Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm a scam prevention expert and I got scammed

lupinia.net

Post reply on HN
Print view View original

81–90 of 562 posts

Re: I'm a scam prevention expert and I got scammed

#81

Post by roozbeh18 »

klik99 wrote: post #21

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info a…

I am a security guy by profession, the other day my wife singed up for a tesla and they ran her credit. next day we get a random call from wellsfargo regarding an auto application and wanted to verify her information. my wife confused why wellsfargo calling, did what I always ask her to do. tell the individual to provide her with the case number and she will call back and they do not need to provide her the call back number. This is easy to remember for most people and She did just that. It turned out tesla has multiple financier which tesla failed to mention that one is wellsfargo.

Re: I'm a scam prevention expert and I got scammed

#82

Post by harshreality »

anonymousisme wrote: post #34

I had a legitimate call from my credit union last month. They were following up on a problem I had reported with their on-line bill pay system. Toward the beginning of the call, they wanted to verify that it was me and they asked me to provide them with the 2FA code they had just texted to me. I declined and told them that this is what scammers do. They agreed with me and encouraged me to call them back at the number…

It's insane for them to request that you read a 2fa code to a human over the phone. Even if you called them. Escalate and get their policies changed, or get them fired if they're violating policy.

Re: I'm a scam prevention expert and I got scammed

#84

Post by bragr »

lostlogin wrote: post #63
ghostly_s wrote: post #46

Earlier quoted context omitted.

Your neighbor just dialed the new number without hanging up first?

No dial tone and no ring… Seems a difficult mistake to make but then again, I regularly surprise myself with my errors.

There's nothing technical that prevents the other side from playing dial tone and ring sounds

Re: I'm a scam prevention expert and I got scammed

#85

Post by giaour »

gnicholas wrote: post #77
onaworkcomputer wrote: post #33

Earlier quoted context omitted.

It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?" It would be difficult to come up with something you could reasonably ask an acc…

What I was suggesting wasn't asking the account holder, but asking the bank. With a little training, the call center reps should be able to handle adding together the last few digits of a card number. I agree that asking account holders for this would be confusing, but since the bank is the one calling in this case it makes sense that the caller (bank) should provide information first. Of course, it appears that in t…

If the account holder has to ask the bank for a piece of information, the account holder will also have to produce it for comparison.

Summing the last four digits could unintentionally leak information (what if those digits are all zeros?), so the challenge question should be carefully chosen by the bank, not just whatever the account holder comes up with.

Re: I'm a scam prevention expert and I got scammed

#86

Post by Cd00d »

rolobio wrote: post #6

I nearly got taken by a scammer because Amazon transferred me to one. I purchased a set of Reolink cameras on Amazon, (they've been great) one of them failed a couple months in. I contacted Amazon customer support (via my Amazon login and in their interface) and they wanted to troubleshoot with their technical team. Eventually the (very helpful) Amazon technician suggested contacting Reolink for support and started a…

I'm blown away that Amazon has phone support! I had no idea!

Re: I'm a scam prevention expert and I got scammed

#87

Post by afiori »

e40 wrote: post #48
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

The neighbor hung up, but the scammers didn't, and the call was not disconnected? That's not my experience. Is this what you meant?

Apparently it is a feature Called Subscriber Held (CSH).

https://security.stackexchange.com/a/100342/143105

TL;DR It was just how analog phone worked, users came to rely on it, digital exchanges reimplemented it (with a timeout)

Re: I'm a scam prevention expert and I got scammed

#88

Post by blondin »

klik99 wrote: post #21

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info a…

surprised too, once i read it all started with a phone call from author's bank. your bank will "almost" never ask you for your info on the phone. if they do, you don't have to provide it. you can ask to go to a branch in-person, or log onto the website to provide the required information.

all banks should often remind their customers of this. mine does.

banks and phone carriers should do scam and fraud trainings for customers. or friendly reminders.

Re: I'm a scam prevention expert and I got scammed

#89

Post by function_seven »

mdoms wrote: post #50
cjg wrote: post #42

Earlier quoted context omitted.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, e…

Your neighbour dialed a new number without hanging up his ongoing call? Is this his first time operating a telephone? The scammers mustn't have believed their luck when they realised that was happening. Did they mimic a "brnnnnggg brnnnggg" sound when he dialed?

The connection isn't always torn down immediately. Different switches behave differently in this regard. I remember a long time ago being trolled by a friend of mine who refused to hang up. I wanted to call someone else, but every time I picked up the handset to dial out, he was still on the line laughing at me.

So if you're served by a switch that operates this way, the scammer just holds the line open, plays dialtone and ringback tones appropriately, and you're none the wiser.

Re: I'm a scam prevention expert and I got scammed

#90

Post by droffel »

onaworkcomputer wrote: post #33
hunter2_ wrote: post #24

Earlier quoted context omitted.

> sum of the last 4 It's a chicken/egg problem of not wanting to give information first, but a one-way function (hash) is a fantastic idea. The collision possibilities in this particular function are worrisome, though.

It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?" It would be difficult to come up with something you could reasonably ask an acc…

The dataset for hashed credit card numbers is small enough that it can be easily represented in a static lookup table, or brute forced.
Post reply on HN