Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#141

Post by Scoundreller »

techsupporter wrote: post #32
aero142 wrote: post #21

Earlier quoted context omitted.

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me. I always pull up the website and confirm before telling them anything.

> I usually laugh at them and tell them they they are the unverified party in this phone call, not me. This is one of the related reasons why I finally got my ducks in a row and switched away from Chase three years ago. Their potential-fraud-has-happened outreach department was, in my experience, terrible about this. It didn't help that their potential-fraud-detection department was similarly bad. ("You used your deb…

The fellow that publishes YouTube videos under VinWiki was setting a NYCLA driving race record (the Cannonball).

While making their second gas stop, their credit cards were being rejected because Amex erroneously thought it was impossible to legitimately use their credit cards between two locations that quickly.

https://m.youtube.com/watch?v=HkZNddd9Pxc

Supposedly they also track flights worldwide to assess legitimacy of card-present transactions through distance-time bounding.

Re: Voice Phishing Scams Are Getting More Clever

#142

Post by Scoundreller »

reaperducer wrote: post #51
fitzroy wrote: post #36

Earlier quoted context omitted.

Also, for anyone that doesn't know: you can request an old school ATM card (not a debit card, i.e. no MC/Visa logo) from your bank and use a credit card for purchases instead. This reduces the exposure of a critical account. And if you do become a victim of fraudulent charges, you don't have to worry about your bank account being drained immediately (possibly resulting in overdrafts, etc).

Card skimming has become so rampant where I live that I don't ever put a bank or credit card in a gas pump. I got a gas company card (non-Visa/MC) with a super-low limit, and when I need to buy gas I make a payment online with my phone, then pump away knowing if it got skimmed, the perps would probably throw the info out because it's not usable anywhere else, and even if they used it at the gas station, they'd only g…

Where do you live?

Re: Voice Phishing Scams Are Getting More Clever

#143

Post by Scoundreller »

andrewaylett wrote: post #74
jerf wrote: post #7

I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my acc…

Tell them you'll call them back, and call the number on the back of your card -- even without a case number, there should only be a limited number of things wrong with your account and you probably want to fix all of them :). Otherwise the next scam will be to put an obviously-fraudulent transaction on a card, then phish for the rest of your details so they can get cash, rather than just charge-backs.

Here’s another trick that sometimes works: call the “collect” number instead of the toll-free one.

The company may put you in a faster queue because they think they’re paying $$$/minute for the call.

Re: Voice Phishing Scams Are Getting More Clever

#144

Post by Scoundreller »

jor-el wrote: post #133

I am interested to understand how does these attacks work. The article states, after the victim disclosed the CC number there were ATM transactions performed using it. How are scammers able to generate a physical card in first place to perform ATM transaction? Is it something similar to card skimming with cards having magnetic stripe? Can this attack be performed with cards using chips? Also I often come across a fra…

Yes, some countries still use the magnetic stripe for authentication, or allow fall-back onto it if the chip “fails”.

Re: Voice Phishing Scams Are Getting More Clever

#145

Post by toast0 »

wlesieutre wrote: post #132
gerdesj wrote: post #118

Earlier quoted context omitted.

Have you ever tried to implement DMARC? DKIM and SPF are OK but DMARC breaks mail lists. Yes there are ways to mitigate but it might not be worth it unless you also do DNSSEC as well. Well actually I believe that every little helps and use every weapon available. I do think that the analogy works really well. PBXs can have quite a few weapons of their own to attempt to authenticate callers. For example you can pass "…

I haven't set it up, but how does it break mail lists? Do you mean like using third party providers to send emails with your own domain in the From address?

It is (or was) common for mailing lists to keep the From header when forwarding mail to a list. The envelope sender is commonly changed to refer to the mailing list for bounce processing, and often a mailing list footer is added, sometimes the subject is adjusted and other administrative headers are added.

Changing the subject or adding a footer will almost always break the DKIM signature, and DMARC won't like it anyway, because the From address and the envelope sender don't have the same domain (alignment). This makes it pretty hard to use DMARC for a public domain.

It's not so bad to use it for a corporate domain, and it helps a bunch if your domain is being used to source phishing; except that people still think you sent it when it comes from admin@yourlocaldentist.crappyhosting.example.org which is clearly some ancient web mailer script that was compromised 20 years ago, but still remains online. (I'm totally not bitter!)

Re: Voice Phishing Scams Are Getting More Clever

#146

Post by hinkley »

My bank's fraud department sent me a voicemail saying my card had been deactivated and I needed to call them at 1-800...

Yeah, fuck you. I'm not calling a fraud prevention number that was given to me over the phone and more to the point, what is wrong with you for asking your customers to trust people that called them on the phone.

I called the main switchboard for the bank and couldn't find the fraud number from there. They got an earful about that too. None of this is okay, including why they flagged my card (Not for buying a TV and a bluray player, no. For getting a $8 car wash on the way home...)

Re: Voice Phishing Scams Are Getting More Clever

#147

Post by JBlue42 »

We deal with this on a semi-monthly basis at the hospital I work at. We'll here from one department ("Hi, this is the Emergency Dept, all our phones are busy with a robocaller") then it will roll across other departments for about 20-30 minutes. The best our telecom team has come up with is to take the numbers, give to the FBI, and ¯\_(ツ)_/¯. Last time, they had spoofed the number of FedEx so we couldn't even report that.

Most are very noticeable for being in Chinese and tying up multiple lines at a time. That's not really great though, like in the example, when it's all the phones in the ED.

Re: Voice Phishing Scams Are Getting More Clever

#148

Post by technion »

wlesieutre wrote: post #132
gerdesj wrote: post #118

Earlier quoted context omitted.

Have you ever tried to implement DMARC? DKIM and SPF are OK but DMARC breaks mail lists. Yes there are ways to mitigate but it might not be worth it unless you also do DNSSEC as well. Well actually I believe that every little helps and use every weapon available. I do think that the analogy works really well. PBXs can have quite a few weapons of their own to attempt to authenticate callers. For example you can pass "…

I haven't set it up, but how does it break mail lists? Do you mean like using third party providers to send emails with your own domain in the From address?

My domain, lolware.net, has a total of three email accounts. I'm usually happy to move and break things because it's largely a personal playground. For example, my website's SSL ciphers have frequently veered into the "not many browsers support" solutions.

I cannot properly enable DMARC. I have working SPF and DKIM on everything I send, but as soon as I enforce it, people stop getting my email. The sticking points are mailing lists, and anyone with a forwarder. I've been on this merry go round a few times. If it's this bad on this personal domain, I'm a long way from considering it in a business.

Re: Voice Phishing Scams Are Getting More Clever

#149

Post by toast0 »

howard941 wrote: post #47
ttul wrote: post #37

The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything. There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration. > It's a major nightmare for telephone companies. Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.

There's two means of number identification -- caller id (CID), and automatic number identification (ANI). ANI used to be a lot harder to spoof than CID; likely because ANI is always delivered out of band, and some early CID spoofing was done by just overplaying in-band CID. On the consumer side of things, you're allowed to disable CID on outgoing calls, but not to disable ANI.

Toll free routing may be less amenable to grey routes and things as well. International callers aren't "supposed" to be able to call US toll free numbers, which may make it harder to get to. I've seen some companies claim that they can use call routing information to toll free numbers to get accurate caller id information in some countries; but I would never trust it.

You also shouldn't trust the source IP, or the return address on a standard envelope in the mail, unless you have convincing evidence. It's hard to think of an example of a source address in communications that's really trustable.

Re: Voice Phishing Scams Are Getting More Clever

#150

Post by albedoa »

hinkley wrote: post #146

My bank's fraud department sent me a voicemail saying my card had been deactivated and I needed to call them at 1-800... Yeah, fuck you. I'm not calling a fraud prevention number that was given to me over the phone and more to the point, what is wrong with you for asking your customers to trust people that called them on the phone. I called the main switchboard for the bank and couldn't find the fraud number from the…

Yes! This happened to me too and is very alarming. It’s training users to fall for phishing.

I’m not sure what a correction looks like though. Should they call customers and instruct them to find or verify a phone number and call back? Instruct them to log into their online account? That would be fine for you and me, but I’m thinking of the average cardholder.

Post reply on HN