"TPPCO" PPI SMS spam

Despite some high-profile recent cases where SMS spammers have been busted by the ICO, the wave of spam seems to be continuing. This one came less than an hour ago from +447729938098.

Unsure if you qualify for a refund of PPI paid on a loan or credit card? Reply PPI and we will run a no obligation check or reply STOP to opt out. TPPCO

I have no idea who "TPPCO" are, but they are a common sender of these spam message. In this case, the spam was sent to a number that is TPS registered, and I believe that the approach is fraudulent in any case - in most cases the spammers will get paid for a lead even if it turns out that the claimant wasn't eligible.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Carriers and the ICO are cracking down on these scumbags, but they need reports from victims to gather enough evidence.

You can also report persistent spam like this via the ICO's page on the subject, which might well end up in the spammers getting a massive fine.

"Unsure if you qualify for a refund of PPI paid on a loan or credit card?" SMS spam

This scumbag scammers are still at it, pumping away lead generation spam to persuade people to make PPI claims to which they are not entitled.

Unsure if you qualify for a refund of PPI paid on a loan or credit card? Reply PPI and we will run a no obligation check or reply STOP to opt out. TPPCO

In this case the scammers used the contact number +447743623103 but they burn through dozens of SIM cards every day with their illegal spamming operations.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

You can also report persistent spam like this via the ICO's page on the subject.  With any luck these spammers will end up on the receiving end of a massive fine.

0844 number scam (08445715179)

This is a particularly insidious scam that relies on mobile phone users in the UK not knowing that an 0844 number is much, much more expensive than a normal phone call. The scam SMS goes something like this:

ATTENTION! We have tried to contact you, It is important we speak to you today. Please call 08445715179 quoting your reference 121190. Thank You.

In this case the sender's number was +447453215347 (owned by Virgin Media Wholesale Ltd, but operated by a third party). The catch is that the calls to an 0844 number can cost up to 40p per minute (see more details here), a large chunk of which goes into the operator's pockets. So what happens when you ring back? You get put on hold.. and left on hold until you have racked up a significant bill.

Sadly, I don't know who is behind this scam, and in this case it was illegally sent to a TPS-registered number.
If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints. You should also send a complaint to the ICO who may be able to take more serious action against these spammers.

Gary McNeish, Christopher Niebel fined £440k for SMS spams

I've covered Gary McNeish and his SMS spamming outfit before, they are quite possibly behind the majority of financial SMS spam messages that have been doing the rounds lately.

Well, it seems the ICO finally caught up with him and his business partner Christopher Niebel and have hit the pair with a whopping £440,000. The Daily Telegraph reports that they were pumping out up to 840,000 spam SMS messages per day. The BBC has more details about the pair.

It looks like Mr Neibel has suffered the bulk of the fine, with £300,000 ordered to be paid by the ICO. Mr McNeish lives in Thailand (but owns the spamming company Tetrus Telecom) and has been fined £140,000. Mr Neibel seems a bit upset by this according to reports. Tough shit, I say.

Anyway, this is the guy who probably won't be coming back to the UK any time soon..

Check out some of his semi-naked photos here. Classy!

SMS Spam: "Records passed to us show you're entitled to a refund approximately £2130"

More SMS spam from.. well, I think the ICO will shortly reveal who. It's not just a spam, but it's also a scam because the spammers are attempting to persuade you to make fraudulent claims. Not everyone is eligible for a PPI refund, and I'm certainly not.. no "records" exist, it's just a scammy sales pitch. Avoid.

Records passed to us show you're entitled to a refund approximately £2130 in compensation from mis-selling of PPI on your credit card or loan.Reply INFO or stop

In this case, the sender's number is +447585858897, although it will change as it gets blocked by the networks.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

ppinomore.com PPI SMS spam

These PPI spammers are at it again, this time promoting a website ppinomore.com.

URGENT you are owed £3350 for the PPI you took out, time is running out to claim, please visit www.ppinomore.com to claim, thank you. To opt out reply STOP.

The sending number is +447787446160 although this will change at they get blocked for spamming. If you have any more numbers, then please considered adding them in the Comments section.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

The thing with these spam PPI messages is that they are also a scam. I don't have any mis-sold PPI, so I'm not eligible for anything, but it seems that the spammers are encouraging you to make a fraudulent claim, which is a criminal offence.

So who is behind ppinomore.com? It has anonymous WHOIS details so no clue there. They claim their address is in Pakistan:
PPI-Today
586, Park Towers,
Block 26, P.E.C.H.S.,
Shahrah-e-Faisal,
Karachi

And they're not regulated by anyone..
ppinomore is a marketing agent. Our partners are regulated by the Ministry of Justice in respect of regulated claims management activities - their authorisation number is available on request and their registration is recorded on the Ministry of Justice website 

So who are their partners. Of note, the ppinomore.com site is hosted on 217.23.12.215 which is hosted by Worldstream in the Netherlands, but actually allocated to a scam/spam friendly outfit called YoHost . The following sites are on the same server:

antismsspam.com
birthdaywishlist.net
buyfacebookfriends.info
claimsdirects.com
cpamatch.net
downloads4.biz
easyexplorer.net
englandinsolvency.com
filewizard.net
flywith.org
glasgowtrustdeeds.com
guystube.net
homeworkers.tv
ineedajob.tv
jizzin.me
kimdotcom.biz
liquidationadvice.info
megahost.tv
memorysticks.tv
monstercv.tv
mortgagecharges.info
myppi.org
numbergenerator.info
phoneapps.tv
ppinomore.com
ppinow.org
prepaidcards.tv
protectedtrustdeeds.tv
referafriend.info
rofl.hk
scotlandtrustdeeds.info
scottishdebtinfo.com
scottishtrustdeed.info
smsoptout.com
streamingloads.com
surveymonster.info
textforgold.com
transfermypension.info
txtforloans.com
whatsbetterapp.com
yadoo.tv

Some of these look quite interesting.. they're also using SMS and PPI themed sites. Almost all the sites have anonymous WHOIS details.. apart from myppi.org that is..

Domain ID:D166396094-LROR
Domain Name:MYPPI.ORG
Created On:21-Aug-2012 10:52:54 UTC
Last Updated On:21-Aug-2012 10:52:55 UTC
Expiration Date:21-Aug-2013 10:52:54 UTC
Sponsoring Registrar:GoDaddy.com, LLC (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:CR122029936
Registrant Name:john mcneish
Registrant Organization:surveycentre
Registrant Street1:flat 3 11a whitworth street
Registrant Street2:opal house
Registrant Street3:
Registrant City:manchester
Registrant State/Province:lancashire
Registrant Postal Code:m1 3gw
Registrant Country:GB
Registrant Phone:+1.614083744
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:gary@tetr.us
Admin ID:CR122029938
Admin Name:john mcneish
Admin Organization:surveycentre
Admin Street1:flat 3 11a whitworth street
Admin Street2:opal house
Admin Street3:
Admin City:manchester
Admin State/Province:lancashire
Admin Postal Code:m1 3gw
Admin Country:GB
Admin Phone:+1.614083744
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:gary@tetr.us
Tech ID:CR122029937
Tech Name:john mcneish
Tech Organization:surveycentre
Tech Street1:flat 3 11a whitworth street
Tech Street2:opal house
Tech Street3:
Tech City:manchester
Tech State/Province:lancashire
Tech Postal Code:m1 3gw
Tech Country:GB
Tech Phone:+1.614083744
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:gary@tetr.us
Name Server:NS19.DOMAINCONTROL.COM
Name Server:NS20.DOMAINCONTROL.COM

John McNeish? So why is his email address gary@tetr.us then? Probably because this is really Gary McNeish who has been involved in offshore SMS spamming before.

So, is Gary McNeish responsible for the ppinomore.com SMS spam? It could just be a coincidence that a server stuffed with dodgy finance and marketing sites contains both a site belonging to Gary McNeish and these ppinomore.com scammers, after all there's no indication that this is actually Gary McNeish's server, just that he has a site on it.

Still, hopefully the recently announced ICO crackdown on SMS spammers might have a positive effect.

Update:
Here is another link between ppinomore.com and Gary McNeish's myppi.org - if you search for the text "ppinomore is a marketing agent. Our partners are regulated by the Ministry of Justice" on Google, it also appears on myppi.org:

Funnily enough, the content for myppi.org has changed to some search engine called "Yadoo" since it was indexed by Google. It must just be a coincidence that the ppinomore text appeared on Mr McNeish's site, yes?

The following numbers also seem to be in use for this spam:
+447867368703
+447780458447 

Please add any more in the comments, thanks!

SMS Spam: "Hi, we think you may be entitled to compensation.."

These annoying spammers (and probably scammers) are back, sending out their scummy PPI spam messages from +447568105443

Hi, we think you may be entitled to compensation of up to £3500 from missold PPI on a credit card or loan.
Reply INFO for more info
Reply STOP to quit

I've never been mis-sold PPI, so this is obviously a generic spam. It also looks like an invitation to make a claim even if you're not eligible. And that would be fraud..

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

"Records passed to us show you're entitled to a refund.." SMS Spam (again)

These spammers are at it again:

Records passed to us show you're entitled to a refund approximately £2560 in compensation from mis-selling of PPI on your credit card or loan.Reply INFO or stop

The sending number is +447876628983 (although they will change this). Bearing in mind that I have never been mis-sold PPI, I can pretty much disregard this as a scam. Except, rather more seriously the implication is that the spammers are prepared to submit a fraudulent refund claim on your behalf, which is something rather more serious.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

"Hi, we think you may be entitled to compensation.." SMS spam

The PPI claim spammers are back again, this time using the throwaway number of +447969662555

Hi, we think you may be entitled to compensation of up to £3500 from missold PPI on a credit card or loan.
Reply PPI for more info
Reply STOP to opt out

Obviously they think nothing of the sort and are just randomly spamming, even to mobile phone numbers registered with TPS. Given that their pitch is based on a lie, it's likely that the whole outfit it some sort of scam in any case.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

Isn't it amazing..

Isn't it amazing how everything sometimes comes together. I came across this particularly well researched article at a blog called Cultivated Drivel.

Sometimes people make those connections that you should have seen your case. In this case, the post managed to link together several strands of my own blog that I hadn't managed to do myself.. namely: Inter Financial Ltd, Gary NcNeish and Piradius.net

It looks like Mr McNeish might have his fingers in quite a few spam pies..

SMS Spam: "We have been trying to contact you regards your recent accident"

These scumbag SMS spammers are at it again:

URGENT: We have been trying to contact you regards your recent accident; you could be due up to £5,100 in compensation. Reply CLAIM for info, STOP to opt out.

In this case, the sender's number is +447788313443 but this will change as the networks block it.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

txt4aloan.co.uk SMS spam / Sellers Griffin Ltd

I hate SMS Spam.. this one is particularly annoying.

Loan update: Brand new lender, up to £1000 instant approval all online. No Fees. www.txt4aloan.co.uk Cash within 15 mins. Any credit ok. To opt out reply stop.

In this case the sender was +447867397593 although this will probably change when the number gets blocked by the networks.

So who are txt4aloan.co.uk? Well, that's actually a bit unclear because their website claims that they are Sellers Griffin Ltd, and a quick check at Companies House reveals that there is indeed such a firm at the address they claim:

SELLERS GRIFFIN LIMITED
PEEL HOUSE
30 THE DOWNS
ALTRINCHAM
CHESHIRE
WA14 2PX


Sellers Griffin Ltd appears to be owned by someone called Will King. Essentially, this is a lead generator company who think that SMS spam is an appropriate way to drum up business.

However, the WHOIS details for the txt4aloan.co.uk website are completely different:

Domain name:
        txt4aloan.co.uk

    Registrant:
        Inter Financial Ltd

    Registrant type:
        Unknown

    Registrant's address:
        Mont Crevelt House
        St Sampson
        Guernsey
        GY2 4LH
        United Kingdom

That's a completely different company from Sellers Griffin, again it really does exist (and it has its own website on inter-financial.co.uk). Why are there two unrelated entities? It beats us, but it certainly is odd.

Anyway.. a closer look at txt4aloan.co.uk shows just what kind of company they are. Right at the bottom of the page, you can see the interest rate that they charge:

Representative 1737% APR

No.. that's not 17.37%, that's one thousand, seven hundred and thirty-seven percent interest. No wonder they can afford to send out random SMS spam for that kind of money..

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

"URGENT: Your pension could be underperforming" SMS Spam

Arriving just minutes apart from this spam and probably related, these SMS spamming scumbags are back with another pitch:

URGENT: Your pension could be underperforming and could leave you with less then you thought on retirement, reply REVIEW for a free review now, STOP to opt out.

The sending number this time was +447895882070 although this will change as numbers get blocked.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

"Records passed to us show you're entitled to a refund.." SMS Spam

These scumbag SMS spammers again:

Records passed to us show you're entitled to a refund approximately £2560 in compensation from mis-selling of PPI on your credit card or loan.Reply INFO or stop

This is pure and simple spam, there are no "records" showing any such thing. In this case the spam came from +447790682898 although spammers often change their numbers.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

SMS Spam: "You could be entitled up to £4856 in compensation.."

I really hate these scumbags:

IMPORTANT - You could be entitled up to £4856 in compensation from mis-sold PPI on credit cards or loans. Please reply PPI for info or STOP to opt out. 

In this case, the sender's number is +447436261356 although this will change regularly to avoid detection.

If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

"You may be entitled to up to £3000 from mis-sold PPI" SMS Spam

I hadn't heard anything from these scummy SMS spammers recently, I assumed they had been busted in one of the recent crackdowns.

Urgent - You may be entitled to up to £3000 from mis-sold PPI on loans or credit cards. For a free no obligation check reply PPI or STOP to opt out

The sending number was +447866079549, although these spammers change their number more often than their underwear.

If you get one of these, you should forward the spam to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

SMS Spam: loanslineuk.co.uk / Gary McNeish

Here's an annoying SMS spam sent from +447979520064:

Short on Cash? Need a payday loan? 100% Apps Processed. Up to £750 today. Apply now at www.loanslineuk.co.uk to Opt Out Rply stop

We can easily identify the owner of loanslineuk.co.uk from their WHOIS records:

Domain name:
        loanslineuk.co.uk

    Registrant:
        gary mcneish

    Registrant type:
        Unknown

    Registrant's address:
        flat 3 11a whitworth street
        opal house
        manchester
        M1 3GW
        United Kingdom

loanslineuk.co.uk simply forwards to moneyfix.co.uk via an affiliate link: www.moneyfix.co.uk/Default.aspx?AID=TETRUS&SAID=MONEYFIX_JPD_PARTNER1

The word "TETRUS" in the link is a clue. We can also see Gary McNeish's address on the domain for tetr.us.. well, we could before it was re-registered to an address in the Seychelles:

Registrant ID:                               CR17598876
Registrant Name:                             gary mcneish
Registrant Address1:                         flat 3 11a whitworth street
Registrant Address2:                         opal house
Registrant City:                             manchester
Registrant State/Province:                   lancashire
Registrant Postal Code:                      m1 3gw
Registrant Country:                          United Kingdom
Registrant Country Code:                     UK
Registrant Phone Number:                     +7.799764944
Registrant Email:                            gary@tetrustelecoms.com
Registrant Application Purpose:              P1

If we look at the domain registration for tetrustelecoms.com we see the bogus address:

    tetrus, tetrus  serialsniper@gmail.com
    tetrus
    capital city, lancashire M35 0AE
    SC
    +66.838273350

There can't be many people called Gary McNeish in Manchester, but oddly enough it isn't the same Gary McNeish who was fingered for a fake Data Protection scam in 2002, but this Gary McNeish (Gary John Peter McNeish) was mentioned by the Daily Telegraph recently in an article called "For sale: your mobile phone number" which questioned the way that Mr McNeish obtained telephone numbers for leads.

According to Companies House, Tetrus Ltd was dissolved on 22/3/11, so it should no longer be trading.

If you get one of these, you should forward the spam to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

Added: The Slough Times has some more background information here.

SMS Spam: "Due to a new legislation, those struggling with debt .."

Some sort of debt management spam this time. You can bet that these people will probably charge a lot for their services, and dealing with spammers is usually a bad idea in any case.

Due to a new legislation, those struggling with debt can now apply to have it written off. For Free information reply INFO or to opt-out text stop. Free Text!

In this case, the spam originated from +447977237820 although these numbers change regularly.

If you get one of these, you should forward the spam to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.

There's a good article about protecting yourself from unscrupulous debt management companies here.

SMS Spam: "You have still not claimed the compensation you are due.."

These mystery ambulance-chasing SMS spammers are at it again:

You have still not claimed the compensation you are due for the accident you had. To claim then pls reply CLAIM. To opt out text STOP

In this case the spam comes from +44749353036, but the spammers rotate numbers regularly as they get blacklisted.

If you get one of these, forward the message to 7726 ("SPAM") on T-Mobile, O2, Orange or Three. If you are a Vodafone customer, forward it to 87726 ("VSPAM"). Your carrier should be able to block the spammer's number and with enough evidence may be able to take action against them.

Update: 3's spam reporting number is 37726 (3SPAM). Thanks for the tip, Richard!

SMS Spam: "URGENT! If you took out a Bank Loan prior to 2007.."

This SMS spam is probably from the same bunch of scumbags who brought you this long-running ambulance chasing spam.

URGENT! If you took out a Bank Loan prior to 2007 then you are almost certainly entitled to £2300 in compensation. To claim text 'YES'. Free to apply.

In this case the SMS came from +447591233963, but the spammers vary these all the time to avoid getting blocked.(Update 28/9 they are now using +447968780878 and +447968766208. Update 30/9 and now +44798044443)

Since they don't honour TPS opt-outs, then they are probably not to be trusted.. whoever they are.

If you get one of these, forward the message to 7226 ("SPAM") on T-Mobile, O2 or Orange.. If you are a Vodafone customer, forward it to 87726 ("VSPAM"), on Three the number is 37726 ("3SPAM") Your carrier should be able to block the spammer's number and with enough evidence may be able to take action against them.

If you see any other telephone numbers for this, please consider letting us known through a Comment.