8 ms·

I got a call from Wells Fargo telling me that they had identified a fraud on my account. Fair enough, I was about to call them to tell them that they cashed a

I got a call from Wells Fargo telling me that they had identified a fraud on my account. Fair enough, I was about to call them to tell them that they cashed a check against my account that was written for a different name. This was entirely their own doing, essentially. Then, they ask me to verify my information before starting the process of fixing this and creating a new account number. “With all due respect, you called me. How do I verify you?” “Well you have to answer the question otherwise we can’t fix this over the phone.” “OK that’s fine, just give me some way to contact you when I call the main number.” “No, there’s no way to do that. If your don’t answer these questions now, you’ll have to go to a branch.” This was entirely surprising to them. In the end I had to go to an office and show my forms of ID, which I found amusing because they didn’t even bother to verify that the name on the check matched the account. But anyway. This bank, at least, is not yet on board with good security practices.

gnicholas 7y ago
I’ve had a similar experience when my bank called me and asked me to verify my identity. I asked them to tell me the sum of the last four digits of my account number. They wouldn’t. I had to call another number and get transferred around a bunch. Perhaps I should have said: here are five possible transaction amounts and dates. Tell me which one is real and then I’ll verify my identity to you.
- caseysoftware 7y ago
  It's simpler than that. Ask for their desk extension and then call the number on your bank's website/card and use the extension. I have yet to talk to a bank employee who isn't willing to do that.
  - patio11 7y ago
    This is the best way, but some call centers aren’t set up to give it. (I have intimate knowledge of this topic.) If you run into one of them, the quickest resolution is calling their preferred services line and saying “I just got a call from the Fraud Department but was disconnected; can you transfer me?”
    - projektfu 7y ago
      I asked for this on a recent Wells Fargo call as I got disconnected from the previous one when they put me on hold. They said they don’t do that. Maybe you need a million dollars with them before they do, I don’t know.
LeoTinnitus 7y ago
I've done that to credit card companies that I even called. They'd say something like "okay I need your full social security number" and I would just say no. There would be a pause, then they would say "okay I can verify you by your recent transactions." Like why didn't you start with that! Some companies just don't teach their reps to care about security.
- mannykannot 7y ago
  If they did it the right way, each call would be longer, and they would have to employ more people to maintain their goal of giving the minimal level of service they can get away with.
technion 7y ago
My real estate agent has a @agentname.com domain which all my previous communication has run over. Last week I got an email notice that a payment was due for a household bill. It came from mailer@constantcontact.com and contained a link to a Google Form which asked for a credit card number. The form itself even has Google's warning not to provide credit card numbers down the bottom. It never even named my agent, where I was living or what the bill was for or anything that made it believable. I forwarded it to them and said I wanted to report some potential phishing. A legitimate person responded from their mailbox noting that they don't accept excuses like that, and pointing out the bill must be paid and noone else had ever questioned it. I work so hard to train users about scams but I just have no idea what to do about the rest of the world.
- trevyn 7y ago
  >I just have no idea what to do about the rest of the world. Assume that it's only going to get worse and act accordingly.
- thaumasiotes 7y ago
  > The form itself even has Google's warning not to provide credit card numbers down the bottom. I received a PayPal phishing email once which included PayPal's actual security footer at the bottom. It helpfully pointed out that communications from PayPal will always address you by name, never as "Dear customer". I was amused by this, since the phishing email started off with "Dear customer". There must be some population of people out there who are looking for the footer, but not bothering to think about what it means. (Or possibly a population of scammers who copy the official formatting without checking whether it's something they really want.)
  - _-___________-_ 7y ago
    There's a theory about phishing emails that they deliberately make them slightly more obvious in order to weed out people like yourself who are unlikely to fall for them, to increase the average ROI of time spent on dealing with responses.
Zenst 7y ago
Had a similar situation, mobile provider had called me to offer me a deal, was no CLI showing - usual withheld affair, as is the case of many companies alas (though mindful that can be spoofed). Again, same situation, wanted to very who I was and when I wanted them to verfy who they was we ended up in a circle-dance. But it is important and getting their number or in your case, a branch to go into - something you can prove with a degree of confidence is important. Many will happily give out information. In my early days of work(before CLI and still analogue exchanges afoot) a friend pulled a joke upon me, phoned up pretending to be TAX office and to verify details. It's easy to fall foul of such things and been a source of many scams against less aware and older people less savy of such. One way is to partialy give information and ask them for some back that they are verfying againt. Also if you ask them to verify details they will (legit even) use the data protection law flavour of the country to say they are not allowed to do that and very easy to get into a circle-dance. Which makes online more secure than the whole phone network with all it's legacy overhead opening up to abuse such as spoofing. Bit like the early days of the internet and spoofing IP's, not so easy today (mostly if routers configured right as most are).
grey-area 7y ago
Do banks ever actually do this? It makes no sense and what you describe us identical to a push payment fraud? A bank account number is not private information so there's really no point in creating another account.
- projektfu 7y ago
  I asked if it was really necessary and they said they had to. So perhaps this was a situation where they expected much more fraud if they didn't give me a new account. I discovered it is a real hassle to change a business operating account number. Providers who, in the past, were happy to start doing ACH through your account with minimal documentation require a lot more to change that ACH account number. In one case, they asked for something I don't think I can provide (a scan of a canceled check) as the bank doesn't send those anymore. I'll have to see if they really only need a void check.
madaxe_again 7y ago
Even when a bank or organisation does have good general security practices, I have, far too many times, encountered CS agents who have leaked information like sieves - given me multiple attempts on passwords, hinted which address I’ve registered with. I get why - many people have no idea about any of this stuff, and if CS don’t cut corners they never get to serve anyone. Many, many people I know can’t recall any passwords, and reset them every single time they need them. I was recently targeted by I-don’t-know-what. Third party opened a fault ticket on my BT FTTC line, and then through a combination of SMS SC spoofing, real links to BT systems, and false links to very plausible looking “book an engineer visit” screens tried to get me to invite a criminal over to play with my technology. The idea was likely to get me to welcome some unknown party into my home to mess with my router - I would assume putting some kind of packet sniffer in place to skim data and cards - but I honestly have no idea to what ends. As a general rule, I ignore all communication from banks and service providers, as I’ve nearly fallen for a “card fraud” scam twice - the second time, they already had my card, and had already done some petty fraud that they wanted to talk to me about, with the hope of me giving them access to my online banking. The worst case in ignoring them is that they will try again. If it’s actually important, they’ll keep trying. If it’s fraud, I’ll notice and will contact them.
Angostura 7y ago
HSBC UK fraud department in the UK send you a text message if they believe there is fraudulent use of your card with a number to call. The problem is that number is nowhere on the website. How do I know that text is actually from HSBC? How do I know the number I’m being asked to call is legit? I’ve tried to explain to HSBC that they are training their customers to be susceptible to scammers but they just don’t get it. I had this conversation with someone in the fraud department where I said, “at least put that number on your website somewhere, so if I go to Hsbc.co.uk and search it turns up” “we don’t want to publicise the number sir” “Well out it on a page that isn’t displayed on the site, but which still shows up in a search if I search for the number” - “I’ll pass on your concerns”. That was about 10 years ago. They still do it.
- chownie 7y ago
  I think the situation has improved in the last 10 years. When I got a fraud call and was asked to authorise I told the agent that I didn't trust them unless I had a number to call to verify, so the agent on the phone told me to call the number on the back of my debit card. They give every person the number explicitly now.
- avianlyric 7y ago
  This situation is getting better. In the UK now there’s a big push among all the banks to ensure that phone numbers and links are never placed in texts. Rather they will only tell you to “ring the number on the back of your card“. The banks got rather upset when the gov sent that COVID-19 text with a link in it. Silly move, and we’ve seen plenty of fruadsters take advantage of it.
  - nicoburns 7y ago
    At least the link was to gov.uk
    - avianlyric 7y ago
      Yeah, but now people are spoofing the phone number to get other links to appear in the same conversation as the COVID-19 message.
xenocyon 7y ago
I think this is a significant part of why identifying frauds is hard: normal business phone practices are often surprisingly scam-like (e.g. asking to provide verification info when they are the ones calling). So not only do frauds imitate legit activity, legit activity frequently imitates fraud.

gnicholas 7y ago

I’ve had a similar experience when my bank called me and asked me to verify my identity. I asked them to tell me the sum of the last four digits of my account number. They wouldn’t. I had to call another number and get transferred around a bunch. Perhaps I should have said: here are five possible transaction amounts and dates. Tell me which one is real and then I’ll verify my identity to you.

caseysoftware 7y ago
It's simpler than that. Ask for their desk extension and then call the number on your bank's website/card and use the extension. I have yet to talk to a bank employee who isn't willing to do that.
- patio11 7y ago
  This is the best way, but some call centers aren’t set up to give it. (I have intimate knowledge of this topic.) If you run into one of them, the quickest resolution is calling their preferred services line and saying “I just got a call from the Fraud Department but was disconnected; can you transfer me?”
  - projektfu 7y ago
    I asked for this on a recent Wells Fargo call as I got disconnected from the previous one when they put me on hold. They said they don’t do that. Maybe you need a million dollars with them before they do, I don’t know.

LeoTinnitus 7y ago

I've done that to credit card companies that I even called. They'd say something like "okay I need your full social security number" and I would just say no. There would be a pause, then they would say "okay I can verify you by your recent transactions." Like why didn't you start with that! Some companies just don't teach their reps to care about security.

mannykannot 7y ago
If they did it the right way, each call would be longer, and they would have to employ more people to maintain their goal of giving the minimal level of service they can get away with.

technion 7y ago

My real estate agent has a @agentname.com domain which all my previous communication has run over. Last week I got an email notice that a payment was due for a household bill. It came from mailer@constantcontact.com and contained a link to a Google Form which asked for a credit card number. The form itself even has Google's warning not to provide credit card numbers down the bottom. It never even named my agent, where I was living or what the bill was for or anything that made it believable. I forwarded it to them and said I wanted to report some potential phishing. A legitimate person responded from their mailbox noting that they don't accept excuses like that, and pointing out the bill must be paid and noone else had ever questioned it. I work so hard to train users about scams but I just have no idea what to do about the rest of the world.

trevyn 7y ago
>I just have no idea what to do about the rest of the world. Assume that it's only going to get worse and act accordingly.
thaumasiotes 7y ago
> The form itself even has Google's warning not to provide credit card numbers down the bottom. I received a PayPal phishing email once which included PayPal's actual security footer at the bottom. It helpfully pointed out that communications from PayPal will always address you by name, never as "Dear customer". I was amused by this, since the phishing email started off with "Dear customer". There must be some population of people out there who are looking for the footer, but not bothering to think about what it means. (Or possibly a population of scammers who copy the official formatting without checking whether it's something they really want.)
- _-___________-_ 7y ago
  There's a theory about phishing emails that they deliberately make them slightly more obvious in order to weed out people like yourself who are unlikely to fall for them, to increase the average ROI of time spent on dealing with responses.

Zenst 7y ago

Had a similar situation, mobile provider had called me to offer me a deal, was no CLI showing - usual withheld affair, as is the case of many companies alas (though mindful that can be spoofed). Again, same situation, wanted to very who I was and when I wanted them to verfy who they was we ended up in a circle-dance. But it is important and getting their number or in your case, a branch to go into - something you can prove with a degree of confidence is important. Many will happily give out information. In my early days of work(before CLI and still analogue exchanges afoot) a friend pulled a joke upon me, phoned up pretending to be TAX office and to verify details. It's easy to fall foul of such things and been a source of many scams against less aware and older people less savy of such. One way is to partialy give information and ask them for some back that they are verfying againt. Also if you ask them to verify details they will (legit even) use the data protection law flavour of the country to say they are not allowed to do that and very easy to get into a circle-dance. Which makes online more secure than the whole phone network with all it's legacy overhead opening up to abuse such as spoofing. Bit like the early days of the internet and spoofing IP's, not so easy today (mostly if routers configured right as most are).

grey-area 7y ago

Do banks ever actually do this? It makes no sense and what you describe us identical to a push payment fraud? A bank account number is not private information so there's really no point in creating another account.

projektfu 7y ago
I asked if it was really necessary and they said they had to. So perhaps this was a situation where they expected much more fraud if they didn't give me a new account. I discovered it is a real hassle to change a business operating account number. Providers who, in the past, were happy to start doing ACH through your account with minimal documentation require a lot more to change that ACH account number. In one case, they asked for something I don't think I can provide (a scan of a canceled check) as the bank doesn't send those anymore. I'll have to see if they really only need a void check.

madaxe_again 7y ago

Even when a bank or organisation does have good general security practices, I have, far too many times, encountered CS agents who have leaked information like sieves - given me multiple attempts on passwords, hinted which address I’ve registered with. I get why - many people have no idea about any of this stuff, and if CS don’t cut corners they never get to serve anyone. Many, many people I know can’t recall any passwords, and reset them every single time they need them. I was recently targeted by I-don’t-know-what. Third party opened a fault ticket on my BT FTTC line, and then through a combination of SMS SC spoofing, real links to BT systems, and false links to very plausible looking “book an engineer visit” screens tried to get me to invite a criminal over to play with my technology. The idea was likely to get me to welcome some unknown party into my home to mess with my router - I would assume putting some kind of packet sniffer in place to skim data and cards - but I honestly have no idea to what ends. As a general rule, I ignore all communication from banks and service providers, as I’ve nearly fallen for a “card fraud” scam twice - the second time, they already had my card, and had already done some petty fraud that they wanted to talk to me about, with the hope of me giving them access to my online banking. The worst case in ignoring them is that they will try again. If it’s actually important, they’ll keep trying. If it’s fraud, I’ll notice and will contact them.

Angostura 7y ago

HSBC UK fraud department in the UK send you a text message if they believe there is fraudulent use of your card with a number to call. The problem is that number is nowhere on the website. How do I know that text is actually from HSBC? How do I know the number I’m being asked to call is legit? I’ve tried to explain to HSBC that they are training their customers to be susceptible to scammers but they just don’t get it. I had this conversation with someone in the fraud department where I said, “at least put that number on your website somewhere, so if I go to Hsbc.co.uk and search it turns up” “we don’t want to publicise the number sir” “Well out it on a page that isn’t displayed on the site, but which still shows up in a search if I search for the number” - “I’ll pass on your concerns”. That was about 10 years ago. They still do it.

chownie 7y ago
I think the situation has improved in the last 10 years. When I got a fraud call and was asked to authorise I told the agent that I didn't trust them unless I had a number to call to verify, so the agent on the phone told me to call the number on the back of my debit card. They give every person the number explicitly now.
avianlyric 7y ago
This situation is getting better. In the UK now there’s a big push among all the banks to ensure that phone numbers and links are never placed in texts. Rather they will only tell you to “ring the number on the back of your card“. The banks got rather upset when the gov sent that COVID-19 text with a link in it. Silly move, and we’ve seen plenty of fruadsters take advantage of it.
- nicoburns 7y ago
  At least the link was to gov.uk
  - avianlyric 7y ago
    Yeah, but now people are spoofing the phone number to get other links to appear in the same conversation as the COVID-19 message.

xenocyon 7y ago

I think this is a significant part of why identifying frauds is hard: normal business phone practices are often surprisingly scam-like (e.g. asking to provide verification info when they are the ones calling). So not only do frauds imitate legit activity, legit activity frequently imitates fraud.