7 ms·

As an individual authenticating callers is difficult. I recently had someone claiming to be from the ATO (Australian Taxation Office) call and ask me to identi

As an individual authenticating callers is difficult. I recently had someone claiming to be from the ATO (Australian Taxation Office) call and ask me to identify myself. Not surprising, my tax filing is overdue. I advised them as a security policy I do not give out PII to unauthenticated callers, asked for a reference number and a return phone number. The number I was given is not listed on the ATO website so I did not return the call. Found some forum posts claiming the number is for return callers who have a reference number. Still, if I can’t find the number listed on offical media I don’t call back. I’m trying to think of a way the average person could authenticate a caller. I’m not security or technology expert so my knowledge in this area is limited. Any ideas?

asfdsfggtfd 8y ago
I think just call back on one of their listed numbers and explain.
- TheSpiceIsLife 8y ago
  It seems so obvious now you've pointed it out. I do like to over complicate things.
  - asfdsfggtfd 8y ago
    This is the advice given by banks and anti-fraud agencies. NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up. A phisher will play a dial tone etc to make it seem realistic. The advice is to either wait 10 minutes (longer?) or preferably call back on another line if you receive a suspicious call.
    - princekolt 8y ago
      Or try calling somebody else you know. If you land back on the same caller, you know they're playing you. =)
    - jsjohnst 8y ago
      > NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up. Source for this? I find it highly suspect from a technical perspective (1-3 seconds, maybe, but not several minutes) and nothing I can find online even remotely seems legitimate / real.
      - Mister_Snuggles 8y ago
        I’ve personally experienced this, probably 30 years ago, in Canada. I’d call a friend, we’d finish talking, then I’d hang up and as a joke he’d leave his phone off the hook. I couldn’t make another phone call until he hung up or some timeout of unknown length passed.
        macintux 8y ago
        When I was younger in the US the situation was similar, but I thought it was up to the originator of the call to disconnect. Been too long to be certain of my recollection. I never determined the timeout, and I haven't had a land line in at least 15 years to experiment with.
        Mister_Snuggles 8y ago
        You could be right, I can’t remember if the times that happened were when I originated the call or my friend did. I know it didn’t work all the time, and I think it stopped working at some point too. This was back in the days when you could tell roughly where someone lived by their phone number - 43x—xxxx was south Edmonton (but not Mill Woods or Riverbend), 2xx-xxxx was Calgary, area codes didn’t matter because the whole province was 403, etc. The phone system is a lot different now - you can port a landline to a cell phone (and vice-versa). The original phone number where that happened has been ported to the cable company and now goes through coax (the equipment that handles it is basically a cable modem with a phone jack).
        macintux 8y ago
        Actually, I’m coming around to your point of view. I think it was the recipient who controlled the “transaction”. The world was so very different. Waiting for that 0 to finally work its way around the dial, good grief. Especially since as a kid I was perpetually afraid any phone number that included a 0 might lead me to somehow get connected to a phone operator, so I wanted to dial the following number as quickly as possible.
  - dbuder 8y ago
    Chances are they wouldn't have been able to make the cross reference anyway, different departments etc.
moftz 8y ago
I've had my bank call me at work because I forgot to pay my credit card off the day after it was due. No callerid info, just a number. The woman on the phone didn't say who she was, who she was calling from, she just immediately asked me if this was blahblah. My work has been the subject of a bunch of scammers calling about financial services lately so I wasn't too keen on saying who I was. I kept asking her who she was calling from and she just kept asking me who I was. Finally she said she was from my bank. I told her I'd call her back. Called up my bank and had to wait through several people for someone to tell me what was up. Not only does there need to be some etiquette when cold calling someone (like using callerid and stating upfront who you are and who you are calling from!) but callerid need an update so you can't spoof it so we can trust it again.
- bo1024 8y ago
  Funny cause on email this is a solved problem (from a technical standpoint not a social one); encryption and digital signatures are easy. And it would be so useful to those industries too.
- JackCh 8y ago
  Etiquette from a bank is like water from a stone. Consider moving your accounts to a credit union.
ramy_d 8y ago
Same thing is happening here in Canada, got 2 calls recently. Geez what is going on?
A_Person 8y ago
I just had the exact opposite experience! I was discussing scams with my regular painter. He said he got one recently, and showed it to me on his phone. It was an SMS that said, "Dear <FORENAME>, we have been trying to contact you without success. Please ring BlergCo on 99999 about your outstanding ATO debt". I thought, easy enough to check. I went to the ATO website; clicked the link about what we do if you don't pay; clicked the link about which collection agencies they use; checked for green padlocks throughout; and voila - BlergCo, 99999! Since the number on the SMS exactly matched the number on the verified ATO website, I couldn't see how the scam would work. So I told my painter I'd changed my mind, it was probably legitimate, and he should ask his tax agent to follow it up. Which he did. Then paid the overdue provisional tax that he'd completely forgotten about! It made me think, legitimate SMSs (like that one) should probably have extra words to tell the recipient how they can check that it's legitimate. For example, "NOTE: to verify our company name and contact number, please go to the ATO website at xxx.yyy.zzz (and remember to check the green padlock!)", or somesuch.
r00fus 8y ago
The whole POTS system is archaic and ripe for abuse (which we see with telemarketers able to spoof their numbers). IMHO the solution would be a calling system where spoofing is difficult/not allowed.

asfdsfggtfd 8y ago

I think just call back on one of their listed numbers and explain.

TheSpiceIsLife 8y ago
It seems so obvious now you've pointed it out. I do like to over complicate things.
- asfdsfggtfd 8y ago
  This is the advice given by banks and anti-fraud agencies. NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up. A phisher will play a dial tone etc to make it seem realistic. The advice is to either wait 10 minutes (longer?) or preferably call back on another line if you receive a suspicious call.
  - princekolt 8y ago
    Or try calling somebody else you know. If you land back on the same caller, you know they're playing you. =)
  - jsjohnst 8y ago
    > NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up. Source for this? I find it highly suspect from a technical perspective (1-3 seconds, maybe, but not several minutes) and nothing I can find online even remotely seems legitimate / real.
    - Mister_Snuggles 8y ago
      I’ve personally experienced this, probably 30 years ago, in Canada. I’d call a friend, we’d finish talking, then I’d hang up and as a joke he’d leave his phone off the hook. I couldn’t make another phone call until he hung up or some timeout of unknown length passed.
      - macintux 8y ago
        When I was younger in the US the situation was similar, but I thought it was up to the originator of the call to disconnect. Been too long to be certain of my recollection. I never determined the timeout, and I haven't had a land line in at least 15 years to experiment with.
        Mister_Snuggles 8y ago
        You could be right, I can’t remember if the times that happened were when I originated the call or my friend did. I know it didn’t work all the time, and I think it stopped working at some point too. This was back in the days when you could tell roughly where someone lived by their phone number - 43x—xxxx was south Edmonton (but not Mill Woods or Riverbend), 2xx-xxxx was Calgary, area codes didn’t matter because the whole province was 403, etc. The phone system is a lot different now - you can port a landline to a cell phone (and vice-versa). The original phone number where that happened has been ported to the cable company and now goes through coax (the equipment that handles it is basically a cable modem with a phone jack).
        macintux 8y ago
        Actually, I’m coming around to your point of view. I think it was the recipient who controlled the “transaction”. The world was so very different. Waiting for that 0 to finally work its way around the dial, good grief. Especially since as a kid I was perpetually afraid any phone number that included a 0 might lead me to somehow get connected to a phone operator, so I wanted to dial the following number as quickly as possible.
- dbuder 8y ago
  Chances are they wouldn't have been able to make the cross reference anyway, different departments etc.

moftz 8y ago

I've had my bank call me at work because I forgot to pay my credit card off the day after it was due. No callerid info, just a number. The woman on the phone didn't say who she was, who she was calling from, she just immediately asked me if this was blahblah. My work has been the subject of a bunch of scammers calling about financial services lately so I wasn't too keen on saying who I was. I kept asking her who she was calling from and she just kept asking me who I was. Finally she said she was from my bank. I told her I'd call her back. Called up my bank and had to wait through several people for someone to tell me what was up. Not only does there need to be some etiquette when cold calling someone (like using callerid and stating upfront who you are and who you are calling from!) but callerid need an update so you can't spoof it so we can trust it again.

bo1024 8y ago
Funny cause on email this is a solved problem (from a technical standpoint not a social one); encryption and digital signatures are easy. And it would be so useful to those industries too.
JackCh 8y ago
Etiquette from a bank is like water from a stone. Consider moving your accounts to a credit union.

ramy_d 8y ago

Same thing is happening here in Canada, got 2 calls recently. Geez what is going on?

A_Person 8y ago

I just had the exact opposite experience! I was discussing scams with my regular painter. He said he got one recently, and showed it to me on his phone. It was an SMS that said, "Dear <FORENAME>, we have been trying to contact you without success. Please ring BlergCo on 99999 about your outstanding ATO debt". I thought, easy enough to check. I went to the ATO website; clicked the link about what we do if you don't pay; clicked the link about which collection agencies they use; checked for green padlocks throughout; and voila - BlergCo, 99999! Since the number on the SMS exactly matched the number on the verified ATO website, I couldn't see how the scam would work. So I told my painter I'd changed my mind, it was probably legitimate, and he should ask his tax agent to follow it up. Which he did. Then paid the overdue provisional tax that he'd completely forgotten about! It made me think, legitimate SMSs (like that one) should probably have extra words to tell the recipient how they can check that it's legitimate. For example, "NOTE: to verify our company name and contact number, please go to the ATO website at xxx.yyy.zzz (and remember to check the green padlock!)", or somesuch.

r00fus 8y ago

The whole POTS system is archaic and ripe for abuse (which we see with telemarketers able to spoof their numbers). IMHO the solution would be a calling system where spoofing is difficult/not allowed.