6 ms·

show-iphone-location.com is one of the most obvious phishing URLs I've ever seen.

sundvor 10y ago
Yes, but if you are desperate to get your phone back, the rush of excitement when finally seeing the message could very well make you gloss over this.
uptown 10y ago
The base of lost cell phone users has a very very long tail.
Theodores 10y ago
It is all cognitive dissonance though, if you lost EVERYTHING (your phone) then any glimmer of hope would be pretty good and you would be typing that password in without checking - speed would matter more in this situation. Also, how literate are most mobile phone users? If your English is txt spk IN BLOCK SHOUTO CAPS then you are not really going to be reading URLs. Excellent bit of social engineering by the scammers, shame they cause so much harm.
chrischen 10y ago
I deal with end users and customers and there are definitely a very high % of people who can afford an iPhone and would have no clue that that would be an illegitimate website.
Matsta 10y ago
In New Zealand when you pay for something using a Visa card, you get redirected to a "Verified by Visa" page which the domain is "securesuite.co.uk". That always looks incredibly dodgy to me, not sure why they don't use a visa.com subdomain so it doesn't look like a phishing scam.
- X-Cubed 10y ago
  Yeah, it does look dodgy. Bear in mind that it's also used for Mastercard's SecureCode and possibly other credit card providers as well.
- wsinks 10y ago
  Thank you! I've never signed up for it because of this.
- jsmthrowaway 10y ago
  I've seen that in the United States on a completely different domain. I actually changed banks over it when Wells Fargo set it up. To answer your root cause question: I think it's a hook back to the issuing bank, and Visa themselves are only tangentially involved, AIUI. So things like securesuite are the vendors for the bank. (Am I wrong? That's how it was explained to me once.)
- sirn 10y ago
  These pages are authorization page of an Access Control Server (ACS) in the 3-D Secure flow. Visa/MasterCard designed the scheme, but the spec is open (in a somewhat limited sense), so anyone can implement the ACS as long as you're qualified to see the spec and can get it certified. Banks are free to choose the ACS vendor as long as it's certified. Many banks do provide ACS authorization page at their own domain name, although a many of them just use a third party service just like in your case.
- milankragujevic 10y ago
  In Serbia it does that too, often with dosgy bank branding and incredibly long and convoluted base64-encoded urls... Weird.
haney 10y ago
Unfortunately there a so many users that have no idea how the internet works. It's not unusual for me to have to explain to someone, what a URL is. I had a 20 something year old friend ask me "so /where/ is the Internet?" not that long ago.
- SuperPaintMan 10y ago
  My girl believes the "cloud" is a physical structure in California. That's why the Bay Area is popular for software development. Not even joking.
  - snowwrestler 10y ago
    To be fair, the fog clouds coming over the hills in the Bay Area can be thick enough to look like physical structures.
  - colejohnson66 10y ago
    Well, she's technically correct. The "cloud" is just a fancy word for someone else's computer. Be it in California or the middle of nowhere in Utah.
    - pbhjpbhj 10y ago
      Hmm, I've always considered it to be a logical structure dissociated from physical machines. The prior systems were such that one stored data on a particular rack of computers but using a cloud removed that association from the customer. Yes, the data is ultimately in some computer's storage somewhere but the company can remove that computer from the internet and move the data, it's not a computer - there's an abstraction layer in place. So, I'd say a server is "just a computer somewhere", The Cloud is necessarily more than that.
  - sedeki 10y ago
    I recently talked to an older fellow who thought that it is called "the cloud" because it is located in satellites.
tamana 10y ago
Congratulations, you are an IT expert. Not everyone is.

Yes, but if you are desperate to get your phone back, the rush of excitement when finally seeing the message could very well make you gloss over this.

uptown 10y ago

The base of lost cell phone users has a very very long tail.

Theodores 10y ago

It is all cognitive dissonance though, if you lost EVERYTHING (your phone) then any glimmer of hope would be pretty good and you would be typing that password in without checking - speed would matter more in this situation. Also, how literate are most mobile phone users? If your English is txt spk IN BLOCK SHOUTO CAPS then you are not really going to be reading URLs. Excellent bit of social engineering by the scammers, shame they cause so much harm.

chrischen 10y ago

I deal with end users and customers and there are definitely a very high % of people who can afford an iPhone and would have no clue that that would be an illegitimate website.

Matsta 10y ago

In New Zealand when you pay for something using a Visa card, you get redirected to a "Verified by Visa" page which the domain is "securesuite.co.uk". That always looks incredibly dodgy to me, not sure why they don't use a visa.com subdomain so it doesn't look like a phishing scam.

X-Cubed 10y ago
Yeah, it does look dodgy. Bear in mind that it's also used for Mastercard's SecureCode and possibly other credit card providers as well.
wsinks 10y ago
Thank you! I've never signed up for it because of this.
jsmthrowaway 10y ago
I've seen that in the United States on a completely different domain. I actually changed banks over it when Wells Fargo set it up. To answer your root cause question: I think it's a hook back to the issuing bank, and Visa themselves are only tangentially involved, AIUI. So things like securesuite are the vendors for the bank. (Am I wrong? That's how it was explained to me once.)
sirn 10y ago
These pages are authorization page of an Access Control Server (ACS) in the 3-D Secure flow. Visa/MasterCard designed the scheme, but the spec is open (in a somewhat limited sense), so anyone can implement the ACS as long as you're qualified to see the spec and can get it certified. Banks are free to choose the ACS vendor as long as it's certified. Many banks do provide ACS authorization page at their own domain name, although a many of them just use a third party service just like in your case.
milankragujevic 10y ago
In Serbia it does that too, often with dosgy bank branding and incredibly long and convoluted base64-encoded urls... Weird.

haney 10y ago

Unfortunately there a so many users that have no idea how the internet works. It's not unusual for me to have to explain to someone, what a URL is. I had a 20 something year old friend ask me "so /where/ is the Internet?" not that long ago.

SuperPaintMan 10y ago
My girl believes the "cloud" is a physical structure in California. That's why the Bay Area is popular for software development. Not even joking.
- snowwrestler 10y ago
  To be fair, the fog clouds coming over the hills in the Bay Area can be thick enough to look like physical structures.
- colejohnson66 10y ago
  Well, she's technically correct. The "cloud" is just a fancy word for someone else's computer. Be it in California or the middle of nowhere in Utah.
  - pbhjpbhj 10y ago
    Hmm, I've always considered it to be a logical structure dissociated from physical machines. The prior systems were such that one stored data on a particular rack of computers but using a cloud removed that association from the customer. Yes, the data is ultimately in some computer's storage somewhere but the company can remove that computer from the internet and move the data, it's not a computer - there's an abstraction layer in place. So, I'd say a server is "just a computer somewhere", The Cloud is necessarily more than that.
- sedeki 10y ago
  I recently talked to an older fellow who thought that it is called "the cloud" because it is located in satellites.

tamana 10y ago

Congratulations, you are an IT expert. Not everyone is.