HACKER MEDICINE

In 2013, scammers published thousands of apps on Google Play that led to fraudulent sites. This form of scam is typically called “one-click fraud” in Japan.  The very first variant appeared in January and while only a handful of these fraudulent apps survive for a few days at most, we confirmed that, in total, more than 3,000 apps were published on the market in 2013. By October, scammers for the most part have stopped publishing new variants of the fraudulent apps on Google Play for unknown reasons.

Figure 1. Total number of apps leading to one-click fraud sites published on Google Play throughout 2013

While apps that lure victims to fraudulent sites may no longer be available on Google Play, there are currently other vehicles leading victims to these sites, such as spam. 

This scam typically begins with spam that has been sent to a mobile phone, ideally a smartphone. The spam message contains a link to an adult video website. The site claims that videos can be viewed free of charge.

Figure 2. Example of the spam message sent as part of this scam

Figure 3. The adult video site linked in the spam message

To view a video, the visitor is instructed to make a phone call in order to register for the site. Once the user calls the number provided on the site, an automated system will accept the call and save the phone number of the victim’s mobile device. The visitor will then be prompted to input their telephone number in order to access the site.

Figure 4. The site instructs the user to register to access the videos

When the user clicks on a video after they’ve registered for the site, another Web page opens. If you read the page carefully, you will notice that the term “free” has completely disappeared and a tiny note about a subscription fee has been added.

Figure 5. The adult video site with details of a subscription fee

If the visitor fails to notice this detail and clicks the download button, they will end up registering for the paid service and will be charged the hefty price of about US$1,000. If you actually compare the URL of the two adult video Web pages, you will notice that the two sites have different domains. The original site redirects the visitor to a different service and allows free videos to be viewed only on its own site, but no videos can be found. There are videos on the second site, but they are not available for free.

Figure 6. Registration page for the site that charges a subscription fee

The end-user agreement on the original site states that all content on the site can be accessed free of charge, however, other services linked to the site may not be free.

Interestingly, the site’s Q&A page warns visitors that they may receive phone calls from scammers asking them to pay for video services. The Web page instructs users to be carefully about making payments. The scammers do follow up by calling the visitors if the fee is not paid by the deadline.

Figure 7. The Q&A page with a warning about scammers

These scams occur on a daily basis and affect users with smartphones that run any type of operating system. Users should remain vigilant of one-click fraud scams and should avoid clicking on links received through unsolicited spam messages.