Written Jun 30, 2016

This morning I woke up to a post on Reddit by /u/gzegozas accusing TotalVPN of creating a fake testimonial using the unlikely mashup of Joost van der Ree’s picture (an UBER Designer and fairly public figure) and Mr Bean’s actor’s name (R Atkinson).

As a mod on /r/vpn, I wanted to verify that the photo was indeed one of Joost, which the OP provided a google image search link to. I approved the post and flaired it as “Verified”, but decided to do a little further digging.

I started a live chat session using the tool on TotalVPN’s website, which went something like this (note that time stamps are only given for the first message in a block, so subsequent messages are not stamped and don’t properly reflect the passage of time for follow-up comments):

Hi , thank you for contacting Chat Support, you are speaking with James [redacted]. How can I help you today? 6:34 ——————– TOPG: Hi James I wanted to ask you about a testimonial that I believe is fake reddit.com/r/VPN/comments/4qkn1e/totalvpn_fakes_testimonial_using_photo_of_uber In which you use a photo of someone famous with a different name. 6:34 ——————– James: I didn’t get you.Will you please elaborate? 6:35 ——————– TOPG: Sure. TotalVPN has a testimonial seen here screenshot.net/d0165fr That uses the photo of UBER Designer Joost van der Ree 6:37 ——————– James: Yes 6:37 ——————– TOPG: But you changed the name, leading me to believe its a fake testimonial. Why did you decide to do that? Hello? 6:38 ——————– James: Please allow me a moment while I look over your request. 6:40 ——————– TOPG: Thanks Its been about 5 minutes, just checking back. 6:40 ——————– James: I am sorry but I cannot help you with this. 6:45 ——————– TOPG: Who can? 6:46 ——————– James: You can email on the email address on our website. 6:46 ——————– TOPG: Thanks I’ll do that then Can you confirm that address please? 6:46 ——————– James: Which address you can see? 6:48 ——————– TOPG: I don’t see any, and when I click “open a ticket to email” it redirects to live chat 6:48 ——————– James: If you have any technical support related query you can get help at support@totalvpn.com 6:49 ——————– TOPG: Would you consider this a tech support question? 6:49 ——————– James: No. 6:49 ——————– TOPG: Can you give me an email address for someone relevant to my question then please? 6:50 ——————– James: There is no email address which can help you on such queries. 6:50 ——————– TOPG: I’m sure there must be. Just so you’re aware, this chat log will be posted in that thread. I’ll ask once more. Can you please provide an email address to someone who can help me? Can I please speak to a manager? 6:51 ——————– James: legal@totalvpn.com 6:56 ——————– TOPG: How quickly should I expect a response? 6:56 ——————– James: I cannot say that. 7:04 ——————– TOPG: Can I speak with a manager then? 7:04 ——————– James: May I know why? 7:05 ——————– TOPG: To ask for details regarding my question. May I please speak with a manager? 7:06 ——————– James: There is no ETA but it will be answered the earliest. 7:07 ——————– TOPG: I’m still asking to speak with a manager please. 7:07 ——————– James: Manager is not available on chat. 7:09 ——————– TOPG: Can I call them? How are they available? 7:09 ——————– James: Please mail on the email address I provided you. 7:10 ——————– TOPG: That appears to direct to your legal team, I’d like to speak with a support manager. I want to give them the chance to comment so they don’t have to let the internet theorize that long without a comment. This is giving you the benefit of the doubt. I think they will want to give me a quote or something at least so that I don’t go back to that thread and tell them you were being uncooperative. That will surely make things look worse. 7:10 ——————– James: Please let me check what happens. 7:21 ——————– TOPG: What do you mean? Are you looking for a manager? Or do you want me to share what I’ve learned and you want to see what happens as a result. Not sure which you mean. 7:22 ——————– James: I am looking for the best solution to give you at the moment . 7:24 ——————– TOPG: Thanks, standing by 7:29 ——————– James: My apologies, this is taking longer than expected. Your patience is appreciated. 7:29 ——————– TOPG: Still here. 7:36 ——————– James: Let me get that information for you. Meanwhile, I appreciate your patience. 7:37 ——————– TOPG: Still here It’s been over 10 minutes since I heard anything. Do you have a comment for me? Its been about 20 minutes, are you still with me? 7:47 ——————– James: That site is designed externally. We weren’t aware of it 7:58 ——————– TOPG: By who? 7:59 ——————– James: We aren’t aware of it. 7:59 ——————– TOPG: And did an external site also collect the testimonial? 7:59 ——————– James: We aren’t aware of it. We don’t know we’ll have to check. We’ll get this rectified ASAP 7:59 ——————– TOPG: I’d like to know about where the testimonial came from 8:02 ——————– James: I already told you that “We aren’t aware of it.” 8:02 ——————– TOPG: What I’m asking though, is who collects testimonials? It seems odd that a site design firm would have gotten it. It seems like it would have been provided by your company and implemented into the site by your designer. Unless maybe they made it up? So I’m asking who the designer is so I can reach out to them 8:03 ——————– James: I don’t have that information. 8:06 ——————– TOPG: Can I talk to your manager then? 8:07 ——————– James: This chat line is for technical support or billing support. 8:07 ——————– TOPG: I’ve asked for an email address, but you gave me a tech support one (which doesn’t apply) and a legal one, which I’m sure also won’t know the answer. 8:07 ——————– James: I provided you with the email address legal@totalvpn.com 8:08 ——————– TOPG: I just want to confirm, you’re refusing to let me speak to a manager, is that correct? Its not probable that your legal team will know the answer to my question regarding your site designer and as I’m nearing two hours on live chat, I’d prefer getting to the root of this. If you can’t provide me with a manager (which a support employee should be able to do in almost any infustry) I will be reporting back as much. 8:08 ——————– James: We’ll get it fixed. 8:13 ——————– TOPG: I believe you will. However that isn’t my question or concern. I’d like to find out more information about how it happened And for the final time before I report that support was uncooperative, I’d like to speak to a manager now please. 8:14 ——————– James: Should I provide you with the numbers of our billing team? You will be talking with our manager on those numbers. 8:18 ——————– TOPG: Why can’t I talk to them now. This live chat is for billing and tech as you said. 8:21 ——————– James: He is available on the phone.If you want to talk to him you need to call the phone numbers. 8:21 ——————– TOPG: I’d like to document the conversation. Do you have an email address? 8:22 ——————– James: Its a billing and tech support chat.So if you want to talk to our manager have the numbers. 8:22 ——————– TOPG: Go ahead and give me the number then. 8:23 ——————– James: Are you calling immediately? 8:24 ——————– TOPG: Yes, while you’re on chat 8:24 ——————– James: Sure. Please proceed towards the call. Here are the numbers US/Canada: 1-888-883-7088 UK: 0333-370-6112 EU: 0044-333-370-6112 AU: 1-800-815-762 International: 001-888-883-7088 8:24 ——————– James [redacted] left the chat session 8:27

As you can see James left only 3 minutes after providing me with the number, even though I told him I’d be calling with him still in the chat.

The phone call itself went something like this:

Support: (In heavy accent) Thank you for calling TotalVPN ——————– TOPG: I spoke with live chat who said you’d be able to help me, are you the manager there? ——————– Support: Yes, I’m a senior executive at TotalVPN ——————– TOPG: Good (explains situation, gives link, provides evidence) ——————– Support: Everything on our website is authentic. ——————– TOPG: (Explains that this is impossible given the name and photo don’t match, that it’s Joost van der Ree, etc) ——————– Support: I can’t help you, I’m just a billing support tech.

“TotalVPN” is one VPN operated by its parent company, “PSEUDiO Ltd” which also operates “Incognito VPN” and “SaferWeb VPN”.

I did a little more digging and found an info page on PSEUDiO Ltd by bizdb.co.uk

The last line in the description, caught my interest: “At least one secretary in this firm is a limited company: Gibson Whitter Secretaries Limited.”

So, I looked up Gibson Whitter Secretaries Limited. This search returned another business info page for two companies called JDI Backup Limited and Just Develop it Limited – where… Gibson Whitter Secretaries Limited (the company, not the person) was also a “Company secretary”. As near as I can tell, it’s a dummy Ltd set up to be an “employee” of both PSEUDiO and JDI. JDI… where have I seen that?

And the address for JDI? The same as PSEUDiO:

So, a testimonial by someone who doesn’t exist, with a ripped off photo of a fairly well known Designer, who “works” at a company owned by the parent company at the same location as the company they’re giving a testimonial for. Ladies and gentlemen, THIS is why I’m doing this project. Between the testimonial and the level of “professionalism” when asked for a comment, I think it’s safe to say that something is indeed wrong with far too many companies in this industry. I can’t stand to see companies doing shady things and getting away with it and hopefully with your help, we can send the message that this garbage will not be tolerated and will be exposed for all to see. Spread the word, and if you, like me, believe your VPN should be trustworthy – I would highly recommend staying away from TotalVPN, Incognito VPN, and SaferWeb VPN.

Update (7-1-2016): Some additional commentary on the purpose of this exercise here.

If you like the project and find my work useful, please consider donating – your generous contributions help pay for the hosting, tools, and time I need to do my research and keep the data fresh.