Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm a scam prevention expert and I got scammed

lupinia.net

Post reply on HN
Print view View original

361–370 of 562 posts

Re: I'm a scam prevention expert and I got scammed

#361

Post by otterley »

AnIdiotOnTheNet wrote: post #157
otterley wrote: post #26

Scam reports like these really frighten me. If someone of above-average intelligence like the author can nearly be taken for a ride, imagine how easily our friends and family -- who are often far more vulnerable -- can be taken advantage of. As the people most capable of remediating the vulnerabilities in our telecommunication and banking systems, I think we ought to close ranks and insist that our employers do a bet…

Why do you assume the author is of above average intelligence just because they work in a technology profession? I work in this industry, and I've met a lot of people even dumber than me in it, so intelligence can't be much of a requirement.

I'm not assuming she's of above-average intelligence because of where she works. The quality of her blog post speaks for itself.

Re: I'm a scam prevention expert and I got scammed

#362

Post by otterley »

jstarfish wrote: post #106
otterley wrote: post #26

Scam reports like these really frighten me. If someone of above-average intelligence like the author can nearly be taken for a ride, imagine how easily our friends and family -- who are often far more vulnerable -- can be taken advantage of. As the people most capable of remediating the vulnerabilities in our telecommunication and banking systems, I think we ought to close ranks and insist that our employers do a bet…

> imagine how easily our friends and family -- who are often far more vulnerable -- can be taken advantage of. FUD. Hackers and scammers exist, sure, but your friends and family are always most likely going to be victimized by friends and family. Outsiders have to work to collect intelligence, gain access and obtain your trust. Friends and family already have all three prerequisites. Bernie Madoff didn't become the m…

I'm not exactly sure how what you said contradicts my comment. Threats from families are "in addition to," not "instead of."

Re: I'm a scam prevention expert and I got scammed

#364

Post by unixbane »

nilsbunger wrote: post #161
klik99 wrote: post #21

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info a…

Banks and health care providers have aggressively trained customers to be ok with giving sensitive info in a received call. It's a real disservice to the community, but kind of a tragedy of the commons. I also do a callback (verifying the number they give me via a google search) but it seems like almost no one else does. On one of these calls from a bank, I asked the agent whether anyone else asked to do a callback,…

> it seems like almost no one else does

Nope, I do basic stuff like this too. And it's basic stuff. As in, can be defeated by simple wiretaps in infrastructure outside your control.

Re: I'm a scam prevention expert and I got scammed

#365

Post by unixbane »

gridspy wrote: post #197
paxys wrote: post #71

I expected some crazy new attack vector that was so sophisticated it could fool this Scam Prevention Expert, but this post is laughable. They fell for textbook "scamming 101" that my grandma knows to avoid. Here's one tip for this expert – if you get a 2FA code over text or email that clearly has the line "we will never contact you for this code over phone or text" right under it, DON'T give it to a "support agent" o…

Anyone can fall for these attacks in the moment, even experts. That was the point of the article. What makes us vulnerable is that we are human: we get tired, caught up in the urgency of the call and our logical thinking stops working. The actual story of the article is that we need to design systems that are robust even when people are getting scammed. Able to identify and reverse scamming soon after it happens with…

There are no experts in information security. It's just random people with in depth knowledge of some tiny subsystem they happened to feel like studying. They are literally all LARPers who will fall for every single thing aside from whatever class of vulns they specialized in. There is no way to use modern systems securely. Absolutely none. Even with 20 years of study you will still find new ways they are broken and where security forgot to be implemented.

All of this is a consequence of the industry being controlled by what is essentially a 5 year old: monetary incentives.

> Able to identify and reverse scamming soon after it happens with easy ways to report it.

Just make a site with a username / password where the user gets locked out forever if he forgets it. Do banking transactions by singing them with your public key, via a phone app. This is what I was complaining about not being able to do before smart phones became a thing. This is literally better than the tripe the 'experts' come up with. All these roundabout shit ways of authenticating people just add new ways of getting phished, exploited, etc.

Re: I'm a scam prevention expert and I got scammed

#366

Post by jotm »

duderific wrote: post #337
aceazzameen wrote: post #178

Earlier quoted context omitted.

Yep. I've been ordering from Target, Best Buy, and Walmart much more often these days. I just assume the product descriptions and reviews on Amazon are all lies.

As someone who has contributed legitimate reviews on Amazon, I think "all lies" is a bit of an exaggeration.

Do they still allow listing different products on the same page, with the same reviews?

You can read reviews for a whole different model of headphones or kettle, for example, but what you get is another, (usually) cheaper model/revision. Which is insane!

Re: I'm a scam prevention expert and I got scammed

#367

Post by whiddershins »

14 wrote: post #148
carabiner wrote: post #108

Earlier quoted context omitted.

Amazon today is a street side flea market. You really don't know what you'll get. I've started ordering more stuff from traditional retailers. Their online operations these days are really good, and at most a few dollars more than Amazon. Clothes from macys.com, home goods from homedepot.com and target.com, and so on. You're not flooded with choices with these stores that are mostly garbage, instead you get only 1-3…

Agreed. Last example was LED grow light I purchased and description said had a grounded plug. When it arrived there was only a 2 prong plug. I’m weary of everything I buy there now and try find a manufacturer direct order when possible. Fulfilled by Amazon should read as a warning sign.

Just FYI weary = tired … wary = suspicious.

Re: I'm a scam prevention expert and I got scammed

#368

Post by bkyiuuMbF »

camtarn wrote: post #68
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

For the people who are confused: this is a fairly common thing on landlines in some countries, where the telephone exchange doesn't drop the connection until both ends have hung up, or in some cases when the caller hangs up but not the callee. So it's possible to put your own phone down, but when you pick it up again your phone is still connected to the scammer's telephone. If they play a convincing dial tone, then c…

What the actual f. I feel like the only commenter here who wasn't aware of this. Thankfully I don't use landlines, but still, that is beyond crazy to me.

Re: I'm a scam prevention expert and I got scammed

#369

Post by tgsovlerkhgsel »

wccrawford wrote: post #65
klik99 wrote: post #21

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info a…

Agreed. No matter how tired and annoyed I was, I'd have stopped dead at the confirmation code that they asked for. There's absolutely no way I'd have given that to them, even if it meant cancelling my account and using a different bank. That seems a bit extreme, but if their procedures are so crazy as to require circumventing another system's security procedures, I'm not going to bank with them. I actually had a bank…

1) You don't hear about the stories where the scam is stopped.

2) As you have noticed yourself, legitimate banks do what they can to make their actual requests indistinguishable from scams, and "not falling for that" can have severe consequences.

Re: I'm a scam prevention expert and I got scammed

#370

Post by thedougd »

bliteben wrote: post #358
aceazzameen wrote: post #178

Earlier quoted context omitted.

Yep. I've been ordering from Target, Best Buy, and Walmart much more often these days. I just assume the product descriptions and reviews on Amazon are all lies.

God I wish walmart’s site was better, it is like punishment shopping there, why does home depot outclass them in every way?

I thought Jet.com acquisition would solve this. What a waste.
Post reply on HN