12 ms·

How I lost control of our bank accounts to a phone scammer

203 points by miles 7y ago

vxNsr 7y ago
The persistence is what tells me its fraud. A regular bank would just tell you the number to call and say "have a nice day." In fact my bank recently did try to reach me for fraudulent charges and they did it by text and at the end it said "call the number on the back of your card" so I would suggest just like the IRS will never call you directly; assume your bank will never call you. They might text you, email you, have their app send you a notification but never a call. and they will always say "call the number on the back on your card"
- xapata 7y ago
  I got a call from my bank earlier today, trying to get me to finish my mortgage application. I think it was them, but I refused to authenticate, because I didn't schedule the call.
  - gowld 7y ago
    I hated that. When I was buying real estate, it's an endless stream of of warnings to not give away all your money to scammers, interleaved with a stream of messages from the bank, brokerage, and escrow company that look and act exactly the way scammers behave. No security in the phone based transactions. No challenge-response. Constant handoffs to new associates and affiliates. They don't care about security at all; they just want to be able to say "we warned you" if you get robbed.
    - paultopia 7y ago
      This is so true! It's absolutely mind-blowing how a fraud warning can be immediately followed by an impromptu call from someone's assistant using a cellphone. This is also more broadly true of the consumer lending industry. One of the things that totally boggles my mind is that consumer loans are bought and sold, and then a consumer just receives a random letter one day: "hey, start sending your payments to me now!" How on earth is the poor consumer to know that the random person who is demanding money actually holds the note? And it's not like the student loan or the auto loan or the mortgage loan originator actually has a phone number one can call where someone actually reliably will answer the phone and will actually know whether the note was sold or not (have you tried to get a student loan servicer on the phone?)... I think probably the only solution for that industry is to legislate rational security practices at them.
  - wil421 7y ago
    That’s more of sales call than anything else. I’d expect the bank to follow up on loan applications.
    - xapata 7y ago
      Sure, but there's also a bunch of wire fraud chasing people going through the process. It's scary.
- goodcanadian 7y ago
  Your bank may call in the case of suspected card fraud. I've had that a handful of times.
  - vxNsr 7y ago
    I've had that once a long time ago, now they always just text or email, I'd rather that... no matter what I'm trying to buy, I have 15 credit cards if one doesn't work a different one will.
stevebmark 7y ago
Another missed red flag is when the scammer told him his last four of SSN. No legitimate company who has your DOB or SSN will ever tell you it over the phone. I'm pretty sure that's a violation of compliance laws. Agents are trained to ask, not tell.
- mannykannot 7y ago
  Giving it to some random caller does not make me any more secure - so it would seem that the rational approach is to distrust any incoming call that mentions the issue, as it does not belong in any security challenge.
  - mannykannot 7y ago
    To correct my own claim, it seems reasonable to give this information if you are confident you have contacted a trusted entity, so that it can do its verification.
- deleted 7y ago
  [deleted]
- wwwwewwww 7y ago
  You're overestimating the legitimate companies' employees security acumen. They do it all the time. Sometimes when a legitimate company asks me to verify something, they do it by telling to me. As in, "I need to verify your date if birth. Is it xx/yy/zzzz"?
- chrisseaton 7y ago
  Your DOB and SSN shouldn’t need to be private information! The first is a matter of public record and the second is an identifier not a security token.
grecy 7y ago
I steadfastly have the stance I will never talk to anyone over the phone unless I initiated the call, and this is a great reminder to stick to that, no matter what they say.
- gpderetta 7y ago
  Yes, everybody should do that! /s
- lucb1e 7y ago
  Just to be clear, that's in the context of talking to companies, not when a friend calls you up? Because I'm not sure if it's because I'm just thick or because I'm not natively English but it can be understood (as my sibling comment seems to do) as literally never talking to anyone unless you called them.
  - rootusrootus 7y ago
    Everyone has their own strategy. I only answer calls from my own contact list. I have some friends who literally turned off the ringer and don't answer any calls. You have to leave them a message, or just text them and ask them to call.
    - fortran77 7y ago
      You realize this fails because you can spoof Caller ID. The Caller ID was from the bank, so if you had the bank in your contact list, you'd have no protection.
      - _-___________-_ 7y ago
        If your contact list is small enough to be people that you know well, though, it's not a bad policy. Most scammers are not going to be equipped to imitate my brother's or my wife's voice and mannerisms well enough for me to believe them.
      - rootusrootus 7y ago
gowld 7y ago
> Here’s the tl;dr version: Do not ever, as in never ever, give out a verification code over the phone. The deeper lesson here is the power of cognitive dissonance. If you get even slightly fooled, your egotistic brain will Stockholm Syndrome you into working for the attacker, to postpone the embarrassment of acknowledging to yourself you got a little bit fooled. The worse it gets the deeper your denial will grow to stop you from cutting off the attack.
cgijoe 7y ago
My takeaway: Never, ever talk to anyone over an incoming call. Always, always initiate the call yourself, and to the official number.
- DonaldFisk 7y ago
  If someone claiming to be from your bank calls you, it isn't safe to hang up and call on the official number, unless you call the bank on a different line. The original call doesn't end until the calling party hangs up, and they might spoof a dialling tone and then a ringtone.
  - riyakhanna1983 7y ago
    How do you spoof "dialing tone" on a smartphone?
  - deleted 7y ago
    [deleted]
  - cortesoft 7y ago
    That is only on VERY old land line systems... in fact, I don't think any exist anymore (the lasts ones were phased out a few years ago)
    - miles 7y ago
      New scam keeps fraudsters connected after victim hangs up https://www.cbc.ca/news/canada/ottawa/line-in-trapping-technology-1.5387822 https://www.cbc.ca/news/canada/ottawa/line-in-trapping-techn... "Scammers using line-trapping technology to trick victims, police warn"
      - duckmysick 7y ago
        What is line-trapping? The article doesn't explain how it works and which devices are vulnerable. I tried to look it up but the results aren't helpful. They are either rewrites of the same article or irrelevant pages about wildlife trapping. I suspect they affect landlines, but the articles have confusing photos showing smartphones.
tdy721 7y ago
At the end he mentioned he had 2fa activated. How did the scammer defeat that? Did he read another code out to them and gloss over it?
- bowmessage 7y ago
  That may have been the 'second code' referred to as a typo by the article, but was perhaps the standard 2fa token that came in after the original password change token? Nice catch.
dumbfoundded 7y ago
Some banks do actually send and then ask for a verification code over the phone. And it's legit! They have multiple types of verification codes, like ones for wires and another verifying your identity if you call customer service. Avoiding fraud is complicated already and will continue to be a problem forever. As people get better at identifying scams, the next one will emerge. As companies create new policies to avoid fraud, "jerk"s will figure out ways to manipulate it. I'm not sure a long term solution exists.
- bitcoinbutter 7y ago
  I mean, if there is proper 2 factor authentication set up, it would be much more difficult for this scam to work. Most banks in Asia issue you a physical security token, which if you lost you'd need to get it replaced in person.
- riyakhanna1983 7y ago
  Is it possible to eliminate the phone number? It was needed in old days, and many people today use over-the-top services like WhatsApp and FaceTime. Companies use phone number to track us and scammers use it to swindle us.
  - dumbfoundded 7y ago
    Probably not. If a phone number is replaced with a hash or a username, similar if not identical problems will emerge. Look at the numerous bitcoin scams. I think the only thing that helps is time. The longer a technology has been around, the harder it is to fake. Fraudulent gold or currency is pretty tough to do and the people tasked with tracking down the offenders are effective. With most internet-based scams, the technology is emerging. It will take a long time for detection and mitigation to catch up.
robenkleene 7y ago
The author is Rob Griffiths of the venerable Mac OS X Hints (http://macosxhints.com http://macosxhints.com) and Many Tricks Software (https://manytricks.com/ https://manytricks.com/).
- rsync 7y ago
  I chuckle because rsync.net purchased a few "Witch"[1] licenses and my accountant's auditor who was going through last years expenses came across a charge from "manytricks.com" and sort of sheepishly said " ... I think this might not be a business expense ...". I had to explain that it was, in fact, and showed her the software that we had licensed ... [1] https://manytricks.com/witch/ https://manytricks.com/witch/
jeffdavis 7y ago
One lesson is that it's not a certain type of person that falls for a scam. It's anyone when they are in the wrong frame of mind. Obviously there are ways to prepare yourself, and rules to follow, and red flags to watch for. But you won't really follow the rules unless you believe that "yes, it can happen to me". It might be when you are busy or fatigued or in the middle of a big transaction or whatever.
- AdrianB1 7y ago
  There are 2 types of a person that falls for a scam: the one who does not know how things work and the one that ignores the red flags. Writing the story is good for the ones that don't know.
antoncohen 7y ago
Yesterday a family member got scammed out of banking information in a COVID-19 related scam. These scams are rampant right now. I think it is worth warning family and friends that might be unaware. Banks sometimes make it hard to do the right thing. Last year my bank called me, I didn't answer the unknown number and they left a message. The message had a phone number to call and a case number. I'm not going to call a number someone gives me, so I called the main number and asked to be transferred. After a few transfers to the wrong people, it eventually became clear they couldn't transfer me to this particular fraud department. I physically went into a bank branch. A very nice banker there tried to call them for me, spent 20 minutes on hold and being transferred around. They were able to confirm the call was real, and what it was about. But the final conclusion was, there was no possible way to reach the person in this fraud department, they had to call me. We arranged a 1 hour window where they would call me and I'd be sure to answer the phone.
- antoncohen 7y ago
  I'm going to correct myself. My family member didn't get scammed! There is a government agency cold emailing people, telling them to fill out a form that that asks for Bank Name, Account Number, and Routing Number. https://imgur.com/a/5loIfnW https://imgur.com/a/5loIfnW Way to teach people to be safe. At the same time the IRS is telling people to avoid scams by not clicking links in emails: https://www.irs.gov/newsroom/irs-issues-warning-about-coronavirus-related-scams-watch-out-for-schemes-tied-to-economic-impact-payments https://www.irs.gov/newsroom/irs-issues-warning-about-corona...
  - TylerE 7y ago
    The banking system (checking in particular) is hopelessly dumb, but that information is printed on every check. It isn't top secret.
    - antoncohen 7y ago
      True. The form also asks for SSN, DOB, address, phone number, etc.
_bxg1 7y ago
The fact that the phone number on your screen cannot be trusted to be the real one is completely unacceptable. It takes a very savvy person to know not to trust it; any reasonable person would assume it to be correct. And there is no one to blame but the carriers. I really hope the FCC's new anti-spam rules kill this problem dead in the water.
- projektfu 7y ago
  This is an unfortunate by-product off the easy phone numbers work. It’s necessary that when I call from one of my N lines, your caller ID says my main number. Adding in SIP, cellular and other forms of phone mobility makes it hard to authenticate phones without a central system that was never provided.
  - _bxg1 7y ago
    It is not hard, carriers are lazy. These are massive companies with deep pockets and no motivation to tackle a problem that doesn't directly impact their bottom lines. Just keep a registry of every organization that you've given permission to to fake phone numbers, and which phone numbers they're allowed to fake. Make them route those calls through a special system and give them a secret token that that system will verify. Centralize your client/token/virtual phone number registry across all carriers (it's no different from certificate-authorities). If one of the accounts starts sending spam calls, revoke their token. Done.
    - closeparen 7y ago
      >Make them route those calls through a special system and give them a secret token that that system will verify STIR/SHAKEN is handling this at the provider level. There are an awful lot of PBX installations out there, with hundreds of makes and models and service lives in decades. You are absolutely not getting every business with a trunk line (e.g. essentially every business with more than one telephone) to participate in a protocol change.
      - 7y ago
projektfu 7y ago
I got a call from Wells Fargo telling me that they had identified a fraud on my account. Fair enough, I was about to call them to tell them that they cashed a check against my account that was written for a different name. This was entirely their own doing, essentially. Then, they ask me to verify my information before starting the process of fixing this and creating a new account number. “With all due respect, you called me. How do I verify you?” “Well you have to answer the question otherwise we can’t fix this over the phone.” “OK that’s fine, just give me some way to contact you when I call the main number.” “No, there’s no way to do that. If your don’t answer these questions now, you’ll have to go to a branch.” This was entirely surprising to them. In the end I had to go to an office and show my forms of ID, which I found amusing because they didn’t even bother to verify that the name on the check matched the account. But anyway. This bank, at least, is not yet on board with good security practices.
- gnicholas 7y ago
  I’ve had a similar experience when my bank called me and asked me to verify my identity. I asked them to tell me the sum of the last four digits of my account number. They wouldn’t. I had to call another number and get transferred around a bunch. Perhaps I should have said: here are five possible transaction amounts and dates. Tell me which one is real and then I’ll verify my identity to you.
  - caseysoftware 7y ago
    It's simpler than that. Ask for their desk extension and then call the number on your bank's website/card and use the extension. I have yet to talk to a bank employee who isn't willing to do that.
    - patio11 7y ago
      This is the best way, but some call centers aren’t set up to give it. (I have intimate knowledge of this topic.) If you run into one of them, the quickest resolution is calling their preferred services line and saying “I just got a call from the Fraud Department but was disconnected; can you transfer me?”
joshthecynic 7y ago
Imagine being dumb enough to fall for this.
litoE 7y ago
A couple of months ago my wife fell for a similar scam. Caller on her cell phone said he was from our cellular carrier. She was sent a text message with a code, which she read back to him. Caller proceeded to access our on-line account at the carrier, using her cell phone number as the user ID, and purchased two top of the line iPhones, to be shipped to a hotel a couple of blocks from our house under her name and, of course, billed to us. Fortunately, the carrier put the order on hold and sent her a text message asking her to confirm the order, so I was able to regain access to the account and reverse the purchase. I called the carrier's security, told them the story and gave them the address of the hotel where the scammer would be picking up the phones he had ordered, but they were not interested in following up.
- maccard 7y ago
  > but they were not interested in following up. Why would they be? All they're interested in is avoiding transactions that might be marked as fraudulent, they're not interested in actually fixing the issue. Thats the polices issue, not your carrier.
  - Nextgrid 7y ago
    Following up and putting the scammer in legal trouble means he's no longer going to be around to retry the scam on the next victim (who might actually fall for it).
1024core 7y ago
Why do phone companies allow phone number spoofing? I can't spoof just anybody's IP address; why can I spoof a phone number?
- pwg 7y ago
  Two reasons: 1) Because the whole system was designed back in the day of one single integrated phone company (Ma Bell/ATT in the US), so having any form of authentication was unnecessary, because only the one single phone company was ever responsible for handling anything phone related. 2) Because caller-id is an 'add on' that has no relationship to the underlying phone number "address" that is actually used to route phone calls. It is just an extra text string sent along from the call initiator for the purpose of appearing on a display at the destination end.
  - 1024core 7y ago
    But ATT was broken up almost 40 years ago!
- cerberusss 7y ago
  Of course you can spoof anybody's address. Depending on the protocol, you may not be able to get it working. But if it's UDP, you can definitely spoof someone's IP address.
  - Tepix 7y ago
    Quite a few ISPs will not let you use IP addresses that do not belong to them.
  - namibj 7y ago
    Actually, good luck. People have ingress filters.
chrischen 7y ago
Even with new tech companies like Plaid they're designing patterns that will compromise security down the line. Plaid has you enter your bank login information right on some third party website. While Plaid can be trusted, there's no reason to trust the third party with my bank login info. My password manager right doesn't work on these pages since it doesn't recognize the domain. But a less astute user may unwittingly give out their bank login info to some random site that makes a fake Plaid UI.
- LordOfWolves 7y ago
  Please correct me if I’m wrong, but I believe Plaid uses an OAuth-Luke experience via an external tab/window to an encrypted sub domain of their website for authentication (so no middle man sniffing technically possible). Disclaimer: I do not work for Plaid, but have used it in the past.
  - chrischen 7y ago
    If it is implemented that way there’s no way to tell from the user side. It just looks like it’s a part of whatever website you are on. My password manager even refuses to autofill.
NightlyDev 7y ago
No doubt that this person made a huge mistake, but... Is this seriously a thing? A bank that uses one-factor login? Not only that, but a weak one too? This seems absolutely ridiculous. Why would anyone use such a terrible bank? Isn't the bank at least required to try to protect the customers money? It's usually not that hard to get a hold of a number belonging to someone else. Where in the world is this?
- DangitBobby 7y ago
  Isn't this two-factor login? Something you know (username) and something you have (phone)? There's also a good chance that the scammers had a set of leaked security questions on hand. I'm sure some banks even use SSN as an authentication factor.
  - NightlyDev 7y ago
    No, it's not. A username is rarely a secret used for anthentication. In this case it seems the user got tricked into giving away a password reset code given over SMS. So the first factor(password) was skipped. If an SMS code and the password would have been needed then it would be 2 factors. SSN is alsp a stupidly bad usage as an authentication factor. A lot of people have access to it, it's not unique to the service and you can't just change it whenever you want.
ipv6ipv4 7y ago
I read these accounts of scams and I can’t imagine any legitimate scenario where I could possibly expect a call from a bank about any of my accounts - checking, savings, brokerage, CC, mortgage. With everything available online, there is no reason to step into a branch or have an ongoing phone ‘relationship’ with a bank. I can’t remember the last time a financial institution called me about an account. Even credit cards have moved away from fraud check calls to simple and foolproof yes/no verification messaging. Outside of non-specific marketing and upsell calls, any call I get out of the blue can only be a scam.
libraryatnight 7y ago
Why do people answer the phone at all when it's not an actual person (family or friend)? There's no reason for a business to call you. My phone sends any call that's not from a number in my contacts straight to voicemail - if a voicemail even gets left that's not just someone hanging up, you can return the call to a number you know is real. The IRS deals almost exclusively by mail, banks have apps with account notifications. There's not many good reasons to answer unexpected calls from businesses.
- noitsnot 7y ago
  Working remotely is new for a lot of people and sometimes coworkers will call your personal number because it is available for emergency purposes, which unfortunately we now live in.
- xenocyon 7y ago
  Presumably you have never interacted with a doctor :-)
  - libraryatnight 7y ago
    My doctor interacts via a patient portal online.
deleted 7y ago
[deleted]
kls 7y ago
I had one of these guys call me and I can tell you they are good, we have a lot of skimmers on gas terminals, atms, etc. in South FL so it's pretty normal to get fraudulent transactions calls. But like this article, the guy spoke perfect English. The cunning part is they really knew the workings of my bank, they would call 5 minutes after the main line closes for the night. The worst part about it is, they had my card number but it has been put in cold status due to legit fraudulent activity, which basically means you can only use it as a debit card. Their aim was to get my pin from me, and they had a whole script before that, that they run thru. The scary part is it felt like a legit fraudulent activity call from my bank and I still suspect that one of the scammers had inner-working details of my bank. I knew it was not when they asked me to verify my pin. At which point I realized it was not a legit fraud activity call. I ask for a call back number and of course the excuse making started about the main line being closed now (they have a separate fraud line that is 24 hours). I told them I would call back in the morning, they said they would have to let these transactions go thru if I did. I said fine but I dispute them if you are recording and hung up and promptly called the fraud line. The scammers are getting more sophisticated and convincing.
deleted 7y ago
[deleted]
icedistilled 7y ago
He still failed to notice a huge red flag. Companies are not supposed to call people up and tell them your last 4 SSN digits, let alone the entire thing. If your bank every does that to you, close your accounts and switch banks. Why did he not realize this after the fact and point it out as a missed red flag? Has anyone had their bank read them their SSN over the phone? That sounds like a massive PII compliance issue.
greendestiny_re 7y ago
If you suspect you're talking to a scammer, the best solution is to—waste their time.

203 points by miles 7y ago

The persistence is what tells me its fraud. A regular bank would just tell you the number to call and say "have a nice day." In fact my bank recently did try to reach me for fraudulent charges and they did it by text and at the end it said "call the number on the back of your card" so I would suggest just like the IRS will never call you directly; assume your bank will never call you. They might text you, email you, have their app send you a notification but never a call. and they will always say "call the number on the back on your card"

xapata 7y ago
I got a call from my bank earlier today, trying to get me to finish my mortgage application. I think it was them, but I refused to authenticate, because I didn't schedule the call.
- gowld 7y ago
  I hated that. When I was buying real estate, it's an endless stream of of warnings to not give away all your money to scammers, interleaved with a stream of messages from the bank, brokerage, and escrow company that look and act exactly the way scammers behave. No security in the phone based transactions. No challenge-response. Constant handoffs to new associates and affiliates. They don't care about security at all; they just want to be able to say "we warned you" if you get robbed.
  - paultopia 7y ago
    This is so true! It's absolutely mind-blowing how a fraud warning can be immediately followed by an impromptu call from someone's assistant using a cellphone. This is also more broadly true of the consumer lending industry. One of the things that totally boggles my mind is that consumer loans are bought and sold, and then a consumer just receives a random letter one day: "hey, start sending your payments to me now!" How on earth is the poor consumer to know that the random person who is demanding money actually holds the note? And it's not like the student loan or the auto loan or the mortgage loan originator actually has a phone number one can call where someone actually reliably will answer the phone and will actually know whether the note was sold or not (have you tried to get a student loan servicer on the phone?)... I think probably the only solution for that industry is to legislate rational security practices at them.
- wil421 7y ago
  That’s more of sales call than anything else. I’d expect the bank to follow up on loan applications.
  - xapata 7y ago
    Sure, but there's also a bunch of wire fraud chasing people going through the process. It's scary.
goodcanadian 7y ago
Your bank may call in the case of suspected card fraud. I've had that a handful of times.
- vxNsr 7y ago
  I've had that once a long time ago, now they always just text or email, I'd rather that... no matter what I'm trying to buy, I have 15 credit cards if one doesn't work a different one will.

stevebmark 7y ago

Another missed red flag is when the scammer told him his last four of SSN. No legitimate company who has your DOB or SSN will ever tell you it over the phone. I'm pretty sure that's a violation of compliance laws. Agents are trained to ask, not tell.

mannykannot 7y ago
Giving it to some random caller does not make me any more secure - so it would seem that the rational approach is to distrust any incoming call that mentions the issue, as it does not belong in any security challenge.
- mannykannot 7y ago
  To correct my own claim, it seems reasonable to give this information if you are confident you have contacted a trusted entity, so that it can do its verification.
deleted 7y ago
[deleted]
wwwwewwww 7y ago
You're overestimating the legitimate companies' employees security acumen. They do it all the time. Sometimes when a legitimate company asks me to verify something, they do it by telling to me. As in, "I need to verify your date if birth. Is it xx/yy/zzzz"?
chrisseaton 7y ago
Your DOB and SSN shouldn’t need to be private information! The first is a matter of public record and the second is an identifier not a security token.

grecy 7y ago

I steadfastly have the stance I will never talk to anyone over the phone unless I initiated the call, and this is a great reminder to stick to that, no matter what they say.

gpderetta 7y ago
Yes, everybody should do that! /s
lucb1e 7y ago
Just to be clear, that's in the context of talking to companies, not when a friend calls you up? Because I'm not sure if it's because I'm just thick or because I'm not natively English but it can be understood (as my sibling comment seems to do) as literally never talking to anyone unless you called them.
- rootusrootus 7y ago
  Everyone has their own strategy. I only answer calls from my own contact list. I have some friends who literally turned off the ringer and don't answer any calls. You have to leave them a message, or just text them and ask them to call.
  - fortran77 7y ago
    You realize this fails because you can spoof Caller ID. The Caller ID was from the bank, so if you had the bank in your contact list, you'd have no protection.
    - _-___________-_ 7y ago
      If your contact list is small enough to be people that you know well, though, it's not a bad policy. Most scammers are not going to be equipped to imitate my brother's or my wife's voice and mannerisms well enough for me to believe them.
    - rootusrootus 7y ago

gowld 7y ago

> Here’s the tl;dr version: Do not ever, as in never ever, give out a verification code over the phone. The deeper lesson here is the power of cognitive dissonance. If you get even slightly fooled, your egotistic brain will Stockholm Syndrome you into working for the attacker, to postpone the embarrassment of acknowledging to yourself you got a little bit fooled. The worse it gets the deeper your denial will grow to stop you from cutting off the attack.

cgijoe 7y ago

My takeaway: Never, ever talk to anyone over an incoming call. Always, always initiate the call yourself, and to the official number.

DonaldFisk 7y ago
If someone claiming to be from your bank calls you, it isn't safe to hang up and call on the official number, unless you call the bank on a different line. The original call doesn't end until the calling party hangs up, and they might spoof a dialling tone and then a ringtone.
- riyakhanna1983 7y ago
  How do you spoof "dialing tone" on a smartphone?
- deleted 7y ago
  [deleted]
- cortesoft 7y ago
  That is only on VERY old land line systems... in fact, I don't think any exist anymore (the lasts ones were phased out a few years ago)
  - miles 7y ago
    New scam keeps fraudsters connected after victim hangs up https://www.cbc.ca/news/canada/ottawa/line-in-trapping-technology-1.5387822 https://www.cbc.ca/news/canada/ottawa/line-in-trapping-techn... "Scammers using line-trapping technology to trick victims, police warn"
    - duckmysick 7y ago
      What is line-trapping? The article doesn't explain how it works and which devices are vulnerable. I tried to look it up but the results aren't helpful. They are either rewrites of the same article or irrelevant pages about wildlife trapping. I suspect they affect landlines, but the articles have confusing photos showing smartphones.

tdy721 7y ago

At the end he mentioned he had 2fa activated. How did the scammer defeat that? Did he read another code out to them and gloss over it?

bowmessage 7y ago
That may have been the 'second code' referred to as a typo by the article, but was perhaps the standard 2fa token that came in after the original password change token? Nice catch.

dumbfoundded 7y ago

Some banks do actually send and then ask for a verification code over the phone. And it's legit! They have multiple types of verification codes, like ones for wires and another verifying your identity if you call customer service. Avoiding fraud is complicated already and will continue to be a problem forever. As people get better at identifying scams, the next one will emerge. As companies create new policies to avoid fraud, "jerk"s will figure out ways to manipulate it. I'm not sure a long term solution exists.

bitcoinbutter 7y ago
I mean, if there is proper 2 factor authentication set up, it would be much more difficult for this scam to work. Most banks in Asia issue you a physical security token, which if you lost you'd need to get it replaced in person.
riyakhanna1983 7y ago
Is it possible to eliminate the phone number? It was needed in old days, and many people today use over-the-top services like WhatsApp and FaceTime. Companies use phone number to track us and scammers use it to swindle us.
- dumbfoundded 7y ago
  Probably not. If a phone number is replaced with a hash or a username, similar if not identical problems will emerge. Look at the numerous bitcoin scams. I think the only thing that helps is time. The longer a technology has been around, the harder it is to fake. Fraudulent gold or currency is pretty tough to do and the people tasked with tracking down the offenders are effective. With most internet-based scams, the technology is emerging. It will take a long time for detection and mitigation to catch up.

robenkleene 7y ago

The author is Rob Griffiths of the venerable Mac OS X Hints (http://macosxhints.com http://macosxhints.com) and Many Tricks Software (https://manytricks.com/ https://manytricks.com/).

rsync 7y ago
I chuckle because rsync.net purchased a few "Witch"[1] licenses and my accountant's auditor who was going through last years expenses came across a charge from "manytricks.com" and sort of sheepishly said " ... I think this might not be a business expense ...". I had to explain that it was, in fact, and showed her the software that we had licensed ... [1] https://manytricks.com/witch/ https://manytricks.com/witch/

jeffdavis 7y ago

One lesson is that it's not a certain type of person that falls for a scam. It's anyone when they are in the wrong frame of mind. Obviously there are ways to prepare yourself, and rules to follow, and red flags to watch for. But you won't really follow the rules unless you believe that "yes, it can happen to me". It might be when you are busy or fatigued or in the middle of a big transaction or whatever.

AdrianB1 7y ago
There are 2 types of a person that falls for a scam: the one who does not know how things work and the one that ignores the red flags. Writing the story is good for the ones that don't know.

antoncohen 7y ago

Yesterday a family member got scammed out of banking information in a COVID-19 related scam. These scams are rampant right now. I think it is worth warning family and friends that might be unaware. Banks sometimes make it hard to do the right thing. Last year my bank called me, I didn't answer the unknown number and they left a message. The message had a phone number to call and a case number. I'm not going to call a number someone gives me, so I called the main number and asked to be transferred. After a few transfers to the wrong people, it eventually became clear they couldn't transfer me to this particular fraud department. I physically went into a bank branch. A very nice banker there tried to call them for me, spent 20 minutes on hold and being transferred around. They were able to confirm the call was real, and what it was about. But the final conclusion was, there was no possible way to reach the person in this fraud department, they had to call me. We arranged a 1 hour window where they would call me and I'd be sure to answer the phone.

antoncohen 7y ago
I'm going to correct myself. My family member didn't get scammed! There is a government agency cold emailing people, telling them to fill out a form that that asks for Bank Name, Account Number, and Routing Number. https://imgur.com/a/5loIfnW https://imgur.com/a/5loIfnW Way to teach people to be safe. At the same time the IRS is telling people to avoid scams by not clicking links in emails: https://www.irs.gov/newsroom/irs-issues-warning-about-coronavirus-related-scams-watch-out-for-schemes-tied-to-economic-impact-payments https://www.irs.gov/newsroom/irs-issues-warning-about-corona...
- TylerE 7y ago
  The banking system (checking in particular) is hopelessly dumb, but that information is printed on every check. It isn't top secret.
  - antoncohen 7y ago
    True. The form also asks for SSN, DOB, address, phone number, etc.

_bxg1 7y ago

The fact that the phone number on your screen cannot be trusted to be the real one is completely unacceptable. It takes a very savvy person to know not to trust it; any reasonable person would assume it to be correct. And there is no one to blame but the carriers. I really hope the FCC's new anti-spam rules kill this problem dead in the water.

projektfu 7y ago
This is an unfortunate by-product off the easy phone numbers work. It’s necessary that when I call from one of my N lines, your caller ID says my main number. Adding in SIP, cellular and other forms of phone mobility makes it hard to authenticate phones without a central system that was never provided.
- _bxg1 7y ago
  It is not hard, carriers are lazy. These are massive companies with deep pockets and no motivation to tackle a problem that doesn't directly impact their bottom lines. Just keep a registry of every organization that you've given permission to to fake phone numbers, and which phone numbers they're allowed to fake. Make them route those calls through a special system and give them a secret token that that system will verify. Centralize your client/token/virtual phone number registry across all carriers (it's no different from certificate-authorities). If one of the accounts starts sending spam calls, revoke their token. Done.
  - closeparen 7y ago
    >Make them route those calls through a special system and give them a secret token that that system will verify STIR/SHAKEN is handling this at the provider level. There are an awful lot of PBX installations out there, with hundreds of makes and models and service lives in decades. You are absolutely not getting every business with a trunk line (e.g. essentially every business with more than one telephone) to participate in a protocol change.
    - 7y ago

projektfu 7y ago

I got a call from Wells Fargo telling me that they had identified a fraud on my account. Fair enough, I was about to call them to tell them that they cashed a check against my account that was written for a different name. This was entirely their own doing, essentially. Then, they ask me to verify my information before starting the process of fixing this and creating a new account number. “With all due respect, you called me. How do I verify you?” “Well you have to answer the question otherwise we can’t fix this over the phone.” “OK that’s fine, just give me some way to contact you when I call the main number.” “No, there’s no way to do that. If your don’t answer these questions now, you’ll have to go to a branch.” This was entirely surprising to them. In the end I had to go to an office and show my forms of ID, which I found amusing because they didn’t even bother to verify that the name on the check matched the account. But anyway. This bank, at least, is not yet on board with good security practices.

gnicholas 7y ago
I’ve had a similar experience when my bank called me and asked me to verify my identity. I asked them to tell me the sum of the last four digits of my account number. They wouldn’t. I had to call another number and get transferred around a bunch. Perhaps I should have said: here are five possible transaction amounts and dates. Tell me which one is real and then I’ll verify my identity to you.
- caseysoftware 7y ago
  It's simpler than that. Ask for their desk extension and then call the number on your bank's website/card and use the extension. I have yet to talk to a bank employee who isn't willing to do that.
  - patio11 7y ago
    This is the best way, but some call centers aren’t set up to give it. (I have intimate knowledge of this topic.) If you run into one of them, the quickest resolution is calling their preferred services line and saying “I just got a call from the Fraud Department but was disconnected; can you transfer me?”

joshthecynic 7y ago

Imagine being dumb enough to fall for this.

litoE 7y ago

A couple of months ago my wife fell for a similar scam. Caller on her cell phone said he was from our cellular carrier. She was sent a text message with a code, which she read back to him. Caller proceeded to access our on-line account at the carrier, using her cell phone number as the user ID, and purchased two top of the line iPhones, to be shipped to a hotel a couple of blocks from our house under her name and, of course, billed to us. Fortunately, the carrier put the order on hold and sent her a text message asking her to confirm the order, so I was able to regain access to the account and reverse the purchase. I called the carrier's security, told them the story and gave them the address of the hotel where the scammer would be picking up the phones he had ordered, but they were not interested in following up.

maccard 7y ago
> but they were not interested in following up. Why would they be? All they're interested in is avoiding transactions that might be marked as fraudulent, they're not interested in actually fixing the issue. Thats the polices issue, not your carrier.
- Nextgrid 7y ago
  Following up and putting the scammer in legal trouble means he's no longer going to be around to retry the scam on the next victim (who might actually fall for it).

1024core 7y ago

Why do phone companies allow phone number spoofing? I can't spoof just anybody's IP address; why can I spoof a phone number?

pwg 7y ago
Two reasons: 1) Because the whole system was designed back in the day of one single integrated phone company (Ma Bell/ATT in the US), so having any form of authentication was unnecessary, because only the one single phone company was ever responsible for handling anything phone related. 2) Because caller-id is an 'add on' that has no relationship to the underlying phone number "address" that is actually used to route phone calls. It is just an extra text string sent along from the call initiator for the purpose of appearing on a display at the destination end.
- 1024core 7y ago
  But ATT was broken up almost 40 years ago!
cerberusss 7y ago
Of course you can spoof anybody's address. Depending on the protocol, you may not be able to get it working. But if it's UDP, you can definitely spoof someone's IP address.
- Tepix 7y ago
  Quite a few ISPs will not let you use IP addresses that do not belong to them.
- namibj 7y ago
  Actually, good luck. People have ingress filters.

chrischen 7y ago

Even with new tech companies like Plaid they're designing patterns that will compromise security down the line. Plaid has you enter your bank login information right on some third party website. While Plaid can be trusted, there's no reason to trust the third party with my bank login info. My password manager right doesn't work on these pages since it doesn't recognize the domain. But a less astute user may unwittingly give out their bank login info to some random site that makes a fake Plaid UI.

LordOfWolves 7y ago
Please correct me if I’m wrong, but I believe Plaid uses an OAuth-Luke experience via an external tab/window to an encrypted sub domain of their website for authentication (so no middle man sniffing technically possible). Disclaimer: I do not work for Plaid, but have used it in the past.
- chrischen 7y ago
  If it is implemented that way there’s no way to tell from the user side. It just looks like it’s a part of whatever website you are on. My password manager even refuses to autofill.

NightlyDev 7y ago

No doubt that this person made a huge mistake, but... Is this seriously a thing? A bank that uses one-factor login? Not only that, but a weak one too? This seems absolutely ridiculous. Why would anyone use such a terrible bank? Isn't the bank at least required to try to protect the customers money? It's usually not that hard to get a hold of a number belonging to someone else. Where in the world is this?

DangitBobby 7y ago
Isn't this two-factor login? Something you know (username) and something you have (phone)? There's also a good chance that the scammers had a set of leaked security questions on hand. I'm sure some banks even use SSN as an authentication factor.
- NightlyDev 7y ago
  No, it's not. A username is rarely a secret used for anthentication. In this case it seems the user got tricked into giving away a password reset code given over SMS. So the first factor(password) was skipped. If an SMS code and the password would have been needed then it would be 2 factors. SSN is alsp a stupidly bad usage as an authentication factor. A lot of people have access to it, it's not unique to the service and you can't just change it whenever you want.

ipv6ipv4 7y ago

I read these accounts of scams and I can’t imagine any legitimate scenario where I could possibly expect a call from a bank about any of my accounts - checking, savings, brokerage, CC, mortgage. With everything available online, there is no reason to step into a branch or have an ongoing phone ‘relationship’ with a bank. I can’t remember the last time a financial institution called me about an account. Even credit cards have moved away from fraud check calls to simple and foolproof yes/no verification messaging. Outside of non-specific marketing and upsell calls, any call I get out of the blue can only be a scam.

libraryatnight 7y ago

Why do people answer the phone at all when it's not an actual person (family or friend)? There's no reason for a business to call you. My phone sends any call that's not from a number in my contacts straight to voicemail - if a voicemail even gets left that's not just someone hanging up, you can return the call to a number you know is real. The IRS deals almost exclusively by mail, banks have apps with account notifications. There's not many good reasons to answer unexpected calls from businesses.

noitsnot 7y ago
Working remotely is new for a lot of people and sometimes coworkers will call your personal number because it is available for emergency purposes, which unfortunately we now live in.
xenocyon 7y ago
Presumably you have never interacted with a doctor :-)
- libraryatnight 7y ago
  My doctor interacts via a patient portal online.

deleted 7y ago

[deleted]

kls 7y ago

I had one of these guys call me and I can tell you they are good, we have a lot of skimmers on gas terminals, atms, etc. in South FL so it's pretty normal to get fraudulent transactions calls. But like this article, the guy spoke perfect English. The cunning part is they really knew the workings of my bank, they would call 5 minutes after the main line closes for the night. The worst part about it is, they had my card number but it has been put in cold status due to legit fraudulent activity, which basically means you can only use it as a debit card. Their aim was to get my pin from me, and they had a whole script before that, that they run thru. The scary part is it felt like a legit fraudulent activity call from my bank and I still suspect that one of the scammers had inner-working details of my bank. I knew it was not when they asked me to verify my pin. At which point I realized it was not a legit fraud activity call. I ask for a call back number and of course the excuse making started about the main line being closed now (they have a separate fraud line that is 24 hours). I told them I would call back in the morning, they said they would have to let these transactions go thru if I did. I said fine but I dispute them if you are recording and hung up and promptly called the fraud line. The scammers are getting more sophisticated and convincing.

deleted 7y ago

[deleted]

icedistilled 7y ago

He still failed to notice a huge red flag. Companies are not supposed to call people up and tell them your last 4 SSN digits, let alone the entire thing. If your bank every does that to you, close your accounts and switch banks. Why did he not realize this after the fact and point it out as a missed red flag? Has anyone had their bank read them their SSN over the phone? That sounds like a massive PII compliance issue.

greendestiny_re 7y ago

If you suspect you're talking to a scammer, the best solution is to—waste their time.