OSINT for Protection: How to Spot a Scam Before It Spots You
We’ve all seen them: the urgent email from "your bank," the too-good-to-be-true investment opportunity on social media, or the "recruiter" offering a high-paying remote job that requires an upfront fee for equipment.
Scammers rely on two things: speed and secrecy. They want you to act quickly before you have time to think, and they want to keep the interaction within a closed loop where they control the information.
OSINT is the ultimate "scam-killer" because it breaks both of those advantages. Here is a simple investigator’s checklist for vetting a suspicious person or offer.
1. Verify the Domain (The Website Check)
Scammers often create "look-alike" websites. A site might look exactly like a major bank or a well-known brand, but the URL is slightly off (e.g., support-amazon.com instead of amazon.com).
- The WHOIS Check: Use a tool like who.is to see when the domain was registered. If a "well-established" investment firm has a website that was registered only three weeks ago, it’s a scam.
- The Contact Check: Does the website list a physical address? Is it a real office building or a residential house? Use satellite imagery to see if the headquarters is actually a P.O. Box in a strip mall.
2. Reverse Image Search the "Professional"
If you are being contacted by an "executive," a "recruiter," or even a potential romantic interest, take their profile photo and run it through a reverse image search like TinEye or Google Images.
- Stock Photos: If the "CEO" is actually a stock photo titled "Smiling Businessman," walk away.
- Stolen Identities: If the photo belongs to a real person but with a different name and a different job, the person contacting you is using a stolen identity.
3. Check the "Company" Registration
Legitimate businesses leave a paper trail. In Canada, you can use the Canada Business Network or provincial registries (like Service New Brunswick) to see if a company is actually incorporated.
- No Record? If there is no official registration for a company that claims to be handling millions of dollars, it doesn't exist.
- Mismatched Details: Does the registration date or the names of the directors match what you're being told?
4. Search the Specific "Hook"
Scammers are often lazy—they use the same scripts for thousands of people. Copy a unique-sounding sentence from the email or the job description and paste it into a search engine inside quotation marks.
- The Result: You will often find forums or "Scam Tracker" websites where other people have posted the exact same message they received.
5. Follow the "Financial Exhaust"
If they ask for payment, how do they want it?
- Red Flags: Requests for gift cards, wire transfers to overseas accounts, or cryptocurrency are almost always signs of a scam. These methods are chosen because they are nearly impossible to reverse once the scammer has the funds.
Trust Your "Investigation," Not Just Your Gut
Your "gut feeling" is a great early warning system, but OSINT gives you the evidence to back it up. If someone is pressuring you to act, that is exactly when you should slow down and start searching.
The goal isn't to be paranoid—it's to be prepared. When you know how to look for the cracks in a scammer's story, you become a much harder target.
- Marie Landry, OSINT Investigator & Founder, Marie Landry's Spy Shop
Comments
Post a Comment