Picking your PC's pocket

The premium-rate dialler scam seems to be spreading, despite renewed efforts by the regulators to stamp it out. Charles Arthur has good and bad news for victims

Good news for those plagued by premium-rate diallers: from next week, the numbers that your machines have been dialling should fall dead. That may mean that your internet connection will fail, if you've unknowingly been hijacked.

Good news for those plagued by premium-rate diallers: from next week, the numbers that your machines have been dialling should fall dead. That may mean that your internet connection will fail, if you've unknowingly been hijacked.

In addition, phone companies will be told to hang on to the cash generated by those numbers for longer - at least 45 days, rather than three - so that the scammers must wait longer to get paid. That should be long enough for victims to alert the regulators and prevent that money getting passed on.

The bad news, however, is that you probably won't be getting back any money you've already lost to these scams. Although the premium-rate regulator Icstis will be telling phone companies to stop allocating premium-rate numbers to diallers until it has verified that they aren't ripping you off (by failing to tell you that it is going to connect you to the net for £1.50 per minute, and getting you to verify that you're 18 or over).

That's a start - but the form letter that Icstis is sending to the thousands of people who contact it every week to complain about internet dialler rip-offs shows that there's no relief from your financial pain. Even BT, which has made a public show of announcing that it will proactively block premium-rate numbers that it thinks belong to scam diallers, isn't letting people off the bills they run up. According to www.bt.com/premiumrate, it will simply give you longer to pay them. If Icstis decides that the dialler is a scam, you can try to get your money back from the dialler company. (And good luck with that one, as most are based in far-flung parts of Europe or even the US.)

If you suddenly find a lot of premium-rate calls on your phone bill, it is wise (after first following the procedure detailed, below) to do a Google search on it, or check the Icstis page of known numbers at www.icstis.org.uk/icstis2002/default.asp?Node=67 (you might need to try different configurations of the number in a Google search).

The big question, however, is: why have these problems suddenly exploded like this? The answer seems to be that changes made in UK law a couple of years ago, with the intention of making the UK the best place in the world for e-commerce, had the unintended consequence of also making it heaven for online scammers.

Here's why. Until two years ago, Icstis had the power to check dialler software. Then the e-commerce directive came into force in August 2002, and although it made much of "new powers" for all sorts of people, it also allowed companies based outside the UK to offer premium diallers without Icstis's prior approval, because that would restrict trade.

In February 2003, Icstis made its first fines for premium-rate dialling, against a Spanish and a German company that perpetrated exactly the scams that so many people have suffered. Since then, more companies have got on board with the scam: currently, Icstis is overwhelmed by around 6,000 calls each week from people complaining about premium internet services.

Does that mean that the UK is a regulatory soft touch? No, says Rob Dwight, Icstis's spokesman: "The UK has the oldest and best-established premium-rate business in Europe; problems that we have tend to get mirrored across the mainland 12 to 18 months later."

Most people wonder how they got infected by these programs, and why their antivirus software didn't catch it. The first answer is almost always through browsing pornography sites, according to experts. But some of those who contacted The Independent were women; they're perhaps less likely to have strayed so far. The possibility - though it's not proven - is that some of the companies carrying out these scams have been buying pop-up adverts, perhaps with reputable companies, in the hope of catching unwary users. The more widely you browse, the more likely you are to come across such a pop-up, which will silently download the required software and subvert your machine.

What about antivirus products, and firewalls? The latter won't help; they simply monitor the internet "packets" flowing in and out of your machine, not what number it has dialled. On the antivirus (AV) front, Graham Cluley, senior consultant at Sophos, says: "Most AV programs can detect these to some extent. But it's complicated, because we have to decide if something is a Trojan. Premium-rate dialling is a legitimate business model for adult and specialist-content sites because it means a transaction won't show on a credit card, for instance. Sometimes, these programs are upfront about what they're doing, but people don't read the small print; they just click 'I accept'. As for the rogue diallers, we need to see examples before we can protect against them, that's another problem." People tend to send viruses to antivirus companies; most don't consider sending dialling software.

If anything, though, the problem is worsening, and widening. A number of people who contacted us had found that their machines were dialling international numbers, another way of scamming cash. Icstis has no powers over those, and blocking of international calls costs money with BT, whereas premium-rate blocking is free.

At the same time, levels of support from ISPs and telephone companies is woeful. One person was told by Telewest's support that it could "only block calls on a phone line, not a modem". As dial-up modems use phone lines, this was worse than useless: it made the problem sound insoluble. It's not - but it does require you to be honest about how things might have happened.

The conclusion? Innocent users on PCs are being targeted by international criminals who have realised a way to exploit those machines, and the security flaws in Internet Explorer and Windows, to make millions of pounds. Icstis's action on rogue diallers is a start - but the real war is only just getting underway.

WHEN THE PRICE ISN'T RIGHT

* Check the number being dialled by your internet settings control panel. If this begins with 090, the problem lies there. If not, the dialler is lurking in your computer. Search for files installed just before the problem arose; look in Internet Explorer's downloads window for files you don't recognise. One may be the culprit.

* Find your original internet settings: there should be a disk or leaflet with the phone number for your ISP. Reinstall this.

* Reconnect your phone line and download Ad-Aware ( www.lavasoftusa.com/software/adaware/); Spybot ( www.safer-networking.org/en/home/index.html); and, for good measure, HijackThis ( www.net-integration.net/tools/hijackthis.html). You may need CoolWebShredder, too (from www.scumware.com/apps/scumware.php/action::view_article/article_id::1075343980/).

* Run the programs and find out what's on your computer. Up-to-date antivirus software may find it, but some don't treat dialler programs as Trojans or viruses. Delete the invaders.

* Get your phone company to block premium-rate calls.

* Get patches from Microsoft's Windows Update.

* Stop using Internet Explorer. It's vulnerable to such attacks. Try Mozilla ( www.mozilla.org) or Firefox ( www.mozilla.org/firefox) instead.