Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm a scam prevention expert and I got scammed

lupinia.net

Post reply on HN
Print view View original

51–60 of 562 posts

Re: I'm a scam prevention expert and I got scammed

#51

Post by hunter2_ »

onaworkcomputer wrote: post #33
hunter2_ wrote: post #24

Earlier quoted context omitted.

> sum of the last 4 It's a chicken/egg problem of not wanting to give information first, but a one-way function (hash) is a fantastic idea. The collision possibilities in this particular function are worrisome, though.

It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?" It would be difficult to come up with something you could reasonably ask an acc…

For sure. I wonder what the state of the art is in human-friendly challenges.

Re: I'm a scam prevention expert and I got scammed

#52

Post by [deleted] »

compsciphd wrote: post #25
buscoquadnary wrote: post #8

Security theater. I had a situation where I had to buy something online from a company in Europe (owl4thunderbird) I placed the charge and then right after I got a text telling me to call a # for a possible fraud alert. That's a big red flag there. So I try and find the phone # of the fraud dept of Citi because anyone can send a text message. Turns out can't find it anywhere in the official Citi site. So I finally gi…

isn't there a phone # printed on your credit card?

[deleted]

Re: I'm a scam prevention expert and I got scammed

#53

Post by vmception »

> if it was a scam, then this was clearly a bluff to try to reassure me, but he had WAY more information about me than I would expect an average scammer to have

you can purchase FULLZ from darkweb marketplaces, these contain name and address and social security number and often come with credit card details too

with that, you can do social engineering like this, you can also remote desktop into any computer nearby to their zipcode (from a different darknet marketplace of compromised computers being rented out) and purchase things online from that, making it less likely to be flagged

the idea that "scammers intentionally do obviously red flag things to weed out discerning people and just target susceptible people" is just one segment of the market. doing smarter more cunning things is entirely available and entirely lucrative

Re: I'm a scam prevention expert and I got scammed

#54

Post by AdamTReineke »

ghostly_s wrote: post #46
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

Your neighbor just dialed the new number without hanging up first?

I could see this working if the other end played a click followed by and dial tone sound.

Re: I'm a scam prevention expert and I got scammed

#55

Post by whimsicalism »

iforgotpassword wrote: post #38
whimsicalism wrote: post #17

Just don't give people 2FA codes? I am never going to give a 2FA code to someone who calls me, no matter what combination of words come out of their mouth.

As TFA starts out, it is always easy to point out all the mistakes after the fact. People underestimate how prone the mind is to just trying to play down danger, inconvenience and generally unpleasing situations. Even after a few minutes on the phone, after you built up the most basic "relationship" with the person on the other end, you simply don't want this to be a scam. Avoiding cognitive dissonance. Just like whe…

Look, I certainly believe that as you get larger and larger groups of people, law of large numbers it becomes inevitable that someone becomes scammed.

And I certainly don't doubt that I could be scammed at some time, especially by a phishing email or something of the sort.

But I don't think I'll ever give out a 2FA code to anybody that's not me. It's a really simple rule of thumb. Just never do it, there is never any reason for anybody besides myself to know my 2FA. If there is a reason, that is unfortunate that they've designed their system that way because, again, I am never going to give out my 2FA code to anybody.

The person in your anecdote never gave his 2FA to anybody, so it is not relevant to what I am discussing.

Re: I'm a scam prevention expert and I got scammed

#56

Post by KMag »

buscoquadnary wrote: post #8

Security theater. I had a situation where I had to buy something online from a company in Europe (owl4thunderbird) I placed the charge and then right after I got a text telling me to call a # for a possible fraud alert. That's a big red flag there. So I try and find the phone # of the fraud dept of Citi because anyone can send a text message. Turns out can't find it anywhere in the official Citi site. So I finally gi…

Side note: if unexpectedly getting a new card, call the support number on your old card. A friend of mine almost got taken about 15 years ago by a scam where someone got his address and bank name, then sent him a fake credit card from that bank with a letter saying something like fraud had been detected and they were sending him a replacement card. When he called the number on the new card's activation sticker, something seemed off and he balked when they asked for his SSN. He called the support number from his old credit card and confirmed that he had in fact not been sent a new credit card by them!

Hopefully we can at some point stop treating a SSN as a universal password that can never be changed. At least mother's maiden name stopped being a universal security question.

Re: I'm a scam prevention expert and I got scammed

#57

Post by switchbak »

rolobio wrote: post #6

I nearly got taken by a scammer because Amazon transferred me to one. I purchased a set of Reolink cameras on Amazon, (they've been great) one of them failed a couple months in. I contacted Amazon customer support (via my Amazon login and in their interface) and they wanted to troubleshoot with their technical team. Eventually the (very helpful) Amazon technician suggested contacting Reolink for support and started a…

Not an isolated incident. My mother was transferred to an Amazon employee who tried to scam her as well. This was years ago, and I reported it to Amazon. No idea what eventually happened, but I was shocked that they'd be so brazen about committing fraud as an actual employee.

Re: I'm a scam prevention expert and I got scammed

#58

Post by ghostly_s »

nopeYouAreWrong wrote: post #22

I'm so skeptical of these "experts" especially if they write a blog post where they hate their bank. I've been with Wells for over a decade. They have never called me. Never. I have had "fraud" alerts hundreds of times. They always happen at certain POS, and it's always a text alert. Some of the stories I read make me viscerally react with "what in the world are you doing with something as simple as a bank account?"…

> I'm so skeptical of these "experts" especially if they write a blog post where they hate their bank.

There is a nearly endless list of legitimate reasons for one to hate Wells Fargo.

Re: I'm a scam prevention expert and I got scammed

#59

Post by harshreality »

ghostly_s wrote: post #46
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

Your neighbor just dialed the new number without hanging up first?

Unless both sides hang up, there's something like a 10-20 second window where the call is held open. Hanging up, picking up within 10 seconds and dialing, means you're still connected to the original caller. If they're clever, the might even detect the click of you hanging up, and play a dialtone for when you pick back up, and stop playing it when you start to dial.

Re: I'm a scam prevention expert and I got scammed

#60

Post by rolobio »

ejb999 wrote: post #36
dqv wrote: post #28

Earlier quoted context omitted.

Well this initiated a rant, not directly related to ads, but Google in general. This is an internet literacy issue I’ve noticed more and more. People will refer to Google listings as an authoritative source even if the data comes from some third party. “Is this Jordan’s Tiles?” “No. This is Patrick. You have the wrong number.” “It says on their website this is the number!” “Their website is wrong, this isn’t Jordan’s…

I've had that happen to me as well - person finds a wrong number online someplace, calls me, and then is mad at me that I am not who they are looking for...go figure.

Had this happen to me when I was in IT. I got a cold transfer of an angry customer who wanted to talk to a guy who had a very similar name. I told the customer that they wanted the other guy, I was in the wrong department, and they wouldn’t believe me. They said “I know it’s you from yesterday, I recognize your voice!” How was I supposed to argue against that?? Eventually I convinced them and did a warm transfer to the correct guy. We do have similar voices…
Post reply on HN