When in doubt: hang up, look up, and call back

https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/

by todsacerdoti • 6 years ago

734 347 6 years ago

munificent• 6 years ago

But he said he still feels like a chump for not observing the golden rule: If someone calls saying they’re from your bank, just hang up and call them back — ideally using a phone number that came from the bank’s Web site or from the back of your payment card. As it happened, Mitch only followed half of that advice.

Banks could normalize this behavior by having their customer service reps ask customers to do this at the beginning of every call.

"Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."

jstarfish2• 6 years ago

That can still be gamed by any malicious SEO wizard. People will trust the top Google hit for "bank of america phone number" before they bother with finding it on the website.

karthikb2• 6 years ago

I’ve been asked to “call the number printed on the back of [my] card” which would be much harder to spoof.

vlovich123• 6 years ago

Should be solvable by making sure there's an easy, reliable, uniform way to get this info within the call.

"Hello. Please find the callback number on boa.com/contact. Please enter code XYZ to be connected directly to the agent regarding this matter. Thank you & goodbye."

It's not perfect & you'll still have some percentage of fraud that goes through, but I'd be interested to see the impact this has on fraud rates.

* EDIT: Callback number via the card as the other commentor noted probably works too.

sytse• 6 years ago

Even worse than SEO, fraudsters edited Google Maps bank information directly http://archive.vn/PPJYW

Wowfunhappy• 6 years ago

How is a random fraudster going to suddenly get the top Google result for "Bank of America phone number"?

I'm sure it's possible, but it strikes me as a pretty large hurdle. And even if they manage to pull it off, they also need no one from the bank to notice and report it.

techsupporter3• 6 years ago

I wish the regulators for financial institutions would mandate this. One of the reasons I left, years ago, the much-beloved-for-reasons-I-do-not-understand Pacific Northwest darling credit union BECU is because I got griped at by their customer service rep who called me to ostensibly tell me about fraud on my credit card. When the rep asked me "identity verification" questions, they got most upset when I replied that they should have this information and how do I know I'm actually talking to BECU.

"Sir, I'm just trying to help prevent fraud on your account and I need to know that it's actually you who answered the phone."

(Yes, there legitimately was fraud but I had no way to know it at the time. I closed the account about a month later after another issue.)

jbverschoor• 6 years ago

Same with my bank. They should be fined for this, because they will refund 0 if you fall for this, and they’re encouraging this behavior

jdofaz2• 6 years ago

I got a credit card fraud alert sms text once that asked me to call a number that was different than the phone number on my credit card. I called the card number instead and the alert was legit but they still should have used an easily verified phone number.

neltnerb• 6 years ago

Hospitals are even worse. They would periodically call me with random information about appointments or prescriptions and whatnot and would always start off by asking me my birth date and PII to identify myself to them! They're the ones calling me!

I told them as much and after a few years they finally started sending me secure emails asking me to call them. Certainly I wouldn't trust "call back at..." messages claiming to be from a medical provider, even though they're indistinguishable from the real thing because that's the same thing the doctor's office does. It's bizarre considering how security conscious they have to be.

verelo2• 6 years ago

I recently missed a bill due to an error on behalf of my utility company. It ended up at a debt collector, who when calling me insisted i share my date of birth, address and full name before they'd tell me what the call was regarding. I refused, they got mad and acted as if I was trying to avoid paying the bill. I assumed the call was fraud.

I found it was in fact not fraud when my credit monitoring service informed me that someone reported I refused to pay a bill. One call to the utility company later, it was resolved...unfortunately i'm still trying to fix the credit report.

grey-area5• 6 years ago

A favourite trick in the UK is for scammers to stay on the line when you hang up, and play simulated noises for a dial tone and connection, then pretend to be your bank when you call the number on your card.

jeffdavis• 6 years ago

If you hang up, how does that help? Are you talking about them trying to make you think they hung up?

If so, it sounds like a long-shot tactic, especially because everyone uses cell phones now.

cbg02• 6 years ago

I'm not sure I follow. If you've ended the call, and you call the bank number on your card, how exactly would the call get routed to the scammers?

flattone• 6 years ago

I vaguely remember a phone e experience where if the other person didn't hang up I was stuck with that connection.

Glitchy landline behavior from the 90s?

uoaei• 6 years ago

How can they stay on the line if you hang up?

nrr• 6 years ago

A trick I learned to deal with this very thing was just to attempt to call the local time/weather number after getting my dial tone back.

That said, with far-side supervision, I suspect that the call would actually time out after something like 20-30 seconds of either party hanging up. I'd just make it a habit to go put the kettle on and make some tea before placing another call.

If the call doesn't time out, well, it's time to ask BT some hard questions as to why they're allowing that sort of nuisance on their telephone network. AT&T managed to get rid of it here just fine.

outworlder3• 6 years ago

A favourite trick in the UK is for scammers to stay on the line when you hang up, and play simulated noises for a dial tone and connection, then pretend to be your bank when you call the number on your card.

Sure, but that only works for landlines. Is this still a common thing in the UK?

Havoc2• 6 years ago

Surely that doesn't work in the age of cellphones?

userbinator• 6 years ago

Interesting reading: https://security.stackexchange.com/questions/100268/does-han...

jedimastert• 6 years ago

Just yesterday there was an article on HN about a guy who was called by someone from the NSA who gave him detailed instructions on how to get back to him through publically availible information like 411

wolco• 6 years ago

Where? I did see anything like that.

seanwilson• 6 years ago

What about if that puts you into an hour long phone queue where the person who you eventually get through to has trouble helping you with what the initial call was about?

freeone3000• 6 years ago

Find a bank that doesn't have hour-long phone queues where customer service matters? AMEX has reasonable call response times.

StillBored2• 6 years ago

A lot (Most?) credit card/banks/etc have separate direct dial fraud lines.

Example: https://www.discover.com/credit-cards/help-center/faqs/credi...

gowld3• 6 years ago

Then switch to a better bank.

also, if someone is calling you, they most likely aren't trying to help you.

pdonis2• 6 years ago

"Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."

This would be great as long as your call back was recognized and immediately routed to the right person instead of being placed on infinite hold, as is usually the case when you call a bank's or credit card company's number.

jaredsohn2• 6 years ago

as long as your call back was recognized and immediately routed to the right person

It would be great if more companies had this functionality. It would also be useful in the situations where you get disconnected while talking with someone.

carbocation• 6 years ago

Good idea. Plus, they could trivially implement this, no? The main phone number's first prompt could be, "If you were told to call this number, please enter the 8-digit code you were given at the prompt."

grecy• 6 years ago

It's not actually required.

As long as the first csr puts a note on the account about what's going on, any csr can resume from there.

i.e. a note like "20200423 - asked customer to call back to discuss recent large transactions on credit card".

weaksauce• 6 years ago

"... and call us back with the phone number on the back of your credit card and use code "12345" to get directed back to me immediately."

jedberg4• 6 years ago

I've had this happen. When the fraud department for my credit card company called and I said I wanted to call them back to verify, they gave me a code to enter after I called to go straight back to the agent. It was great.

acdha• 6 years ago

This is especially important now: I just had a credit card company send me a query about a fraud alert. After confirming that it was fraudulent, it tells me to call the 800 number but that now says that you should use the website for anything which isn't COVID-19 related due to very high call volume.

csours• 6 years ago

It's just a matter of the company prioritizing that feature. If they think that improved handling of identity fraud will save them money, they will prioritize it.

yellowapple2• 6 years ago

You could combine it with an extension: "Please call me back using the number on the back of your card and extension NNNN"

r00fus2• 6 years ago

Used to be the case with certain CC companies that after they put a note/status in my account, any call I made to the main line would immediately route me to their security/fraud department once I entered my abbreviated auth details (last 4 of card# + zip or somesuch).

So it's definitely possible.

dx034• 6 years ago

When the police called me they did exactly this but added their extension. This way I could verify that the number belongs to my local police department but still called his number directly. For CSR, they could use one time extensions so that the service rep doesn't get spammed at later times.

izend• 6 years ago

A few years ago I got a call from Revenue Canada and around the same time it was extremely popular for scammers to pose as Revenue Canada agents. So immediately I just assumed it was a scam and got extremely annoyed and angry at the person... turns out it was a real Revenue Canada agent and I had somehow forgot to submit my taxes a few years back...

kshacker• 6 years ago

Ha ha same here but I got a call from an FBI agent. I had lost money to someone and 2-3 years later he got caught in some other sting and they wanted me to be another witness since they found my name in his books. For me somehow the connection clicked as soon as the agent mentioned the name of the company (but not when he said I am calling from the FBI). I even got login to I think an FBI website to keep updated on the status. Unfortunately after communication every few months, they decided to not pursue the case, after maybe 2-3 years of elapsed time.

amelius• 6 years ago

To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."

Good idea, except now people will think: "yeah, right, that way the call will cost me money".

the_pwner224• 6 years ago

Where in the world do you still have to pay based on usage of phone minutes?

vageli• 6 years ago

Aren't most of these numbers toll free?

isoskeles• 6 years ago

That would be preferable. I had a call from my bank once that went like this.

CS: Hello, this is X from Y Bank. Is this Z?
ME: Yes, this is Z.
CS: Z, can you confirm your last 4 digits of your social security number so I can confirm who I am speaking to?
ME: Uh... How do I know you're the bank? I can't just tell any person who calls that information.
CS: Z, we are from your bank, Y Bank. Please provide the last 4 digits of your social.
ME: There has to be another way to do this, right?
CS: Please hold... (puts me on hold for 30 seconds)
CS: Hi Z, I'm back. Can you look up our phone number on Google and give us a call back and ask for me by name, X?
ME: Sounds good.

It was them. I got quickly reconnected to the same woman. I'm still concerned that the norm should be something closer to what you commented, even if it adds friction and will probably result in lazier people not calling back for something important. It's better to normalize this than allow for the alternative, which is to normalize people telling random strangers their sensitive, personal information.

Any time this topic comes up, I immediately worry about my parents and grandparents falling for this sort of thing if real scammers are out there trying. I realize the last four digits of my social security number are not as great as the whole thing, but as far as I know, it's enough to be dangerous.

Moru9• 6 years ago

In Sweden the whole personal number is public information. Anyone can just call the tax department and get it without any questions asked. Still some use it as proof that you are you...

voiper1• 6 years ago

lol, something horribly ironic about that. They called your number, but you need to prove it's you. But obviously, they are who they claim to be.

softgrow• 6 years ago

Used to offer this when working on fraud in <a Big Corp>, but have to give them my name so main number switchboard can route call. Very few people did, but those that did appreciated it. Only costs you a few minutes while they find the old time printed phone book, look up <a Big Corp> and call back.

erikbye3• 6 years ago

My bank’s policy is simple: we will never call you.

Cthulhu_5• 6 years ago

Or, you know, send a letter or e-mail. Not that e-mails are secure per definition, but services like gmail spend a lot of time and effort on detecting and blocking spam and scams.

richardowright• 6 years ago

Why not use reverse verbal passwords (i.e. have the bank give you a secret phrase)? That should eliminate a large amount of issues without the need for a call back.

prodave• 6 years ago

Side lessons seems to be that scammers have access to a lot of your personal info, which can fool you, and that you should never ever give an OTP over the phone.

alexpetralia• 6 years ago

One-time PIN for the curious

grey-area5• 6 years ago

How much time and money is lost to this kind of scam?

We need verified identity for phone numbers and email, with consequences attached to bad behaviour.

dsfyu404ed• 6 years ago

This should also be a lesson about having $9k in an account tied to a debit card and not following up on suspicious transactions. If the thieves had done an ATM balance check and seen a combined balance of a number of hundreds of dollars that could be counted on one hand they likely would have settled for withdrawing that and wouldn't have bothered hitting Mitch with the advanced scam to gain the bank info needed for a wire transfer. If Mitch had noticed the test withdrawals he could have called his bank and stopped the fraud there.

For how often you need that kind of cash readily accessible it's simply not worth the risk for the overwhelming majority of people.

This was a really sophisticated attack and fooled even a security conscious person but defense in depth (not having the big bucks accessible from your general use card and/or following up on unknown transactions) would have stymied it. With a good security protocol breaking one rule (not hanging up and calling back) shouldn't screw you.

ipython2• 6 years ago

I just had this experience from pnc bank. I don’t even bank with them, but a member of my household does.

The incoming message was automated, asking for (person who lives here) with a visa debit card that has fraudulent transactions. The caller id was a number not listed on the back of the card.

Pressing “1” puts you into the next phase, which asks you to “verify” your identity by - guess what - typing in your full 16 digit debit card number!

At this point I am convinced this is a scam. You google the phone number and you see tons of links saying it’s a scam.

The person calls their regular number on the back of her card and they claim no fraudulent activity.

A few days later I still get these calls so I decide to investigate. Pressing zero a bunch and asking for an agent finally gets me to a live individual. He claims they’re from pnc and they are a different section not connected to the “main” number. He’s able to recite details about the account that only pnc would know, so now I’m not sure.

I email abuse@pnc.com asking them to please either say the calls are fraudulent or acknowledge that the phone number associated with these calls is legitimate (it doesn’t appear anywhere on pnc’s web site)

I did get a response - good! But they didn’t actually change the site ... so I suppose in this case anyone who receives notification of fraud on their pnc debit card should email abuse@pnc.com to validate the calls are legitimate?

xur17• 6 years ago

I email abuse@pnc.com asking them to please either say the calls are fraudulent or acknowledge that the phone number associated with these calls is legitimate (it doesn’t appear anywhere on pnc’s web site)

Note that faking the number you are calling from is fairly trivial, so do not trust the callerid as proof of identity.

ipython2• 6 years ago

I should have clarified: I called the number back (from the caller ID)

0xff00ffee4• 6 years ago

He’s able to recite details about the account that only pnc would know, so now I’m not sure.

That's the creepy part. There is so much of our info available on the darkweb that even engaging with scammers potentially verifies it and makes it more valuable, although it is unlikley a purchaser of a phishing database is going to provide feedback to the point of origin, they may feed it forward if they resell and augmented dbase. [For example, if someone buys 1,000,000 phone numbers, and that person finds 250,000 are bogus, they can sell the "cleaned" database again claiming it's been slightly sanitized. DefCon has taught me to fear the world.]

mint2• 6 years ago

My company expense card is from pnc. I’ve had many bad experiences with it that make them seem very unprofessional and not competent technically. First time I needed to update my pin to use the card and their databases were down...

But yeah their fraud detection is lacking and reporting it was a pain, and they are slow to resolve anything. They did not detect the fraud at all.

Your experience reinforces my impression.

ydnaclementine• 6 years ago

Banks do this themselves too I think. I seem to have the recent memory where I called Chase, then they called me back. For the life of me I can't remember what I as calling about though

duxup• 6 years ago

That's what I always told my older family.

If it is about finances, YOU call them at a number on your billing statement that you know is correct, or just go to the bank.

Never make a decision / give info if "they" called you.

NKosmatos• 6 years ago

he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. Most were relatively small charges — under $100 apiece — but there were also two very recent $800 ATM withdrawals from cash machines

How is it possible for someone not to check his/her bank account all this time? There were unknown transactions for several weeks and no one noticed?

IMHO not having alerts for your cards/accounts and not noticing strange transactions is a bigger security risk than trusting the telephone number calling you.

I fully agree that we should call back on the official number for any banking issues and don’t blindly trust whoever is pretending to be from the bank.

bityard• 6 years ago

Most people I know check their credit card, debit card, and/or bank statements once a month, if ever.

You and I are the outliers, my friend.

0xff00ffee4• 6 years ago

Count me in. Text alerts on all financial institutions to a google voice # and monthly reconciles of all acounts plus weekly investment checks.

I have had two fraudulent CC charges in 25+ years, and they both were reversed immediately so I'm not worried about that. More worried about my credit union so I keep as little in there as possible. (Interest rates are a joke so it doesn't matter.)

riantogo• 6 years ago

This also applies to offline solicitation. Someone came to my door and asked me to sign on to switching my gas supplier. He said it is a supply chain change and will not affect anything beyond I getting a smaller monthly bill, still coming from PG&E. I told him that it sounds wonderful but this is the first I'm hearing of such a thing and I need to research online what it is about before signing anything. He said he has all the details in his paper folder and I can read it. I insisted on doing my own research. He said the deal is off once he leaves and it is my last chance. I told him, "so be it, such is life".

Did a quick Google search the next day and figured the process is legit but people out there have gotten higher bills than before.

Moral is to fight the human-interaction pressures and be adamant on doing your own research. No shame in that.

stronglikedan• 6 years ago

My standard response to that sort of thing is, "Sorry, but my personal policy is to not make any decision without sleeping on it first." That usually gets them right to the "deal is off" phase quickly, since there's really no good rebuttal for that. Or they leave their materials. Either way, they leave me alone.

grogenaut• 6 years ago

You can in fact close the door on people. This is also effective.

secabeen• 6 years ago

Yep, I have a standing rule that I don't buy anything marketed by someone standing at my front door (I will make an exception for Girl Scout cookies). Someone at your front door is interrupting you, and creating a power imbalance leveraging long standing cultural norms that you invite people in and are courteous. That may apply to neighbors and friends, but not to salespeople.

Taniwha• 6 years ago

"We do not give money at the door"

"We do not buy things at the door"

schraitle• 6 years ago

Exact same experience about a year ago, I also passed up the deal and ultimately concluded later that it was legit. I then emailed PG&E telling them that whoever is doing this is training people to trust a random, pushy person at the door who shows nothing other than a badge and iPad full of content.

jnosCo• 6 years ago

These people work on commission or quota, which is why they're so pushy.

imglorp• 6 years ago

There seems to be a huge margin on those things, which bring all kinds of sleazy tactics for third party marketing companies.

I had a call from a guy claiming to be from PECO (my power co) with a good deal to switch off of PECO. Indeed we do have alternate generation supplier options, but this smelled. So I asked him several times if he worked for them and he insisted. Finally i agreed and he wanted to route me to a neutral, recorded line, agreement gathering company, but he said it would identify as "xyz energy". Whoops, deal's off, fat liar.

gowld3• 6 years ago

It's legal, but it's not legit. They are trying to rip you off and they are lying to you.

StanislavPetrov3• 6 years ago

If someone knocks on my door and I haven't invited them over I don't even consider answering it. It doesn't matter to me what sort of uniform they are wearing. The same goes phone calls. I don't understand the obligation people feel to engage in unsolicited meetings and conversations.

TeMPOraL• 6 years ago

I don't understand the obligation people feel to engage in unsolicited meetings and conversations.

If they get you on the line, you're going to fight against a professional liar on an uphill territory made of cultural norms and basic politeness. Turns out disengaging from a conversation isn't easy. But how do they get you on the line in the first place?

Like anyone, you probably have frequent periods of time when you have a lot of errands in progress. Maybe you've ordered a bunch of things on-line, booked a trip, just sent documents to your accountant, and posted your car for sale. Any of these can face roadblocks that generate a phone call. In such periods of time, you'll be more likely to pick up that unknown number calling in, because maybe it's one of the vendors calling with an issue that can either be resolved in 30 seconds on the phone, or 2 days via e-mail.

For the bad actors (marketers), it's a numbers game. Personally, I also don't take calls from numbers I don't know... except whenever I run any kind of errand remotely, which is when they usually manage to catch me (only for me to wait until they tell me what they want, at which point I hang up).

1123581321• 6 years ago

Learning to say no to solicitors gives you the freedom to make new connections with your neighbors. People enjoy that freedom.

miguelmota• 6 years ago

I second this. If I’m not expecting it then I don’t bother. If something is important then they'll call a second time and leave a voicemail or come knocking again but that has rarely happened.

s17n• 6 years ago

Because a world in which people are unwilling to answer their doors is depressing, and answering the door is only going to cost you like 30 seconds of your time.

copperx• 6 years ago

I get what you're saying, but I get irate at people who don't answer calls from unknown numbers. Spam or soliciting? Hang up and block caller. It doesn't take more than 5 seconds.

I've been in situations when I don't have access to my cell phone and I need help from friends, so I call from a stranger's cellphone. I never get an answer. I have to text them from the stranger's phone (and see their text messages), wait for them to see the message, then accept the call. It's incredibly frustrating.

emiliobumachar• 6 years ago

Thanks for sharing. Questionable whether it's legit since they're apparently making false verbal promises of a lower bill. Hard to prove, yes. It's not right just because a corporation does it.

exhilaration• 6 years ago

Just an FYI, my town (in Pennsylvania) passed an anti-peddling / door-to-door sales ordinance to get these high pressure utility sales guys off our streets. You might want to talk to your city council about doing the same.

At this point we can call the cops on them and the cops can issue a citation. I haven't seen them since the ordinance was passed.

jimmydddd• 6 years ago

My town (in New Jersey) has a similar law. We have a list at town hall. You can ask to be put on the list. Salesman must not go to your door if you are on the list. Only problem is that charities and politicians are exempt from the requirement.

jvanderbot• 6 years ago

Nothing is ever that urgent. If they insist on immediate purchase, I invariably walk.

chickenpotpie• 6 years ago

My policy is before any time sensitive decision is to determine if it is manufactured time sensitivity, that is the company created the time sensitivity. I refuse to act on things that are only time sensitive because someone else decided it should be. Those are traps.

0xff00ffee4• 6 years ago

Nothing is ever that urgent

It took me decades to learn this. I mean, to really learn it.

Barring emergencies (like blood squirting out of puncture wound, or part of your house is on fire):

NOTHING is ever urgent.

You set the pace of your life. You speak when you are ready. You act when you are ready. Take as much time as you need to think.

loeg• 6 years ago

"Exploding offers" (the deal is off when he leaves) and other hard-sell tactics are big red flags in general, IMO. If I get a whiff of hard-sell it's an automatic and unconditional "no."

sk5t2• 6 years ago

"Oh, do you need me to make an emotional decision? Right now? Hang on a minute--how do you think this is going for us both?"

gbrown• 6 years ago

I've been working on this over the years, since I noticed a tendency to just go along to make the uncomfortable situation go away. Just having a mental flag helps a lot: "this is probably BS, don't agree to anything."

hinkley• 6 years ago

Pressure sales are an automatic 'no'.

Saves so much time and energy, and you rarely if ever actually miss out on anything good.

sharadov2• 6 years ago

I would tell them to fuck off and go back to sales school - these tactics don't work in today's day and age, they worked when information was opaque, you got the world's information at your fingertips now.

RandomBacon3• 6 years ago

Those tactics still work for most people who don't know any better. Most people are still too lazy (even when you tell them it's so easy to save money).

Nextgrid6• 6 years ago

Speaking of school, being aware of sales/marketing/scam tactics and how to defend against them should be taught very early on.

I have yet to find a use for some advanced math school tried to teach me when I was a teen, while basic life skills like how to manage finances, deal with scams, etc are invaluable.

RandomBacon3• 6 years ago

When someone tells me the offer expires when I walk out the door etc, I just reply "It must not be that good of a deal if you don't want me to comparison shop." I've never run into a salesperson that had a good/any comeback to that.

jejunebug• 6 years ago

Used to work for a sales company, impulse is a textbook tried-and-true sales tactic. For everyone like yourself that decides to sit on it another jumps at the offer.

rdiddly• 6 years ago

The ol' reverse psychology eh? I don't want this deal. Oh yeah, well you can't have this deal. WHAT!? I'LL TAKE IT IMMEDIATELY!

r00fus2• 6 years ago

He said the deal is off once he leaves and it is my last chance

Standard sales pitch tactic: "manufacture a sense of urgency"

triceratops4• 6 years ago

"I have to talk to my wife/husband/SO/roommate". Works for practically any decision that you need time to make.

TylerE3• 6 years ago

"No." is a complete sentence.

dweekly• 6 years ago

A simple "No Soliciting" sign can help ward off many such ruses given the further illegality of proceeding with soliciting when such a sign is visible. (This also may signal you are not as easy a mark and therefore not worth their time.) Doorbell cams + Nextdoor/Citizen make this even harder since one skeptic can poison a neighborhood.

Cthulhu_5• 6 years ago

Plenty of companies here that are like subletters for utilities; they claim to be able to offer you a lower energy bill because they buy up electricity in bulk, but when I looked into it it turns out that in practice they're only cheaper the first year. These aren't energy companies, they're marketing / sales companies.

Anyway I went with one of the "source" power suppliers who instead offer a loyalty discount that builds up over time. I'm sure switching suppliers every year will be a bit cheaper in the long run but I choose reliability and convenience in this case. Also because the reseller companies tend to pop up and be bought up / merge constantly. Besides, it gives me some moral peace of mind that I'm paying the company producing electricity directly instead of a marketing middle man.

icelancer• 6 years ago

Maybe if banks and other companies didn't have a 10-level nested phone tree, we would.

jariel• 6 years ago

If phone companies had any initiative or product brains at all, they would have initiated 'real caller ID' a decade ago.

StanislavPetrov3• 6 years ago

But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening.

My response is not picking up the phone at all.

choeger2• 6 years ago

So the scammers expected the victim to callback the bank to get the secret code? That is pretty sophisticated. But when they first called they knew about fraudulent discharges, and presumably had caused them, right? Or did they break into the victim's computer? Tbh., something is missing in that story.

mannykannot5• 6 years ago

You got me thinking, so I went back to the report. The victim's call to the bank is something of a red herring, in that the scammers neither need the victim to make that call, nor to know that he did so (and I assume they did not know that.) I am guessing that the bank texted the code to the victim's phone in response to the call made by the fraudulent team, who were just hoping that he would read it back to them... which he did.

The victim unfortunately assumed, on verifying that the bank had a second call, supposedly to himself, in progress, that the bank had placed that call and that it was in fact the call he had received on the first phone.

FalconSensei• 6 years ago

So, seems that the scammers knew about the fraudulent ones, but apparently not the regular ones. So: 1 - do fraudulent transactions 2 - call card holder and say that those charges might be fraudulent. 3 - because you know the fraudulent charges, card holder believes you are from the bank 4 - profit

overheadnoise4• 6 years ago

I think the attackers had Mitch’s bank card and PIN and was making those fraudulent charges to see if Mitch would notice. If he did, the attackers would have been shut out then and there.

Mitch didn’t notice, so the attackers called Mitch pretending to be the bank. They didn’t ask him for any details so no red flags were raised, they just said “we noticed fraudulent charges and rest assured we are fixing it.”

Next day, attackers call the bank and Mitch at the same time. They needed the code the bank would send to the # on the account, so the attacker requested it from the bank, the bank sent it to Mitch, Mitch read it to the attacker, and the attacker repeated it to the bank.

At some point, Mitch got suspicious and called the bank to ask if they were on another call with him. The bank was on a call with the attacker pretending to be Mitch, so they said yes. Mitch thought the other Mitch was himself.

choeger2• 6 years ago

This is exactly what I meant. If the attackers already could make fraudulent discharges, then why should they put up such a complicated and risky attack? Could they not simply have gotten the money via the debit card?

misnome• 6 years ago

Does anyone know any good guides for being aware of these things, strategies used by scammers, and what to be suspicious of? Something that isn't patronisingly simple, but not aimed at teach expert users either.

“But as it turned out, that other call was the attackers also talking to my bank pretending to be me.”

I don't understand this part - the _actual_ bank said that he was on a different line with them? Wouldn't that mean that the scammers had authorised as him already, in which case the account is already compromised? Also, the bank asking for 2FA over the phone also sounds like training into bad habits, but I appreciate there's different approaches with different banks.

This is a pretty similar sequence of events to one a reasonably intelligent but non-tech friend of mine fell for this week: Got an email saying that the TV licence needed to be renewed. They followed the link on the email, didn't check the URL and filled out their account details to set up a direct debit.

Two days later, gets a call from their "bank", telling them that they filled out a scam direct debit (gets victim flustered to compromise judgement) but they need to authorise them first before they can speak any further... my friend challenged their identity but they used the exact same "fake caller ID" trick - to the correct bank number since they had the sort code from step 1, and that identifies the bank. I knew this (caller ID) was possible in general, but hadn't heard of it being actively used in the UK - only from stories in the US. After "verifying" they asked for the 2FA device code, then (registered a card for ApplePay and) asked them to "confirm" the code they had just been texted, which is the point I walked in and was "WTF are you doing?"

About 10 minutes later while in the waiting queue for the actual bank, the actual bank called them - when we said that we wouldn't trust the call they instantly gave us a reference number to quickly recall the case and advised us to call back quickly. Luckily, the bank reimbursed the amounts taken before they locked it off (apparently some UK agreement from a couple of years ago.)

They were pretty shaken up from the experience, and want to know what to look for in the future. It strikes me that a lot of these cases are hitting otherwise reasonably cautious people who aren't aware that something they think is authentication, really isn't, like caller ID.

overheadnoise4• 6 years ago

I think the attacker called the bank and Mitch at the same time. The attacker knew that the bank would send Mitch a SMS code so the attacker asked the bank to send it, Mitch told the attacker, the attacker told the bank.

The bank was on the phone with Mitch and the attacker at the same time. Mitch thought the “other Mitch” was himself on the other line.

soulofmischief3• 6 years ago

Krebs mentioned that Mitch logged into his bank account while on the phone with the scammers. That's a HUGE no. We live in a threshold period where acoustic emanation attacks are about to become much more commonplace due to increasing computational capabilities. [0]

Getting you to browse your computer for 10-20 minutes and then log into your bank account could be enough to gain access to your account.

And 2FA is proven insecure with SIM hijacking. These methods have a high up front time investment but will take even less effort than Mitch's gambit once deployed.

https://www.cs.cornell.edu/~shmat/courses/cs6431/zhuang.pdf [0]

vngzs• 6 years ago

Do you think a phone call is high enough bitrate for these attacks, or are you implying parabolic microphones could be used to make this happen?

The mentioned paper contains a remark:

While recording from the third keyboard, we get several seconds of unexpected noise from a cellphone nearby.

But that's the only mention of a phone in the paper ...

soulofmischief3• 6 years ago

I don't think the techniques and technology have become quite refined enough for this to be widely deployed, at most people are simply experimenting with the idea. But people are taking this seriously because it represents quite an attack vector once things fall into place. The thing is we won't know when we've reached that threshold until the first news stories about a widespread phishing scam using the technique emerge.

It seems VoIP will be the first low-hanging fruit: https://arxiv.org/pdf/1609.09359.pdf

0xff00ffee4• 6 years ago

Google Voice for 2FA. Some companies still have issues with Google Voice SMS (Paypal, I'm looking at you), but it is preferable.

ValentineC• 6 years ago

Krebs mentioned that Mitch logged into his bank account while on the phone with the scammers. That's a HUGE no. We live in a threshold period where acoustic emanation attacks are about to become much more commonplace due to increasing computational capabilities.

Huh, this reminds me that a major US bank verifies people on the phone by asking them to log on to online banking.

I love the convenience, but it's never crossed my mind that it was a huge vulnerability waiting to happen.

soulofmischief3• 6 years ago

It will take a series of high profile hacking incidents to finally wake the public up to the need to develop mitigations. We won't see the problem until it's widespread.

koheripbal• 6 years ago

I don't think that method is very reliable for pulling credentials.

Google is one example of companies that asks its GSUITE admins to login to confirm support ticket codes.

Xavdidtheshadow• 6 years ago

A password manager makes this attack vector useless. The sound of my typing my password on any site is the keyboard shortcut to activate it, my finger silently passing Touch ID, and the "enter" key.

Zenbit_UX• 6 years ago

You just need to mute the call before authenticating.

bosswipe• 6 years ago

VoIP has not been worth the billions in thefts that it has enabled via easy call id spoofing. I would happily give up VoIP to have restored trust in the telephone network. But unfortunately that is not where our captured regulators are heading.

cactus2093• 6 years ago

That's interesting, I come to the exact opposite conclusion (I am admittedly not a telephone network expert, maybe I am missing some important things).

But I don't see why having voice conversations over the internet is the issue. The issue is these systems keeping compatibility with old telephone networks which prevents solving these problems. If we dropped that compatibility requirement we could require a certificate authority and be able to verify callers and use end-to-end encryption, just like with https.

Or maybe better would be a compromise where all these systems can still fall back to unencrypted/unsigned connections, but on any modern phone or cell phone it would show a big insecure warning like modern browsers do for http.

frandroid• 6 years ago

Armed with a counterfeit copy of his debit card and PIN, the fraudsters could pull money out of his account at ATMs and go shopping in big box stores for various items. But to move lots of money out of his account all at once, they needed Mitch’s help.

Whoa, a double-tap attack

maowtm• 6 years ago

But how...

Isn't bank cards designed to be non-cloneable (with crypto chips)?

hanoz2• 6 years ago

An anti nuisance call policy that has served me well and I try to get my folks to adopt is that if there is the merest hint of a delay between my hello and the caller's response, I put the phone down immediately.

I don't think I've ever had an identifiable repeat call, from which I conclude it's both effective and has a low false positive rate.

mvexel• 6 years ago

I take this a step further and don't say anything for the first few seconds if I pick up a call from a number I don't recognize. I used to not pick up those calls at all, but now that spam callers are using local area code caller IDs more and more, that is getting more difficult.

mannykannot5• 6 years ago

"He said he checked his account online several times over the weekend, but saw no further signs of unauthorized activity."

If, in retrospect, you feel someone was attempting to scam you, a better option - I hope - might be to contact the bank's fraud line, explain that you are suspicious, and have them look for suspicious activity.

overheadnoise4• 6 years ago

Mitch was satisfied thinking that the bank was already looking into it, since the attacker pretending to be the bank didn’t ask for any details /raise any flags.

mannykannot5• 6 years ago

For the point I am making, it does not really matter what Mich was thinking, but his behaviour over the weekend suggests that he was not entirely comfortable with the outcome. What do you suppose he was checking for? I would guess that he did not need to see his balance more than once.

He says that his suspicions were tweaked, near the end of the call, by the scammer giving an old address for him, and apparently his girlfriend was a good deal more suspicious: "Anyway, the whole time my girlfriend is sitting next to me listening to this conversation and she’s like, ‘This sounds like bullshit.'”

dantiberian• 6 years ago

On first read, I didn't understand how the call to the bank's customer service department went wrong.

Something about that conversation didn’t seem right, and so Mitch decided to use another phone to place a call to his bank’s customer service department — while keeping the first caller on hold.

“When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch,” he said. “But as it turned out, that other call was the attackers also talking to my bank pretending to be me.”

What happened is that the attackers made one call to Mitch, and another call to the bank posing as Mitch. When Mitch called the real bank to check up if there was a call in progress, they said yes (the call with the attackers).

overheadnoise4• 6 years ago

I don’t know if I’m just really tired or if the post was just badly written, but I’ll go with the latter since you were confused too.

My understanding is this happened:

1. Attacker got a hold of Mitch’s bank card, PIN, and some personal details.

2. Attacker starts pulling out money and buying things here and there to see if Mitch ever notices.

Mitch never notices so...

3. Attacker calls Mitch on Friday and pretends to be Mitch’s bank. Attacker doesn’t ask for any details, just alerts Mitch that something was going on with his account to get him to think the bank was looking into it.

4. Attacker calls Mitch’s bank and also Mitch at the same time the next day.

5. Attacker asks the bank to send the SMS verification code to Mitch.

6. Mitch gets the code and reads it back to the Attacker.

7. Attacker repeats code to the bank.

wingerlang• 6 years ago

I think it was perfectly clear.

Havoc2• 6 years ago

Especially with deepfake voices. That CEO instructing you to move cash right now might now because of an emergency...

yalogin• 6 years ago

At this point, we should really throw away the current phone system and use an authenticated model. There should also be laws forcing the phone companies to not allow this. I get at least 2 spam/scam calls a day and there is no hope that it will reduce.

kccqzy• 6 years ago

There are anti-spoofing requirements for carriers. The TRACED Act requires carriers to implement voice call authentication which should make spoofing caller IDs impossible. https://www.congress.gov/bill/116th-congress/senate-bill/151

Last time I checked, carriers have until June 2021 to implement it. https://arstechnica.com/tech-policy/2020/04/ajit-pai-follows...

jlgaddis4• 6 years ago

Actually, there is a (small) bit of hope: SHAKEN/STIR [0]!

STIR/SHAKEN, or SHAKEN/STIR, is a suite of protocols and procedures intended to combat caller ID spoofing on public telephone networks.
...
As of 2019, SHAKEN/STIR is a major ongoing effort in the United States, which is suffering an "epidemic" of robocalls. The Federal Communications Commission is requiring use of the protocols by June 2021.

---

[0] https://en.wikipedia.org/wiki/STIR/SHAKEN

EGreg• 6 years ago

Tips from my experience:

1. If someone who calls you asks you for ANY sensitive personal info, just tell them that your policy is to not give any personal info to those who called you, but you’re happy to call the official number. That stops it right there

2. Use email aliases instead of your actual email when creating accounts with eg Amazon Web Services. An email alias is like me+somethinghere@gmail.com — this way the attacker can’t get the customer service rep to give them access to your account easily.

3. If you use your phone as a 2FA, be on the lookout for sim porting - that’s when they trick the rep into porting your phone number.

I had the third one happen, luckily I acted fast. The attackers couldn’t get into my G Suite email but they got into godaddy to port the domain and MX records to their servers. So they could receive email sent to me, and send email as me. They also changed my GoDaddy password. I had my phone as the 2FA at the time. Better to not have one at all, or use an authenticator app.

I called in and luckily GoDaddy restored my account. Too bad they had no tool to check what changed so I had to check every domain manually.

The attacker was too slow in that regard. But it was telling that I received an email with the subject “Test”. That’s what tipped me off.

willart4food• 6 years ago

TL;DR: Always hang up, look up, and call back.

jokoon• 6 years ago

shouldn't be banks liable for providing those security code to a stranger if it can be proven they were tricked?

paddlesteamer• 6 years ago

How do these scammers hide their identities? Is there a tor network or some kind of proxy for gsm?

rhacker• 6 years ago

I have done this every time it involves money. Banks, Credit Companies, etc... don't let an incoming call end up with your money.

tomxor• 6 years ago

The investigator said another man had called in on Saturday posing as Mitch, had provided a one-time code the bank texted to the phone number on file for Mitch’s account.

Wow. In the UK as far as i'm aware no bank uses auth codes over txt, we have a physical devices to generate one time codes for identification or transaction signing using chip and pin.

Most people here are aware txt messaging is not secure, it's enough of an issue for email hijacking, I'm very surprised banks are using it in US.

perl4ever3• 6 years ago

Banks and brokers.

Sometimes a device is an option. Some organizations use a software token app on your phone, or something physical they send you.

AndrewKemendo• 6 years ago

I've been in Intelligence and Law Enforcement for the better part of two decades and I put situations like this into the bin of:

If someone really wants your stuff, they are going to get it.

The cost of getting this guy's money was very high relative to the average scam - but it's important to note that the cost of sophisticated multi-factored scams is dropping.

mikece• 6 years ago

Among many other things in this article, it's a good reminder to simply never use a debit card: use a credit card instead as the most you can be out is $50 for any incident of fraud. And if you need cash? How about going to the bank and talking to a teller (or going through the drive-through during social distancing)?

kgwxd• 6 years ago

I just don't answer. Haven't been scammed yet.

dwoot• 6 years ago

Anyone else notice that Krebs' site lacks TLS?

dddddaviddddd• 6 years ago

I get a 301 redirect to the HTTPS version. SSL Labs shows the site supports TLS 1.0 - 1.3. https://www.ssllabs.com/ssltest/analyze.html?d=krebsonsecuri...

nhumrich• 6 years ago

No. Seems to be supporting all versions of tls. https://www.ssllabs.com/ssltest/analyze.html?d=krebsonsecuri...

Pxtl2• 6 years ago

Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account. Mitch said the caller ID for that incoming call displayed the same phone number that was printed on the back of his debit card.

Imho, this is where the phone company should be liable. If I let people masquerade as other users in my software, it would be a critical security bug and I'd be in deep trouble. But we just accept this crap from phone companies.

Endlessly• 6 years ago

Using that logic, who else should be on the hook for fraud, identity theft, etc. - that they could have prevented:

- governments

- credit card companies

- social media sites

- email providers

- search engines

- long, long list, since basically, any system currently that allows fraud could be prevented if counter measures were invasive enough and were legally required. Problem is no one would agree to such a system and would rather just pay for the fraud either directly or indirectly.

kerkeslager2• 6 years ago

Your software probably isn't a multinational network of literally billions of pieces of hardware ranging in manufacturer and age by half a century, which isn't even owned and operated by a unified group of companies in a unified group of nations, which is used by all sorts of people in situations where its failure could cause people to literally die, so that changes have to be unequivocally backward compatible.

So there's that minor difference. If you decide to do a security upgrade and your software breaks, it probably doesn't mean that an 85-year-old woman dies because her only form of communication, a rotary phone, suddenly stops working and she can't get out of the house.

STIR/SHAKEN[1] is the solution to this problem, but the rollout is scheduled to be completed by June 2021 in the US, and September 2020 in Canada. It's slow, but this is something that you don't want to be rushed. Yes, I get it that Robocalls are terrible: I got 3 calls which I didn't pick up but I assume were robocalls today. But this upgrade is a difficult problem and the stakes are high.

[1] https://en.wikipedia.org/wiki/STIR/SHAKEN

Pxtl2• 6 years ago

This prompted me to do some digging, and I learned something fascinating:

Caller ID and Email are just about the same age.

habosa• 6 years ago

I got an call on my Verizon phone. It showed up as Verizon on the caller ID. The guy said there was a problem with my payment but I was busy and said I'd call back later. When I called that number back later they didn't know what I was calling about. I said "you called me" and they said "oh that's a scam, we never call you. If we call don't pick up"

If Verizon can't stop people from spoofing their own customer support number on their own network, we're all screwed.

aviditas• 6 years ago

They (all phone providers) can stop the caller ID spoofing. They just don't want to invest the time and money to do so. It's finally a bipartisan issue but as long as Ajit Pai is the FCC chairman, nothing will happen aside from a few pay to block gambits.

skrause• 6 years ago

"FCC requires carriers to deploy STIR/SHAKEN caller ID authentication" - https://www.fiercewireless.com/operators/fcc-requires-carrie...

grawprog• 6 years ago

I was getting a bunch of those canada revenue scam calls a while back. They left a message with some robot voice saying 'there was a lawsuit in my name and blah blah blah blah bullshit' so I looked up the number and read about the scam. Apparently they'd actually managed to rip some people off and they were being searched for. So, the next time they called me, I called the number they left me. Some dude with a French accent answered. I started ranting. I told them if they ever called my number again I'd report them to the RCMP and swore a bunch and was fairly rude.

Funny enough, I never got a call back from canada revenue agency for, being less than polite to them, and the spam calls stopped.

My advice, if you actually get a real person on the line, call them out on their shit and tell them to fuck off. It seems to work.

Gatsky• 6 years ago

Although satisfying, this isn’t a good idea, they have your number and are capable of asymmetrical warfare eg spoofing your number for the next 10000 scam calls they make.

dificilis• 6 years ago

I had someone claiming to be from my bank phone me in relation to certain transactions that actually happened, and like a fool I just answered their questions, without verifying who they were.

Later on I called back, to verify that it was someone from the bank who had phoned me.

The call-centre person in the bank who answered my call was unable to confirm or deny if someone from the transaction-checking department had actually phoned me, because it was all very confidential.

kerkeslager2• 6 years ago

On landlines on some networks, it used to be that one person on the call hung up but the other didn't, the call would remain connected for a while. So if the person who had hung up, picked up the phone again, they'd still be connected to the same person, and wouldn't hear a dial tone. This was useful: if you wanted to move to a different phone connected to the same line, say, for more privacy, you just tell the other person what you're doing, hang up, and then pick up in the other room. But some scammers found a way to use this.

Basically, the scammer would instruct a suspicious mark to hang up, look up their bank's phone number, and call back, just as Krebs is instructing. As soon as the mark hung up, the scammer would begin playing a dial tone instead of hanging up. When the mark picked up the phone, they would hear the dial tone, so they would begin dialing at which point the scammer would end the dial tone, wait for the dialing to stop, and then play a few ring tones and then pretend to pick up the phone. This was in the 90s so the technology was there to automate it, but it's simple enough it could have been done completely manually by stopping and starting recordings. From the user's perspective, it seemed they had hung up and made a call to the bank, so it seemed impossible that they were connected to someone else.

Cell phones, which don't stay connected when only one party hangs up, are totally immune to this hack. And this hack has probably fallen out of use since the ubiquity of cell phones has deprived scammers of a viable pool of marks.

Junious2• 6 years ago

Beware that there is also no-hang up scam. Below details are from wiki -

Another simple trick used by the fraudsters is to ask the called parties to hang up and dial their bank, but after the victim hangs up, the fraudster does not, keeping the line open and remaining connected when the victim picks up the phone to dial.[4] When in doubt, calling a company's telephone number listed on billing statements or other official sources is recommended, as opposed to calling numbers received from messages or callers of dubious authenticity. However, sometimes hanging up and redialing is insufficient: if the caller has not hung up, the victim might still be connected, and the fraudster spoofs a dial tone down the phone line to entice the victim to dial. Then the fraudster's accomplice answers and impersonates whomever the victim is trying to call.[5] This is known as a 'no hang-up' scam.[6] Hence consumers are advised to use a different phone when dialing a company's number to confirm.

When in doubt: hang up, look up, and call back "from a different number".

xvector2• 6 years ago

This seems like something that would only work on a landline.

Junious2• 6 years ago

True.

gorgoiler• 6 years ago

Poor Mitch. The core of this sounds like another variant of the Mig-in-the-middle attack.

Page 126 (page 10 of the PDF) from RJA’s Security Engineering being my reference...

https://www.cl.cam.ac.uk/~rja14/Papers/SEv3-ch4-dec18.pdf

AzzieElbab• 6 years ago

Well, do not call back overseas numbers or numberz that stat with 8

xvector2• 6 years ago

“When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch,” he said. “But as it turned out, that other call was the attackers also talking to my bank pretending to be me.”

Jesus Christ. This is some Inception-level shit. I do not operate on this many levels of meta in real life.

mcv5• 6 years ago

It's not the first time I've heard of a scam like this. Scammers are increasingly sophisticated about this, basically performing a kind of man-in-the-middle attack on the phone between you and your bank. And phone protocols aren't secure enough to deal with this.

nicolas_t• 6 years ago

Not so long ago, I got a legitimate phone call from my bank's fraud department (HSBC HK) regarding a dispute I had made (someone had used my credit card to book on booking.com).

The bank employee asked me to give him my passport number and acted annoyed when I refused. He couldn't understand why I would not give this kind of private information on a phone call and why it was a breach of security. I then called the bank's customer service hotline and they had no record of the call from the fraud department being made because it's a separate department and they didn't have access to that data. It took 3 days before I got a confirmation from my bank that that call had indeed been legitimate (and that's only because I have a relationship manager)...

So I think Banks are part of the problem, they need to massively step up their training in security so as not to make this kind of demands on phone calls they have themselves initiated.

z3t4• 6 years ago

It's not just a social problem, it's also a technical problem as you can't tell if a number is legit, as they can be spoofed or hijacked. There could be something like SSL for phones where you would get a green lock and the company/parson name when someone calls. It wouldn't work with analog phones, it's funny actually, that it's just one small part of the chain that is analog, the rest is digital, we could easily get rid of the analog part, I believe. Still, there are no SSL in popular messenger apps, where you can be any person if you just know their username/password, same for e-mail. We need to have private keys controlled by the users for second factor and end-to-end encryption.

Cthulhu_5• 6 years ago

Yeah, a lot of the issues with security on the phone (both spoken and text messages) seem to have to do with backwards compatibility. I mean they add layers on top of the old ones (e.g. to allow higher call quality) but somewhere you can still call someone using just dial tones.

I hope they're working on a new standard for telecom that allows unspoofable caller verification. That, and secure / verified e-mails. But that too is a standard challenged by 60 years of legacy (I had to do a quick wikipedia check).

djaychela• 6 years ago

Funny you should say that, I've had several calls from my bank - HSBC UK - who have then asked me for information to 'prove my identity. When I've said "you phoned me, you could be anyone, I'm not doing that", they got pretty annoyed, and didn't see why I was saying that I wouldn't give away the information. I phoned them back and then it was OK - when I spoke to the same person (she'd given me an extension to give once I'd phoned the main, publicly verifiable number), she seemed surprised that I'd take such steps.

It's not just banks - I get the same spiel from my insurers, who say they have to check the information "for data protection" - oblivious of the fact that them regularly doing this means that they're setting the scene for people inadvertently leaking the information they take as sacrosanct!

Moru9• 6 years ago

That they do this shows that they have been getting bad publicity by calling the wrong number and give private information to the wrong person. Now and then you see articles about this or that hospital sending faxes with patient data to some company fax by mistake. I'm sure this also happens with phone calls so they are just trying to cover their back, has nothing to do with your security. They get annoyed when it means more work for them.

mcv5• 6 years ago

Exactly. Banks need to be aware that data protection goes both ways, and they should teach their customers to check the identity of any bank employee calling them. Training users to give out personal details to people calling them is exactly the wrong thing.

ChrisRR• 6 years ago

I'm with HSBC too and they seem to be a bit too cautious with their debit card fraud. I get my card blocked a couple times a year.

Whenever they've phoned me and I've told them I don't want to give out my info they just tell me to call the number on the back of my card. Never had anyone act annoyed towards me. Maybe it's because I never act annoyed or accusatory towards them, so they don't act the same towards me. I just tell them that I'd rather not give my info out to someone who's phoned me

losttheplot• 6 years ago

They use email...email.

Unencrypted email.

II2II• 6 years ago

I regularly make outgoing phone calls where I need to request payment details. Out of all of those calls, only one person expressed concern about providing said information so I provided them with three options: pay in person, pay online, or look up our phone number and call me back. Apparently that was enough verification for them, so they provided the information right after I finished the sentence.

Is it any surprise that institutions would not know how to handle their customers seeking verification when it is rare and at least some of the people who claim to want verification have a very low standard for evidence?

I suspect part of the problem is the minimal effort put into most scams, which is where this story is sobering. The people involved in this scam were clearly willing to lay down the framework to take a smaller scale crime and escalate it into something more profitable. While many of us may seek solace in our own practices being able to filter out the type of scam described in this story, the real question is when (rather than whether) these people will find an approach that exploits our own vulnerabilities.

bostik• 6 years ago

So I think Banks are part of the problem

Indeed. This is far too common in the UK. The banks call people, introduce themselves to be from a $bank, and then start asking security questions. I have had to tell the other side a couple of times that is not how it goes - they called me, they should first authenticate themselves before starting to ask for details that are part of customer authentication.

The first time I called back through the banking app. (The ability to initiate a call to bank's customer service from a trusted app is a good idea.) It took their end about 40 minutes to sort out who the first caller was. To my bank's credit, at least they didn't make me wait on the line, but sent me a notification SMS once they had the information ready. Then I called back again.

The second time I knew better and asked for a direct reference code that I could use to make the callback verification tango easier on their end.

But at least with the banks they mostly understand that customers may be suspicious about unsolicited calls. The ISPs on the other hand...

Nextgrid6• 6 years ago

My solution with ISPs or similar utilities is to put them in a position where they need you and not the other way around. Blocking their payment magically makes them call you, the call is from someone that at least speaks English properly and is not a monkey, and security questions or other nonsense usually go out the window.

fudged71• 6 years ago

Something similar happened to me. Utility company called me with important news about my account. I called them back later and the other department had no record of this call even though it was correct information. So weird.

Cthulhu_5• 6 years ago

I'm glad that as far as I know, a lot of the services I make use of - utilities, phone, bank, etc - rarely if ever need any interaction.

I got a letter the other day (yes, snail mail) from my bank (which is one of the more technologically forward ones out there, I've worked for them (as a developer-for-hire) for a couple of years). They said they were rejigging an investment account product I'm using, but all they mentioned is that I should go to the webapp for it and it'll tell me more.

I mean there's nothing on there yet but hey.

t0mas88• 6 years ago

Wow that's bad. My experience with several UK banks has also been "stuck in the 90s"

I did have a very good experience with American Express when they called me about a fraudulent charge on my card. They solved this identity issue by putting a note in their customer support system and had me call the number on the back of the card. On the callback they did their usual phone identity verification and then transferred me back to the fraud department to solve things. Was very confidence inspiring in their security.

mikorym• 6 years ago

On an unrelated note, I find it amazing that Hong Kong dollar notes have written on them The Hong Kong and Shanghai Banking Corporation. [1]

[1] I am not exactly sure how it works, but this Wikipedia article mentions that there are different issuers, of which HSBC is the largest: https://en.wikipedia.org/wiki/Banknotes_of_the_Hong_Kong_dol...

celticninja• 6 years ago

Similar to Scottish banknotes, however they are issued by a multitude of retail banks.

https://en.m.wikipedia.org/wiki/Banknotes_of_Scotland

xtiansimon• 6 years ago

Unrelated to banks, but more to the point of organizations.

I was reconciling a firms bank account. I had four transactions from their payroll company, but the last payroll was weeks ago.

I called the payroll. The first person I spoke can explain one charge is a tax reconciliation, but don't know about the other three. The next human in another division explains a service fee. Because I'm not authorized, I won't be able to get more information about the last two charges.

Each group is compartmentalized and siloed. Each department is focused on administering their part, but no one person can accounting for the bank activity.

Nextgrid6• 6 years ago

If you need "training" to understand such a basic thing you have no place in a fraud department.

I am skeptical of training because I've seen a lot of people do the training sessions and parrot out the knowledge (thus pass any tests) despite not understanding the underlying reasons, so when faced with a slightly different situation than the one in the training session they will fail spectacularly.

matheusmoreira• 6 years ago

So I think Banks are part of the problem, they need to massively step up their training in security so as not to make this kind of demands on phone calls they have themselves initiated.

Banks are horrible. Their security measures have been and will continue to be defeated by any targeted attack. Not only that, they act very entitled to people's personal information because they want to protect against fraud. Apparently, that is more important than any other concern.

My bank's authentication system is so convoluted people will just write down the stuff they have to type in. This is so normal, the bank employees print out the passwords and hand them out. This happened to me yesterday: I have two sets of passwords in my wallet. They actually print a message saying they will never ask for this information over the phone but it wouldn't surprise me if they did it anyway. The ATMs ask people trivial stuff like dates of birth as if it was proof of identity. The mobile app wants complete access to my phone, including file system, contacts, camera, microphone and call management. They have a "security" browser plugin that's actually a rootkit: it contains a kernel mode driver module which intercepts all network traffic, reducing performance noticeably. I assume it records the traffic and leaks the information back to the bank. If this thing isn't installed and running, the bank's website won't let users log in.

low_key• 6 years ago

I've had the same thing in the US from Chase bank. They called me about potentially fraudulent charges on a credit card and then proceeded to ask me to verify myself by providing details.

I thought it was fraud, so hung up and called them using the number on the card. Turned out it was a legitimate call. I wrote them a detailed explanation of why their process was indistinguishable from a scam and never got a response. Great.

DarmokJalad1701• 6 years ago

Same experience trying to open a Checking+Savings account with them online. I get a call supposedly from them and asks me to verify myself by telling them the code they just texted me. I refused, hung up and called back. By then it was past 5 on a Friday and I had to wait till Monday.

The whole thing was BS as it was because they wanted to verify that I owned the external checking account I was using to fund the new accounts -- one that I registered on their portal ~7 years ago and have consistently used since then to pay off my Chase credit cards.

alsargent• 6 years ago

Interesting story about how this developer got called by the NSA, who instructed him to hang up then call back the publicly listed number for the agency. Exactly the steps that big banks should take. https://medium.com/datadriveninvestor/why-the-nsa-called-me-...

yhager• 6 years ago

I had a legit call a few months ago from the CRA (Canada Revenue Agency). He was nice enough and sounded calm, and I explained that with all due respect, since he called, I have no way of knowing if he is a scammer or not, so I'd like to call back. He was somewhat taken aback, but not annoyed. I asked where to call, and what to say to get to the matter at hand. After hanging up, I looked up the number, called them back, and got the issue settled. But I was truly surprised that he expected me to talk to him when he called. The CRA is probably the number one pretend-caller in Canada (Or two, after the RCMP - the federal police), so I was surprised they do not employ this as a standard practice and education for people to protect against scam calls. I was lucky to keep my wits about me, and that the call indeed was legit, but it shows there's a huge opening for scamming less savvy people.

shrimpx• 6 years ago

There’s basically no reason to ever answer a call from an unknown phone number, let alone engage and divulge private data. If it’s important they’ll leave a voicemail. Going further, I’d say it’s basically safe to always block missed calls from unknown numbers that didn’t leave a voicemail. If it’s important, you’ll hear about it via some other channel.

dandare• 6 years ago

It is 2020 and this prominent blog is not responsive for mobile device. You have to scroll horizontally to read at decent font size. Shame

earthboundkid• 6 years ago

How long until black hat SEO elevates the wrong numbers? If you search for Apple support, you already get ads for sketchy people in India that look like regular Apple support.

pbhjpbhj2• 6 years ago

My problem with the whole thing is that even the companies doing it right aren't initiating it. They need to verify at their end first; and they need to initiate that.

This is our password & credentials, now please confirm your identity.

castillar76• 6 years ago

I've had this issue a few times with credit card companies, loan companies, and on one or two occasions collections agents. Some very nice person calls in order to discuss an issue with me, but wants me to tell them my birthdate, last-four-of-SSN, and other stuff "in order to verify your identity". They then act annoyed and puzzled that I won't just reel that information off to some rando who called me out of the blue, and start pointing to the caller ID as evidence that they're legitimate. The funniest part of the conversation is when they warn me that we won't be able to discuss this problem if I won't verify my identity, at which point I respond that they called me, so if they don't want to spend any more time on the phone, I'm happy to go back to whatever I was doing and they can try reaching me by some non-brain-dead means.

I feel like if we ran a public education campaign about how easy it is to spoof caller ID, a lot of these scams would stop working, but that's probably just me being foolishly optimistic.

monksy• 6 years ago

Try calling chase. They'll tell you that they'll "call you back". They claimed that they would text me but the texts failed.

The guy claimed that "don't worry it's me". I told the guy that if you call me back to "talk about my account/verify me" you're going to be met with a "go fuck yourself". They do not have any protocols to confirm they are who they claim when they call back.

pontifier• 6 years ago

I was recently scammed by either a man in the middle attack or a replay attack due to insufficient authentication of a new party I did business with.

When you are starting a new person to person transaction with an unknown party, it seems impossible to verify that an attack like this is not happening. The attacks could get arbitrarily complex and every defense I can think of has repucussions.

Even trying to start a transaction could be replayed to someone to make it look like I was the one that was doing the scamming.

p2t2p• 6 years ago

Unknown number? Don't pick up in the first place.

onionjake• 6 years ago

This doesn't work for everyone, but if you can do it then it works well. Don't answer any calls from a number outside your contact list. If it is important, they will leave a message. You can then call them back by looking up their number on the website.

yodelinghambone• 6 years ago

I just: Don't answer, look up and maybe call back.

When in doubt: hang up, look up, and call back

Related Stories