RMZ Fire Safety: The Investigation Continues

Print This Post

You may also like...

42 Responses

  1. Jim Salter says:

    In addition, if anyone has any ideas on getting information on the persons associated with the phone number — (626) 373-8717, using Google Voice — let me know.

    That's easy – call the number, posing as A/P for a company that received an invoice, and find out where to direct your payment. Follow it downhill from there.

  2. Nicholas Weaver says:

    Getting Google voice info without a court order is probably a non-starter.

    Getting Google voice info with a court order should be slam dunk easy. Have your postal inspector friend get the Google guide to law enforcement to learn just how to ask the questions:

    Probably want access history metadata, account/billing info, etc, but no content.

  3. Jim Salter says:

    Correction, sorry – I see that you already had an address for "RMZ Fire Safety", and of course it's a commercial mail drop.

    Basically from here I think you have to get a postal inspector or other entity with the budget and authority to do a stakeout interested, then they can stake out the maildrop and collar whoever collects.

    Although you still might be able to get identifying info out of the scammer if you bait them with the Google Voice number and/or mail to the maildrop. They might or might not be dumb enough to give you alternate contact info if you reply to an "invoice" with an expressed willingness to pay but needing more info, blah blah blah. Depends on how bright they are (which usually seems to be "not all that bright").

  4. Dion starfire says:

    If you really want their identities, you could always pull a Prenda (or any other copyright troll, for that matter) on 'em.

  5. Jim Salter says:

    Nicholas – note that there's no guarantee that they EVER check that Google Voice number, or even that it's actually theirs. The Google Voice number isn't where the cash flows in, the maildrop is. The GV number could even be a very deliberate red herring. The maildrop, on the other hand… well, like I said, that's where they go to get paid.

  6. Nicholas Weaver says:

    Jim: The Google Voice number was properly registered, and answers as "RMZ fire safety services". Thus it is theirs, thus the metadata associated with the account can possibly identify the account holder.

    Also, since the search needed is ONLY metadata and billing records (Contact history for fetching/controlling the account, account registration information, etc), its not going to need a full warrant, but just a subpoena should probably be sufficient.

  7. Jed Sutherland says:

    This reminds me of a question I keep forgetting to ask: What happened regarding the first company that was identified as running this type of scam? It's been so long that I can't remember its name any more.

  8. Ryan says:

    How about call, sound somewhat frantic about the invoice being overdue and ask where you can courier the cheque overnight? Smart crooks wouldn't fall for it, but most crooks aren't smart.

  9. En Passant says:

    AC 626, which Google Voice user may have chosen at random, or which may reflect actual user's location, covers the San Gabriel Valley. Various public reverse number lookups indicate the number (626) 373-8717 may be for a copper phone line drop in Covina. Maybe it is, or maybe not.

    RMZ invoice gives a mail drop address in La Verne, in the San Gabriel Valley.

    "UST" / "US Telecom" scam invoices give a mail drop address in La Verne, in the San Gabriel Valley.

    US-Telecom.com, the domain printed on the "UST" / "US Telecom" scam invoice, is registered to "US Telecom" in Monrovia, in the San Gabriel Valley.

    Covina, La Verne and Monrovia are all within a short drive, with Covina at approximate midway between the other two.

    This online complaint about a scam "UST" / "US Telecom" invoice has comments indicating that one Mr. Bell, a person believed to be behind the scam, has an actual phone number in the 626 AC, though not the same as the number given on the RMZ invoice.

    Both RMZ and "UST" / "US Telecom" invoices have some 626 AC phone numbers printed on them, though not the same exchanges.

    There is certainly a lot of possibly coincidental location information indicating that the two scam invoice operations originate from locations geographically close to each other.

    Just sayin'.

  10. Lazy criminals always confuse me. Why don't they increment the invoice number or connect it to the company name somehow, like "JOES-0718"? It would be trivially easy and if your entire operation consists of generating fake invoices, the time spent will be easily covered.

    You have to assume that some do-gooder such as Ken is going to wind up with multiple invoices. At least TRY to create some doubt.

    Idiots. (still evil, mind you, but also idiots)

  11. naught_for_naught says:

    I've this overwhelming urge to put on a windbreaker and aviator shades, then have a powdered doughnut with black coffee in a paper cup. This would be a perfect moment if I still smoked.

  12. Richard says:

    @Jed Sutherland:

    This, I think, is the most recent update from Ken on this case (March of this year):
    http://www.reddit.com/r/IAmA/comments/1aokls/iama_federal_criminal_defense_attorney_and_former/c8zalx1

    Not very informative, I'm afraid.

  13. En Passant says:

    @naught_for_naught on Sep 12, 2013 @10:13 am:

    I'd suggest ordering a pizza to go, no anchovies. Then sit back and listen to the monotonous staccato of rain on your desktop while reading your name backward through the glass on your office door.

    Wait for a visit from a guy with the unmistakable scent of Pyramid Petchulli cologne. His name will be Rocky Rococo. He'll be carrying a brown paper bag containing a pickle.

    Then it will all come rushing back to you like a hot kiss on the end of a wet fist.

  14. Trebuchet says:

    Is there any avenue of approach through the mailbox company? Let them know they are being used for fraudulent purposes, try to find out who leases the box, or, better yet, who they forward the mail to? Do they have any legal liability?

  15. naught_for_naught says:

    @En Passant

    Mickey?

  16. En Passant says:

    @naught_for_naught: Regnad Kcin. He spells his name "Danger"!

  17. naught_for_naught says:

    @En Passant

    It was brilliant, a mini-clinic in the use of sensory details to create a crime noir scene. The Pyramid Petchulli and the pickle in the paper bag just killed me.

  18. Nezrite says:

    @En Passant – Ah, lovely flashback. Thank you! As an aside apropos of not much, I used to use the name "Nina Danger" as a work alias, back in the day.

  19. En Passant says:

    @naught_for_naught:

    Not mine though. I stole it fair and square from the Firesign Theatre, Philip Austin, David Ossman, Philip Proctor, and the late, great Peter Bergman.

    Specifically, The Further Adventures of Nick Danger, Third Eye.

  20. damon says:

    Go Ken!

  21. En Passant says:

    Nezrite wrote Sep 12, 2013 @11:39 am:

    @En Passant – Ah, lovely flashback. Thank you!

    You're welcome, Audrey… Farber? Susan Underhill? Melanie Haber? Betty Jo Bialowski?

    Is that you, Nancy? Do you still recall the night we stood trembling under the dwarf maples outside the Om Mane Padme Sigma house?

  22. ZarroTsu says:

    See, if I were a direct victim of this sort of thing, I'd try to counter-scam the fraud by posing as a Nigerian prince and asking that they loan me the amount listed so I could work out the legal fees with recovering my fortune.

    I'd clearly be a part of the problem, but if it were slightly more feasible than the above, I'd possibly get a (mail-box redirected) contact number, and a (off-site, drop-off) postal address.

    Of course then I risk being investigated for fraud myself… Still, it would make for an interesting weekend.

  23. En Passant says:

    Back to the phone numbers. I may be wrong, but I expect that the USPO inspectors could subpoena the subscriber info and call records (essentially pin register info) from all CLECs or other carriers who provided each and every phone number used in the RMZ and UST bogus invoice scams.

    If the subscriber info is bogus or indirect to a rental mail drop, it could still be useful (eg: it could show consistent bogus info from both scams). The calling info could also be useful in many ways, about which one can only speculate without knowing what calling info actually exists. So all subpoenable CLEC or carrier data could be useful evidence in a prosecution.

    Another, more expensive line of attack: If the envelopes from the scams are sealed with a moistened gum flap, DNA profiles can likely be extracted from the flap edges. DNA profiles aren't just useful in rape and bloody murder cases.

    DNA from envelope seals could match that of persons believed to be perpetrators.

    It's cheap for invoice recipients to seal the envelopes into plastic bags and not handle them further before turning over to USPO or other investigators. For investigating agencies the DNA profile development would be a significant but not overwhelming expense though.

    Postmarks on the envelopes could also provide useful evidence.

    Just as a suggestion, asking scam invoice recipients to preserve, seal and send envelopes as well as invoices to investigators could prove useful to investigators. I would think that evidence which could rebut claims of coincidence would be useful in any prosecution.

  24. Bear says:

    Ken: "In addition, if anyone has any ideas on getting information on the persons associated with the phone number — (626) 373-8717, using Google Voice — let me know. "

    FOIA to the NSA?

    Michael Donnelly: "Lazy criminals always confuse me. Why don't they…"

    It's deliberate. They're selecting for gullible people: https://www.schneier.com/blog/archives/2012/06/far-fetched_sca.html

  25. tsrblke says:

    @Bear
    There's also very little incentive for them to put in the extra effort. People will only recognize the false account numbers at identical if two of the potential (or actual) victims come in contact and compare. The scammers consider that very low risk, so no effort is added to protect against it.

  26. Khaim says:

    Nicholas Weaver is correct – with a court order, getting Google Voice info should be trivial; without one, no way.

    Incidentally, you appear to have multiple readers who are Googlers.

  27. Ken White says:

    I just called the number again, left another message with my name and phone number, and asked if they'd like me to introduce them to the postal inspector.

  28. Bear says:

    Aw, Ken. That's takes the fun out of it. You could have done something along these lines:
    http://sicherheitskultur.at/David%20Ehi%20Reverse%20Scam.htm

    Of course, anyone who's already been scammed by this guy probably would prefer your way.

  29. Matt says:

    Bear • Sep 12, 2013 @2:11 pm

    FOIA to the NSA?

    Nah, just do what Dilbert did, and hack 'em :p

    (Mind you, is this how Clark and Patrick would react? :D http://dilbert.com/2013-09-09/)

  30. RogerX says:

    Place a code-locked phone with gps and long battery life into a padded mailer addressed to scammer. Drop in mailbox near the mailbox location. Assume scammer will not open padded envelope until he arrives elsewhere– though that could be an expensive assumption. Small trackable units are also available on the internet. Staking out the mailbox place is also an option, noting license plates and correlating to the time the mailbox's mail is picked up, assuming you have eyes on the place.

  31. Bear says:

    Matt • Sep 12, 2013 @7:42 pm: "Nah, just do what Dilbert did…"

    Nah. I hate mud. And squirrels.

  32. Bear says:

    (Added, for those who don't follow Dilbert.)
    http://dilbert.com/fast/2013-09-13/

  33. ElwoodBlues says:

    The person renting the mailbox is required to fill out USPS Form 1583, and provide two forms of ID to the Commercial Mail Receiving Agency (CMRA) providing the mail box. The CMRA providing the mailbox is required to keep copies of the form and ID and make them available to Department of Consumer Affairs or any law enforcement agency conducting an investigation (California Code – Section 17538.5) and to the postmaster or postal inspectors (per form 1583).

  34. Joe says:

    I will bet my bottom dollar, or my bottom 379 dollars that these are the the UST jokers reimagined.

  35. Ibidem says:

    I'm not really familiar with all the laws, but I thought California required advertisements to include the license number if a license was required…
    Which means that you have them in a knight's fork, of sorts: Either they broke the law by scamming people, or they broke the law by advertising without properly displaying the license/without a license.

  36. Petro Gravus says:

    The guy at the mailbox place is making $10 an hour.

    A quick interpersonal transaction out back will give you all the information you need.

  37. John Faulkner says:

    I just received an invoice from them as well.

  38. Ken White says:

    John, if you want to email it to me, I can pass it to the Postal Inspectors.

  39. Chris says:

    I received RMZ Fire Safety Invoice dated 9/26/2013 for $413.11 with same "account number" and everything. I also had a guy from some other random company…came in and claims that he did an inspection (which i did not see). I told him that I've never heard of his company and I have not authorized him to even come in.. He claims that he comes every year.. .which i've never paid him for. be careful with fire inspection claims since so many are fake. Always ask to see the inspection report and inspection sticker.

  40. Scott says:

    I received an invoice also from RMZ – left them a message with a google voice mail. I have never heard of these guys and never used them. BBB need to be contacted about the fraud.

  41. Jacob says:

    I work at a hotel in the engineering department. In the mail today I recieved an invoice from them. 9/26/2013 act # 414639957. total of $413.11. Bunch of idiots. Thank you to Ken White for trying to stop this bs

  42. Ann says:

    We received same invoice, same invoice amount and invoice number. FRAUD! Thanks for posting on internet so we did not have to go scrambling too far…