5 ms·
The easiest way to avoid this entire class of attack, is to never be willing to answer any kind of question from someone who calls you. Always hang up, Google t
by anaisbetts 7y ago
The easiest way to avoid this entire class of attack, is to never be willing to answer any kind of question from someone who calls you. Always hang up, Google the customer support line for the business, then call them.
- rkangel 7y agoMy bank does that. They call you and say "we need to talk about some fraudulent transactions, can you please ring the helpline and ask to talk to Dave".
- icelancer 7y agoYeah but people expect when calling a business to be put on hold for 20 minutes and be dicked around on a phone tree. They don't want to deal with that.
- easytiger 7y agoThere was a widespread phishing attack in the UK that used this approach. On UK landlines the call is not terminated until the person who made the call hangs up. That is to say if I call you, you answered and then hung up, then waited a minute and picked up the phone again, I'd still be there and the connection still made. Scammers phoned people, told them there is an account issue and to phone the number on the reverse of their credit or debit card. The scammers keep the line open and play a recording of a dial tone to the target phoning back and then go through garnering all the details needed to rinse the accounts. I believe in response UK phone networks are implementing time limits on one sided terminations
- wintermute58 7y agoThis BBC article from 2014 suggests that the call clearing time was reduced to a few seconds by most carriers: https://www.bbc.co.uk/news/technology-26559554 https://www.bbc.co.uk/news/technology-26559554
- gexla 7y agoWe should have learned this one a long time ago from email. If something comes through from a service which may require action, then go directly to the service and stop interacting with the email. Phones seem just as dangerous these days. I don't answer them at all. Anyone who really needs to get in touch knows multiple services that will get through to me.
- upwardbound 7y agoHow easy would it be for an attacker to (at least temporarily) outrank the bank in SEO so that when people google the bank's number they find the top result being the attacker's number?
- afghanPower 7y agoExtremely hard. Maybe you could buy an ad space and "outrank" them that way. Have to pass Google's ad approval process though.
- rahidz 7y agoThere's quite a few articles about this happening in India through Google Maps: https://www.forbes.com/sites/leemathews/2018/11/26/fraudsters-change-bank-phone-numbers-on-google-maps-to-empty-victims-accounts/ https://www.forbes.com/sites/leemathews/2018/11/26/fraudster...
- tidenly 7y agoI've already taken the most effective security measures against this kind of attack, which is to never answer the phone.
- SmellyGeekBoy 7y agoSadly this is my approach, too. If it's important they can leave a voicemail message and I'll call back at my convenience. I always thought the expectation of interrupting whatever you're doing at a few seconds notice was incredibly rude anyway, even more so now we have so many other ways of communicating.
- throwaway744678 7y agoOr have your regular representative call you; an attacker may guess their name and hope you won't be able to recognize their voice, but it adds a level a complexity