I'm a scam prevention expert and I got scammed

Easy way to avoid this: don't answer the phone

This is a perfect case of iatrogenic security. When the systems get so complex and remote that security experts are caught out, they do more harm than good.

It's also a consequence of solutionism, systematic monotonicity, mother-knows-best and externalising costs such that we:

Only add more security solutions on top of existing ones to fix their holes.

Deny the user any choice or agency in setting their own security terms

Never revoke or remove a feature (that would be admitting defeat)

Push the burden in every process on to the user

Create fear in the user - that any misstep will cause them more inconvenience and trouble.

Make security an authoritarian culture such that user will not question or be sceptical.

All of these are antithetical to civic cyber-security that we need available so educated and empowered users can operate technology under their control.

I nearly got taken by a scammer because Amazon transferred me to one. I purchased a set of Reolink cameras on Amazon, (they've been great) one of them failed a couple months in. I contacted Amazon customer support (via my Amazon login and in their interface) and they wanted to troubleshoot with their technical team. Eventually the (very helpful) Amazon technician suggested contacting Reolink for support and started a 3-way call. The "Reolink" technician got my phone number and then said they wanted to call me back.

They called me back a minute later (now without Amazon recording the conversation) and asked me for my NVR's serial number so they could connect to my NVR. I was shocked they had a backdoor into my NVR but I figured I'd let it play out. A minute later the technician said that he was having trouble connecting because "an internet virus is corrupting my firewall". I was extremely confused and thought it must be a translation problem. Until he kept insisting it was a problem and became belligerent and angry. He said I needed to pay $300 to have an on-site technician troubleshoot the problem. I got angry because he was making some weird excuse for their camera not working, and wanting to charge me rather than just ship me a replacement. I refused and he started mocking me. I demanded his manager and he ignored me. Eventually I hung up and called Amazon back.

The Amazon technician was helpful and shipped me a replacement. I contacted Reolink via email to complain about their technician. They responded that they have no on-site technicians and that it was a scam!

I was blown away that Amazon would transfer me to a scammer. I contacted Amazon again and let them know what had happened. Hopefully they will figure out how their guy got this scammers phone number and teach him how to find a 3rd party phone number...

Security theater. I had a situation where I had to buy something online from a company in Europe (owl4thunderbird) I placed the charge and then right after I got a text telling me to call a # for a possible fraud alert.

That's a big red flag there. So I try and find the phone # of the fraud dept of Citi because anyone can send a text message. Turns out can't find it anywhere in the official Citi site. So I finally give up and call the phone # before they could go further they asked me to confirm a 2FA they would text to me. At that point I noped out and decided if it was a realt problem I'd find out about it another way.

The problem is I now know how easy it is to break into any Citi account just send them a text with a # and pretend to be the bank. The worst part is every every every message I get that is actually being secure always says "You will never be asked for this code" and everytime they ask for it.

It is security theater of the worst degree by incompetents and MBAs and I am getting sick of it.

> He verified my name, he had the last four digits of my debit card number, and everything generally seemed to follow the normal script of a transaction verification call

There's a red flag right there — I've never found a bank willing to provide any verification of who they are when calling me. They call me and ask me to give them a code or card number without providing me with any proof of their identity. I've tried to get them to give the sum of the last 4 numbers of my account, but they won't do it.

They always tell me to just call back using the number on my card and try to find my way to the right department. Super annoying.