Unrelated question: I went to my bank for a wire transfer. And I was horrified to find out that after verifying my info, they had full access to the same web interface I use, with my accounts. They even showed it to me, asking me which account I'd like the money to go out from. Is it common for banks to grant this kind of access to employees?
I was just subjected to the most credible phishing attempt I’ve experienced
281–290 of 360 posts
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#282> 3) "We've sent a verification pin to your phone."
> ~ Gets verification pin text from bank's regular number ~
> Me:
I think I'd be able to stop them and refuse at this step. But I suppose it depends on what sort of text shows up in the verification SMS message.
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#283Earlier quoted context omitted.
Banks have this in place already - EMV cards have powerful cryptoprocessors. In Germany we can use chipTAN, it's a small cheap reader for your card where you scan a six-binary-blinking screen that transmits the transaction data, then the card signs it and you get a six-digit TAN back. You can also manually enter the hash to be signed ("start code" is the technical term) and you get the TAN. Customer support could ask…
Would you happen to know what kind of signature scheme they use?
I don't know about the German system, but here they use EMV-CAP: https://en.wikipedia.org/wiki/Chip_Authentication_Program
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#284Well that's brillant, up to the moment when the ask for the PIN code.
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#285Earlier quoted context omitted.
I had an experience indistinguishable from the phishing attack being discussed - with the only difference that I initiated the phone call. A transaction I had initiated had triggered some fraud warnings and my account was locked. They asked for my account number, name, and address for verification. When they got to the point that they sent me a code over SMS and wanted me to tell it to them over the phone, I stopped…
I wonder if bank staff are in on it sometimes. I once was at a bank branch and had the teller pick up the phone, call another teller and tell her my balance in a foreign language that I happen to speak fluently (but don’t look like I should). I wanted to ask her why she would be doing that, but I was a bit more meek in my younger days.
I had something not exactly like this occur to me. It wasn't something I overheard, but I'm pretty sure it went something like this:
1. You talk to a teller at a branch, and they bring up your account details. The teller see's you have a mortgage with the bank, but registered to a different branch. 2. They have some sort of incentive from the mortgage specialists at their own branch or management, to refer those accounts to their own mortgage team. 3. The mortgage department at the new branch calls me, and says I can do an early renewal at a lower rate, if I come in and see them.
Anyways, I did the early renewal at my original branch, as I had a connection to a manager at that location. Either way, I ended up shaving a good chunk of interest by renewing a year early.
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#286Nit-pick: Phishing is sending out e-mails and hoping someone responds with private info. Vishing is phishing via voicemail. Calling someone up and using an elaborate set of mental tricks to gain unauthorized access is social engineering.
Many fun stories here: https://www.youtube.com/results?search_query=social+engineer...
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#287OP here. Just a couple of the things I learned since I posted the Twitter thread: - The caller spoofed the phone number of the bank. The bank was not in my contacts, so I did not notice. Someone else in the thread noted that they did have the bank's phone number stored, which upped the credibility of the call to them. - The caller called me twice in rapid succession (First ignore the call from a number you do not kno…
I've got a number of calls from my bank over the years (usually the Visa department asking about international charges) and my standard response has always been "I'm sorry, as a rule I do not discuss personal details with someone who called me, since I don't know who you are" and they typically respond with "no problem, please call the number on the back of your credit card". I still wish they wouldn't try to initiat…
Why would they need to verify you when they call your phone? When I got theses calls personnaly it was a robot voice that was simply asking if a few of my transactions were done by me. It only happened twice, and I feel they make sure to include both actual transactions and a few fake ones to verify your truthfulness because in both case I had one that was clearly wrong that I never saw in my transaction log and they didn't replace my card.
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#288OP here. Just a couple of the things I learned since I posted the Twitter thread: - The caller spoofed the phone number of the bank. The bank was not in my contacts, so I did not notice. Someone else in the thread noted that they did have the bank's phone number stored, which upped the credibility of the call to them. - The caller called me twice in rapid succession (First ignore the call from a number you do not kno…
I would say Thanks for the call. I'm hanging up now to call my bank to verify this.
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#289I don't understand how step 4 was achieved. How did they get a list of recent transactions? Or does the password reset functionality ask you to verify certain transactions?
Re: I was just subjected to the most credible phishing attempt I’ve experienced
#290Earlier quoted context omitted.
Good idea - but here in the UK there was a scam where they called you and THEN suggested you call the number on the back of the card. They then don't hang up, but play a dialling tone down the line until you dial the number. At which time they 'answer'. This only works on home phones, not mobile, but is worth considering, and warning your family/friends about.
Have you any idea when this worked in the UK? It's such an old story that you'd have thought there would be an explanation online by now of exactly which telephone exchanges had this problem and when those telephone exchanges were in use. For what it's worth, it didn't work when I tried it, probably in the 1980s. Perhaps it worked in the 1970s in some places?
Mechanically it's more or less unavoidable that call circuits are opened by the caller and can't close until the caller is disconnected with a Strowger exchange (electro-mechanical, pulse dialled). Once they moved to System X (the first digital exchanges, which introduced tone dialling though they can still interpret pulses) it becomes a matter of software engineering in the face of two conflicting considerations
1. Users do not expect the call to drop if for some reason the connection to the recipient momentarily is interrupted - there doesn't seem to be any obvious reason it should be right? Remember users don't understand how any of this actually works.
2. But, when they hang up, which to you as the exchange looks essentially the same as the connection being interrupted, they expected the call to end.
As an extreme example of (1) suppose you have a rotary telephone and idly while talking on a call you put a finger in the dial and dial a '4'. What do you expect to happen? Nothing right? Maybe it makes some click noises, and you apologise to the person at the other end. But those click noises are the same - for a fraction of a second - as hanging up. So if we just naively code the system to drop calls whenever it thinks anybody has hung up, the call drops. You can bet customers will not be happy.
So the providers would pick a plausible delay. OK, let's say after two minutes with the call recipient showing as closed we'll give up and end the call, the caller can always just call back if that's a mistake anyway.
Well this fraud comes into the picture, adding a third consideration to the balancing act. Most UK providers would go in and choose a new smaller timeout. One second seems to cause false positives. How about five seconds?
So there's going to have been a window, and it will vary depending on where you live. System X was definitely not everywhere in the 1980s. It will also depend how you tested. If you tried waiting 5 minutes and the timer was set for 30 seconds then your test seems fine, but a victim who hangs up, counts to five and then tries their bank will get stung.