Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon's customer service backdoor

medium.com

Post reply on HN
Print view View original

301–310 of 366 posts

Re: Amazon's customer service backdoor

#301

Post by Silhouette »

matt4077 wrote: post #294
jeswin wrote: post #280

Earlier quoted context omitted.

Wow, I was just about to switch to Namecheap. More people need to hear this. How can a registrar make DNS changes without permission and blackmail? Please write a blog post about this.

"If you don't pay us, we'll turn it off" isn't blackmail.

But locking all of romanh's domains, so he can't take his business elsewhere, and transferring all of the traffic intended for his systems to somewhere else, does sound a lot like blackmail, not to mention blatant violation of how domain registration is supposed to work.

Also, $240 because of one chargeback, and doing the above while the customer is trying to sort out a fraud issue? Neither of those sounds like normal practice for a responsible domain registrar either.

Obviously there are two sides to every story and we're only seeing one here, but that one does look pretty bad for Namecheap.

Re: Amazon's customer service backdoor

#302

Post by tamar »

Silhouette wrote: post #301
matt4077 wrote: post #294

Earlier quoted context omitted.

"If you don't pay us, we'll turn it off" isn't blackmail.

But locking all of romanh's domains, so he can't take his business elsewhere, and transferring all of the traffic intended for his systems to somewhere else, does sound a lot like blackmail, not to mention blatant violation of how domain registration is supposed to work. Also, $240 because of one chargeback, and doing the above while the customer is trying to sort out a fraud issue? Neither of those sounds like norma…

Please see my comments above - there are ways around this but it appears that that path was never pursued.

Re: Amazon's customer service backdoor

#303

Post by pfg »

SimpleMinds wrote: post #274
kuschku wrote: post #269

Earlier quoted context omitted.

I had a situation where Amazon couldn't bill my bank account, so they blocked logging in. I verified with just name and address to a customer service rep and asked for the steps I'd have to do to unlock it again, and they told me that (a) the transaction failed, (b) they told me my IBAN. In plaintext. The full IBAN. (c) and then they told me the steps to fix it (wire them the money that I was owing them, plus 6 EUR.…

Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money. Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.

SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction).

Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work".

Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring that they have written permission from each debitor. Additionally, although this might be country-specific as well, chargebacks can be initiated without providing any reason for at least 8 weeks, and in case of a fraudulent transaction, up to 13 months.

Re: Amazon's customer service backdoor

#304

Post by hvidgaard »

SimpleMinds wrote: post #274
kuschku wrote: post #269

Earlier quoted context omitted.

I had a situation where Amazon couldn't bill my bank account, so they blocked logging in. I verified with just name and address to a customer service rep and asked for the steps I'd have to do to unlock it again, and they told me that (a) the transaction failed, (b) they told me my IBAN. In plaintext. The full IBAN. (c) and then they told me the steps to fix it (wire them the money that I was owing them, plus 6 EUR.…

Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money. Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.

If you call a bank or another entity, that has your bank information on record, and claim to be someone specific, can answer basic questions and knows the full IBAN - perhaps they believe you are who you claim to be. This is social engineering, and it works.

Re: Amazon's customer service backdoor

#305

Post by pcora »

kuschku wrote: post #271
steve-howard wrote: post #167

Earlier quoted context omitted.

My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

And you can imagine how maddening it is when 90% of students worldwide don't have a .edu, but some do. Only one university in Germany has a .edu, and their students obviously manage to get far more benefits than those of us with an @informatik.uni-kiel.de email.

99% of times we need to send proof that we are students, what is interesting is that many companies accept that even if it's not in English. Probably on good faith.

In Brazil, universities can use .edu.br, but we have few universities providing email addresses to students and also, the majority of grad schools in Brazil are not universities but a small college called 'University Center'

Re: Amazon's customer service backdoor

#306

Post by hvidgaard »

rhblake wrote: post #145
turar wrote: post #37

If you own a home in the U.S., anybody already can get your address legally and easily from your county or district property appraiser's/assessor's website. Along with how much you paid for it, and when you bought it. So calling Amazon CS rep is a hard way to go about it. :)

Ah... if you're a resident of Sweden, anybody can get your full name, address, date of birth, civil status, list of company engagements (e.g., board member, owner of a firm, etc.) and the make and year of any cars registered by going to one of several websites - http://www.ratsit.se/ being one of the most popular ones. No login needed. This information is public data straight from the government. (Exceptions: people…

I believe that such openness from the govnerment is actually helping you implement a more sound security procedure. If all of that information is well known to be publicly available, there is much more awareness that it is unless as authorisation.

Re: Amazon's customer service backdoor

#308

Post by garblegarble »

wrboyce wrote: post #300
lucaspiller wrote: post #231

Earlier quoted context omitted.

In the UK this and a lot more is public information. As an example of what is available about me online (without paying a penny) just by searching for my name: - The year I was born - The district I was born (not the exact town, although that wouldn't be hard to guess) - My mother's maiden name (which is what most banks et al ask as a security question...) - The areas I've lived (based upon the electoral register, wh…

Your remark about opting out of the electoral register is not quite correct. It is a requirement to register if requested, the fine for failing to do so is £80. However, it is always an option to not appear on the open register. The open register is publicly accessible, and being absent from it will not be detrimental to your credit rating.

>being absent from it will not be detrimental to your credit rating.

But it will make identity checks with banks a little more complicated, normally they use the electoral register to confirm your address

Re: Amazon's customer service backdoor

#309

Post by SimpleMinds »

pfg wrote: post #303
SimpleMinds wrote: post #274

Earlier quoted context omitted.

Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money. Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.

SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction). Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work". Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring tha…

Thanks, didn't know about that. Sounds like it's very specific version of account and most default accounts with IBAN doesn't have this possibility.

Re: Amazon's customer service backdoor

#310

Post by krampian »

I'm concerned that names and addresses alone seem to be enough for these guys to do meaningful ID theft with. The phone book is full of names and addresses anyone can get their hands on easily. Even these guys in India - there's whitepages.com. Not sure why they're going to all the trouble of trying to game Amazon's customer support.

On that note, I order alot from Amazon and throw out their boxes in the trash outside all the time. Sometimes I notice that neighbors (presumably) take those boxes for their own use before trash pickup comes along. All of them have my name and mailing address on them...

Post reply on HN