Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm a scam prevention expert and I got scammed

lupinia.net

Post reply on HN
Print view View original

31–40 of 562 posts

Re: I'm a scam prevention expert and I got scammed

#31

Post by mekoka »

dade_ wrote: post #16

Not much of an expert, caller ID means nothing. Standard procedure for everybody in the last 20 years should be: Whenever I get a call about security or fraud from the bank, I thank them for the notification and tell them I will call them back, and hang up. Then I call the number on my credit /bank card, not the number I was called from. Fortunately there is a lost or stolen cards so there is no queue time and tell t…

Simple and effective. It's been over 10 years that I've followed this same protocol. It hasn't failed me yet. I also don't think I've missed anything that could have been better handled, had I chosen to speak to the caller. Just don't say anything, beyond greetings, to the caller.

Re: I'm a scam prevention expert and I got scammed

#32

Post by buscoquadnary »

nopeYouAreWrong wrote: post #22

I'm so skeptical of these "experts" especially if they write a blog post where they hate their bank. I've been with Wells for over a decade. They have never called me. Never. I have had "fraud" alerts hundreds of times. They always happen at certain POS, and it's always a text alert. Some of the stories I read make me viscerally react with "what in the world are you doing with something as simple as a bank account?"…

My wife used Well's Fargo, I've heard about how they don't like to bother customers, in fact they hate it so much they didn't even bother notifying customers when opening new accounts for them, or performing actions on their behalf to generate fees.

Re: I'm a scam prevention expert and I got scammed

#33

Post by onaworkcomputer »

hunter2_ wrote: post #24
gnicholas wrote: post #10

> He verified my name, he had the last four digits of my debit card number, and everything generally seemed to follow the normal script of a transaction verification call There's a red flag right there — I've never found a bank willing to provide any verification of who they are when calling me. They call me and ask me to give them a code or card number without providing me with any proof of their identity. I've trie…

> sum of the last 4 It's a chicken/egg problem of not wanting to give information first, but a one-way function (hash) is a fantastic idea. The collision possibilities in this particular function are worrisome, though.

It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?"

It would be difficult to come up with something you could reasonably ask an account holder to figure out on their own that also wasn't easy to randomly guess.

Re: I'm a scam prevention expert and I got scammed

#34

Post by anonymousisme »

I had a legitimate call from my credit union last month. They were following up on a problem I had reported with their on-line bill pay system. Toward the beginning of the call, they wanted to verify that it was me and they asked me to provide them with the 2FA code they had just texted to me. I declined and told them that this is what scammers do. They agreed with me and encouraged me to call them back at the number on my ATM card.

I thought it was really unprofessional of them to operate this way.

Re: I'm a scam prevention expert and I got scammed

#35

Post by buscoquadnary »

hunter2_ wrote: post #18
buscoquadnary wrote: post #8

Security theater. I had a situation where I had to buy something online from a company in Europe (owl4thunderbird) I placed the charge and then right after I got a text telling me to call a # for a possible fraud alert. That's a big red flag there. So I try and find the phone # of the fraud dept of Citi because anyone can send a text message. Turns out can't find it anywhere in the official Citi site. So I finally gi…

> always says "You will never be asked for this code" and everytime they ask for it. Yes, but the real meaning behind that phrase is "You will only be asked for this code by pages served by our domain name or a native app we published." It's unfortunate brevity.

Sorry the exact message is something like you will never be asked for this by a real employee.

Re: I'm a scam prevention expert and I got scammed

#36

Post by ejb999 »

dqv wrote: post #28
______-_-______ wrote: post #13

Earlier quoted context omitted.

I bet your Amazon rep just searched for Reolink and clicked on a Google ad that happened to belong to the scammers.

Well this initiated a rant, not directly related to ads, but Google in general. This is an internet literacy issue I’ve noticed more and more. People will refer to Google listings as an authoritative source even if the data comes from some third party. “Is this Jordan’s Tiles?” “No. This is Patrick. You have the wrong number.” “It says on their website this is the number!” “Their website is wrong, this isn’t Jordan’s…

I've had that happen to me as well - person finds a wrong number online someplace, calls me, and then is mad at me that I am not who they are looking for...go figure.

Re: I'm a scam prevention expert and I got scammed

#38

Post by iforgotpassword »

whimsicalism wrote: post #17

Just don't give people 2FA codes? I am never going to give a 2FA code to someone who calls me, no matter what combination of words come out of their mouth.

As TFA starts out, it is always easy to point out all the mistakes after the fact. People underestimate how prone the mind is to just trying to play down danger, inconvenience and generally unpleasing situations. Even after a few minutes on the phone, after you built up the most basic "relationship" with the person on the other end, you simply don't want this to be a scam. Avoiding cognitive dissonance. Just like when you bought something expensive that doesn't really meet your expectations.

Then you must not underestimate the pressure under which you then are, because either way is not a pleasant situation (getting scammed or having been scammed already trying to contain the damage). I fully believe the author that they only skimmed that mail and weren't even aware that this is 2FA. It must have seemed like "just some one-off verification code".

Then I think there is also this phenomenon where experts think that just by being an expert on something, they are immune to it. Not consciously, rationally, but lingering in the subconsciousness. It reminds me of the show "the good doctor" where a seasoned oncologist is diagnosed with a brain tumor and completely blocks off any conversation about it and rejecting treatment. I think that very well illustrates what I mean.

Another anecdote to add here if that Jim Browning, a YouTuber focused on finding scam call centers, getting into their systems to gather information and shutting them down in the end got his YouTube account taken away from him through a scammer on the phone. So I'd be careful with claiming this could never happen to me because I'd never do X. Until the day you do without realizing.

Re: I'm a scam prevention expert and I got scammed

#40

Post by acheron »

dqv wrote: post #28
______-_-______ wrote: post #13

Earlier quoted context omitted.

I bet your Amazon rep just searched for Reolink and clicked on a Google ad that happened to belong to the scammers.

Well this initiated a rant, not directly related to ads, but Google in general. This is an internet literacy issue I’ve noticed more and more. People will refer to Google listings as an authoritative source even if the data comes from some third party. “Is this Jordan’s Tiles?” “No. This is Patrick. You have the wrong number.” “It says on their website this is the number!” “Their website is wrong, this isn’t Jordan’s…

Yeah, you hear about this with the people who get taken in by Grubhub or whoever that's spoofing a restaurant's phone number/ordering site. I would never take a third-party source as authoritative, but apparently people do it.
Post reply on HN