Office Depot and Support.com, Inc, a tech support software provided from California, agreed to pay $25 million and $10 million respectively for allegedly tricking their customers into paying for millions of US dollars worth of computer repair services using fake malware scans.
According to a press release issued today by the U.S. Federal Trade Commission (FTC), the agency will use the money received after the two settlements are paid to provide refunds to customers that were impacted by the allegedly deceptive tech support offered by Office Depot and Support.com.
“Consumers have a hard enough time protecting their computers from malware, viruses, and other threats,” said FTC Chairman Joe Simons. “This case should send a strong message to companies that they will face stiff consequences if they use deception to trick consumers into buying costly services they may not need.”
In the complaint [PDF], the FTC said that Support.com in cooperation with Office Depot allegedly sold costly computer repair services to customers using PC Health Check to persuade clients to pay for tech support services “from Office Depot and OfficeMax, Inc., which merged in 2013.”
From at least 2009 to November 2016, Office Depot, Inc. (“Office Depot”), its subsidiary OfficeMax, Inc. (“OfficeMax”) (collectively, “Office Depot Companies”), and its tech-support services vendor throughout this time period, Support.com, Inc. (“Support.com”), made misrepresentations to consumers regarding the security of their computers. Support.com provided the Office Depot Companies with the “PC Health Check Program,” a software program designed as a sales tool to convince consumers to purchase diagnostic and repair services.
As reported by BleepingComputer back in 2016, a whistleblower told KIRO 7 reporters that Office Depot employees were forced at the time by internal procedures to use the PC Health Check PC diagnostics software to show, in most cases, a malware infection on the user’s PC.
Afterward, Office Depot’s employees would then offer to repair the “affected” computers through a procedure that would usually incur extra charges.
KIRO 7’s reporters took new computers to both Washington and Oregon Office Depot stores where four of the six laptops were found to be infected with malware and the employees offered to clean them for extra payment.
The reporters subsequently took the six computers to the IOActive security firm from Seattle to confirm the Office Depot malware results but no traces of malware were found.
FTC says in a blog post detailing this issue that “Many consumers who got false scan results bought computer diagnostic and repair services from Office Depot and OfficeMax that cost up to $300. Suppport.com completed the services and got a cut of each purchase.”
“For example, one OfficeMax employee complained to corporate management in 2012, saying ‘I cannot justify lying to a customer or being TRICKED into lying to them for our store to make a few extra dollars’,” says the FTC press release.
Also, “Despite this and other internal warnings, Office Depot continued until late 2016 to advertise and use the PC Health Check program and pushed its store managers and employees to generate sales from the program, according to the complaint.”
FTC’s investigation and the settlement could very well be a direct cause of a letter sent to the FTC Chairwoman Edith Ramirez by Senator Maria Cantwell’s office on November 18, 2016, asking the agency to investigate Office Depot’s alleged practices of misleading their clients into buying unneeded computer repair packages.
As a reminder: A phishing attack is when an attacker sends you an email that contains a link to a malicious website. You click on the link because it appears to be trusted. Merely visiting the website may infect your computer or you may be tricked into signing into the malicious site with credentials from a site you trust. The attacker then has access to your username, password and any other sensitive information they can trick you into providing.
