,000 total downloads (2,000 by this one guy, Lamar Johnson, who pled guilty to the crime) but not one report that I've found which seems to question the math.

I guess it's entirely possible that buying a bunch of songs yourself would boost the songs onto some lists, that would drive additional "real" sales, but if that were the case, that would be a much more interesting story -- and you would think that the press would point that out. We've certainly heard claims of "real" music releases where labels have dumped money into getting people to "buy" thousands of copies of songs to try to push a song into a hit list but none of the news on this story suggests that's the case.

Separately, despite the claim of the original article that this is a crime, I fail to see how that's the case at all. It's clearly an attempt to launder money via iTunes, but there seem to be multiple serious problems with it. First, as soon as the stolen cards are discovered and the false charges are made clear, it has to be incredibly easy to track down the likely suspect: whoever uploaded the music. On top of that, given iTunes' 30% or so cut, it seems like a somewhat costly way to launder money... in a way that is incredibly traceable, so the money isn't even that well laundered.

Lots of people suspect that the various companies out there who promise to clean viruses off your computer are a bit of a scam -- and, apparently, in at least one case, it turned out to be a huge scam. Apparently a guy working for one of those companies, Vickram Bedi, realized that Roger Davidson, who brought in his laptop to have it cleaned of a virus, was a wealthy composer (and heir to a fortune). So, rather than clean up the virus, Bedi and his girlfriend, Helga Invarsdottir, worked out a scam that bilked Davidson of somewhere between $6 and $20 million.

When asked to remove the virus from the laptop, Mr. Bedi allegedly told Mr. Davidson that his computer had in fact been attacked with a virus so virulent that it also damaged Datalink's computers, according to prosecutors.

Mr. Bedi told Mr. Davidson that he had tracked the source of the virus to a remote village in Honduras and that Mr. Bedi's uncle, purportedly an officer in the Indian military, had traveled there in a military aircraft and retrieved the suspicious hard drive, prosecutors said.

In addition, Mr. Bedi told the victim that his uncle had uncovered an assassination plot against Mr. Davidson by Polish priests tied to Opus Dei, according to prosecutors....

In addition to the thousands of dollars charged to secure Mr. Davidson's computer, Mr. Bedi and Ms. Invarsdottir allegedly charged thousands more to provide 24-hour covert protection for Mr. Davidson and his family.

Harrison Police Chief Anthony Marraccini said the couple charged Mr. Davidson about $160,000 every month for bogus security and other services. At the time of their arrest, Ms. Invarsdottir had $1.6 million in a bank account and Mr. Bedi had $6 million in a separate account, Mr. Marraccini said. Those accounts have been frozen and computers and business documents were seized by police, Mr. Marraccini said.

According to the article, this scam only came to light after law enforcement was investigating Bedi and Invarsdottir for another scam, suggesting that this may have been an even bigger scam, with more targets.

We recently pointed out that the latest name for Vision Media TV appeared to be World Progress Report, and it appeared to be doing the same thing that it has been heavily criticized for by both the New York Times and NPR. Basically, it's the same deal: they hire a semi-famous retired news person (such as Walter Cronkite, Hugh Downs and Joan Lunden) and get them to film a generic "opening" to a "report" about some organization (usually a non-profit), with the claim that such programs will appear on "public television." Then they approach the non-profits about having a news segment done about them (heavily name dropping the current "star") for "public television." Then they drop the news that the organization needs to pay the "production costs," which run anywhere from $20,000 to $30,000. A poorly edited clip is filmed, which never airs on PBS. In fact, PBS has put a warning on its website specifically calling out the company under various names and suggesting if you're contacted by any of them to notify PBS so it can complain:

PBS wishes to clarify that it is not associated with and does not endorse, distribute programming for, review underwriting for or otherwise have any business relationship with the following production companies: American Artists Television, American Review TV, Business Break TV, Business Trends, Eco Planet TV, Event Media TV, Evergreen Entertainment, Family Television Studios, Food For Thought TV, Giving Back, Global Television Studios, Great America (with Hugh Downs), Healthy Path, Heroes of Hope, Infinity Media Group, Insights, Paradigm Media Group, Platinum Group, PMG, PMGTV, Roadshow Productions, United Media Communications Group, Vision Media, Vision Media Television, VM Television, VT Media, VT Media Productions, or World Progress Report (with Joan Lunden). PBS does not oversee the production or distribution of any programs associated with any of these companies.

If you are solicited by a production company that claims or implies an association with PBS, please notify PBS.

However, one of the oddities about World Progress Report was the fact that it was putting out a bunch of press releases promoting a program on "scams." While at first people thought this was just irony, Paul Levy notes that it seems to have the effect of burying any Google results that call World Progress Report a "scam."

By this new strategy, World Progress Report is loading up the search results both for its own name, and for its name combined with the word "scam," with reports about its supposed public television programming. As a result, the information that impartial critics are calling it a scam are being buried in a welter of search results for its own self-promotion.

Earlier this year, we noted that scammers were copying the mass automated pre-settlement copyright infringement notices of law firms like ACS:Law and US Copyright Group, in order to get people to install malware on their computers. It appears that sort of effort is only expanding. With French President Sarkozy getting his wish for a three strikes law in France, the bureaucracy set up to deal with the resulting mess, Hadopi, is now trying to warn people around France that scammers have started sending out fake notices, pretending to be from Hadopi, demanding money for copyright infringement. Unfortunately, it's yet another unintended consequence of bad legislation.

When we've discussed adblockers in the past, one important point that many people have raised is the growing likelihood of scammers "buying" ads as a method of distributing malware through popular sites. Apparently, that business of "malvertising" is getting more and more popular... and more and more sophisticated. Joshin4colours points us to a story about a super sophisticated "malvertiser" who went to great lengths to appear legit. In another discussion about that case, it's suggested that somewhere around 50% of "self-service" advertising setups may be part of some kind of scam. I'm not sure I quite believe that number, but if the number is even half of that, it does raise questions about how online ad buying and ad placement works, and how it will work in the future. Perhaps this will finally drive companies who insist on banner ads, rather than more effective forms of advertising/marketing, to rethink their position.

It's the idea that's been put forth in various movies over time: what if computer hackers could just take a tiny amount off of millions of transactions -- transactions so small that most people wouldn't notice or care. And yet, we hadn't really heard of it actually working anywhere... until now. The FTC has apparently shut down one such scam, though it was an operation since 2006. The details of how it was set up are pretty convoluted, and help explain, in part, why this sort of scam isn't quite as easy as the movies make it out to be. Also, by "micro" charges, we're not talking fractions of pennies, but charges between $0.25 and $9 -- enough that they could get away with this for four years without too much of an outcry. In fact, apparently only 6% of the charges were contested. Yes, out of 1.35 million fraudulent charges, only 78,724 people noticed and complained.

Wired digs into the details of how this was set up, which highlights the complexity of the operation:

According to court documents filed (.pdf) in the U.S. District Court for the Northern District of Illinois, the scammers -- identified only as "John Does" in the complaint -- recruited money mules through a spam campaign that sought to hire a U.S.-based financial manager for an international financial services company.

Mules who responded to the ad and were chosen for the task opened multiple bank accounts and about 100 limited liability companies for the scammers, which were then used to make the fraudulent charges and launder money to bank accounts in Cyprus and several east European countries, including Estonia and Lithuania.

Front companies set up by the mules included Albion Group, API Trade, ARA Auto Parts Trading, Data Services, New York Enterprizes, and SMI Imports, among others.

The scammers then purchased domain names and set up phone numbers and virtual office addresses for the front companies through services such as Regus. They used this information -- along with federal tax I.D. numbers stolen from legitimate companies with similar names -- to apply for more than 100 merchant accounts with credit card processors, such as First Data.

According to IDG,

They used another legitimate virtual business service -- United World Telecom's CallMe800 -- to have phone calls forwarded overseas. To further make it seem as though their companies were legitimate, the scammers would set up fake retail Web sites. And when credit card processors asked them to provide information about company executives, they handed over legitimate names and social security numbers, stolen from ID theft victims.

When they had to log into payment processor Web sites, they would do this from IP addresses that were located near their virtual offices, again evading payment processor fraud detection services.

Once approved by the card processors, the front companies were able to charge consumer credit and debit cards. Money charged to the cards was directed into the bank accounts set up by the money mules, who then transferred it to accounts overseas.

The charges showed up on consumer credit and debit card statements with a merchant name and toll-free phone number. But consumers who called the numbers to question the charges generally encountered an automated voicemail recording saying the number had been disconnected or instructing them to leave a detailed message. The calls, of course, were never returned.

See? A bit more complex than just taking a fraction of a penny off of each transaction. But, as the IDG report notes, if you're looking to set up an online scam, here's a blueprint.

With companies like Digiprotect, Davenport Lyons and ACS:Law busy sending out tens of thousands of so-called pre-settlement letters that threaten people (often on very little evidence, if any) of copyright infringement, but allow them to pay up to avoid a lawsuit, is it any surprise that out-and-out scammers are jumping into the game as well? Ben alerts us to a warning from US-CERT of a new email scam, which involves the scammers sending out legitimate looking emails pretending to be from a law firm, telling the recipients they're being sued for copyright infringement. The details are supposedly in a file at a URL provided in the email. When a visitor goes to that URL and downloads the file, they get malware instead. Yes, it appears that the malware scammers are now learning from the best in the business...