CASE FILE 02 · SOLVED

Blue Magpie is Ho Chia-ying

A campaign planner at Langhua Marketing. She matched up two of BeatBird’s pilot files she had access to at work and sold the result to a scam ring.

What happened

On 25 November, Ho Chia-ying downloaded F-02 (the marketing list with names, emails and phone numbers) from the file-sharing system. On the 27th, through the share link Yunshan Data had made for Langhua, she also downloaded F-03 (the usage analytics with sleep data). Both files use the same user_hash, so joining them gives a list of who people are, how to reach them and how much they have been sleeping.

From 1 December the scam ring registered the sending domain kq3fz.idv.tw and three domains posing as BeatBird, and on 5 December the emails started going out. Chih-ning got hers on 7 December. She searched as told, clicked an ad and scanned the “verification” QR code, and her Ripple account was linked to the scammers’ computer.

How the scam works

• An email with no link: with no link, it slips past mail filters and seems “not like a scam”. It only tells you to search for support yourself.
• Paid ads: the top three “official support” results are all ads, using the brand as a subdomain (beatbird.app.member-care.com), extra words next to the brand (beatbird-help.app), and a Cyrillic е in place of e (bеatbird.app). All three domains were registered a few days before the emails went out.
• Real personal data: name, phone number, band model and hours of sleep. Real data makes people believe BeatBird sent it.
• The QR code: the “member verification” decodes to ripple://link-device, Ripple’s “link a new device”. Scanning it made the scammers’ computer part of Chih-ning’s account: they could read her new messages and ask her friends for money in her name.
• The sender: SPF and DKIM both pass, but for kq3fz.idv.tw itself. Authentication only proves the mail really came from that domain, not that the domain is BeatBird.

Ruling people out

The scam uses both names (F-02) and avg_sleep_30d (only in F-03), and only Ho Chia-ying and Chiang Po-yu downloaded both. Canary mailbox C-05 received the scam, and C-05 was planted only in download D-05: the F-02 that Ho Chia-ying downloaded.

Traps

• Chiang Po-yu: downloaded F-03 late at night from home, and someone on the forum says he has been asking about loans. He looks the most suspicious, but the canary in his copy of F-02, C-04, never received a scam email.
• The GoodDeals breach: Chih-ning’s main address really did leak in 2024, with her name and phone number. But the scam went to an alias she gave only to BeatBird, and that alias is not in the group-buying site’s list.
• The fake site’s form: when you check a fake site, look but never fill in or send anything. Even fake details tell them someone bit.

Next time you get an email like this

• A plan that is “now active” or “billed monthly”: open the app yourself, or call a number you already know, to check. Don’t search for the support the email points you to.
• Read the registered domain of every address. A brand in a subdomain, extra words next to it, or letters from another alphabet all make a different domain.
• Never scan a QR code someone sends you with a messaging app to “verify your identity”. Check “Linked devices” now and then, remove any you don’t recognise, and turn on two-step verification.
• Use a different email alias for each service, so when something leaks you can tell where it came from.
• If money has already gone, call 165 at once.

Further reading: What an ordinary person should actually do · Email aliases, and who you hand your trust to · anoni.net utilities