Live data from Hacker News

The golden age of scammers: AI-powered phishing

mailgun.com

111–120 of 143 posts

Re: The golden age of scammers: AI-powered phishing

#111
post #95

Earlier quoted context omitted.

It appears that criminals really are stupid, and thank goodness for it!

Most people are criminals. Speeding, piracy, dubious porn, and so on. In a wider sense consumption of products or other use of criminally exploited labour. At the same time, most people are more clever than one tends to expect.

”If the prosecutor is obliged to choose his cases, it follows that he can choose his defendants. Therein is the most dangerous power of the prosecutor: that he will pick people that he thinks he should get, rather than pick cases that need to be prosecuted. With the law books filled with a great assortment of crimes, a prosecutor stands a fair chance of finding at least a technical violation of some act on the part of almost anyone."

-Justice Robert H Jackson

Re: The golden age of scammers: AI-powered phishing

#112

Earlier quoted context omitted.

The ROI on scams based in Indian call centers is already huge. They recently took my mom for $25k for what was a few hours of “work” over the span of two days. When I reviewed their communications and got the full story from my mom they’re in some ways laughably bad and in other ways very cunning. Turns out it all started with a comically bad initial e-mail, pop-up, and then remote access. Then follow-up calls and te…

Banks are actually getting much better at ferreting out these scams. My Mom got one of those calls where the guy said my son was jail and they needed to pay his cash bail to get him out. They never called me or him, just panicked and went to the bank to get the cash out and the bank refused to give them the money because they knew it was a scam. They started asking my parents questions and pointing out how the scam w…

I've read that even Target does this now, especially when an elderly person comes in trying to buy thousands of dollars worth of gift cards. Unfortunately too late for my grandmother. In her case, she'll know it's a scam and still participate just because she's bored.

Re: The golden age of scammers: AI-powered phishing

#113
post #13

Earlier quoted context omitted.

As evidence of the current state of play: Friend receives an email from ISP, asking her to contact them. She searches, comes across a "customer service number" on a legit looking page, calls them up. (Whoever she called) plays out a 30 minute charade about how she's been flagged by IRS for illegal activity and is about to have her business accounts frozen, including multiple phone transfers to "another party" (played…

I shouldn't, but sometimes I play along just to see what the scam looks like. Last time I did this, it took three days of texting my new friend before it was finally clear that what she really wanted more than anything was to teach me to trade cryptocurrency. Once, I thought I had her, because she spelled D&D like: D&D, but she played it off real cool and just explained that her English isn't that great so she us…

I noticed the same pattern. The rude humans afterwards answered with expressions sounding like translated Chinese (like, I wouldn't think mentioning the ancestors' graves)

Re: The golden age of scammers: AI-powered phishing

#114
post #100

Earlier quoted context omitted.

basically everything that retains the same structure between two occurrences can be inferred. Only randomness cannot be inferred. But true randomness is not useful for determining if you are who you say you are.

Even a password can be changed if there's a compromise. Biometrics are bad because they can be imitated, but not changed. A breach is permanent

good point, but that was left out of the earlier statement about inference. I suppose I should have inferred it however.

Re: The golden age of scammers: AI-powered phishing

#115

Earlier quoted context omitted.

The ROI on scams based in Indian call centers is already huge. They recently took my mom for $25k for what was a few hours of “work” over the span of two days. When I reviewed their communications and got the full story from my mom they’re in some ways laughably bad and in other ways very cunning. Turns out it all started with a comically bad initial e-mail, pop-up, and then remote access. Then follow-up calls and te…

Banks are actually getting much better at ferreting out these scams. My Mom got one of those calls where the guy said my son was jail and they needed to pay his cash bail to get him out. They never called me or him, just panicked and went to the bank to get the cash out and the bank refused to give them the money because they knew it was a scam. They started asking my parents questions and pointing out how the scam w…

Then you get the BTC folks arguing that all this regulation and safeguarding is a plot to prevent you from using your money. And once BTC takes over your mom can finally be her own bank.

Re: The golden age of scammers: AI-powered phishing

#116
post #98

> link or attachment that when clicked or downloaded, takes you to a spoofed website or installs malicious software on your device. Can someone show me a modern OS that would install software by clicking a link?

Does IOS count? In that case people have been compromised without clicking anything and just getting an invisible text message is enough. Browsers have exploits with sandbox escapes. Any link to a file that is automatically downloaded and opened in an application (office doc or PDF for example) can exploit vulnerabilities in the underlying application and allow for anything including remote code execution.

Re: The golden age of scammers: AI-powered phishing

#117

Earlier quoted context omitted.

The ROI on scams based in Indian call centers is already huge. They recently took my mom for $25k for what was a few hours of “work” over the span of two days. When I reviewed their communications and got the full story from my mom they’re in some ways laughably bad and in other ways very cunning. Turns out it all started with a comically bad initial e-mail, pop-up, and then remote access. Then follow-up calls and te…

Banks are actually getting much better at ferreting out these scams. My Mom got one of those calls where the guy said my son was jail and they needed to pay his cash bail to get him out. They never called me or him, just panicked and went to the bank to get the cash out and the bank refused to give them the money because they knew it was a scam. They started asking my parents questions and pointing out how the scam w…

Her bank tried... She lives across the country from me and I flew to see her to help put her life back together. It was very involved: pretty much had to reconstruct her entire digital life. New phone numbers, e-mail addresses, online accounts, passwords, all banking, credit cards, recurring payments, bill pay - EVERYTHING. My concern was now that they had a fish on the hook where the scam worked once, they'd (of course) come back with a new angle.

As part of that we went to the branch where she made these cash withdrawals. I had the opportunity to speak with the teller that was there both days. The teller's story (and I believe her) was that she was extremely suspicious of the overall situation and had an extended conversation with my mom about how unusual this was, often used for scams, etc. However, back to my original point the scammers were well ahead of this...

My mom banks with Wells Fargo. Once the scammers discovered that they were able to capitalize on the news story from years back with the Wells Fargo fake accounts/fraud scandal. They even sent her links to news stories about it.

They were able to convince my mom that her money wasn't safe at Wells Fargo because the government was investigating another Wells Fargo scam and that all of their employees are in on it. They had another scammer in the org impersonate someone from the Federal Trade Commission (ridiculous) who was supposedly investigating this.

They prepared my mom with a robust script to dance around the teller's questions and skepticism that the cash she was withdrawing was for legitimate purposes. In this case the script was something about my mom doing construction on her home and paying laborers, contractors, etc in cash.

The entirety of the scam is wild. Once they got remote access from the phishing e-mail they got opened up Windows Command Prompt and pasted in a bunch of echo statements with stuff like "Child pornography detected" and a bunch of other ridiculous stuff. However - let's remember that thanks to Hollywood any terminal interface looks scary and sophisticated to the general population (every movie ever "hacking" with CLI gibberish).

They had her convinced she was being watched/followed, investigated for CP, her phones were tapped, etc, etc, etc. She was so freaked out she didn't know if she was going to be killed or go to jail.

My sister happened to try to reach her and my mom called her back from a friends phone. Was sister somehow stumbled on this and of course knew it was a scam. My mom didn't believe her. Needless to say I have a lot of credibility in my family on this stuff (given what I do) so thankfully my sister was able to get my mom to call me.

At the beginning of the call I was able to say to my mom "This is a scam. Let me guess: they did X, then did Y, told you Z, something with cryptocurrency, etc, etc". Only when I more-or-less nailed/predicted most of the details before my mom could even tell me her story did she realize that this was, in fact, a scam.

It made me realize something: when we were growing up a saying was "talk to your kids about drugs". There needs to be an equivalent campaign for these scams. Like many here I follow this kind of stuff pretty closely but only thought of it as a curiosity because they're so ridiculous (to me/us). It never occurred to me that I should be regularly updating less sophisticated friends and family members on the scams du jour.

HN Community: Talk to your friends and family about scams.

Re: The golden age of scammers: AI-powered phishing

#118

Earlier quoted context omitted.

Banks are actually getting much better at ferreting out these scams. My Mom got one of those calls where the guy said my son was jail and they needed to pay his cash bail to get him out. They never called me or him, just panicked and went to the bank to get the cash out and the bank refused to give them the money because they knew it was a scam. They started asking my parents questions and pointing out how the scam w…

I've read that even Target does this now, especially when an elderly person comes in trying to buy thousands of dollars worth of gift cards. Unfortunately too late for my grandmother. In her case, she'll know it's a scam and still participate just because she's bored.

If she's bored there are other ways to have fun with scammers. Perhaps this YouTube playlist can inspire her: https://m.youtube.com/playlist?list=PLk5KvJPikK02cQeWELmS-zh...

Re: The golden age of scammers: AI-powered phishing

#120
post #77

Earlier quoted context omitted.

I beat that drum so long it turned into beating my head against a wall. The last two companies I worked for insisted that customer account security was the highest priority, but as soon as I said we needed to stop hiding links to our own website behind Hubspot tracking URLs so we don't train our customers to click links that look like gobbledygook garbage, the marketing team melted down and it became clear where user…

People realize the risk, they just think it can't happen to them personally , and/or just don't care because they personally aren't going to bear the risk. People run businesses the way they drive their cars, i.e. selfishly and arrogantly.

Are all people bad drivers? Technology gives diffusion of responsibility. And business gives limited liability. Put them together and you have magnified sense of agency and invulnerability. But without wheels and a windshield people couldn't travel at 100 miles an hour. The question is how gracefully the person at the wheel handles that. Are you a gentleman in a Jaguar or a BMW driver? [0]

[0] https://www.fastcompany.com/90457589/science-proves-it-men-w...

Post reply on HN