Inside an International Tech-Support Scam

Another older man started crying when told it would cost about $1,500 to repair his machine. “Oh, bloody hell. I'm going to have a heart attack. I feel sick.” When the scammer asked why he was crying, he said he suffered from depression. As the man wept, Jim captured images of the salesmen in the room who were listening to the call, and laughing and pointing fingers mockingly at the victim.

Scammers are laughing at the distraught target described above.

Photo illustration by John Ritter/SCREEN GRAB FROM JIM BROWNING

This is when Jim reached a new stage in his journey: outright fury. He wanted to do more than make a few salesmen squirm. He wanted to stop as many operations as possible so they couldn't continue to abuse people.

But Jim was careful; he had his and his family's welfare to worry about. “I could have physically destroyed their computers by placing a virus in them, but I intentionally didn't do that because there was really nothing on their computers worth destroying,” he said. “And secondly, if I physically destroyed property, I would be overstepping the mark.” Translation: He, too, would be a criminal.

So what could he do? Jim had already started to intervene personally when he thought he could prevent a fraud from occurring, by calling the victim, the financial institution or anyone else he thought could halt the scam. So he tried a new tactic: using “call flooding” software to tie up the boiler room's phone lines with thousands of junk calls. Viewing the scene through his computer, he saw all the salesmen removing their headsets and complaining that the calls were nothing but annoying white noise. To his joy, he successfully shut the place down for several hours.

But then, reality set in: What Jim had done was just a trivial, temporary annoyance for just one operation. The next morning, the boiler room was back to business as usual.

Determined to make a difference, Jim moved to plan C: He contacted the media. He sent his best footage to the BBC, Britain's largest news operation. And it bit, producing a half-hour program featuring the evidence he had gathered and naming “Jim Browning” as the source. It aired in the U.K. in March 2020, just as the coronavirus pandemic hit. The piece received widespread international exposure. Around the same time, Jim sent videos to local authorities in India; they arrested the scammers and shut down the boiler room.

After years of obscurity, Jim had become a YouTube star. As of this writing, Jim's video of this particularly cruel boiler room has been viewed more than 14 million times, and his YouTube page has grown to over 2.8 million subscribers. Success!

And he had succeeded at walking the fine line. “Doing just enough to make life miserable and identifying who they are is probably the best thing that I can achieve,” Jim said.

But again, Jim asked himself, What now?

Finding a way to help victims

This is where I enter the story. i stumbled onto Jim's YouTube page early in 2020, and after watching many of the videos, emailed him to see if I could learn more about his work. To my joy, he responded immediately, saying he would be happy to work with AARP on educating its members about tech-support scams. He said that while his videos do reach millions of people, most of his subscribers are male and younger than 40, meaning many are likely tech geeks, law enforcement or even scammers. He has found it difficult to reach older people who are the prime scam targets.

And so, in the middle of a pandemic, I entered into one of the most intriguing correspondences of my life. At first, I needed to verify his story. You already know that Jim Browning is not his real name; but for AARP to tell his story, we had to confirm his real identity and situation. Ultimately, he agreed, and I can assure you that the “Jim Browning” of this story is real and accurately described.

Once that was done, Jim and I spent countless hours over the summer looking over new footage he had recorded earlier in the day to watch phone marauders try to steal money. We communicated only on Skype, with our personal cameras turned off, again to protect Jim's identity and his family's privacy.

On four separate occasions, I witnessed a tech-support crime occurring in real time. The first time this happened, Jim was showing me what I thought was a recording from earlier in the day. I asked him when it happened, and to my surprise he said, “It's happening right now.”

"Well, what do we do?” I asked, my blood pressure surging. “We can't just let this transaction go through. They are about to send the scammer $10,000!”

Jim, an old pro at these situations by now, was already at work to find the victim's phone number. Often, he could get it directly from the scammer's computer; as we became more familiar, he sometimes would ask if I could access the person's contact information through a U.S. public data aggregator service to which I subscribe.

In those cases, I would give Jim the victims’ phone numbers as fast as I could find them, and he would call to warn them. After initial skepticism, they typically became convinced that it was a scam, and decided not to send cash. Which is what many scammers actually asked for.

The picture below is of a woman holding a box with $10,000 in cash. The scammers turned her computer camera on and asked her to show them the package to prove she was really going to send it to them. In this case, Jim was able to contact FedEx, which intercepted the package and stopped delivery.

Photo illustration by John Ritter/SOURCE: SCREEN GRAB FROM JIM BROWNING

But for every successful intervention, there were many more times when we were too late. “I can't tell you how many times I have infiltrated a scammer's computer and looked at his previous transactions, and it will say things like, ‘Confirmation of wire transfer,’ “ Jim told me. “You just know those people have been scammed, and there is nothing you can do about it. That is the worst feeling."

I get it. I witnessed crimes with Jim that couldn't be undone; I can't overstate how frustrating it was, or how angry I became.

Here are some cases I observed with Jim. I'd urge to you read on, as knowing the details is the best protection from becoming a victim. It might spark a little rage in you, too.

One important note: Don't try to do what Jim does! Hacking undetected into criminal computers takes advanced skills, gear and cunning; it is also illegal and very dangerous.

Two countries team up to take down fraudsters

Impostor scams like these — in which a crook fakes the identity of some kind of authority to coerce money out of you — were the number one form of consumer fraud in 2020, the Federal Trade Commission reports. And it's not just Jim's observation that victims often are older. Consumers over 60 were about five times more likely to report losing money to a tech-support scam in 2020 than those ages 20 to 59, the FTC says.

In response, law enforcement agencies have invested heavily to take down tech-support scammers, resulting in more than 900 arrests in the U.S. in the past three years. Industry giants like Microsoft have also ramped up the fight by more widely sharing information they see about these types of abuses. After all, their brand reputation is at stake.

Just in October, the Central Bureau of Investigation (India's equivalent to the FBI) and the U.S. Justice Department brought charges against a group of tech-support scammers who allegedly defrauded thousands of seniors for almost a decade. Jim had penetrated these operations years earlier and sent details of them to the CBI. He even confronted one of the main defendants, Michael Brian Cotter, online; Cotter denied any wrongdoing, saying Jim's evidence was just the result of a couple of rogue employees and was not what his company was all about.

The Justice Department and the India law enforcement agency disagreed; Cotter, a California resident, and numerous others have been indicted in the United States.

Did Jim's tip play a role? It's impossible to know. I spoke with a senior manager at the FTC and a former state assistant attorney general about how law enforcement thinks about people like Jim. They both said that even if what vigilantes like Jim do is illegal, law enforcement will turn a blind eye as long as they don't “cross the line” and use the information they gather for nefarious purposes. One person likened them to industry whistleblowers who report wrongdoing that in some cases leads to indictments — and, in some cases, cash payments to the whistleblower.

India’s equivalent to the FBI staged a large boiler room bust in October.

Photo illustration by John Ritter/SOURCE: MANJUNATH KIRAN/AFP VIA GETTY IMAGES

Jim doesn't expect reward money anytime soon. “I know that law enforcement probably wouldn't approve of what I do,” he told me. “But almost every time I pass on information” — Jim notes he's done so at least 100 times — “they tell me they are grateful and say, ‘Keep doing what you are doing.’ “

Perhaps that's because the onslaught of tech-support fraud shows no sign of letting up. Robocall technology has made it shockingly cheap and easy for fraudsters to call millions of homes, thereby increasing their chances of reeling in unsuspecting victims. Likewise, the global pandemic has caused us to spend more time online, exposing us to dubious websites where malicious pop-ups are more common. And high youth unemployment in developing countries, combined with easy access to technology, has swelled the number of individuals willing to engage in fraud for a living.

You're probably wondering: Do law enforcement agencies sneak into scammers’ computers and observe crimes as Jim does? The answer is: only under the narrowest of circumstances. Electronic wiretapping rules are extensive and highly restrictive. One U.S. official told me, “It's a big deal” to get a judge to sign off on electronic surveillance that would allow the government to do what Jim is doing; prosecutors would need overwhelming documentation ahead of time that a crime is occurring before a judge would grant such approval.

But Jim doesn't work for the U.S. or any other government, which means there is no one to stop him as he continues his solitary quest to search and call out the bad guys.

What's the ultimate solution to this growing fraud menace? Realistically, it will require a mix of tough law enforcement, tighter regulations and increased education to warn consumers of these evil practices.

Still, it's comforting to know there are people like Jim Browning, fighting the battle on his own, simply out of compassion and because he happens to be pretty brilliant at technology. What does his fraud-fighting future look like? He tells me he's not quite sure. On the one hand, he isn't ready to quit his day job to fight fraud full time. On the other hand, he has been amazed at how many people have shown interest in his work. And he still enjoys discovering new ways to disrupt criminals.

I asked him how much of his efforts are still about satisfying an engineer's curiosity. He admits that his motivation has evolved to be more of a personal cause, albeit one he feels overwhelmed by at times. For example, he told me he receives some 300 emails a week from fraud victims who want his help.

"I don't know if they think I am some kind of a savior or miracle worker,” he told me. “I can't even begin to answer all these people.” Still, he persists in tracking as many tech-support bad guys as he can and rescuing as many victims as time permits.

Jim's work reminds me of the story of the boy who was on a beach one bright and sunny day, when he came upon countless starfish washed up onshore and dying in the heat. He began to throw them back into the ocean one by one when a man came up to him.

"What are you doing, son?” the man asks.

"I'm throwing the starfish back into the water so they can live.”

"But there are thousands of them. You can't possibly make a difference."

The boy reaches down, grabs another one and heaves it into the surf.

"I made a difference for that one.”