I'm a scam prevention expert and I got scammed

> Said he was calling from Wells Fargo's Fraud Prevention Department, calling to verify some transactions. He verified my name, he had the last four digits of my debit card number, and everything generally seemed to follow the normal script of a transaction verification call.

I recently had to speak with the Zelle FPD because it had frozen my ability to send (but not receive) after I had made some small trial transactions. Also, I use a Google Voice number with Zelle, which Zelle seems not to like.

I was shocked at the depth of questions that the Zelle FPD agent asked me. My SSN, DOB, address and recent transactions were expected. But then it went deeper: state where my birth certificate was issued. Fine. Car loans I had. Okay, this is all stuff on my credit report. But then it went past me: where my kids were born and their DOBs; my brother's DOB and age; my wife's DOB and age; my mother-in-law's (!) maiden name. Keep in mind this all after I've authenticated myself to my bank including a phone password I have setup. And, it's for a secondary checking account that I have less than $1000 in.

Real bank FPDs have a crazy amount of information on not just you, but also your family members.

I personally would hang up if any of my financial institutions called me and I'd call them back.

He almost certainly meant that sha256(card number) can be bruteforced to figure out what card number was hashed. 10^12*256 bits is only 29 TiB.

So providing a hashed card number to a potential scammer is just as bad as providing the card number.

Honestly, how do you know what the right number is though? Everybody outsources their stuff. The real website is at jordans-eatery.outsourcedsite.com. Or maybe the guy at jordans-eatery.seo.com is taking calls and placing orders to the real site at a markup. Or maybe the real number is on jordans-eatery.com. Or maybe it's none of those.

There was one time I thought I was being scammed, but it turns out there was an actual issue with my bank account.

Sitting at my desk at work, I get a phone call from my bank on by cell phone. "Mr. Anechoic, there appears to be a security issue with your bank account. We can resolve it for you. For security purposes, can you give your checking account number and the last four of you SSN"?

This is clearly a scam, right? I tell the guy there is no way I'm giving up that info for a random dude that calls me. He stresses again that there is an issue with my bank account, that the account will be frozen, and there is nothing he can do about it without the account and SSN information. I refuse again, and he tells me that I should go to a local bank to get it resolved. I hang up and go back to work. I log into my bank account website, and all seems fine.

After about 20 minutes, something is still bothering me, so I leave work to go to a local branch. I speak to a branch manager about what happened, and she agrees with me that it was clearly an attempted scam and the bank would never call me and ask for that information. But just to be safe, she checks my account on her computer. To our surprise, it turns out there was a security flag on my account!

She calls the bank security desk, they confirm that there was an attempt by someone in another branch a few states to get money from my account and the call I got was legit and logged in their system. We get the account locked out, and then the manager asks to talk to a security supervisor about the messed-up way they reached out to me. The security person basically said "this is how they do things" and didn't see the problem. The bank manager apologized, said it was messed up and she would try to run things up the chain to improve their process.

Damned if you do, damned if you don't.

There may be inferences you can make from the sum that aren't immediately obvious. If cards can end in four zeros, the sum and the last four digits contain equivalent information, but you would also confirm that three of the digits are zeros if the sum was 1. It's something that, if I were a bank, I would want someone with a background in number theory to weigh in on. If I were a paranoid bank exec, I wouldn't trust the low-wage customer support reps I had on staff to vet customer questions for how much information they might leak and would instead have blanket prohibitions on answering questions from customers until after the authentication phase of the call.

Questions like "is the sum even?" trade a lower opportunity for information leakage for a greater opportunity for a random guess to be correct.