INDIANAPOLIS — A glimmer of hope turned into a nightmare for a local mom who thought she was applying for a rental assistance grant. Instead of receiving help, her child’s social security check was stolen. 13 Investigates uncovered the site was using the names, pictures and personal information of people who told 13News the site was using their information without permission.
"The pain that they just caused me, I wouldn't wish that on nobody," Vivian Collado said.
Tears streamed down the mother of three’s face as she remembered the moment, she realized the website was not really going to help her. 13 Investigates learned the site Collado visited claims to be the Aaron Family Foundation in California. 13News spoke with the people who run the actual Aaron Family Foundation that is registered with the IRS, and they told 13 Investigates they were shocked by what Collado found. They said they do not have a website and that the one Collado found is using their information without permission.
The website appears to be one of billions created to prey on people. Google reports it blocks 40 billion pages of spam and malicious content a day, but some still get through its defenses.
Applying for help
At the end of February, Collado applied for a grant on behalf of her 9-year-old son Tony, who has autism. She shared with 13News the conversation she had through a messaging app with a person associated with the website. The representative sent her a message that she was approved to receive $1,400. Collado told her contact the money was going to help her pay the rent, which was increasing by more than $100.
"I got excited like really they're helping people like us?" she said.
Collado thought it was a much-needed break. The single mom says money is always tight when caring for three kids with special needs. Things were even more strained this past year after the family’s apartment caught fire in May 2022.
Collado told 13 Investigates, her family desperately needed the money promised, but it never came. Instead, Collado discovered her son’s social security check was not deposited in her bank account in March as usual. The check was sent to a different account that Collado does not own. She filed a report with the Social Security Administration and provided documentation showing it considered her a “victim of fraud” and was investigating the matter.
When her son’s check didn’t show up Collado realized she gave the person from the website all the information someone would need to take the funds.
“I just feel so dumb,” she said. “I just wanted help. That's all I was asking for.”
She wonders how many other people were impacted. Collado explained that a fellow mom of a child with autism shared the link in an effort to pay it forward after being approved for a grant. That woman told 13 Investigates, she never got her money either. She trusted the website because it was recommended by a case manager at an Indianapolis mental health facility.
Even with the recommendation – Collado was skeptical.
"I'm not like a pro, but I even Googled, like the next day,” she said. “I'm like, ‘Is this real?’”
Cyber experts search for red flags
13 Investigates brought in two cybersecurity experts to review the site. At first glance both could see why Collado and others would believe it was legitimate.
They say it’s well designed, uses the “HTTPS” prefix to show the site is secure and there are no glaring spelling errors.
Isak Asare is the co-director of the Cybersecurity and Global Policy Program and executive director of Indiana University’s Cybersecurity Clinic.
He says scammers are getting smarter and realize most people are taught to look for a secure site and spelling errors.
“Spell checking your website is not that difficult,” he said.
It’s also easy to buy and design a secure site.
Misspellings are still a good indicator of something fraudulent, but a rookie mistake for a savvy fraudster. Asare says users should also read passages aloud. That’s one way he noticed some odd grammar on the website Collado shared.
Asare says when he considers the minor grammar issues along with several other issues, the problems become a larger warning.
"First red flag is that anything that you click on keeps you inside the website," Asare said while examining the site.
For example, the buttons for social media pages – like Facebook and Instagram – do not work. They loop users back to the contact page on the original website.
Asare says that is a technique likely used to keep users on the site to get them closer to applying for a grant and divulging important details like names, addresses, social security numbers and other personal information.
Ally Armeson with the Cybercrime Support Network pointed out the site's phone number was another clue that the user should ask additional questions. The number listed was from a different state than the address listed.
Also, it was not functional. Every time 13 Investigates called – the user was busy or temporarily unavailable. That could be one reason why a section of the website told applicants, “We do not accept phone calls for assistance.”
Collado missed those warnings, but did try to do her due diligence in checking out the website. First, she looked for news reports that the website was fraudulent. She also looked up the website and organization on scam tracker websites but did not find anything concerning.
Armeson recommends also looking for positive articles about a group. She explained to 13 Investigates the lack of positive news articles could be a sign something is amiss. She says that’s especially concerning here, because the website included logos of several companies it was allegedly working with like Bank of America. The major bank and other companies told 13 Investigates they had no affiliation with the website. Armeson says if they did, there would likely be a news article or press releases to show that association.
Collado also checked and confirmed the foundation had an EIN or employer identification number issued by the IRS. She also saw the IRS listed the foundation as a tax-exempt organization. Again, there is a real Aaron Family Foundation, but it does not have a website.
Armeson says Collado was on the right path but needed to dig deeper.
It is easy to check the IRS website and confirm if an organization is listed as a charity or nonprofit.
“That is an indicator that you need to look for, but it's not an absolute," Armeson said. "Unfortunately, scammers and cyber criminals can take advantage of the form that the IRS has. It's actually a simplified form, which is wonderful for people who are trying to initiate a smaller nonprofit. However, there's always consequences. Right now, scammers can easily start their own fake nonprofit and steal money.”
Just finding an organization listed does not mean the group has been vetted by the government.
Sometimes cyber criminals use the name and details from existing charities and nonprofits.
Tracking down the real foundation
13 Investigates found the Aaron Family Foundation that is approved by the IRS as a nonprofit. The website Collado searched used the foundation’s real address and even the real names of the people who run it.
Tax returns 13 Investigates reviewed show the foundation gave money to churches and other organizations but not to individuals. The website Collado used highlights that it provides help directly to people who are elderly or have special needs.
13 Investigates found the real Aaron family. Two family members said they first learned of the website because we reached out. During phone conversations, they repeatedly emphasized that their foundation does not have a website, and the one 13News brought to their attention is fake.
They were alarmed to realize the website was using not only the foundation name but also the real names of family members. The pictures next to those names are not the actual people.
The website in question has several pictures of people who are supposed to be executives.
13 Investigates used reverse image searches to discover the real identities of most of the people shown.
Nearly all of them work for a cancer institute. The reverse image search found their real names and jobs posted on the institute’s website. 13 Investigates spoke with the organization to confirm the identities and that none of the people are associated with an Aaron Family Foundation.
"Obviously a very big indicator red flag, right?” Armeson said. “They're stealing people's pictures and putting them up as partners.”
The man Collado thought she was working with was listed as David J. Halminton. The picture attached to that name on the website belonged to a man who works at a university in Washington, D.C. After 13 Investigates spoke to him, he says he contacted the site. A short time later, his picture was removed.
Now, a different man’s picture appears above David J Halminton’s name.
Business affiliation questions
The website Collado used displayed the logos of several companies, like Bank of America and First Republic. The site did not say exactly what the connection was between the foundation and the companies.
13 Investigates reached out to the businesses about their logos appearing on the site. Some reported they were ready to take legal action if the logos were not removed.
A short time later, all of those logos disappeared from the website.
Taking responsibility
Asare thinks too much of the responsibility for vetting websites is placed on average people.
“It is not Vivian's fault that this website exits," Asare said. “But we're acting like it is. It's her responsibility to protect herself against this type of a scam. And as a consequence, to protect her network from this type of a scam. I think that's nonsense."
Asare thinks it’s time lawmakers consider legislation that would require more verification from the government and businesses like web providers, hosts and search engines.
“Then we'll see some changes,” he said.
"You best believe that if Google could be held accountable for this site showing up in their search, they would find a way to solve it too,” Asare said.
13 Investigates did reach out to Google. The website Collado used appears to violate the company’s content and spam policies. Those policies do not allow deceptive practices or scam and fraud.
The website shows up as a top result in some Google searches.
Google says it doesn’t comment on specific sites, and the company told 13 Investigates Google does not shut down websites. It can block them. Google sent a statement.
“While scams are a significant threat to online safety across the web, we design our systems to help fight malicious content and keep people safe on Search. Our advanced spam fighting systems enable us to block 40 billion pages of spam and malicious content every day, which helps keep Search 99% spam free. While our systems are highly effective overall, they don’t catch everything, which is why we also offer helpful ways for you to get context about the sources of information you see on Google Search. By clicking on About This Result, the three dots next to your result, you can learn more about the sources and websites you see in Search. This added context enables you to make a more informed decision about whether you can trust the source before clicking the link.” - Google Spokesperson
The company did not answer 13 Investigates' question about how this particular website became a top search result.
Google does allow people to report websites for potential violations of company policies, but Google says it does not use those reports to take action against the site. Go to Google Search Central to find details about how to flag a website.
Our experts say Collado did the right thing by reporting the website to 13News as well as to the Social Security Administration and later to the Federal Trade Commission’s identity theft website.
“It feels like they're evil people to me,” she said. “How can you lie to somebody that you know that they're applying because they need help? Obviously, they need help.”
Last year, the FBI reported nearly 12,000 Hoosiers lost money to internet scams. Nationwide, Americans lost more than $27 billion over the last 5 years. You can also file a complaint with the FBI’s Internet Crime Complaint Center.
Be your own detective
13 Investigates uses reverse image searches as a tool to help identify whether a photo is fake or if the subject of a photo is really what someone claims.
A reverse image search is basically searching the internet using an image instead of using keywords. It can help determine when a photo first appeared online and the original source of the picture.
There are a number of tools available, and most search engines offer a reverse image search. 13 Investigates often uses Google’s search tool as well as TinEye and the RevEye browser extension.
If the results show many sites with the same photo, that could be a sign to take a closer look. The photo may have been stolen from a legitimate website or person.
In the summer of 2023, Google says it plans to add a new tool called “About this Image.” It will let viewers see easily when an image or similar images were first indexed by Google, where the image may have first appeared, and which sites have published it since.
Be aware that sometimes a search will return no results or incomplete results. It may be useful to run a search with several tools.
To search using the Google Chrome browser on a computer:
- Right click over an image.
- Select “Search Image with Google.”
- The right side of your screen will show results. You may need to click “Find Image Source” at the top of the screen to see a list of websites with similar images.
To search an image saved on your computer using Google Chrome:
- Go to images.google.com. Or go to google.com and click “Images” in the top right corner.
- Click the Lens icon (a dot with a camera outline around it)
- Upload your image file into the search box.
- Click search. You may need to click “Find Image Source” at the top of the screen to see a list of websites with similar images.
To search on a mobile device using Google Chrome:
- Google also provides guides about how to search using an iPhone or iPad or using an Android device.
- In general, you can search with a photo in a browser, a photo from your camera roll or a photo you take as you do the search.
- If you are using the Chrome browser, you can hold and press a photo to select “Search Image with Google.”
To search using TinEye:
TinEye is a website that allows you to search using the URL of an image or by uploading an image.
You can also add TinEye as an extension to the Google Chrome, Firefox, Edge and Opera search engines, which allows you to right click on an image and select “Search Image on TinEye.” TinEye also works on mobile devices.
The results typically display a date showing the first time the photo was identified on a particular website.
To search using RevEye:
RevEye is a browser extension you can install on Chrome. It allows you to right click on any online image and do a reverse search with any of several different services, including TinEye and Bing.