8 ms·
I've got a number of calls from my bank over the years (usually the Visa department asking about international charges) and my standard response has always been
by dkersten 7y ago
I've got a number of calls from my bank over the years (usually the Visa department asking about international charges) and my standard response has always been "I'm sorry, as a rule I do not discuss personal details with someone who called me, since I don't know who you are" and they typically respond with "no problem, please call the number on the back of your credit card". I still wish they wouldn't try to initiate a call (usually they launch straight away into verifying who I am, asking me a ton of personal details before I even know that they're legit... sigh) and would just ask me to call them back on an official number (not one they give me over the phone, obviously) instead. If that were standard practice, I think these kind of scams would be a lot easier to detect.
- deleted 7y ago[deleted]
- TheSpiceIsLife 7y agoI always say to them: I can not identify myself to you because I cannot authentic who you are. And explain to them that we, as a society, need to come up a way of authenticating inbound and outbound calls to ensure we are connect with who the other party claims to be because when you do this it conditions society in to responding and that’s how phishing attacks occur.
- VMG 7y agosociety could fix all sorts of problems if we had a public key infrastructure...
- mschuster91 7y agoBanks have this in place already - EMV cards have powerful cryptoprocessors. In Germany we can use chipTAN, it's a small cheap reader for your card where you scan a six-binary-blinking screen that transmits the transaction data, then the card signs it and you get a six-digit TAN back. You can also manually enter the hash to be signed ("start code" is the technical term) and you get the TAN. Customer support could ask you to authenticate using the TAN already, the hurdle is that you would need to carry the reader at all times. Unrelated to banks, I believe it could be possible to extend SS7 signalling to not just transmit the caller ID but also a crypto signature/public key which the phone then can verify - or your phone provider could. Think of something like HSTS with a global database, if there is no match for the phone number the provider patches the call through, but if there is an entry, all providers can check for the public key transmitted by the caller and refuse to patch the call if it's missing or faked.
- dependenttypes 7y agoWould you happen to know what kind of signature scheme they use?
- mschuster91 7y agoIIRC the German system is proprietary, the specs are available only after payment of a couple hundred euros.
- dependenttypes 7y agoI am grossed out by proprietary protocols but proprietary encryption algorithms just make me laugh. Who even though that this would be a good idea? Are they seriously trusting their money with this?
- Fnoord 7y agoMy bank seems to use a similar scheme. It appears akin to TOTP with 8 numbers. But the secret is inside the black box. They also have something like a QR code but with RGB colors (does not work with blue light reducing features).
- icebraining 7y agoI don't know about the German system, but here they use EMV-CAP: https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program
- dependenttypes 7y agoNo public key crypto?
- JshWright 7y agoOr maybe some sort of interconnected web of people who trust each other...
- cbm-vic-20 7y agoThat would be pretty good privacy.
- dependenttypes 7y agoLike the web of trust from GPG?
- JshWright 7y agoThe WoT originated with PGP (though obviously GPG implemented it as well), but yes, that was the joke.
- novalis78 7y agoWe are in some kind of Stone Age of The digital age...
- londons_explore 7y agoWhile spoofing numbers on incoming calls is far easier, it is also possible for an attacker to redirect your outgoing calls from the right place in the phone network. You just shouldn't consider any aspect of the phone network to provide authenticity or confidentiality.
- evancordell 7y agoI had an experience indistinguishable from the phishing attack being discussed - with the only difference that I initiated the phone call. A transaction I had initiated had triggered some fraud warnings and my account was locked. They asked for my account number, name, and address for verification. When they got to the point that they sent me a code over SMS and wanted me to tell it to them over the phone, I stopped them and explained that this is also the exact set of steps required to reset my account and that I wouldn’t do it. I went to a branch in person to unlock my account and the person helping me asked me to enter my password on their terminal so that they could “see the error message”. I’m still not sure if some parts of this were a more advanced phishing scheme than I had thought was possible, even though it does just seem like a set of confusing practices by the bank.
- partisan 7y agoI wonder if bank staff are in on it sometimes. I once was at a bank branch and had the teller pick up the phone, call another teller and tell her my balance in a foreign language that I happen to speak fluently (but don’t look like I should). I wanted to ask her why she would be doing that, but I was a bit more meek in my younger days.
- beerandt 7y agoAt least if you're at the bank, the typical separation of powers would at least ensure they're caught promptly, should something go wrong.
- kevin_nisbet 7y agoI had something not exactly like this occur to me. It wasn't something I overheard, but I'm pretty sure it went something like this: 1. You talk to a teller at a branch, and they bring up your account details. The teller see's you have a mortgage with the bank, but registered to a different branch. 2. They have some sort of incentive from the mortgage specialists at their own branch or management, to refer those accounts to their own mortgage team. 3. The mortgage department at the new branch calls me, and says I can do an early renewal at a lower rate, if I come in and see them. Anyways, I did the early renewal at my original branch, as I had a connection to a manager at that location. Either way, I ended up shaving a good chunk of interest by renewing a year early.
- Ensorceled 7y agoMy bank always says "There is an issue with your credit card/account, please call the number on the back of the card/your branch as soon as possible." and has for years. The only time they do otherwise is on very specific instances where they provide the info, "did you just buy something at store XXX for approximately $YYY" All banks and credit institutions should be required by law to do this.
- monkeynotes 7y agoCapital One has an app, every time my card is used I get a push notification. This is the best solution in my mind. I can actively monitor my card usage and call if I see something suspicious.
- alistairSH 7y agoI wish all banks and CCs offered this feature.
- sgc 7y agoIt's worth searching on their site / calling them, since in my experience every time over the last couple years I have dug, I have found it offered.
- pickle-wizard 7y agoMy AmEx does that too. I really like that feature.
- clairity 7y agochase does this too. applepay, for all my cards, gives me an immediate push notification, despite some cards not doing so for regular chip/swipe transactions. really like that feature & also wish all cards did it for all transactions.
- parliament32 7y agoAMEX does this and it's honestly great. Unfortunately my credit union doesn't, but I use credit for most transactions anyway.
- megablast 7y agoI don't do that. I say "are you crazy, you are a bank and asking me to prove who I am? You called me. You prove who you are first."
- dkersten 7y agoYes, you’re right, I did say something like that once but the end result was the same: they asked me to call the number on my card.
- lol768 7y ago>my standard response has always been "I'm sorry, as a rule I do not discuss personal details with someone who called me, since I don't know who you are" Amex got quite offended when I did this, and almost chastised me when I got through to an agent after making the outbound call myself. They argued that because they only asked for limited personal information (DOB) it was fine... I would still do it again!
- joosters 7y agoI had that same issue with Amex, they phoned, said there was a concern with my card and then wanted me to go through identity checks before saying more. They also got quite stroppy when I refused and asked them to prove their own identity first! Eventually they did suggest I call the number on the back of my card, but I was annoyed by their lack of professionalism by this point (I mean, they are asking me to do stuff - giving out information to unknown callers - which they themselves always tell customers never to do!) I said I wasn't going to phone a general number and get stuck on hold for hours over an unknown issue - either give me some reference to get through quickly to the right person, tell me what the problem is now, or send me a letter. But they kept claiming that they couldn't send out letters in the post :-( In the end, I finally received a letter by mail telling me that there were problems with my direct debit payments. So it was a genuine call but their inability to securely make these calls is frustrating.
- mffnbs 7y agoI think if they gave you a number to bypass the general queue that you’re still vulnerable to an attack, right? The only way to ensure you’re calling amex is to call the number you know, otherwise the scammer will have you call another one.
- joosters 7y agoNot a different number to call, but instead a shortcut through the usual automated phone menus - e.g. I've had a bank tell me to phone their number and then enter an extension to take me straight through to the right person.
- jimsug 7y agoI get these calls from time to time, and any bank with proper training should be 100% okay with you questioning their authenticity. There are some replies which indicate that the agent is annoyed... That's just poor training. As for them initiating a phone call, it still does remain the best way to contact someone urgently, usually falling back to SMS and/or email when/if you don't answer (this was our SOP when I was in a fraud detection team years ago). We'd also usually tell them to call the number on the bank of your card (because not everyone is able to look up the bank's website, shockingly, so this is the most universally applicable way to give people a number) but my usual spiel was "call us on the number on the back of your card or from our website". There's also no real way for you to know that they're legit, but an interesting reassurance one bank I know uses is to provide your month and day of birth and ask you for the year (as just part of the verification process). The partial info probably helps some people but I still wouldn't go for it - too many people know my birthday.
- dwild 7y agoWhy would they need to verify you when they call your phone? When I got theses calls personnaly it was a robot voice that was simply asking if a few of my transactions were done by me. It only happened twice, and I feel they make sure to include both actual transactions and a few fake ones to verify your truthfulness because in both case I had one that was clearly wrong that I never saw in my transaction log and they didn't replace my card.
- somecanadian 7y agoYou should be careful even about doing that if you are on a landline. There is a landline scam where they don't let the call disconnect, so when you hangup and then think you are dialing the bank, you are actually still connected to the scammer. Always use your mobile phone to make the call (although I'm sure its only a matter of time before even that is compromised). https://toronto.ctvnews.ca/etobicoke-couple-defrauded-of-more-than-33k-in-landline-scam-1.4629999 https://toronto.ctvnews.ca/etobicoke-couple-defrauded-of-mor...
- dkersten 7y agoLuckily I don’t have a landline so it’s all mobile :)
- merpnderp 7y agoThis. I always tell them I'll call them back if it is someone I don't know who needs to discuss sensitive matters. It's the only way to be sure.
- dheera 7y ago> "I'm sorry, as a rule I do not discuss personal details with someone who called me, since I don't know who you are" Correct. If someone calls me, the onus is on them to prove to me that they are who they say they are. However, I usually just block ALL unscheduled phone calls, period. Not only do I not have time for unscheduled interruptions, but banks have secure websites and if they can't make proper use of them, too bad, they aren't going to reach me by trying to call me. They should know that phones are easy to phish with, and stop using phone calls to initiate communication. Ideally what I want is an e-mail saying "we saw some suspicious transactions, please /log in/ to check that there is no fraudulent activity" or even a more general "please log in for an urgent message" with a suspend button in the online interface.
- dkersten 7y agoGood point, and in fact I haven’t gotten such a call in a long time. All the “did you make transaction X” type calls now go through their app or via sms, so don’t get those calls anymore. I can’t actually remember the last time the bank called me, but maybe 6 or 7 years ago they called me a good few times. Nowadays I actually also block incoming calls unless in my contacts or I’m expecting it. I communicate mostly online and outside family, rarely get phone calls. So I really don’t care to answer a random call.