Number one advice I give my family: never give out any information (no matter how inconsequential it seems) to a person purporting to be from a company calling you. Hang up and call the company yourself using a trusted number (e.g., the number on the back of a credit card).
Voice Phishing Scams Are Getting More Clever
81–90 of 226 posts
Re: Voice Phishing Scams Are Getting More Clever
#82The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…
The problem here is the ability to spoof caller ID. This should not be possible.
Think of incoming CLID in the same way that you do email From: addresses. Often and easily faked. Funnily enough both my office PBX and SMTP daemon check incoming CLID/HELO and drop attempts to spoof their own identity. Its not a particularly sophisticated protection these days but is one of many, many rules. Actually, now I come to think of it, my firewalls also check for inbound IP spoofing on their own IPs.
As the OP stories highlight, your mental firewall must make you bail out when asked for your PIN, regardless of how legitimate things sound. The only thing that should ever request your PIN is a machine that you have stuffed your card in first. I'm pretty certain that CVV requests should also only ever come from vendors that you are buying from, not your bank.
Re: Voice Phishing Scams Are Getting More Clever
#83How come in 2018 we can't get a reliable CallerID. Surely this is something that could be simply regulated. Perhaps there should be a few types of CallerID - verified, physical and nominated. Eg a company calls you with a verified ID (like TLS), a local number from a single line is physically authenticated and anything else is just a best guess. That way we can filter more reliably.
In Germany we separately transmit the actual caller ID, which you can get shown based on your phone's UI. This can't be spoofed, or rather, it's illegal to do so under https://www.gesetze-im-internet.de/tkg_2004/__66k.html .
"mit einer Geldbuße bis zu hunderttausend Euro," is the wording for how much you'll pay if you, with intent or through negligence, transmit a number you are not assigned when you are user, or, if you are a telco, meddle with this header field _at_all_ if you didn't generate it, or didn't make sure it's a valid numbering scheme and not some premium number/short-dial-code. It's not limited to this, and so far this has not been a problem in Germany, at least as far as the CLIP itself goes, as the CLIP -no-screening- which the user can provide through his PBX if configured and contracted does sometimes, but rarely, mess up. Also we have a caller-pays system with a split between fixed-area landlines and floating mobiles, which seems to alleviate some of the problems with robocallers (the cost to even just waste the caller's time).
Re: Voice Phishing Scams Are Getting More Clever
#84The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…
Yeah I get spam phone calls almost daily, and it's always from a local area code and ANI which I recognize as being from a nearby city. So, it _seems_ legit. But I no longer answer phone calls from numbers I don't already have in my Contacts... :P
Re: Voice Phishing Scams Are Getting More Clever
#85The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…
If we make a regulation that requires protocols to change so that the caller ID to be unspoofable, we might as well also require to make it impossible to spoof an IP address or a sender email address...
Re: Voice Phishing Scams Are Getting More Clever
#86Earlier quoted context omitted.
How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration. > It's a major nightmare for telephone companies. Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.
Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw. As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.
Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D
Re: Voice Phishing Scams Are Getting More Clever
#87Earlier quoted context omitted.
If it's "completely insecure," then why aren't there reports of people correctly dialing their banks phone number and being connected to a scammer?
The insecurity comes from the fact that once a call is in the network, it is mostly passed off without validation or verification. You only need to find someone willing to carry your call in to the network, and the rest takes care of itself. To change the routing of a call other than yours would require you to access a carrier's systems and change where the call is routed to--which is substantially more difficult.
Kind of like ip routing, email routing, or even physical mail routing.
Re: Voice Phishing Scams Are Getting More Clever
#88Number one advice I give my family: never give out any information (no matter how inconsequential it seems) to a person purporting to be from a company calling you. Hang up and call the company yourself using a trusted number (e.g., the number on the back of a credit card).
Banks should really just stop calling customers and taking them through security. If there's something urgent, the protocol should be that they call you, give you a ticket number, and tell you to call them back on the bank's standard number for customer service. Anything else just conditions people to expect incoming calls with security questions which will always result in scammers finding a way through.
Re: Voice Phishing Scams Are Getting More Clever
#89Earlier quoted context omitted.
There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms lik…
I just want the major cellphone companies numbers to show up correctly and everything else can be ???. That does not require fixing all these other systems.
Exactly, If your provider can't be certain that the number is real (i.e. they generated it themselves or it came from a trusted/liable source) then they shouldn't be charging for it and held liable if they allow a spoofed number for fraud. Maybe that would be the mean the end of caller-ID and associated fees, but if I'm not sure that it's useful today with the level of spam. If someone spoofs your ph# to make 5000 spam calls, I guarantee it's not useful to you.
Find another in/out of band way of providing caller-ID services.
Re: Voice Phishing Scams Are Getting More Clever
#90The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…
The problem here is the ability to spoof caller ID. This should not be possible. Think of incoming CLID in the same way that you do email From: addresses. Often and easily faked. Funnily enough both my office PBX and SMTP daemon check incoming CLID/HELO and drop attempts to spoof their own identity. Its not a particularly sophisticated protection these days but is one of many, many rules. Actually, now I come to thin…
Curious: how does the PBX verify caller ID? Do you know how it works in practice?