TNS24 - a fake courier company website, used by online scammers

Filed Under: Facebook, Featured, Law & order, Spam

TNS24Beware of attractive strangers contacting you on Facebook, and requesting that you help finance a shipment of goods in your name.. you might find yourself out of pocket, with little chance of redress.

A Naked Security reader contacted us recently, worried that they had become the victim of an internet fraud after they were chatted up by a glamorous-looking woman on Facebook.

According to our correspondent:

"She connected with me on Facebook. Her name is [REDACTED], and she is very attractive. She gave me a story and I fell for it, and I sent her £250 through Western Union. She said she had no cards (lies) having my details she sent me papers for a consignment in my name. [REDACTED], the manager of the TNS24 shipping company phoned me after a few days to track the goods from Turkey to a UK port..."

"All she was concerned about was the consignment, then I was required to pay for the warehouse and insurance purposes £2500 which I did to a personal account through Western Union again, the addresses are all wrong, her Facebook account is an empty shell, I know my money is gone.."

We were curious to find out more, and our eyebrows raised when we visited the TNS24 website at tns24.com.

Can you see anything odd?

TNS24 website

No? Take a closer look.

First of all, there's that photograph of one of the airplanes belonging to the "global courier service".

TNS24 Plane

Not got it yet? Let's take a look at this photograph of one of their staff, carrying a package.

TNS24 Package

Just to be clear - I haven't added the TNS24 logo to these images. TNS24 want you to believe that their planes and packages really look like this.

Here's one of their lorries:

TNS24 Lorry

By their (low) standards of Photoshoppery, the lorry's livery is quite good. But still unconvincing.

Most amusingly of all, however, is one of TNS24's alleged ships:

TNS24 ship

Yes, they really have cut-and-paste the unconvincing TNS24 logo *backwards* onto the side of a boat.

TNS24 ship close-up

Umm.. guys.. wouldn't it have been easier to mirror-flipped the image of the boat before trying to stick your pixellated logo onto it?

(Thanks to Naked Security reader @tug who has identified the ship as the "Aquiline", and found the original image which does not have the distinctive TNS24 branding.)

TNS24 testimoniesThe TNS24 website publishes testimonies from happy, smiling customers - but our suspicion is that these are just as bogus as the photographs used to describe TNS24's staff and vehicles.

If you know where these photos of happy smiling customers come from, please let us know by leaving a comment below. (Of course, if you *are* a happy customer of the TNS24 website, we would love to hear about that too).

And when we tried to contact TNS24 by telephone, using the number they list on their website, all we got was an unobtainable message.

If you needed any more reason to be wary of using TNS24's services (especially if a stranger on Facebook has tried to trick you into believing that you're safe to wire them money via Western Union in order to have TNS24 deliver something) then ask yourself this:

"TNS24's website claims that the firm is headquartered in the UK - specifically in Chatteris, Cambridgeshire. So what does the domain registration for its TNS24.com website say?"

Surprisingly, it's registered at a Nigerian address:

Domain Name: TNS24.COM

Registrant:
Xtrim Technologies
Iheanyi Orji (webmaster@techtrendsng.com)
2 ago palace way
okota
lagos,23401
NG
Tel. +234.08085785120

Mr Orji may have nothing at all to do with TNS24, of course. But it's certainly odd that a UK firm that uses the slogan the "courier company you can trust" would have its website registered to an address in Lagos.

Take care folks. And look out for Photoshop disasters by scammers and fraudsters.

, , , , , ,

You might like

33 Responses to TNS24 - a fake courier company website, used by online scammers

  1. Robert Roessler · 615 days ago

    The text on the website is also a copy & pasty job: http://www.worldtradewt100.com/articles/apl-logis...

  2. Yip Man · 615 days ago

    Third pic in the testimonial is from here - http://en.wikipedia.org/wiki/Yip_Man.

    Considering that Yip Man (Bruce Lee's mentor) died in 1972 either TNS24 has been around for more than 40 years or Yip Man is living under an assumed identity, Matthew Roland, somewhere in the US :-)

  3. Alex B · 615 days ago

    I don't mean to be cruel, but this is so obviously a scam.
    Why are people still falling for these?

    • tbdud · 614 days ago

      You'd be surprised at how many people still fall for this stuff - and argue with our Security Operations Center that the UPS or airline ticket was fake - that they really need to find out the details about the package or ticket!

      • Alex B · 614 days ago

        I'm minded to just let Darwinianism take it's course on these sort of scams. If people really are so careless as to not check out businesses before sending money to them, then just let them learn the hard way.
        There's only so many times you can tell people to stop being so stupid.

  4. the JoshMeister · 615 days ago

    The first testimonial photo of "Michelle Amber, USA" is actually a stock photograph from iStock Photo titled "Happy Woman":
    http://www.istockphoto.com/stock-photo-7284483-ha...

    The second testimonial photo of "Bruce Adams, UK" is actually a portrait of Kenny Luck, a pastor from California:
    https://encrypted.google.com/search?tbm=isch&...

    Mr. Luck is on Twitter (@Kenny_Luck), so I'll point out this article to him. =)

    I found both of these through Google Image searches (you can upload a photo and have it find similar ones for you): https://encrypted.google.com/imghp

    Google couldn't find the original of "Chung Jung, China," the fourth testimonial person.

  5. Hi - the photo after the plane & before the ship refers to their 'Outstading coverage'!

  6. Thaf jet 'photo' is, I believe. one of Ryanair's 737-400s.

  7. claire · 615 days ago

    i cant get over the fact this person handed over so much money just for a package they knew nothing about??? wth!!!...get a grip love....................

  8. Sorry but.... A fool and his money are soon parted. It doesn't take a rocket scientist to know that when someone asks for money, it's gone, simple as that. The fact that anyone would give up their money to total strangers, is just unbelievable, don't matter what story they give.

  9. The airplane shopjob isn't very good, but it's easily the best of the lot, being the only one they bothered to distort at all. If these guys are serious about this scam, they should invest in someone who actually knows how to use photoshop. They'd fool a lot more people and make back their investment pretty quickly. Though I suppose it's better for the rest of us that they don't :P

  10. Orayza · 615 days ago

    boat is from here: http://www.simplonpc.co.uk/Dart_9.html

    last part

  11. JayCG · 615 days ago

    I don't know about you, but I'd gladly pay extra for my parcel to have a window seat.

  12. James · 615 days ago

    so i did some Google image searching and found some fun stuff about the above images. the truck, package guy and the jet look like stock photos. but the funny part is that package one looks to be a photo of a bridge photo shopped with the guy holding the box over it.
    Here is the site they got the photo form. notice the odd line in the guys face and the nasty smug on his shirt this is why. http://www.shutterstock.com/pic-18830602/stock-ph...

    Bridge photo link http://www.sxc.hu/photo/1350768

    Search of truck photo https://www.google.com/search?hl=en&safe=off&...

    Search of the plane photo https://www.google.com/search?tbs=sbi:AMhZZitlqSE...

  13. Ron · 615 days ago

    I live in Chatteris it's a small market town definitely no massive shipping companys here.

  14. oleg · 615 days ago

    Why the scam site is still running ?

  15. mcg42ray · 615 days ago

    Another clue: Real cargo airplanes don't have windows.

  16. Deeban Maniam · 614 days ago

    Another one by Mr. Orji... http://spd27.com/

    Similar looking website with different logo yet same Yip Man... :P

    • Alex B · 614 days ago

      I quite like their tag line in the second scrolling image "Outstading Coverage".

      Obviously a lot of time spent getting this just right.

  17. Mick · 614 days ago

    I notice that the second image on their website boasts 'outstading coverage', and their address has two post codes!

  18. FWIW The aircraft is one from the Ryanair fleet.

  19. Richard C · 614 days ago

    On The contact us page it gives 2 postcodes
    PE16 6TY :- Tudor Rose Industrial Estate,short Nightlayers Drove, Chatteris, Cambridgeshire, http://www.192.com/places/pe/pe16-6/pe16-6ty/
    There are 4 courier companies at this post code none are TNS244
    PE16 6RE:- Dock Road, Chatteris, Cambridgeshire http://www.192.com/places/pe/pe16-6/pe16-6re/
    Is a residual road, there is no Dock Road Industrial Estate, but Dock road dose lead to Tudor Rose Industrial Estate as above ...
    the phone number 44 (0) 70457 23440 is a 070 numbers are personal numbers and can cost up to £1.50 per minute. It allows you to forward calls from this number to any number you wish. So if the number it is forwarding to is not unobtainable you are still charged.

  20. Iang · 614 days ago

    No registration number on the aircraft either, the logo is where it would be. It looks like a Ryanair 737-800 image that has be altered.

    • mike · 612 days ago

      And the tail number isn't the only thing that's been shopped out - did anyone notice that the windows between the wingbox and Section 41 were pretty far out of alignment? And the rear is pretty out of whack - it looks like the cheatline extends beyond the rear of the bird...

  21. Dang, I missed all the fun ... the website appears to be offline now.

    • the JoshMeister · 611 days ago

      I reported the domain to the registrar on 15 November 2012 and provided a link to this article. The registrar's abuse team replied on 17 November at 0013 UTC to notify me that they had suspended the domain:

      "Thank you for bringing this to our notice. We have reviewed your complaint and pursuant to our terms of service, we have suspended the domain name tns24[dot]com due to its involvement in fraudulent activities."

      I just now reported spd27[dot]com (thanks to Deeban Maniam for mentioning this related domain in the comments). That's the trouble with scam and phishing sites; whenever one gets taken down, another one pops up quickly to take its place.

      If anyone else finds any fake-courier domains that are registered through Public Domain Registry, please report the domains at http://resources.publicdomainregistry.com/report-... and they should hopefully get taken down within a couple days. (Check to make sure it's the same registrar; the scammer may switch to another registrar if his sites keep getting taken down.)

  22. MG101 · 613 days ago

    OMG SPD27 Their "other fake delivery site" is using the exact same images of the plane and the delivery guy and the truck but they just changed the TNS24 to SPD27 wow thats lame as.. plus cargo planes do not have windows like that. I'm wondering what these names TNS24 & SPD27 or the letter arrangement plus numbers means to the hackers because the numbers only gone up by 2 digits I dont quite get the letters though.. Any ideas any1?

  23. Tim Boswell · 611 days ago

    oh dear Graham, you appear to have been busted trying to bring down a poor honest international shipping company!

  24. Want to know if the above Web site is real? Apparently situated in austin texas

    Thanks

  25. Myna · 490 days ago

    I was a victim too..the courier company name is Fast Worldwide Diplomatic Courier Service London..

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.