Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm a scam prevention expert and I got scammed

lupinia.net

Post reply on HN
Print view View original

71–80 of 562 posts

Re: I'm a scam prevention expert and I got scammed

#71

Post by paxys »

I expected some crazy new attack vector that was so sophisticated it could fool this Scam Prevention Expert, but this post is laughable. They fell for textbook "scamming 101" that my grandma knows to avoid.

Here's one tip for this expert – if you get a 2FA code over text or email that clearly has the line "we will never contact you for this code over phone or text" right under it, DON'T give it to a "support agent" over the phone.

> this is clearly a two-factor authentication code, meant to be entered directly into an authentication page. Which is normally not something that would be relayed over a phone call to a customer service rep. A concern that I raised to Daniel. However, he said that it was part of Apple's system, which they only had limited access to. An explanation that, as someone who works with computers, data security, and API integration professionally, I completely bought

And after reading multiple paragraphs of this person describing money literally taken out of their account in front of their eyes, you get to this line:

> Putting all of this together, the scales started to tip toward this potentially being a scam call, but I still wasn't certain

I really hope they don't have a lot of clients

Re: I'm a scam prevention expert and I got scammed

#73

Post by [deleted] »

e40 wrote: post #48
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

The neighbor hung up, but the scammers didn't, and the call was not disconnected? That's not my experience. Is this what you meant?

[deleted]

Re: I'm a scam prevention expert and I got scammed

#74

Post by alskdjflaskjdhf »

klik99 wrote: post #21

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info a…

Yes, this is scam prevention 101. Anyone who called you is always unverified. It's hard for me to take seriously a "scam prevention expert" who doesn't seem to know or follow this rule, which by itself is enough to protect you from most scams. Normally I try not to victim blame people for getting scammed, but when you've made a declaration like that you forfeit that right.

I'll also point out that the author seems to have some complicated arrangement for their phone number(s), presumably in the name of security, that in fact got in the way of identifying this to be a scam.

Re: I'm a scam prevention expert and I got scammed

#75

Post by hunter2_ »

camtarn wrote: post #68
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

For the people who are confused: this is a fairly common thing on landlines in some countries, where the telephone exchange doesn't drop the connection until both ends have hung up, or in some cases when the caller hangs up but not the callee. So it's possible to put your own phone down, but when you pick it up again your phone is still connected to the scammer's telephone. If they play a convincing dial tone, then c…

It even makes the news [0] periodically. Watch the video, especially 2:22-2:36 which reiterates the PSTN behavior.

[0] https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...

Re: I'm a scam prevention expert and I got scammed

#76

Post by GTP »

kmeisthax wrote: post #9

These 2FA bypass scam calls genuinely unnerve me - because they're specifically designed to trick someone who knows how scams work and has actually put some effort into securing their accounts. Hardware authentication factors are, of course, immune to these sorts of attacks because you can't confuse the victim into forwarding their second factor back to you. However, I don't see why you couldn't construct a specific…

But they could still try to trick the victim into reading the code for them.

Re: I'm a scam prevention expert and I got scammed

#77

Post by gnicholas »

onaworkcomputer wrote: post #33
hunter2_ wrote: post #24

Earlier quoted context omitted.

> sum of the last 4 It's a chicken/egg problem of not wanting to give information first, but a one-way function (hash) is a fantastic idea. The collision possibilities in this particular function are worrisome, though.

It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?" It would be difficult to come up with something you could reasonably ask an acc…

What I was suggesting wasn't asking the account holder, but asking the bank. With a little training, the call center reps should be able to handle adding together the last few digits of a card number.

I agree that asking account holders for this would be confusing, but since the bank is the one calling in this case it makes sense that the caller (bank) should provide information first.

Of course, it appears that in this guy's case, not even this would have worked, since they apparently had his full card number.

Re: I'm a scam prevention expert and I got scammed

#79

Post by Zachsa999 »

hunter2_ wrote: post #51
onaworkcomputer wrote: post #33

Earlier quoted context omitted.

It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?" It would be difficult to come up with something you could reasonably ask an acc…

For sure. I wonder what the state of the art is in human-friendly challenges.

Please select pictures containing a boat.

Re: I'm a scam prevention expert and I got scammed

#80

Post by afiori »

camtarn wrote: post #68
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

For the people who are confused: this is a fairly common thing on landlines in some countries, where the telephone exchange doesn't drop the connection until both ends have hung up, or in some cases when the caller hangs up but not the callee. So it's possible to put your own phone down, but when you pick it up again your phone is still connected to the scammer's telephone. If they play a convincing dial tone, then c…

I can confirm that at least once this happened to my family in Italy about 20 years ago.

The most anecdotal statement ever, but a data point nonetheless.

Post reply on HN