Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#21

Post by aero142 »

jerf wrote: post #7

I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my acc…

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me.

I always pull up the website and confirm before telling them anything.

Re: Voice Phishing Scams Are Getting More Clever

#22

Post by TallGuyShort »

aero142 wrote: post #21
jerf wrote: post #7

I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my acc…

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me. I always pull up the website and confirm before telling them anything.

IMO even that's not sufficient. I've had calls claiming to be my bank that new dollar amounts and dates of 2 charges I had recently disputed. But I've been fooled once before, so I went into my local branch and spoke to the manager face to face. No one from the bank had placed a call regarding my account and there was no issue with my dispute. The phone number was not owned by the bank and after 2 voice mails they stopped trying to contact me and I never had an issue with the charge back. So there is literally no way I would ever trust an inbound phone call again.

Re: Voice Phishing Scams Are Getting More Clever

#23

Post by phkahler »

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable.

Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a number they provide over the phone or in caller ID. If you can't find a reliable number to the bank, drive over there. The bottom line is that you can't trust anyone who calls you.

Re: Voice Phishing Scams Are Getting More Clever

#24

Post by phkahler »

rb808 wrote: post #16

How come in 2018 we can't get a reliable CallerID. Surely this is something that could be simply regulated. Perhaps there should be a few types of CallerID - verified, physical and nominated. Eg a company calls you with a verified ID (like TLS), a local number from a single line is physically authenticated and anything else is just a best guess. That way we can filter more reliably.

No options. Make it mandatory and make it unable to be faked.

Re: Voice Phishing Scams Are Getting More Clever

#25

Post by CodeCube »

This is 100% destroying the phone for younger generations ... my kids answer nothing, not even my own phone calls because they set their phones on do not disturb to curb the endless robo, scam, and cold calls.

If it wasn't for https://hiya.com/, I'd be at the end of my wits. Seems like the number of fake calls has ramped up exponentially in the last months. I finally just set it up completely block all telemarketing, spam, scam, fraud calls.

Re: Voice Phishing Scams Are Getting More Clever

#26

Post by NeedMoreTea »

fpgaminer wrote: post #19

We all make mistakes, so I'm hesitant to ever say they should have known better. But... > Even technology experts are getting taken in by some of the more recent schemes (or very nearly). Rule number one about phone scams, which I've seen repeated numerously so "technology experts" should know this ... _always_ verify and call the number back. I was under the impression that was common knowledge? The scams iterated i…

> _always_ verify and call the number back

Fine in principle, but banks do call, and often have no direct dial, as a matter of policy, for whoever you're speaking to.

So it becomes verify the number, call back, and spend 30+ minutes in a queuing system before some lowly call centre worker on another continent incorrectly tells you they can't connect you to the xyz department.

It used to work before call centres and all the small banks became just branding on the front of one of the big 4. You were even allowed the phone number of the local branch! That's the UK market btw.

Re: Voice Phishing Scams Are Getting More Clever

#27

Post by kevin_b_er »

aero142 wrote: post #21
jerf wrote: post #7

I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my acc…

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me. I always pull up the website and confirm before telling them anything.

This is no longer a valid tactic. The phone number can, has, and will be spoofed.

Re: Voice Phishing Scams Are Getting More Clever

#28

Post by badgers »

phkahler wrote: post #23

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…

Agreed, caller ID should not be able to be spoofed. My rule of thumb is if it is important, they will leave a voicemail with a call back number. This screens out 90% of the spoofed calls I get. The visual voicemail is a nice feature too, I can immediately check the voicemail that is left and decide if I need to follow up, or if it is spam.

Re: Voice Phishing Scams Are Getting More Clever

#29

Post by carapace »

Who are the people manning the phones for the scam? Does it really pay better than a real job? I mean if you have the skills to scam like this you have skills that are valuable to legit business as well, no?

I knew a few criminally-minded people back in high school and my early 20's (I don't associate with them anymore.) The thing that always stuck me about the "criminal mind" is that they were ready and willing to work hard, as hard or often more as a real job, to try to make money. I asked one guy once about it and he basically said that it was the idea of getting over on society, or "the Man", or something. "Getting away with it."

This same guy also refused to open a saving account, but he would buy CD's (certificate of deposit) with ~3 month terms, and pay down the payments, because it felt like having twice as much money. To him it felt like he got to spend the money (that he used to secure the CD) twice: once with the money the bank loans him, and then again when he pays off the CD and they give him his original money back.

Now, this is insane. He's just giving the bank some money.

I asked him about this because it's so crazy, and he said "I can pay bills", meaning that he can psychologically deal with the idea of having to hustle to pay the ongoing payments on the CD, but (for whatever reason) he can't just give some of his money to the bank and not touch it. He literally can't feel right about savings. So he does this weird thing that basically inverts the whole idea of banking. He even knows it's crazy but it's a working equilibrium for him.

Anyhow, I wrote all that in the present tense but this was years ago and I lost touch with the guy.

I am astonished that the scammer-telemarketers who can sit there and carefully run these scam-scripts on marks don't just go get legit jobs. I wonder what economic context they are in? Or are they just, uh, morally corrupt, or something? The mystery of the criminal mind.

Re: Voice Phishing Scams Are Getting More Clever

#30

Post by vpmpaul »

NeedMoreTea wrote: post #26
fpgaminer wrote: post #19

We all make mistakes, so I'm hesitant to ever say they should have known better. But... > Even technology experts are getting taken in by some of the more recent schemes (or very nearly). Rule number one about phone scams, which I've seen repeated numerously so "technology experts" should know this ... _always_ verify and call the number back. I was under the impression that was common knowledge? The scams iterated i…

> _always_ verify and call the number back Fine in principle, but banks do call, and often have no direct dial, as a matter of policy, for whoever you're speaking to. So it becomes verify the number, call back, and spend 30+ minutes in a queuing system before some lowly call centre worker on another continent incorrectly tells you they can't connect you to the xyz department. It used to work before call centres and a…

Yeah. I worked in banking during the crash. Upper mgmt literally told us to pretend we were XXX small bank (on a list of banks) if someone called and asked about it. Even though we were just large bank 1-4 that bought them.
Post reply on HN