18 ms·

Voice Phishing Scams Are Getting More Clever

203 points by waffle_ss 8y ago

hprotagonist 8y ago
More and more, my plan seems wiser. I’ll generally get a phone call like this, and hang up and re-initiate a request myself starting from the phone number listed on my card.
- misnome 8y ago
  This. I'm also happy to phone a direct number that they give me (e.g. subdepartment), as long as I can find the telephone number listed on their public web site. The sticky ones are things that seem to somehow be tied into people at the actual company scamming - my parents recently got a scam Openreach call within a few hours after calling to complain that their telephone had been disconnected a week earlier than promised. They had knowledge of the complaint call, but did the standard scam walkthrough of looking at event viewer and asked for the router ip address. See also the conveyancing scams whilst buying houses where phishers impersonate the exact solicitors email format and know exactly when the monetary transfer is supposed to take place in order to get you to pay a different bank account.
  - TrinaryWorksToo 8y ago
    Do we need a certificate authority for phone numbers now?
    - EamonnMR 8y ago
      That would actually be a very good idea to cut down on number spoofing.
      - TrinaryWorksToo 8y ago
        Yeah I figured as such. You could pass a hash to a certificate via caller ID
- kweks 8y ago
  You can still be scammed by this technique if you're answering on a landline: https://www.geekrant.org/2016/05/08/phone-scam-part-1/ https://www.geekrant.org/2016/05/08/phone-scam-part-1/
jaclaz 8y ago
The sad thing is that I am old enough to remember when a call from the bank meant that the director of my local branch office or however someone I knew personally was on the phone, usually to ask to go to their offices because something needed my presence/signature.
- reaperducer 8y ago
  I remember that, too. I was a huge deal if a bank called you. Now, when I go into a Chase or Citibank or whatever branch with a question, all the "banker" guy does is call the same 800 number I would have called, and wait on the same 40 minute hold as I would have. They don't even have special in-house IVR anymore. Meanwhile, I drink all their free coffee.
wafflesraccoon 8y ago
I'm at the point where I don't answer the phone unless I know the number calling me or I'm expecting a call.
- amelius 8y ago
  Yeah, even my friends don't call me (they use Whatsapp/SMS), so why should some random marketeer have the privilege of actually talking to me on the phone?
jerf 8y ago
I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my account just as they described. It really was my bank calling me about fraudulent charges. But I was definitely close to hanging up on them, assuming it was a scam. It stinks on both sides.
- tvanantwerp 8y ago
  For those worried about a situation like this, I set up automated purchase alerts on my credit cards and withdrawal alerts on my bank accounts. I see it all in close-enough-to-real-time, and it's helped me catch fraud before the banks did at least twice in the past few years.
  - joezydeco 8y ago
    I do the same. At Chase you can set up push alerts for any transaction greater than $0.01 (it won't accept zero). It's nearly real-time. In any drive-thru I'll have the notification on my phone before the card is handed back to me.
    - ccostes 8y ago
      Super cool, thanks for sharing this!
  - fitzroy 8y ago
    Also, for anyone that doesn't know: you can request an old school ATM card (not a debit card, i.e. no MC/Visa logo) from your bank and use a credit card for purchases instead. This reduces the exposure of a critical account. And if you do become a victim of fraudulent charges, you don't have to worry about your bank account being drained immediately (possibly resulting in overdrafts, etc).
segmondy 8y ago
The latest scam I've experienced is when I last sold my car through craigslist recently. I would get voice calls, they person says hello, starts asking about my car and the call would cut off. Then I would get a text saying, "sorry, bad signal or it's loud where they are" At that point, a chat bot takes over asking questions about the car and talking about how they really want to buy it but need to make sure that it has no accident and that I should get a car verification report and if it has a clean history they will buy it. A link is then sent to me via text. What I haven't figured out is if they are going to steal the CC info if entered in the link or give me some bogus report that costs $5 to acquire and charge me $100 for it.
- dylz 8y ago
  It's typically not CC theft, but CPA spam. CPA spam is incredibly common on craigslist. - https://en.wikipedia.org/wiki/Cost_per_action https://en.wikipedia.org/wiki/Cost_per_action
- fijix 8y ago
  Usually, the scammer is getting an affiliate commission whenever you complete the verification report. You see this a lot with job listings and rentals where the scammer will link to a background check as a condition of hiring/renting.
- murph-almighty 8y ago
  I've gotten that request via email before and nearly fell for it once. I also ended up buying a Carfax just in case people started referring me to other sites just to push them a bit ("I have a carfax, is that okay?").
rb808 8y ago
How come in 2018 we can't get a reliable CallerID. Surely this is something that could be simply regulated. Perhaps there should be a few types of CallerID - verified, physical and nominated. Eg a company calls you with a verified ID (like TLS), a local number from a single line is physically authenticated and anything else is just a best guess. That way we can filter more reliably.
- phkahler 8y ago
  No options. Make it mandatory and make it unable to be faked.
  - EamonnMR 8y ago
    It wouldn't really need to be mandatory, just something that cell providers and reputable businesses provided. Then phone companies could start rejecting anything that didn't provide it.
    - craftyguy 8y ago
      ... so, make it mandatory
    - cm2187 8y ago
      But how does the telco in the last node know the caller id is accurate? They can only tell that the data is coming in that direction but it could have been routed multiple times before (if phones work like the internet protocol). The only telco who can ensure that must be the one who initiated the call (exactly like IP spoofing).
- joering2 8y ago
  Most likely because majority of senate and congress-people want to always have option to hire cold calling companies to send their emergency message, be it some senator accused of using gov founds to sponsor his mistress or simply to get advantage in upcoming political race.
- namibj 8y ago
post_break 8y ago
What do I have to do to get my iPhone to only allow calls from my contact list, without using DND 24x7. Something has to happen for this setting to come out. Will it take enough spam calls to a CEO of a major company to come out with it?
- reaperducer 8y ago
  Set your default ringtone to a minute of silence. Set a custom ringtone for people you will accept calls from.
- snarf21 8y ago
  I like this but it will only help a little and temporarily. I've received calls from my own number. Given the amount of data out there in social media and seeing friends of friends, the scammers will be able to call you from a number that is in your contact list. The phone system needs a new layer but one that is optional. If a call comes from via the old layer, your phone warns you that this call may be fraud.
- BonesJustice 8y ago
  NumberShield lets you block wildcards while letting your contacts through. It won’t let you specify a ‘global’ wildcard, but I find blocking my own area code is generally sufficient. Most scammers and spammers spoof your local area code these days, and Nomorobo is pretty good at filtering out those that don’t. Between those two apps, I go months without unwanted calls. I used to get them daily.
saudioger 8y ago
This is why I don't answer the phone unless it's a contact. Everyone else can leave a message.
- rustcharm 8y ago
  Did you read the article? The Many people have their bank or credit union in the contacts. This won't help if they're spoofing a bank number. > Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. Sasser said he almost got scammed recently after receiving a call that appeared to be the same number as the one displayed on the back of his Wells Fargo ATM card.
  - tomhoward 8y ago
    FYI it's against the guidelines to suggest a commenter hasn't read the article. You can make the same point without being insulting or presumptuous in that way.
  - saudioger 8y ago
    Might as well put your social security and pin number in your phone too. Bank phone numbers in your contacts are a huge vulnerability. Just Google them when needed... or you know, look at the card.
fpgaminer 8y ago
We all make mistakes, so I'm hesitant to ever say they should have known better. But... > Even technology experts are getting taken in by some of the more recent schemes (or very nearly). Rule number one about phone scams, which I've seen repeated numerously so "technology experts" should know this ... _always_ verify and call the number back. I was under the impression that was common knowledge? The scams iterated in this article, no matter how complex, would all have been prevented by that simple and pervasive rule. > “People I’ve talked to about this say there’s no way they’d fall for that, but when someone from a trustworthy number calls, says they’re from your small town bank, and sounds incredibly professional, you’d fall for it, too,” Haughey said. When someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you follow the exact same rule. Hang up. Verify the number. Call back. Again, even the best of us make mistakes, so I'm not trying to be critical of the victims here. I'm just surprised is all.
- NeedMoreTea 8y ago
  > _always_ verify and call the number back Fine in principle, but banks do call, and often have no direct dial, as a matter of policy, for whoever you're speaking to. So it becomes verify the number, call back, and spend 30+ minutes in a queuing system before some lowly call centre worker on another continent incorrectly tells you they can't connect you to the xyz department. It used to work before call centres and all the small banks became just branding on the front of one of the big 4. You were even allowed the phone number of the local branch! That's the UK market btw.
  - vpmpaul 8y ago
    Yeah. I worked in banking during the crash. Upper mgmt literally told us to pretend we were XXX small bank (on a list of banks) if someone called and asked about it. Even though we were just large bank 1-4 that bought them.
afo 8y ago
We (Nomorobo) have a bunch of recordings of this type of scam. They're scary. https://nomorobo.com/lookup/844-386-9815 https://nomorobo.com/lookup/844-386-9815
- chasingthewind 8y ago
  Love your service! I've been using it for a few years now I think and it's really helped. Thanks!
  - afo 8y ago
    Thanks! I really appreciate the support. These voice spam calls have gotten out of control.
phkahler 8y ago
The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a number they provide over the phone or in caller ID. If you can't find a reliable number to the bank, drive over there. The bottom line is that you can't trust anyone who calls you.
- badgers 8y ago
  Agreed, caller ID should not be able to be spoofed. My rule of thumb is if it is important, they will leave a voicemail with a call back number. This screens out 90% of the spoofed calls I get. The visual voicemail is a nice feature too, I can immediately check the voicemail that is left and decide if I need to follow up, or if it is spam.
- walrus01 8y ago
  There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms like whatsapp, signal, telegram, facebook messenger, and the domestic chinese equivalents (wechat etc).
  - ghaff 8y ago
    Yeah, it's hard not to think that basically rebuilding the entire phone system would be a massive case of fighting the last war. People won't stop needing the phone system entirely but it becomes a piece of quirky legacy technology. And probably just have to live with the fact that there will be situations where people are harder to reach quickly than they are today.
    - 8y ago
CodeCube 8y ago
This is 100% destroying the phone for younger generations ... my kids answer nothing, not even my own phone calls because they set their phones on do not disturb to curb the endless robo, scam, and cold calls. If it wasn't for https://hiya.com/ https://hiya.com/, I'd be at the end of my wits. Seems like the number of fake calls has ramped up exponentially in the last months. I finally just set it up completely block all telemarketing, spam, scam, fraud calls.
- nkrisc 8y ago
  Hiya looks interesting. How do they make money if the app is free? How does it work? The site doesn't really say how it does what it does.
  - erikdared 8y ago
    They have a premium subscription detailed here: https://hiyahelp.zendesk.com/hc/en-us/articles/360000872947-What-is-Hiya-Premium- https://hiyahelp.zendesk.com/hc/en-us/articles/360000872947-...
- ghaff 8y ago
  I don't know the end game here. It's easy to say that phone calls as a medium just slides into oblivion and this all becomes academic. But I don't really believe that. There's a real and continuing place for voice conversations and that requires someone to initiate a call. Eliminating spoofing is probably impossible without infrastructure revamps that aren't realistic even augmenting with spam filtering at the telco level. But the current situation is at the edge of the tolerable and people will just stop letting calls ring through.
  - CodeCube 8y ago
    If the implementation of voice calls over the traditional networks do not improve (as you suggest, via improvements and regulations), then people will route around it. My kids only call me via FaceTime ... and the only way they communicate with their friends with voice is either facetime, or by sending videos of them talking over snapchat. Obviously, my kids (and their friends/school) are only one data point ... but yeah, for them, it's already dead.
carapace 8y ago
Who are the people manning the phones for the scam? Does it really pay better than a real job? I mean if you have the skills to scam like this you have skills that are valuable to legit business as well, no? I knew a few criminally-minded people back in high school and my early 20's (I don't associate with them anymore.) The thing that always stuck me about the "criminal mind" is that they were ready and willing to work hard, as hard or often more as a real job, to try to make money. I asked one guy once about it and he basically said that it was the idea of getting over on society, or "the Man", or something. "Getting away with it." This same guy also refused to open a saving account, but he would buy CD's (certificate of deposit) with ~3 month terms, and pay down the payments, because it felt like having twice as much money. To him it felt like he got to spend the money (that he used to secure the CD) twice: once with the money the bank loans him, and then again when he pays off the CD and they give him his original money back. Now, this is insane. He's just giving the bank some money. I asked him about this because it's so crazy, and he said "I can pay bills", meaning that he can psychologically deal with the idea of having to hustle to pay the ongoing payments on the CD, but (for whatever reason) he can't just give some of his money to the bank and not touch it. He literally can't feel right about savings. So he does this weird thing that basically inverts the whole idea of banking. He even knows it's crazy but it's a working equilibrium for him. Anyhow, I wrote all that in the present tense but this was years ago and I lost touch with the guy. I am astonished that the scammer-telemarketers who can sit there and carefully run these scam-scripts on marks don't just go get legit jobs. I wonder what economic context they are in? Or are they just, uh, morally corrupt, or something? The mystery of the criminal mind.
- roywiggins 8y ago
  Reply All decided to try to get to the bottom of a specific "tech support" scam, which might shed some light. https://www.gimletmedia.com/reply-all/102-long-distance-parts-1-2 https://www.gimletmedia.com/reply-all/102-long-distance-part...
- Izkata 8y ago
  > because it felt like having twice as much money Hmmm... Here's a strange thought: What if that was a way of deal with a gambling addiction (or something similar, since I understand risk to be part of the addiction), except you lose significantly less than you would have gambled without the loan?
paul7986 8y ago
Easy solution don’t answer phone calls from those not in your contacts.
- rustcharm 8y ago
  Huh? The caller ID was spoofed. Read the article. > Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. Sasser said he almost got scammed recently after receiving a call that appeared to be the same number as the one displayed on the back of his Wells Fargo ATM card.
  - paul7986 8y ago
    It didn’t say.. wife, friend, mom, joe, etc.. you know people you entered into your contacts. Personally If someone needs to get a hold of me outside of my contacts email or text me and I’ll get back to you accordingly.
neuralRiot 8y ago
>That made Sasser pause. Wouldn’t an actual representative from Wells Fargo’s fraud division already have access to his current PIN? No, nobody has access to your PIN, if you forget it you need a new card.
- roywiggins 8y ago
  > if you forget it you need a new card That's not true- you can reset you PIN if you go to a physical Wells Fargo location, I've done it.
  - mmcconnell1618 8y ago
    Reseting a PIN is different from having access to the old PIN number. Obviously some system in the bank has to verify that the PIN you enter at an ATM matches the one you selected but resetting is a separate operation that does not require the original number.
ttul 8y ago
The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything. There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.
- howard941 8y ago
  How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration. > It's a major nightmare for telephone companies. Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.
  - wintermutesGhst 8y ago
    Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw. As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.
    - amatecha 8y ago
      Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D
      - drewmol 8y ago
        If you suspect a scammer called you, always keep them on the line as long as possible. Feed into the scam and act as gullible as possible, give them fake cc numbers, etc.
        metildaa 8y ago
xphilter 8y ago
Number one advice I give my family: never give out any information (no matter how inconsequential it seems) to a person purporting to be from a company calling you. Hang up and call the company yourself using a trusted number (e.g., the number on the back of a credit card).
- dubhrosa 8y ago
  Banks should really just stop calling customers and taking them through security. If there's something urgent, the protocol should be that they call you, give you a ticket number, and tell you to call them back on the bank's standard number for customer service. Anything else just conditions people to expect incoming calls with security questions which will always result in scammers finding a way through.
  - kweks 8y ago
    This can also be scammed due to the timeout "feature" in telephone systems. Ie, the scammer calls, tells you to call the number on your card. You believe they hung up, but they are still on the line. When you pick up your phone again, you're still contected, and they're playing a dial tone. https://www.geekrant.org/2016/05/08/phone-scam-part-1/ https://www.geekrant.org/2016/05/08/phone-scam-part-1/
    - outworlder 8y ago
      Now the real trick is to get this to work with cellphones :)
    - ams6110 8y ago
      How many people still use landline phones? I don't know anyone.
eyesee 8y ago
If I were able, I would disable incoming telephone calls entirely (consider that a feature request, Apple). The phone system today is fundamentally untrustworthy because of caller ID spoofing, and the phone companies involved are culpable for not addressing this problem. A new ID system using PKI could eliminate the spoofing problem completely. Yes, I'm sure it would require a huge coordinated effort. Given spam calls will exceed 50% of all calls next year [1], this should be seen as an existential crisis for phone companies. [1]: https://finance.yahoo.com/news/spam-robocalls-will-soon-account-almost-50-calls-183157916.html https://finance.yahoo.com/news/spam-robocalls-will-soon-acco...
- mmirate 8y ago
  Public-key identity verification wouldn't even require substantial upgrades to anything except the phone hardware itself - when making the call, just convey the signature upon connection via a dialup-modem-like encoding, and the receiver may at their discretion neglect to connect their audio hardware to the line until after verifying that data. (Could even use some kind of PoW as another option, for calls where the receiver is unlikely to have received your public key yet.)
the_new_guy_29 8y ago
I dont think i even heard about such issue in EU.
flyinghamster 8y ago
I've had an Asterisk box for about 10 years now, mostly to deal with the tide of junk calls, and it has worked nicely. I first just blacklisted numbers (and sometimes whole prefixes), but now I use a CAPTCHA that handles the robocallers beautifully. Calls from known numbers get to ring through without the CAPTCHA. Still, I've been paying too much for that crusty old landline, and finally got motivated to do something about it. I just ported it out last month, and the new VoIP service I'm using costs less per month than what AT&T was charging just for Caller ID. Even funnier, they offer telemarketer blocking like I've set up, at no extra charge. Farewell and f*ck you very much, AT&T. You didn't even lift a finger to insure that the Caller ID I paid for was accurate.
- dredmorbius 8y ago
  Could you please point to guides / docs / references for setting this up? Might make some good HN submissions ;-)
  - flyinghamster 8y ago
    Here's a good starting point: http://nerdvittles.com/?p=75 http://nerdvittles.com/?p=75 Of course, with Asterisk, you can get downright crazy if you wish.
    - dredmorbius 8y ago
      Yeah, I'd like to start simple, basic, and effective.
    - dredmorbius 8y ago
      A bit more a "getting started" guide than this, actually. Hardware, configuration, concepts.
xoa 8y ago
I'm personally somewhat nervous about what voice phishers will be able to accomplish with call ID once voice sample synthesis gets good enough and cheap enough, which is well on the way from what I can tell. Shades of that old Uplink game, call up a family member or friend and just get them to talk into the phone at all, not even give up personal information but literally just speak enough. Then the phisher can call up the target, spoof that number, and directly have the voice sound just like someone the target knows. The voice and the Call ID will both check out, and this should actually be a lower target then the kind of voice synthesis work currently being done because phone calls are highly compressed and tend to be not great quality anyway. Once that hits general usage along with the kind of ML and social network graphs being done up couldn't that just plain be it for phone usage if companies can't come up with a proper cryptographically verified call scheme (which would require new phones, for everyone)? I mean, if a call coming in directly from a "trusted contact's number" that is literally in their voice becomes generally a scam too I think that'd have to be a real tipping point for the general population. I can't see any choice at that point but to disable all incoming calls period, and move my family over to something else as well. And that tech train is coming down the tracks pretty fast, there have to be at least some phone providers who can see that right? Heavily automatically run personalized ML powered social media and ad network profile fed phishing calls in a relative's voice, yeah that'll be really fun.
- DenisM 8y ago
  Simple workaround - you call me and leave voicemail, I call you back on the # I know and we talk.
AcerbicZero 8y ago
I haven't even had a debit card issued for my core bank account, and there is very little chance I ever would at this point. There just isn't a good reason to put my money at risk when I can use a variety of credit cards instead, and just pay them off every month. On the rare occasion I need cash, I can do a cash advance (with an associated charge....really useful motivation to avoid needing cash more than once or twice a year). Unrelated, but I'm pretty sure I know what credit union they're talking about. Super nice place that is focused on the tech workers in the Portland area, and I've always had good experiences with them.
tonymet 8y ago
This highlights what I see as the biggest security weakness with banking and online services -- identity verification is only one-sided. Protocols like passwords , pins, biometrics, secret questions only authenticate the customer and not the service provider. moreover, no one is talking about this huge weakness. For there to be trust, both sides need to be trusted. For apps, this could be a one-time code validated in the app. As a fall back there could be a unique shared "service pin" that gets rotated.
jor-el 8y ago
I am interested to understand how does these attacks work. The article states, after the victim disclosed the CC number there were ATM transactions performed using it. How are scammers able to generate a physical card in first place to perform ATM transaction? Is it something similar to card skimming with cards having magnetic stripe? Can this attack be performed with cards using chips? Also I often come across a fraudulent transaction being performed even if only credit card number is disclosed, while cvv and expiry date are not. As per my understanding all 3 info is needed to perform a transaction. Do anyone have some resource where these attacks are discussed in detail and how they are carried out.
- Scoundreller 8y ago
  Yes, some countries still use the magnetic stripe for authentication, or allow fall-back onto it if the chip “fails”.
kweks 8y ago
One of the issues is that the scams adapt themselves to current "best practices" (use known information to reassure you, tell you not to divulge other pieces of information) - whereas the legitimate institutions use poor practices. When I call my bank, they ask for verification by giving an account number, credit card and expiry details (!)
tormeh 8y ago
Good news, everyone, the industry is moving towards SIP! Bad news is that it's just as bad. There's no improvements in security because that would break backwards compatibility. Also, there's no one who wants to pay extra for security, and the telecoms industry have the virtue of laser-like focus on money.
hinkley 8y ago
My bank's fraud department sent me a voicemail saying my card had been deactivated and I needed to call them at 1-800... Yeah, fuck you. I'm not calling a fraud prevention number that was given to me over the phone and more to the point, what is wrong with you for asking your customers to trust people that called them on the phone. I called the main switchboard for the bank and couldn't find the fraud number from there. They got an earful about that too. None of this is okay, including why they flagged my card (Not for buying a TV and a bluray player, no. For getting a $8 car wash on the way home...)
- albedoa 8y ago
  Yes! This happened to me too and is very alarming. It’s training users to fall for phishing. I’m not sure what a correction looks like though. Should they call customers and instruct them to find or verify a phone number and call back? Instruct them to log into their online account? That would be fine for you and me, but I’m thinking of the average cardholder.
  - jefftk 8y ago
    Telling them to call the customer service number on their credit card seems pretty good?
    - albedoa 8y ago
      Oh duh, thanks. You're obviously right. I was thinking of my experience when I was out and didn't have that card on me.
    - jrochkind1 8y ago
      I just got one of these that had me call a DIFFERENT number than the one that was on my credit card -- the whole time I was thinking it was probably a phishing thing as I was giving them all my info, but in the end it was to ask if I had really made a charge that I _had_ really made the day before (in a city I'm not normally in)... so I'm pretty sure it was legit. Probably?
JBlue42 8y ago
We deal with this on a semi-monthly basis at the hospital I work at. We'll here from one department ("Hi, this is the Emergency Dept, all our phones are busy with a robocaller") then it will roll across other departments for about 20-30 minutes. The best our telecom team has come up with is to take the numbers, give to the FBI, and ¯\_(ツ)_/¯. Last time, they had spoofed the number of FedEx so we couldn't even report that. Most are very noticeable for being in Chinese and tying up multiple lines at a time. That's not really great though, like in the example, when it's all the phones in the ED.
ravenstine 8y ago
I believe that phone companies are complicit in this criminal activity, as they seem to have virtually no interest in actually stopping it. I've already turned off calls on my phone because "why bother", and more and more people I know are doing the same thing. The phone companies probably make so much on streaming that they don't give a shit about the phone system. This is a really bad thing for crime, but might help accelerate the death of a decades-obsolete technology.
- vecinu 8y ago
  > I've already turned off calls on my phone How do you do that on an Android phone?
  - ravenstine 8y ago
    My phone is a Galaxy S5 with Android 6, but it's here: Settings > Call > Call Rejection > Auto reject mode Set it to "All incoming calls".
King-Aaron 8y ago
Can anyone offer any insight into the latest series of odd phone calls I've been noticing, where you get either a private number or an out-of-state number call you, and then sit in silence until you utter a word in which it hangs up at that moment? I've experienced a few so far over the previous months. I've even experimented by not saying anything for an extended time - up to about 30 seconds of silence (and then it usually hangs up itself). But the next time it happens, if you say 'hi' within a few seconds, it immediately hangs up afterwards. Like its waiting for a verbal prompt. The apathetic part of me thinks 'maybe its a robocall thats bugging out', but then the pessimistic part of me wonders 'are they trying to sample my voice'.
- Kalium 8y ago
  https://www.theregister.co.uk/2011/10/06/termination_bypass/ https://www.theregister.co.uk/2011/10/06/termination_bypass/ Probably something like this.
- kalleboo 8y ago
  One reason for calls that get instantly disconnected is that when these systems will call up, say, 10 people at a time, 8 won't answer, so there's no reason to tie up 10 operators waiting for someone to answer. So they don't connect you to an operator until you actually pick up the phone/interact. But if they miscalculated and 4 people answered, they don't have enough operators and they just hang up.
  - King-Aaron 8y ago
    Interesting, I wasn't aware this could be the case.
deleted 8y ago
[deleted]
nanomonkey 8y ago
Most robo-callers feel like Phishing scams. I've been contemplating giving up my cellphone and just using a Calyx mobile data (https://www.calyxinstitute.org https://www.calyxinstitute.org) and use Signal, email and Mumble only. Anyone else do something like this successfully?
- socialist_coder 8y ago
  I did it for 6 years when I lived in Germany. I had a data only sim card and a google voice US phone number. Verdict: It's not doable if you want it to work 100%. And in the US I would say it's not doable at all because Android/dumbphone users are still using SMS instead of a messenger app like Whatsapp, so you have no way of communicating with them at all. The biggest problem for me was online services that want to verify your account via your phone number. They don't understand not having a phone number. And about 20% of the time, they block VOIP phone numbers for verification purposes, so your google voice number won't work there either. Literally no way to move forward there other than ask a friend to let you borrow their number or use your burner phone or something. You also can't sign up for Whatsapp without a phone number, but luckily it does work with google voice. Google voice also doesnt let you set it up so your device gets incoming calls unless you forward them to a real phone number. So you can only make calls with it, not receive. Maybe some other VOIP solutions are better at this. The google voice app on iOS is pretty shitty. Now that I'm back in the US, I had to get a phone number because messenger app adoption is very very low. iOS users are fine because iMessage is awesome, but for people on Android, there's just nothing. They still use SMS. Maybe you can get around this with VOIP, but I didn't want to hassle with it.
  - nanomonkey 8y ago
    Thanks! I'm not concerned about Whatsapp, and I figured I use Twilio for text messages. Out of service phones can still call emergency services, 911. My main concern is being "that guy" who everyone has to make exceptions for when contacting.
nerdbaggy 8y ago
It’s a hard problem to solve since being able to set your own outbound caller ID number is so critical for the phone business. - Call Forwarding - Picking which trunking provider to send a call out -etc
dade_ 8y ago
When receiving a call from your bank's contact centre, always thank them, hang up and call the number on the back of your card. This should be the standard advice from banks to their customers.
paulie_a 8y ago
The amount of spam calls is fucking insane, the fcc needs to seriously crack down. Start fining telecom companies a buck a call and I think the problem would go away. Hell make it 5 dollars for every call after the first ten thousand, I receive at least 5-10 day. If it is an obviously spoofed number make it 50 dollars. The telecoms have the capability to deal with it, they simply have no incentive to bother. I've had a conversation with my cell carrier where I asked to block Texas and Florida, every area code in those states. Apparently that is not possible.
jader201 8y ago
Why has Apple/Android not added the ability to reject (or at least send directly to voice mail) all calls outside of contacts, and make this the default setting? Seems like this would solve almost all of these problems.
tonyquart 8y ago
Well, I think these scammers will always try to steal our money by using hundreds of methods and tricks. Almost everyday I could read dozens of complaints and reports filed at social media and also sites like http://whycall.me http://whycall.me about phone scams. We need to keep informing our family about these scams. They are never getting tired of trying.

203 points by waffle_ss 8y ago

More and more, my plan seems wiser. I’ll generally get a phone call like this, and hang up and re-initiate a request myself starting from the phone number listed on my card.

misnome 8y ago
This. I'm also happy to phone a direct number that they give me (e.g. subdepartment), as long as I can find the telephone number listed on their public web site. The sticky ones are things that seem to somehow be tied into people at the actual company scamming - my parents recently got a scam Openreach call within a few hours after calling to complain that their telephone had been disconnected a week earlier than promised. They had knowledge of the complaint call, but did the standard scam walkthrough of looking at event viewer and asked for the router ip address. See also the conveyancing scams whilst buying houses where phishers impersonate the exact solicitors email format and know exactly when the monetary transfer is supposed to take place in order to get you to pay a different bank account.
- TrinaryWorksToo 8y ago
  Do we need a certificate authority for phone numbers now?
  - EamonnMR 8y ago
    That would actually be a very good idea to cut down on number spoofing.
    - TrinaryWorksToo 8y ago
      Yeah I figured as such. You could pass a hash to a certificate via caller ID
kweks 8y ago
You can still be scammed by this technique if you're answering on a landline: https://www.geekrant.org/2016/05/08/phone-scam-part-1/ https://www.geekrant.org/2016/05/08/phone-scam-part-1/

jaclaz 8y ago

The sad thing is that I am old enough to remember when a call from the bank meant that the director of my local branch office or however someone I knew personally was on the phone, usually to ask to go to their offices because something needed my presence/signature.

reaperducer 8y ago
I remember that, too. I was a huge deal if a bank called you. Now, when I go into a Chase or Citibank or whatever branch with a question, all the "banker" guy does is call the same 800 number I would have called, and wait on the same 40 minute hold as I would have. They don't even have special in-house IVR anymore. Meanwhile, I drink all their free coffee.

wafflesraccoon 8y ago

I'm at the point where I don't answer the phone unless I know the number calling me or I'm expecting a call.

amelius 8y ago
Yeah, even my friends don't call me (they use Whatsapp/SMS), so why should some random marketeer have the privilege of actually talking to me on the phone?

jerf 8y ago

I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my account just as they described. It really was my bank calling me about fraudulent charges. But I was definitely close to hanging up on them, assuming it was a scam. It stinks on both sides.

tvanantwerp 8y ago
For those worried about a situation like this, I set up automated purchase alerts on my credit cards and withdrawal alerts on my bank accounts. I see it all in close-enough-to-real-time, and it's helped me catch fraud before the banks did at least twice in the past few years.
- joezydeco 8y ago
  I do the same. At Chase you can set up push alerts for any transaction greater than $0.01 (it won't accept zero). It's nearly real-time. In any drive-thru I'll have the notification on my phone before the card is handed back to me.
  - ccostes 8y ago
    Super cool, thanks for sharing this!
- fitzroy 8y ago
  Also, for anyone that doesn't know: you can request an old school ATM card (not a debit card, i.e. no MC/Visa logo) from your bank and use a credit card for purchases instead. This reduces the exposure of a critical account. And if you do become a victim of fraudulent charges, you don't have to worry about your bank account being drained immediately (possibly resulting in overdrafts, etc).

segmondy 8y ago

The latest scam I've experienced is when I last sold my car through craigslist recently. I would get voice calls, they person says hello, starts asking about my car and the call would cut off. Then I would get a text saying, "sorry, bad signal or it's loud where they are" At that point, a chat bot takes over asking questions about the car and talking about how they really want to buy it but need to make sure that it has no accident and that I should get a car verification report and if it has a clean history they will buy it. A link is then sent to me via text. What I haven't figured out is if they are going to steal the CC info if entered in the link or give me some bogus report that costs $5 to acquire and charge me $100 for it.

dylz 8y ago
It's typically not CC theft, but CPA spam. CPA spam is incredibly common on craigslist. - https://en.wikipedia.org/wiki/Cost_per_action https://en.wikipedia.org/wiki/Cost_per_action
fijix 8y ago
Usually, the scammer is getting an affiliate commission whenever you complete the verification report. You see this a lot with job listings and rentals where the scammer will link to a background check as a condition of hiring/renting.
murph-almighty 8y ago
I've gotten that request via email before and nearly fell for it once. I also ended up buying a Carfax just in case people started referring me to other sites just to push them a bit ("I have a carfax, is that okay?").

rb808 8y ago

How come in 2018 we can't get a reliable CallerID. Surely this is something that could be simply regulated. Perhaps there should be a few types of CallerID - verified, physical and nominated. Eg a company calls you with a verified ID (like TLS), a local number from a single line is physically authenticated and anything else is just a best guess. That way we can filter more reliably.

phkahler 8y ago
No options. Make it mandatory and make it unable to be faked.
- EamonnMR 8y ago
  It wouldn't really need to be mandatory, just something that cell providers and reputable businesses provided. Then phone companies could start rejecting anything that didn't provide it.
  - craftyguy 8y ago
    ... so, make it mandatory
  - cm2187 8y ago
    But how does the telco in the last node know the caller id is accurate? They can only tell that the data is coming in that direction but it could have been routed multiple times before (if phones work like the internet protocol). The only telco who can ensure that must be the one who initiated the call (exactly like IP spoofing).
joering2 8y ago
Most likely because majority of senate and congress-people want to always have option to hire cold calling companies to send their emergency message, be it some senator accused of using gov founds to sponsor his mistress or simply to get advantage in upcoming political race.
namibj 8y ago

post_break 8y ago

What do I have to do to get my iPhone to only allow calls from my contact list, without using DND 24x7. Something has to happen for this setting to come out. Will it take enough spam calls to a CEO of a major company to come out with it?

reaperducer 8y ago
Set your default ringtone to a minute of silence. Set a custom ringtone for people you will accept calls from.
snarf21 8y ago
I like this but it will only help a little and temporarily. I've received calls from my own number. Given the amount of data out there in social media and seeing friends of friends, the scammers will be able to call you from a number that is in your contact list. The phone system needs a new layer but one that is optional. If a call comes from via the old layer, your phone warns you that this call may be fraud.
BonesJustice 8y ago
NumberShield lets you block wildcards while letting your contacts through. It won’t let you specify a ‘global’ wildcard, but I find blocking my own area code is generally sufficient. Most scammers and spammers spoof your local area code these days, and Nomorobo is pretty good at filtering out those that don’t. Between those two apps, I go months without unwanted calls. I used to get them daily.

saudioger 8y ago

This is why I don't answer the phone unless it's a contact. Everyone else can leave a message.

rustcharm 8y ago
Did you read the article? The Many people have their bank or credit union in the contacts. This won't help if they're spoofing a bank number. > Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. Sasser said he almost got scammed recently after receiving a call that appeared to be the same number as the one displayed on the back of his Wells Fargo ATM card.
- tomhoward 8y ago
  FYI it's against the guidelines to suggest a commenter hasn't read the article. You can make the same point without being insulting or presumptuous in that way.
- saudioger 8y ago
  Might as well put your social security and pin number in your phone too. Bank phone numbers in your contacts are a huge vulnerability. Just Google them when needed... or you know, look at the card.

fpgaminer 8y ago

We all make mistakes, so I'm hesitant to ever say they should have known better. But... > Even technology experts are getting taken in by some of the more recent schemes (or very nearly). Rule number one about phone scams, which I've seen repeated numerously so "technology experts" should know this ... _always_ verify and call the number back. I was under the impression that was common knowledge? The scams iterated in this article, no matter how complex, would all have been prevented by that simple and pervasive rule. > “People I’ve talked to about this say there’s no way they’d fall for that, but when someone from a trustworthy number calls, says they’re from your small town bank, and sounds incredibly professional, you’d fall for it, too,” Haughey said. When someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you follow the exact same rule. Hang up. Verify the number. Call back. Again, even the best of us make mistakes, so I'm not trying to be critical of the victims here. I'm just surprised is all.

NeedMoreTea 8y ago
> _always_ verify and call the number back Fine in principle, but banks do call, and often have no direct dial, as a matter of policy, for whoever you're speaking to. So it becomes verify the number, call back, and spend 30+ minutes in a queuing system before some lowly call centre worker on another continent incorrectly tells you they can't connect you to the xyz department. It used to work before call centres and all the small banks became just branding on the front of one of the big 4. You were even allowed the phone number of the local branch! That's the UK market btw.
- vpmpaul 8y ago
  Yeah. I worked in banking during the crash. Upper mgmt literally told us to pretend we were XXX small bank (on a list of banks) if someone called and asked about it. Even though we were just large bank 1-4 that bought them.

afo 8y ago

We (Nomorobo) have a bunch of recordings of this type of scam. They're scary. https://nomorobo.com/lookup/844-386-9815 https://nomorobo.com/lookup/844-386-9815

chasingthewind 8y ago
Love your service! I've been using it for a few years now I think and it's really helped. Thanks!
- afo 8y ago
  Thanks! I really appreciate the support. These voice spam calls have gotten out of control.

phkahler 8y ago

The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable. Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a number they provide over the phone or in caller ID. If you can't find a reliable number to the bank, drive over there. The bottom line is that you can't trust anyone who calls you.

badgers 8y ago
Agreed, caller ID should not be able to be spoofed. My rule of thumb is if it is important, they will leave a voicemail with a call back number. This screens out 90% of the spoofed calls I get. The visual voicemail is a nice feature too, I can immediately check the voicemail that is left and decide if I need to follow up, or if it is spam.
walrus01 8y ago
There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms like whatsapp, signal, telegram, facebook messenger, and the domestic chinese equivalents (wechat etc).
- ghaff 8y ago
  Yeah, it's hard not to think that basically rebuilding the entire phone system would be a massive case of fighting the last war. People won't stop needing the phone system entirely but it becomes a piece of quirky legacy technology. And probably just have to live with the fact that there will be situations where people are harder to reach quickly than they are today.
  - 8y ago

CodeCube 8y ago

This is 100% destroying the phone for younger generations ... my kids answer nothing, not even my own phone calls because they set their phones on do not disturb to curb the endless robo, scam, and cold calls. If it wasn't for https://hiya.com/ https://hiya.com/, I'd be at the end of my wits. Seems like the number of fake calls has ramped up exponentially in the last months. I finally just set it up completely block all telemarketing, spam, scam, fraud calls.

nkrisc 8y ago
Hiya looks interesting. How do they make money if the app is free? How does it work? The site doesn't really say how it does what it does.
- erikdared 8y ago
  They have a premium subscription detailed here: https://hiyahelp.zendesk.com/hc/en-us/articles/360000872947-What-is-Hiya-Premium- https://hiyahelp.zendesk.com/hc/en-us/articles/360000872947-...
ghaff 8y ago
I don't know the end game here. It's easy to say that phone calls as a medium just slides into oblivion and this all becomes academic. But I don't really believe that. There's a real and continuing place for voice conversations and that requires someone to initiate a call. Eliminating spoofing is probably impossible without infrastructure revamps that aren't realistic even augmenting with spam filtering at the telco level. But the current situation is at the edge of the tolerable and people will just stop letting calls ring through.
- CodeCube 8y ago
  If the implementation of voice calls over the traditional networks do not improve (as you suggest, via improvements and regulations), then people will route around it. My kids only call me via FaceTime ... and the only way they communicate with their friends with voice is either facetime, or by sending videos of them talking over snapchat. Obviously, my kids (and their friends/school) are only one data point ... but yeah, for them, it's already dead.

carapace 8y ago

Who are the people manning the phones for the scam? Does it really pay better than a real job? I mean if you have the skills to scam like this you have skills that are valuable to legit business as well, no? I knew a few criminally-minded people back in high school and my early 20's (I don't associate with them anymore.) The thing that always stuck me about the "criminal mind" is that they were ready and willing to work hard, as hard or often more as a real job, to try to make money. I asked one guy once about it and he basically said that it was the idea of getting over on society, or "the Man", or something. "Getting away with it." This same guy also refused to open a saving account, but he would buy CD's (certificate of deposit) with ~3 month terms, and pay down the payments, because it felt like having twice as much money. To him it felt like he got to spend the money (that he used to secure the CD) twice: once with the money the bank loans him, and then again when he pays off the CD and they give him his original money back. Now, this is insane. He's just giving the bank some money. I asked him about this because it's so crazy, and he said "I can pay bills", meaning that he can psychologically deal with the idea of having to hustle to pay the ongoing payments on the CD, but (for whatever reason) he can't just give some of his money to the bank and not touch it. He literally can't feel right about savings. So he does this weird thing that basically inverts the whole idea of banking. He even knows it's crazy but it's a working equilibrium for him. Anyhow, I wrote all that in the present tense but this was years ago and I lost touch with the guy. I am astonished that the scammer-telemarketers who can sit there and carefully run these scam-scripts on marks don't just go get legit jobs. I wonder what economic context they are in? Or are they just, uh, morally corrupt, or something? The mystery of the criminal mind.

roywiggins 8y ago
Reply All decided to try to get to the bottom of a specific "tech support" scam, which might shed some light. https://www.gimletmedia.com/reply-all/102-long-distance-parts-1-2 https://www.gimletmedia.com/reply-all/102-long-distance-part...
Izkata 8y ago
> because it felt like having twice as much money Hmmm... Here's a strange thought: What if that was a way of deal with a gambling addiction (or something similar, since I understand risk to be part of the addiction), except you lose significantly less than you would have gambled without the loan?

paul7986 8y ago

Easy solution don’t answer phone calls from those not in your contacts.

rustcharm 8y ago
Huh? The caller ID was spoofed. Read the article. > Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. Sasser said he almost got scammed recently after receiving a call that appeared to be the same number as the one displayed on the back of his Wells Fargo ATM card.
- paul7986 8y ago
  It didn’t say.. wife, friend, mom, joe, etc.. you know people you entered into your contacts. Personally If someone needs to get a hold of me outside of my contacts email or text me and I’ll get back to you accordingly.

neuralRiot 8y ago

>That made Sasser pause. Wouldn’t an actual representative from Wells Fargo’s fraud division already have access to his current PIN? No, nobody has access to your PIN, if you forget it you need a new card.

roywiggins 8y ago
> if you forget it you need a new card That's not true- you can reset you PIN if you go to a physical Wells Fargo location, I've done it.
- mmcconnell1618 8y ago
  Reseting a PIN is different from having access to the old PIN number. Obviously some system in the bank has to verify that the PIN you enter at an ATM matches the one you selected but resetting is a separate operation that does not require the original number.

ttul 8y ago

The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything. There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

howard941 8y ago
How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration. > It's a major nightmare for telephone companies. Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.
- wintermutesGhst 8y ago
  Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw. As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.
  - amatecha 8y ago
    Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D
    - drewmol 8y ago
      If you suspect a scammer called you, always keep them on the line as long as possible. Feed into the scam and act as gullible as possible, give them fake cc numbers, etc.
      - metildaa 8y ago

xphilter 8y ago

Number one advice I give my family: never give out any information (no matter how inconsequential it seems) to a person purporting to be from a company calling you. Hang up and call the company yourself using a trusted number (e.g., the number on the back of a credit card).

dubhrosa 8y ago
Banks should really just stop calling customers and taking them through security. If there's something urgent, the protocol should be that they call you, give you a ticket number, and tell you to call them back on the bank's standard number for customer service. Anything else just conditions people to expect incoming calls with security questions which will always result in scammers finding a way through.
- kweks 8y ago
  This can also be scammed due to the timeout "feature" in telephone systems. Ie, the scammer calls, tells you to call the number on your card. You believe they hung up, but they are still on the line. When you pick up your phone again, you're still contected, and they're playing a dial tone. https://www.geekrant.org/2016/05/08/phone-scam-part-1/ https://www.geekrant.org/2016/05/08/phone-scam-part-1/
  - outworlder 8y ago
    Now the real trick is to get this to work with cellphones :)
  - ams6110 8y ago
    How many people still use landline phones? I don't know anyone.

eyesee 8y ago

If I were able, I would disable incoming telephone calls entirely (consider that a feature request, Apple). The phone system today is fundamentally untrustworthy because of caller ID spoofing, and the phone companies involved are culpable for not addressing this problem. A new ID system using PKI could eliminate the spoofing problem completely. Yes, I'm sure it would require a huge coordinated effort. Given spam calls will exceed 50% of all calls next year [1], this should be seen as an existential crisis for phone companies. [1]: https://finance.yahoo.com/news/spam-robocalls-will-soon-account-almost-50-calls-183157916.html https://finance.yahoo.com/news/spam-robocalls-will-soon-acco...

mmirate 8y ago
Public-key identity verification wouldn't even require substantial upgrades to anything except the phone hardware itself - when making the call, just convey the signature upon connection via a dialup-modem-like encoding, and the receiver may at their discretion neglect to connect their audio hardware to the line until after verifying that data. (Could even use some kind of PoW as another option, for calls where the receiver is unlikely to have received your public key yet.)

the_new_guy_29 8y ago

I dont think i even heard about such issue in EU.

flyinghamster 8y ago

I've had an Asterisk box for about 10 years now, mostly to deal with the tide of junk calls, and it has worked nicely. I first just blacklisted numbers (and sometimes whole prefixes), but now I use a CAPTCHA that handles the robocallers beautifully. Calls from known numbers get to ring through without the CAPTCHA. Still, I've been paying too much for that crusty old landline, and finally got motivated to do something about it. I just ported it out last month, and the new VoIP service I'm using costs less per month than what AT&T was charging just for Caller ID. Even funnier, they offer telemarketer blocking like I've set up, at no extra charge. Farewell and f*ck you very much, AT&T. You didn't even lift a finger to insure that the Caller ID I paid for was accurate.

dredmorbius 8y ago
Could you please point to guides / docs / references for setting this up? Might make some good HN submissions ;-)
- flyinghamster 8y ago
  Here's a good starting point: http://nerdvittles.com/?p=75 http://nerdvittles.com/?p=75 Of course, with Asterisk, you can get downright crazy if you wish.
  - dredmorbius 8y ago
    Yeah, I'd like to start simple, basic, and effective.
  - dredmorbius 8y ago
    A bit more a "getting started" guide than this, actually. Hardware, configuration, concepts.

xoa 8y ago

I'm personally somewhat nervous about what voice phishers will be able to accomplish with call ID once voice sample synthesis gets good enough and cheap enough, which is well on the way from what I can tell. Shades of that old Uplink game, call up a family member or friend and just get them to talk into the phone at all, not even give up personal information but literally just speak enough. Then the phisher can call up the target, spoof that number, and directly have the voice sound just like someone the target knows. The voice and the Call ID will both check out, and this should actually be a lower target then the kind of voice synthesis work currently being done because phone calls are highly compressed and tend to be not great quality anyway. Once that hits general usage along with the kind of ML and social network graphs being done up couldn't that just plain be it for phone usage if companies can't come up with a proper cryptographically verified call scheme (which would require new phones, for everyone)? I mean, if a call coming in directly from a "trusted contact's number" that is literally in their voice becomes generally a scam too I think that'd have to be a real tipping point for the general population. I can't see any choice at that point but to disable all incoming calls period, and move my family over to something else as well. And that tech train is coming down the tracks pretty fast, there have to be at least some phone providers who can see that right? Heavily automatically run personalized ML powered social media and ad network profile fed phishing calls in a relative's voice, yeah that'll be really fun.

DenisM 8y ago
Simple workaround - you call me and leave voicemail, I call you back on the # I know and we talk.

AcerbicZero 8y ago

I haven't even had a debit card issued for my core bank account, and there is very little chance I ever would at this point. There just isn't a good reason to put my money at risk when I can use a variety of credit cards instead, and just pay them off every month. On the rare occasion I need cash, I can do a cash advance (with an associated charge....really useful motivation to avoid needing cash more than once or twice a year). Unrelated, but I'm pretty sure I know what credit union they're talking about. Super nice place that is focused on the tech workers in the Portland area, and I've always had good experiences with them.

tonymet 8y ago

This highlights what I see as the biggest security weakness with banking and online services -- identity verification is only one-sided. Protocols like passwords , pins, biometrics, secret questions only authenticate the customer and not the service provider. moreover, no one is talking about this huge weakness. For there to be trust, both sides need to be trusted. For apps, this could be a one-time code validated in the app. As a fall back there could be a unique shared "service pin" that gets rotated.

jor-el 8y ago

I am interested to understand how does these attacks work. The article states, after the victim disclosed the CC number there were ATM transactions performed using it. How are scammers able to generate a physical card in first place to perform ATM transaction? Is it something similar to card skimming with cards having magnetic stripe? Can this attack be performed with cards using chips? Also I often come across a fraudulent transaction being performed even if only credit card number is disclosed, while cvv and expiry date are not. As per my understanding all 3 info is needed to perform a transaction. Do anyone have some resource where these attacks are discussed in detail and how they are carried out.

Scoundreller 8y ago
Yes, some countries still use the magnetic stripe for authentication, or allow fall-back onto it if the chip “fails”.

kweks 8y ago

One of the issues is that the scams adapt themselves to current "best practices" (use known information to reassure you, tell you not to divulge other pieces of information) - whereas the legitimate institutions use poor practices. When I call my bank, they ask for verification by giving an account number, credit card and expiry details (!)

tormeh 8y ago

Good news, everyone, the industry is moving towards SIP! Bad news is that it's just as bad. There's no improvements in security because that would break backwards compatibility. Also, there's no one who wants to pay extra for security, and the telecoms industry have the virtue of laser-like focus on money.

hinkley 8y ago

My bank's fraud department sent me a voicemail saying my card had been deactivated and I needed to call them at 1-800... Yeah, fuck you. I'm not calling a fraud prevention number that was given to me over the phone and more to the point, what is wrong with you for asking your customers to trust people that called them on the phone. I called the main switchboard for the bank and couldn't find the fraud number from there. They got an earful about that too. None of this is okay, including why they flagged my card (Not for buying a TV and a bluray player, no. For getting a $8 car wash on the way home...)

albedoa 8y ago
Yes! This happened to me too and is very alarming. It’s training users to fall for phishing. I’m not sure what a correction looks like though. Should they call customers and instruct them to find or verify a phone number and call back? Instruct them to log into their online account? That would be fine for you and me, but I’m thinking of the average cardholder.
- jefftk 8y ago
  Telling them to call the customer service number on their credit card seems pretty good?
  - albedoa 8y ago
    Oh duh, thanks. You're obviously right. I was thinking of my experience when I was out and didn't have that card on me.
  - jrochkind1 8y ago
    I just got one of these that had me call a DIFFERENT number than the one that was on my credit card -- the whole time I was thinking it was probably a phishing thing as I was giving them all my info, but in the end it was to ask if I had really made a charge that I _had_ really made the day before (in a city I'm not normally in)... so I'm pretty sure it was legit. Probably?

JBlue42 8y ago

We deal with this on a semi-monthly basis at the hospital I work at. We'll here from one department ("Hi, this is the Emergency Dept, all our phones are busy with a robocaller") then it will roll across other departments for about 20-30 minutes. The best our telecom team has come up with is to take the numbers, give to the FBI, and ¯\_(ツ)_/¯. Last time, they had spoofed the number of FedEx so we couldn't even report that. Most are very noticeable for being in Chinese and tying up multiple lines at a time. That's not really great though, like in the example, when it's all the phones in the ED.

ravenstine 8y ago

I believe that phone companies are complicit in this criminal activity, as they seem to have virtually no interest in actually stopping it. I've already turned off calls on my phone because "why bother", and more and more people I know are doing the same thing. The phone companies probably make so much on streaming that they don't give a shit about the phone system. This is a really bad thing for crime, but might help accelerate the death of a decades-obsolete technology.

vecinu 8y ago
> I've already turned off calls on my phone How do you do that on an Android phone?
- ravenstine 8y ago
  My phone is a Galaxy S5 with Android 6, but it's here: Settings > Call > Call Rejection > Auto reject mode Set it to "All incoming calls".

King-Aaron 8y ago

Can anyone offer any insight into the latest series of odd phone calls I've been noticing, where you get either a private number or an out-of-state number call you, and then sit in silence until you utter a word in which it hangs up at that moment? I've experienced a few so far over the previous months. I've even experimented by not saying anything for an extended time - up to about 30 seconds of silence (and then it usually hangs up itself). But the next time it happens, if you say 'hi' within a few seconds, it immediately hangs up afterwards. Like its waiting for a verbal prompt. The apathetic part of me thinks 'maybe its a robocall thats bugging out', but then the pessimistic part of me wonders 'are they trying to sample my voice'.

Kalium 8y ago
https://www.theregister.co.uk/2011/10/06/termination_bypass/ https://www.theregister.co.uk/2011/10/06/termination_bypass/ Probably something like this.
kalleboo 8y ago
One reason for calls that get instantly disconnected is that when these systems will call up, say, 10 people at a time, 8 won't answer, so there's no reason to tie up 10 operators waiting for someone to answer. So they don't connect you to an operator until you actually pick up the phone/interact. But if they miscalculated and 4 people answered, they don't have enough operators and they just hang up.
- King-Aaron 8y ago
  Interesting, I wasn't aware this could be the case.

deleted 8y ago

[deleted]

nanomonkey 8y ago

Most robo-callers feel like Phishing scams. I've been contemplating giving up my cellphone and just using a Calyx mobile data (https://www.calyxinstitute.org https://www.calyxinstitute.org) and use Signal, email and Mumble only. Anyone else do something like this successfully?

socialist_coder 8y ago
I did it for 6 years when I lived in Germany. I had a data only sim card and a google voice US phone number. Verdict: It's not doable if you want it to work 100%. And in the US I would say it's not doable at all because Android/dumbphone users are still using SMS instead of a messenger app like Whatsapp, so you have no way of communicating with them at all. The biggest problem for me was online services that want to verify your account via your phone number. They don't understand not having a phone number. And about 20% of the time, they block VOIP phone numbers for verification purposes, so your google voice number won't work there either. Literally no way to move forward there other than ask a friend to let you borrow their number or use your burner phone or something. You also can't sign up for Whatsapp without a phone number, but luckily it does work with google voice. Google voice also doesnt let you set it up so your device gets incoming calls unless you forward them to a real phone number. So you can only make calls with it, not receive. Maybe some other VOIP solutions are better at this. The google voice app on iOS is pretty shitty. Now that I'm back in the US, I had to get a phone number because messenger app adoption is very very low. iOS users are fine because iMessage is awesome, but for people on Android, there's just nothing. They still use SMS. Maybe you can get around this with VOIP, but I didn't want to hassle with it.
- nanomonkey 8y ago
  Thanks! I'm not concerned about Whatsapp, and I figured I use Twilio for text messages. Out of service phones can still call emergency services, 911. My main concern is being "that guy" who everyone has to make exceptions for when contacting.

nerdbaggy 8y ago

It’s a hard problem to solve since being able to set your own outbound caller ID number is so critical for the phone business. - Call Forwarding - Picking which trunking provider to send a call out -etc

dade_ 8y ago

When receiving a call from your bank's contact centre, always thank them, hang up and call the number on the back of your card. This should be the standard advice from banks to their customers.

paulie_a 8y ago

The amount of spam calls is fucking insane, the fcc needs to seriously crack down. Start fining telecom companies a buck a call and I think the problem would go away. Hell make it 5 dollars for every call after the first ten thousand, I receive at least 5-10 day. If it is an obviously spoofed number make it 50 dollars. The telecoms have the capability to deal with it, they simply have no incentive to bother. I've had a conversation with my cell carrier where I asked to block Texas and Florida, every area code in those states. Apparently that is not possible.

jader201 8y ago

Why has Apple/Android not added the ability to reject (or at least send directly to voice mail) all calls outside of contacts, and make this the default setting? Seems like this would solve almost all of these problems.

tonyquart 8y ago

Well, I think these scammers will always try to steal our money by using hundreds of methods and tricks. Almost everyday I could read dozens of complaints and reports filed at social media and also sites like http://whycall.me http://whycall.me about phone scams. We need to keep informing our family about these scams. They are never getting tired of trying.