22 ms·
I agree that banks and other high value targets still assume that attackers somehow "play by the rules". I got a call not too long (maybe a year ago) from some
by steven777400 11y ago
I agree that banks and other high value targets still assume that attackers somehow "play by the rules". I got a call not too long (maybe a year ago) from someone claiming to be with my bank. Their first line was, "To verify your identity, what's the last 4 of your SSN?" My response, "You called me, how do I know you're actually with (bank)?" The rep was flabbergasted at the response and didn't know what to say.
Finally he gave me a number and suggested I call him back at it. Same problem. He gave me the number. It's a random phone number. I ended up looking up the number and confirming it was associated with the bank and then calling him back on it. Not ideal, but the whole security model is completely broken.
- junto 11y agoThis is a great comment. It is this kind of social engineering attack which is unbelievably effective, simply because most people don't want to offend the other person at the other end of the phone. Banks really need to stop phoning people like this. A simple way to do this would be to have a TOTP type password that the caller needs to confirm with the callee, regardless of which direction the call is going on; bank to customer, or customer to bank. As a customer you should be able to ask the bank representative for the shared password and if they can't answer the question then you should call your bank immediately to warn then.
- mcv 11y agoAnd it's particularly effective because some banks apparently do exactly this. This would be reason to move to a different bank. These banks encourage behaviour that rewards phishing.