Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

171–180 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#171

Post by notyourday »

phkahler wrote: post #23

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a…

The problem is the lack of motivation: VOIP service providers aren't being smacked with multi-thousand dollar penalties per call when their customers spoof caller ID.

If Peerless Networks was starting at millions of dollars in fines fake IRS scams originated on it because there's no way for someone else to find who actually originated the fraudulent calls, you would be able to bet a farm that a concept of a fake caller ID coming from Peerless Networks would go away.

Re: Voice Phishing Scams Are Getting More Clever

#172

Post by ravenstine »

vecinu wrote: post #157
ravenstine wrote: post #152

I believe that phone companies are complicit in this criminal activity, as they seem to have virtually no interest in actually stopping it. I've already turned off calls on my phone because "why bother", and more and more people I know are doing the same thing. The phone companies probably make so much on streaming that they don't give a shit about the phone system. This is a really bad thing for crime, but might hel…

> I've already turned off calls on my phone How do you do that on an Android phone?

My phone is a Galaxy S5 with Android 6, but it's here:

Settings > Call > Call Rejection > Auto reject mode

Set it to "All incoming calls".

Re: Voice Phishing Scams Are Getting More Clever

#174

Post by jrochkind1 »

jefftk wrote: post #159
albedoa wrote: post #150

Earlier quoted context omitted.

Yes! This happened to me too and is very alarming. It’s training users to fall for phishing. I’m not sure what a correction looks like though. Should they call customers and instruct them to find or verify a phone number and call back? Instruct them to log into their online account? That would be fine for you and me, but I’m thinking of the average cardholder.

Telling them to call the customer service number on their credit card seems pretty good?

I just got one of these that had me call a DIFFERENT number than the one that was on my credit card -- the whole time I was thinking it was probably a phishing thing as I was giving them all my info, but in the end it was to ask if I had really made a charge that I _had_ really made the day before (in a city I'm not normally in)... so I'm pretty sure it was legit. Probably?

Re: Voice Phishing Scams Are Getting More Clever

#175

Post by flyinghamster »

dredmorbius wrote: post #130
flyinghamster wrote: post #108

I've had an Asterisk box for about 10 years now, mostly to deal with the tide of junk calls, and it has worked nicely. I first just blacklisted numbers (and sometimes whole prefixes), but now I use a CAPTCHA that handles the robocallers beautifully. Calls from known numbers get to ring through without the CAPTCHA. Still, I've been paying too much for that crusty old landline, and finally got motivated to do something…

Could you please point to guides / docs / references for setting this up? Might make some good HN submissions ;-)

Here's a good starting point:

http://nerdvittles.com/?p=75

Of course, with Asterisk, you can get downright crazy if you wish.

Re: Voice Phishing Scams Are Getting More Clever

#176

Post by TallGuyShort »

jerf wrote: post #31
TallGuyShort wrote: post #22

Earlier quoted context omitted.

IMO even that's not sufficient. I've had calls claiming to be my bank that new dollar amounts and dates of 2 charges I had recently disputed. But I've been fooled once before, so I went into my local branch and spoke to the manager face to face. No one from the bank had placed a call regarding my account and there was no issue with my dispute. The phone number was not owned by the bank and after 2 voice mails they st…

To be honest even after I had seen that the charges being described to me on the phone were indeed on my account I was still running through scenarios where this could be a fraudulent call. However, I eventually came up with the logic that somebody had already managed to put the charge on my account, and once they'd gotten that far, I couldn't think of any reason for the scammer to call me. Basically, scammers had vi…

True. On the other hand, I don't want bank employees to have never been told that cold-calling people to discuss their accounts is a bad practice.

Re: Voice Phishing Scams Are Getting More Clever

#177

Post by Retric »

metildaa wrote: post #154
LeifCarrotson wrote: post #139

Earlier quoted context omitted.

They could not fix it. However, it would be a big value-add to me if, say, the big 4 US carriers could add an out-of-band security check and block calls to their networks from numbers they control but which are spoofed. I get way too many calls from area codes and prefixes I recognize. This would help me get some of that back.

There are legitimate use cases like Google Voice for sending caller ID that another carrier owns. Despite that, a basic authorized users list would be an easy fix, doubt that'll ever happen though. Look at the mess that LRN and CNAM data are, providers will nickel and dime for access to data that doesn't cost much to maintain...

Google Voice could A join the system or B have ??? as their caller ID either one would be useful. Again, they can say whatever number they want as long as I can opt out and block unknown numbers.

However, the current system is largely useless when you get spoofed calls from numbers you recognize.

Re: Voice Phishing Scams Are Getting More Clever

#179

Post by outworlder »

kweks wrote: post #151
dubhrosa wrote: post #88

Earlier quoted context omitted.

Banks should really just stop calling customers and taking them through security. If there's something urgent, the protocol should be that they call you, give you a ticket number, and tell you to call them back on the bank's standard number for customer service. Anything else just conditions people to expect incoming calls with security questions which will always result in scammers finding a way through.

This can also be scammed due to the timeout "feature" in telephone systems. Ie, the scammer calls, tells you to call the number on your card. You believe they hung up, but they are still on the line. When you pick up your phone again, you're still contected, and they're playing a dial tone. https://www.geekrant.org/2016/05/08/phone-scam-part-1/

Now the real trick is to get this to work with cellphones :)

Re: Voice Phishing Scams Are Getting More Clever

#180

Post by ams6110 »

UpshotKnothole wrote: post #140
chiph wrote: post #138

Earlier quoted context omitted.

If you're visiting remote parts of Texas, always have a hat with a brim (there's a reason that cowboy hats are shaped the way they are), bottled water, and a few hundred dollars in cash.

I would add Imodium AD, analgesics, some power bars and jerky, condoms, tampons if you’re female or traveling with women, a compass, weatherproof matches, a small mirror, and a good knife.

Condoms? No emergency so dire as to miss a chance to get laid?
Post reply on HN