This morning I received the following text message on my phone:

FRM: VISA

MSG: VISA ALERT. Unusual Activity - Call now at 1-(623)398-0539

Since I receive SMS alerts from my bank regularly my first though was "holy crap, what's going on with my card?" I almost started dialing the number before I decided to google the number first. I don't normally take things at face value - if someone from my bank calls me I always verify their number or ask to call them back. But I'll get to that in a minute.

A secure call to the number began with a recorded voice telling me my credit card had been compromised. A robotic woman computer voice then came on and asked me to key in my credit card number. I entered a fake (but valid) Visa number at which point it asked for my pin, which I made up. The woman's voice said "thanks for attending to this matter" and hung up.

Pretty much the worst scam ever. I can't imagine too many people falling for it, and the fact that the system gives you no further information after entering your CC number is just going to make people curious and attract attention to them. Whoever is behind the scam is clearly an amateur.

A quick Google search for the number resulted in a whois page for benham.net. The phone number is listed as the contact number for Darren Banham, the guy who registered and runs the domain.

It should be noted up front that the fact that his number is on his domain doesn't necessarily mean he's behind the scam, but it does point a finger at him. His website appears to be down, meaning this could be some kind of elaborate hack or identity theft. His is number could have changed since he input his domain's whois info as well. However, this seems unlikely as the domain was last renewed only two months ago. Furthermore, given the amateurish nature of the scam, it would be no surprise to find out the scammer left his personal information in the first Google result for the number.

Occam's razor would suggest that Benham is behind the scam. Therefore, I'm going to post here on my blog everything I know about him as I continue my investigation.

Name: Darren Benham
Age: 40
Address: PO Box 605 Wickenburg AZ 85390 US
Address: 161 N. Madison St., Wickenburg, AZ 85390
Email: Darren@benham.net

Here are some snapshots of different versions of his website:

Circa July 2003

Circa May 2008

Now (May 2009) Raw SQL queries? Note that this is not some kind of error, this appears to be the actual text published to the page.

A lot of pages are still up at the ols.benham.net as seen here.

Interests:

Unix Administrator (There goes the 'he got hacked' theory)
Experience: Solaris, HPUX, AIX, OS/400, Linux, C/C++, Pascal, Basic, Cobol, Assembly, Perl, Python. (Capable of putting this scam together). Could he be using asterisk?
The Bible (I'll let that speak for itself)
Married
Father of nine, 3 of them step children. (Could one of his kids be the scammer?)

Other info:

Attended Clark, Ed HS in Las Vegas, NV (Grad. 1987)
Air Force Brat

That's all for now.

Update 1:

I have seen one other report of someone getting the same scam from a person with a number very close to mine. I received the text at 10:26am according to my phone and this person received the same text at the same time. It would appear it is a script running on numbers in sequential order. This probably means he doesn't have a phone book, but is just incrementing sets of phone numbers.

The text was sent via email. I'm going to try to figure out if I can find some headers or something.

Time to start working on his voicemail system.

Update 2:

The number appears to just be ringing endlessly now, no answer by the robot woman.

Update 3:

Contacted Benham via Myspace, waiting for response. Haven't pointed him at this blog post yet, but he might find it through my Myspace profile or if he has google alerts on his name.

Filed complaint with Arizona Attorney General Terry Goddard against Benham. Waiting for response.

Update 4:

I was contacted by the Crime Fraud and Victim Resource center for the Arizona State attorney general. The number has been reported to the Attorney General.

Benham has apparently not logged into his Myspace for some time, so it is unlikely he will get my message. If anyone finds alternate contact info, I will call or email him and find out what's up.

Update 5:

Multiple reports have come in to the Attorney General's office and they are now being forwarded to his local (Wickenburg) police department. I have contacted them directly as well. Will keep you posted on updates.

Many more reports coming in here.

More info on the phone number:

Type: Land Line
Provider: XO
Location: Phoenix, AZ

County: MARICOPA
Carrier: T-MOBILE USA, INC.
Phone Type: PHOENIX TEMPAZNR1MD
Rate Center: PHOENIX

Update 6:

Found a twitter page - actually updated recently. Apparently he just had a kid, so maybe he's been offline for a while. http://twitter.com/father0fnine

Correction: He didn't just have a kid, he is involved in the opening of a new ER somehow. It is looking less likely that he is involved in this scam.

Took a closer look at old.benham.net. Apparently he's having a rough time in this economy, and he's got a new baby to pay for to boot. Hmmmmm... Also, his family photos all consist of wolves. That's right, he was raised by wolves.

Update 7

Radio License:
Call Sign: KC7YAQ, Licensee ID: L00327807
Grant Date: 06/27/2008, Expiration Date: 06/27/2018
Registrant: Darren O Benham, 161 N. Madison St., Wickenburg, AZ 85390
Maybe someone could rouse him on the old ham radio?

(If anyone else has information about this, please contact me here or use the chat badge in the right sidebar of this site.)