Due to economic considerations, Consumers Union has decided to shut down Consumer Reports WebWatch as of July 31, 2009.
Along with our parent site, Consumer Reports WebWatch, the UnSponsored Link will remain online as a consumer resource, but we'll no longer be able to follow-up on your comments or investigation requests. As such, for our last post, we’d like to highlight some of the techniques we’ve used to uncover the dozens of online scams we’ve exposed in this blog. We hope you’ll be able to use these methods to spot an online scam before you find yourself scammed.
1. Does the site provide full contact information?
Credible Web sites should clearly disclose the physical location where they are produced, including an address, a telephone number or e-mail address. Although this information is typically found on a “contact us” or “about us” page, some sites stick it in the privacy policy (usually at the very bottom) or terms of use, so you may have to do some clicking and scrolling. If all else fails, check the return policy for an address. If you’ve exhausted all these options and still can’t find an address, find another site.
2. Does the site publish a privacy policy?
Almost all sites publish privacy policies, but once in a while we stumbled across some that didn’t. Needless to say, if a site doesn’t disclose how it uses your personal information (name, address, e-mail, phone number and credit card number), steer well clear. Here’s an example of a site that published contact information but lacks a privacy policy.
3. Does the site enjoy a satisfactory rating with the Better Business Bureau?
Although some sites (particularly smaller ones) aren’t listed by the BBB, it’s still a useful barometer of a site’s credibility. For example, if you come across a site with an “F” rating, forget it. Although many sites are still rated as either “satisfactory” or “unsatisfactory,” most BBB bureaus now issue grades. The lowest acceptable grade is a C-.
Use this link to search for a business (or charity), either by URL or company name. If you’re researching a non-profit, here’s a link to an alphabetical listing of all the BBB’s charity reports. Sites that display the BBB Online Reliability Program seal are almost always trustworthy (beware of spoof seals—clicking on a real seal leads directly to the BBB rating). Although BBB-accredited businesses tend to be better, plenty of excellent sites aren’t accredited by the BBB.
Beware of sites pushing official-sounding seals. Here’s one of our favorites, the plausibly named, but laughably executed WebTrade Bureau. The only kind of “trade” going on here is yet another group of digital hucksters tying to fool consumers into paying for information on “free houses.”
Also, don’t judge a site by the number of complaints. We’ve seen sites with hundreds of complaints receive satisfactory ratings, and others with only a handful of complaints receive failing grades. It’s not the number of complaints that counts—it’s the number of resolved complaints. If you come across a site with a “No Rating,” it can mean one of three things: either the BBB file is being reviewed or updated; the BBB does not have sufficient information about the business; or recent activity requires further review by BBB. In these instances, you’ll have to rely on your own judgment. If the site fulfills the other requirements, it’s probably fine.
Here’s an example of a site with an abysmal BBB record, and based on the number of complaints (641 in early May—and 793 as of today), the worst we ever found.
4. Where is the site hosted?
If you've followed the steps above and remain unsure about a site (or are curious to see where a site may be hosted) WHOIS can’t be beat. Try searching for any site you use and trust, such as Amazon.com, and you’ll find full contact information. That’s because legitimate sites have no reason to hide the identity and/or location of their owners.
But sites that refuse to disclose ownership and location by blind registering their sites via proxy tend to have something to hide. For example, when we looked at the site ProfitLance.com, it listed a partial address we discovered was in the English town of Stockton-on-Tees (the site now says its located in Dubai—business must be booming). But we found no record of of Profit Lance (which is now flagged by Google as a "Reported Attack Site") or its owner, Michael Andrews, listed at the given address. A quick search of WHOIS revealed only that the site is blind-registered by proxy—which means it could be located anywhere and owned by anyone.
Another site we recently investigated, Defenza.com, claims to be based in Montreal, although according to WHOIS, the site is registered in the European microstate of Malta, and hosted in Russia. Similarly, WHOIS revealed that USABankruptcy Associates is actually based in the very un-American city of Montreal. WHOIS also proved especially useful in a post we did on some particularly nasty badware knows as LuckySploit. We used WHOIS to track down the registrants of a number of official-sounding, U.S. government sites hosting the LuckySploit malware ("ustreasury.federalbanksystem.net," "ustreasury.federalbanks.us," "usbanks.esecure-federal.us"), all of which were registered to cybercriminals in an improbable assortment of cities, including Austin, Erfurt, Valencia and Krasnogorsk.
5. How else can I tell if a site isn't legitimate?
If you’re reasonably sure a site may be bogus, but want confirmation, try searching for the site on the Rip Off Report, an excellent user-generated resource. One site we looked at, ProcessAtHome.com, which has thankfully closed its doors, ranks as our all-time Ripoff Report winner, with no fewer than 92 angry consumer complaints.
Another site we examined published full contact information as well as a privacy policy, but we suspected something was fishy due to the bargain-basement site design common to most online scams. So before we even checked with the Better Business Bureau (which also had its number), we ran a quick search on Ripoff Report, and our suspicions were justified.
Remember, while the Web may be an endless cornucopia of information, commerce and entertainment, it’s also a bottomless snake pit populated by thousands of cybercriminals working 24/7 to separate you from your money.
So in parting, to quote Sergeant Phil Esterhaus, "Let’s be careful out there."
]]>
