Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Voice Phishing Scams Are Getting More Clever

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 226 posts

Re: Voice Phishing Scams Are Getting More Clever

#61

Post by sf_rob »

techsupporter wrote: post #32
aero142 wrote: post #21

Earlier quoted context omitted.

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me. I always pull up the website and confirm before telling them anything.

> I usually laugh at them and tell them they they are the unverified party in this phone call, not me. This is one of the related reasons why I finally got my ducks in a row and switched away from Chase three years ago. Their potential-fraud-has-happened outreach department was, in my experience, terrible about this. It didn't help that their potential-fraud-detection department was similarly bad. ("You used your deb…

I contacted Wells Fargo because their survey emails come from a third party email address and link to a different third party site. I was very specific in my feedback that I thought the survey was legitimate but that they shouldn't habituate their customers to entering even general data on unaffiliated sites. They called me and I reiterated the above and even got a fancy case number. After a month I got a voicemail that they completed their investigation and the survey was non-fraudulent... Hooray.

Re: Voice Phishing Scams Are Getting More Clever

#62

Post by ghaff »

CWuestefeld wrote: post #39
techsupporter wrote: post #32

Earlier quoted context omitted.

> I usually laugh at them and tell them they they are the unverified party in this phone call, not me. This is one of the related reasons why I finally got my ducks in a row and switched away from Chase three years ago. Their potential-fraud-has-happened outreach department was, in my experience, terrible about this. It didn't help that their potential-fraud-detection department was similarly bad. ("You used your deb…

their potential-fraud-detection department was similarly bad. ("You used your debit card at an AM/PM in Washington State!!!!" Yes, I know, it is about 900 feet from my house; I go there regularly.) A year ago I had an awful experience with this. We were on vacation at Big Bend National Park, which is hours away from everything in southwest Texas. When trying to pay for breakfast, our card was denied. I tried to call…

I've had really random declines from time to time for no apparent reason--sometimes for very small amounts. I make a point these days of having backup cards across multiple networks (i.e. both Visa and Mastercard).

Also spare ID and cash. The one time I broke this last rule on a trip I was nearly really screwed. (I lost my license and the hotel didn't want to let me check in. They only relented when I showed other ID and was able to make a just large enough withdrawal from an ATM and pay cash.)

Re: Voice Phishing Scams Are Getting More Clever

#63

Post by CodeCube »

ghaff wrote: post #53
CodeCube wrote: post #25

This is 100% destroying the phone for younger generations ... my kids answer nothing, not even my own phone calls because they set their phones on do not disturb to curb the endless robo, scam, and cold calls. If it wasn't for https://hiya.com/ , I'd be at the end of my wits. Seems like the number of fake calls has ramped up exponentially in the last months. I finally just set it up completely block all telemarketing…

I don't know the end game here. It's easy to say that phone calls as a medium just slides into oblivion and this all becomes academic. But I don't really believe that. There's a real and continuing place for voice conversations and that requires someone to initiate a call. Eliminating spoofing is probably impossible without infrastructure revamps that aren't realistic even augmenting with spam filtering at the telco…

If the implementation of voice calls over the traditional networks do not improve (as you suggest, via improvements and regulations), then people will route around it. My kids only call me via FaceTime ... and the only way they communicate with their friends with voice is either facetime, or by sending videos of them talking over snapchat.

Obviously, my kids (and their friends/school) are only one data point ... but yeah, for them, it's already dead.

Re: Voice Phishing Scams Are Getting More Clever

#64

Post by dvtrn »

techsupporter wrote: post #32
aero142 wrote: post #21

Earlier quoted context omitted.

It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me. I always pull up the website and confirm before telling them anything.

> I usually laugh at them and tell them they they are the unverified party in this phone call, not me. This is one of the related reasons why I finally got my ducks in a row and switched away from Chase three years ago. Their potential-fraud-has-happened outreach department was, in my experience, terrible about this. It didn't help that their potential-fraud-detection department was similarly bad. ("You used your deb…

I pointed out, each time, that they were the ones who called me so I should be verifying them. "But, sir, WE are the bank and you could be anyone who just answered your phone."

There has got to be a word for this and similar behavior. Banks, credit card agencies, mobile phone companies are getting really aggressive with how they handle these sort of transaction based interactions and I'm leaning towards wanting to see them get slapped with regulation for it.

I bring it up because a few years back I fell into some hard times, resulting in missing some payments. In a good faith attempt to get caught back up once I found a new job and could right the ship, I called my creditors immediately and tried to make payments and setup payment plans the first paycheck I got.

None of them failed to ask what I thought was a very annoying and horrifically invasive question: "Why were you late on your payments?"

Each time I rebutted asking if disclosing my living situation was required to make a payment or if I should request an escalation to someone who will just take the money. One creditor kept trying to say "We're asking because we want to do you a favor/we understand things are hard sometimes" and I kept asking them if failure to disclose my life situation would prevent payment until they gave up and took the payment.

It strikes me as an offensive, invasive and utterly worthless question and whenever asked I just hang up and call back. Same thing when some entity calls and immediately starts asking for sensitive info. "Send me a letter in the mail with a phone number and I'll call you back when I'm good and ready, otherwise no I'm not just giving you my SSN because you called me at 7:30 on a Monday evening and asked for it".

Fiduciaries are getting bold, I tell you.

Re: Voice Phishing Scams Are Getting More Clever

#65

Post by wintermutesGhst »

howard941 wrote: post #47
ttul wrote: post #37

The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything. There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration. > It's a major nightmare for telephone companies. Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.

Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw.

As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.

Re: Voice Phishing Scams Are Getting More Clever

#66

Post by mmcconnell1618 »

roywiggins wrote: post #41
neuralRiot wrote: post #35

>That made Sasser pause. Wouldn’t an actual representative from Wells Fargo’s fraud division already have access to his current PIN? No, nobody has access to your PIN, if you forget it you need a new card.

> if you forget it you need a new card That's not true- you can reset you PIN if you go to a physical Wells Fargo location, I've done it.

Reseting a PIN is different from having access to the old PIN number. Obviously some system in the bank has to verify that the PIN you enter at an ATM matches the one you selected but resetting is a separate operation that does not require the original number.

Re: Voice Phishing Scams Are Getting More Clever

#67

Post by wintermutesGhst »

jancsika wrote: post #48
ttul wrote: post #37

The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything. There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

If it's "completely insecure," then why aren't there reports of people correctly dialing their banks phone number and being connected to a scammer?

The insecurity comes from the fact that once a call is in the network, it is mostly passed off without validation or verification. You only need to find someone willing to carry your call in to the network, and the rest takes care of itself.

To change the routing of a call other than yours would require you to access a carrier's systems and change where the call is routed to--which is substantially more difficult.

Re: Voice Phishing Scams Are Getting More Clever

#68

Post by craftyguy »

jancsika wrote: post #48
ttul wrote: post #37

The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything. There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

If it's "completely insecure," then why aren't there reports of people correctly dialing their banks phone number and being connected to a scammer?

It's completely insecure because someone could call you, spoof your bank's number, and claim to be your bank.

Re: Voice Phishing Scams Are Getting More Clever

#69

Post by diggerNick6771 »

reaperducer wrote: post #42
techsupporter wrote: post #32

Earlier quoted context omitted.

> I usually laugh at them and tell them they they are the unverified party in this phone call, not me. This is one of the related reasons why I finally got my ducks in a row and switched away from Chase three years ago. Their potential-fraud-has-happened outreach department was, in my experience, terrible about this. It didn't help that their potential-fraud-detection department was similarly bad. ("You used your deb…

("You used your debit card at an AM/PM in Washington State!!!!" Yes, I know, it is about 900 feet from my house; I go there regularly.) Bank of America has an interesting optional feature where they geolocate the transaction, and if it's a certain distance away from your cell phone, it triggers the fraud process. I think if more banks did this, it could cut down on a certain percentage of these problems. The downside…

And for what? To protect their money. It's their responsibility to stop fraud and cover losses. Not mine. I'm paying them my monthly service fee to safely store my money. People don't seem to understand this. If I want to saddle all the risk myself I'll use cash in my mattress.

Re: Voice Phishing Scams Are Getting More Clever

#70

Post by murph-almighty »

segmondy wrote: post #10

The latest scam I've experienced is when I last sold my car through craigslist recently. I would get voice calls, they person says hello, starts asking about my car and the call would cut off. Then I would get a text saying, "sorry, bad signal or it's loud where they are" At that point, a chat bot takes over asking questions about the car and talking about how they really want to buy it but need to make sure that it…

I've gotten that request via email before and nearly fell for it once. I also ended up buying a Carfax just in case people started referring me to other sites just to push them a bit ("I have a carfax, is that okay?").
Post reply on HN