12 ms·

> But he said he still feels like a chump for not observing the golden rule: If someone calls saying they’re from your bank, just hang up and call them back — i

> But he said he still feels like a chump for not observing the golden rule: If someone calls saying they’re from your bank, just hang up and call them back — ideally using a phone number that came from the bank’s Web site or from the back of your payment card. As it happened, Mitch only followed half of that advice. Banks could normalize this behavior by having their customer service reps ask customers to do this at the beginning of every call. "Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."

jstarfish 7y ago
That can still be gamed by any malicious SEO wizard. People will trust the top Google hit for "bank of america phone number" before they bother with finding it on the website.
- karthikb 7y ago
  I’ve been asked to “call the number printed on the back of [my] card” which would be much harder to spoof.
  - mc32 7y ago
    But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number.
    - gruez 7y ago
      > But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number. How long are bank cards valid? I'd say they expire within 5 years? Also, if there is a merger, wouldn't they send you a new card with updated branding?
    - karthikb 7y ago
      > But numbers can change They could, but I just tried calling the numbers on the back of two cards from merged/acquired banks and they both forwarded to the acquiring bank. Yes it's a small sample size, but I suspect that there's enough money on the line and enough legacy contracts and systems that banks keep their communication channels active for some time.
    - yellowapple 7y ago
      Credit cards typically expire after some number of years, and mergers will typically include those phone numbers. If for some reason the acquiring company decides it wants to sunset its acquired phone numbers, it just needs to do so after the expiration date for the last card issued with that number still printed.
  - schwap 7y ago
    Yeah, every time my credit card provider has needed to contact me, they send me an recorded message telling me to call the number on my card.
    - Moru 7y ago
      I've had different cards for 35 years at least, never got a call. What do they call about generally?
      - chipsa 7y ago
        Suspicious activity. Suddenly using your card in the UK, when you're in the US. "Swipes" several hundred miles from your normal location, but also occurring in your normal location on the same day.
        Moru 7y ago
        Ah, I never use my real card on the net, maybe that's why. I used to get a virtual card unique for every purchase but that has been discontinued now. Got a separate card for online usage that I only put money on when I want to buy something. Also needs to be opened up for Internet usage and many places require an electronic signature with the bank id app. Hoping this will be mandatory soon.
- vlovich123 7y ago
  Should be solvable by making sure there's an easy, reliable, uniform way to get this info within the call. > "Hello. Please find the callback number on boa.com/contact. Please enter code XYZ to be connected directly to the agent regarding this matter. Thank you & goodbye." It's not perfect & you'll still have some percentage of fraud that goes through, but I'd be interested to see the impact this has on fraud rates. * EDIT: Callback number via the card as the other commentor noted probably works too.
  - mdszy 7y ago
    There is a very large number of people who would not be able to do this properly and would completely bone up the process at some point.
- sytse 7y ago
  Even worse than SEO, fraudsters edited Google Maps bank information directly http://archive.vn/PPJYW http://archive.vn/PPJYW
  - gruez 7y ago
    I wouldn't call it worse. Google maps entries seem to receive less scrutiny than search results, but I also suspect that nobody use as a phonebook. Most people would use google search, or the back of their card.
    - gowld 7y ago
      Google Maps is part of Google Search
- Wowfunhappy 7y ago
  How is a random fraudster going to suddenly get the top Google result for "Bank of America phone number"? I'm sure it's possible, but it strikes me as a pretty large hurdle. And even if they manage to pull it off, they also need no one from the bank to notice and report it.
  - ocdtrekkie 7y ago
    > How is a random fraudster going to suddenly get the top Google result They pay for it. Most people can't distinguish search ads from search results.
    - minot 7y ago
      > They pay for it. Most people can't distinguish search ads from search results. Would the new transparency requirement be useful to go after these fraudsters after the fact? https://news.ycombinator.com/item?id=22955606 https://news.ycombinator.com/item?id=22955606
      - ocdtrekkie 7y ago
        I'm really hoping so, I specified my thoughts on that here: https://news.ycombinator.com/item?id=22955801 https://news.ycombinator.com/item?id=22955801 It depends how aggressively Google pushes on it, and how carefully they verify the actual identity of the entities putting ads up.
  - bregma 7y ago
    "Alexa, make me the number one search result on Google for Bank of America." "Alexa, confirm."
  - pbhjpbhj 7y ago
    You've got it backwards. One gets a call from the bank, they give you a number to ring, you type the number in to Google search, the results come back listing that number and the bank's name -- identity confirmed!?! The fraudsters just need _a_ website listed by Google. My insurer called me out of the blue: I said I'd call back. Their number was not listed on any of the companies websites. I called the company, and said what has happened, took them about 10 minutes to confirm they'd called me and that the phone number I was called on was valid. As it happened someone was trying to commit insurance fraud, saying we'd crashed in to them; but that's by-the-by (ie not relevant to the main story).
techsupporter 7y ago
I wish the regulators for financial institutions would mandate this. One of the reasons I left, years ago, the much-beloved-for-reasons-I-do-not-understand Pacific Northwest darling credit union BECU is because I got griped at by their customer service rep who called me to ostensibly tell me about fraud on my credit card. When the rep asked me "identity verification" questions, they got most upset when I replied that they should have this information and how do I know I'm actually talking to BECU. "Sir, I'm just trying to help prevent fraud on your account and I need to know that it's actually you who answered the phone." (Yes, there legitimately was fraud but I had no way to know it at the time. I closed the account about a month later after another issue.)
- jbverschoor 7y ago
  Same with my bank. They should be fined for this, because they will refund 0 if you fall for this, and they’re encouraging this behavior
- jdofaz 7y ago
  I got a credit card fraud alert sms text once that asked me to call a number that was different than the phone number on my credit card. I called the card number instead and the alert was legit but they still should have used an easily verified phone number.
- neltnerb 7y ago
  Hospitals are even worse. They would periodically call me with random information about appointments or prescriptions and whatnot and would always start off by asking me my birth date and PII to identify myself to them! They're the ones calling me! I told them as much and after a few years they finally started sending me secure emails asking me to call them. Certainly I wouldn't trust "call back at..." messages claiming to be from a medical provider, even though they're indistinguishable from the real thing because that's the same thing the doctor's office does. It's bizarre considering how security conscious they have to be.
- verelo 7y ago
  I recently missed a bill due to an error on behalf of my utility company. It ended up at a debt collector, who when calling me insisted i share my date of birth, address and full name before they'd tell me what the call was regarding. I refused, they got mad and acted as if I was trying to avoid paying the bill. I assumed the call was fraud. I found it was in fact not fraud when my credit monitoring service informed me that someone reported I refused to pay a bill. One call to the utility company later, it was resolved...unfortunately i'm still trying to fix the credit report.
grey-area 7y ago
A favourite trick in the UK is for scammers to stay on the line when you hang up, and play simulated noises for a dial tone and connection, then pretend to be your bank when you call the number on your card.
- jeffdavis 7y ago
  If you hang up, how does that help? Are you talking about them trying to make you think they hung up? If so, it sounds like a long-shot tactic, especially because everyone uses cell phones now.
  - ocdtrekkie 7y ago
    The most vulnerable population to fall for scams is seniors. Also the most likely population to still be using land lines.
    - bregma 7y ago
      Most seniors I know have a mobile phone. How else would they be able to show off pictures of their grandkids? Also, that's how hearing aids work these days.
      - outworlder 7y ago
        But they might still have landlines.
      - fortran77 7y ago
        My 87 year old mother can not figure out how to use a cell phone. I tried and tried.
  - robjan 7y ago
    In the UK landlines almost always start with 01 or 02 so it's easy to identify who is using a landline. You can also go through the phone book (which only lists landlines) looking for "elderly" names. People who don't bother / know how to opt out of the phone book are probably easier targets as well.
jedimastert 7y ago
Just yesterday there was an article on HN about a guy who was called by someone from the NSA who gave him detailed instructions on how to get back to him through publically availible information like 411
- wolco 7y ago
  Where? I did see anything like that.
  - defen 7y ago
    https://news.ycombinator.com/item?id=22936811 https://news.ycombinator.com/item?id=22936811
seanwilson 7y ago
What about if that puts you into an hour long phone queue where the person who you eventually get through to has trouble helping you with what the initial call was about?
- freeone3000 7y ago
  Find a bank that doesn't have hour-long phone queues where customer service matters? AMEX has reasonable call response times.
- StillBored 7y ago
  A lot (Most?) credit card/banks/etc have separate direct dial fraud lines. Example: https://www.discover.com/credit-cards/help-center/faqs/credit-card-fraud.html?ICMPGN=FRAUD_PUB_FAQ_TXT https://www.discover.com/credit-cards/help-center/faqs/credi...
- gowld 7y ago
  Then switch to a better bank. also, if someone is calling you, they most likely aren't trying to help you.
pdonis 7y ago
> "Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you." This would be great as long as your call back was recognized and immediately routed to the right person instead of being placed on infinite hold, as is usually the case when you call a bank's or credit card company's number.
- jaredsohn 7y ago
  >as long as your call back was recognized and immediately routed to the right person It would be great if more companies had this functionality. It would also be useful in the situations where you get disconnected while talking with someone.
  - TheHypnotist 7y ago
    Most contact centers have some sort of virtual hold - i wonder if they can leverage that tech for this type of functionality.
    - WorldMaker 7y ago
      Or use something really old school such as "extension numbers".
      - jaredsohn 7y ago
        Basically, I'd prefer if pbxes used by these companies providing support did the equivalent of storing short-term 'cookies' that remember you had just called rather than requiring remembering and reentering 'share urls'.
  - novok 7y ago
    The callback number would be special and ask you for a special code.
    - 7y ago
izend 7y ago
A few years ago I got a call from Revenue Canada and around the same time it was extremely popular for scammers to pose as Revenue Canada agents. So immediately I just assumed it was a scam and got extremely annoyed and angry at the person... turns out it was a real Revenue Canada agent and I had somehow forgot to submit my taxes a few years back...
- kshacker 7y ago
  Ha ha same here but I got a call from an FBI agent. I had lost money to someone and 2-3 years later he got caught in some other sting and they wanted me to be another witness since they found my name in his books. For me somehow the connection clicked as soon as the agent mentioned the name of the company (but not when he said I am calling from the FBI). I even got login to I think an FBI website to keep updated on the status. Unfortunately after communication every few months, they decided to not pursue the case, after maybe 2-3 years of elapsed time.
amelius 7y ago
> To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you." Good idea, except now people will think: "yeah, right, that way the call will cost me money".
- the_pwner224 7y ago
  Where in the world do you still have to pay based on usage of phone minutes?
  - Moru 7y ago
    For people that can't afford a new phone every year with a contract. You can buy cheap button-phones and get a phone card that cost you money every time you call but is free while you don't call.
- vageli 7y ago
  Aren't most of these numbers toll free?
isoskeles 7y ago
That would be preferable. I had a call from my bank once that went like this. > CS: Hello, this is X from Y Bank. Is this Z? > ME: Yes, this is Z. > CS: Z, can you confirm your last 4 digits of your social security number so I can confirm who I am speaking to? > ME: Uh... How do I know you're the bank? I can't just tell any person who calls that information. > CS: Z, we are from your bank, Y Bank. Please provide the last 4 digits of your social. > ME: There has to be another way to do this, right? > CS: Please hold... (puts me on hold for 30 seconds) > CS: Hi Z, I'm back. Can you look up our phone number on Google and give us a call back and ask for me by name, X? > ME: Sounds good. It was them. I got quickly reconnected to the same woman. I'm still concerned that the norm should be something closer to what you commented, even if it adds friction and will probably result in lazier people not calling back for something important. It's better to normalize this than allow for the alternative, which is to normalize people telling random strangers their sensitive, personal information. Any time this topic comes up, I immediately worry about my parents and grandparents falling for this sort of thing if real scammers are out there trying. I realize the last four digits of my social security number are not as great as the whole thing, but as far as I know, it's enough to be dangerous.
- Moru 7y ago
  In Sweden the whole personal number is public information. Anyone can just call the tax department and get it without any questions asked. Still some use it as proof that you are you...
- voiper1 7y ago
  lol, something horribly ironic about that. They called your number, but you need to prove it's you. But obviously, they are who they claim to be.
softgrow 7y ago
Used to offer this when working on fraud in <a Big Corp>, but have to give them my name so main number switchboard can route call. Very few people did, but those that did appreciated it. Only costs you a few minutes while they find the old time printed phone book, look up <a Big Corp> and call back.
erikbye 7y ago
My bank’s policy is simple: we will never call you.
Cthulhu_ 7y ago
Or, you know, send a letter or e-mail. Not that e-mails are secure per definition, but services like gmail spend a lot of time and effort on detecting and blocking spam and scams.
richardowright 7y ago
Why not use reverse verbal passwords (i.e. have the bank give you a secret phrase)? That should eliminate a large amount of issues without the need for a call back.

jstarfish 7y ago

That can still be gamed by any malicious SEO wizard. People will trust the top Google hit for "bank of america phone number" before they bother with finding it on the website.

karthikb 7y ago
I’ve been asked to “call the number printed on the back of [my] card” which would be much harder to spoof.
- mc32 7y ago
  But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number.
  - gruez 7y ago
    > But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number. How long are bank cards valid? I'd say they expire within 5 years? Also, if there is a merger, wouldn't they send you a new card with updated branding?
  - karthikb 7y ago
    > But numbers can change They could, but I just tried calling the numbers on the back of two cards from merged/acquired banks and they both forwarded to the acquiring bank. Yes it's a small sample size, but I suspect that there's enough money on the line and enough legacy contracts and systems that banks keep their communication channels active for some time.
  - yellowapple 7y ago
    Credit cards typically expire after some number of years, and mergers will typically include those phone numbers. If for some reason the acquiring company decides it wants to sunset its acquired phone numbers, it just needs to do so after the expiration date for the last card issued with that number still printed.
- schwap 7y ago
  Yeah, every time my credit card provider has needed to contact me, they send me an recorded message telling me to call the number on my card.
  - Moru 7y ago
    I've had different cards for 35 years at least, never got a call. What do they call about generally?
    - chipsa 7y ago
      Suspicious activity. Suddenly using your card in the UK, when you're in the US. "Swipes" several hundred miles from your normal location, but also occurring in your normal location on the same day.
      - Moru 7y ago
        Ah, I never use my real card on the net, maybe that's why. I used to get a virtual card unique for every purchase but that has been discontinued now. Got a separate card for online usage that I only put money on when I want to buy something. Also needs to be opened up for Internet usage and many places require an electronic signature with the bank id app. Hoping this will be mandatory soon.
vlovich123 7y ago
Should be solvable by making sure there's an easy, reliable, uniform way to get this info within the call. > "Hello. Please find the callback number on boa.com/contact. Please enter code XYZ to be connected directly to the agent regarding this matter. Thank you & goodbye." It's not perfect & you'll still have some percentage of fraud that goes through, but I'd be interested to see the impact this has on fraud rates. * EDIT: Callback number via the card as the other commentor noted probably works too.
- mdszy 7y ago
  There is a very large number of people who would not be able to do this properly and would completely bone up the process at some point.
sytse 7y ago
Even worse than SEO, fraudsters edited Google Maps bank information directly http://archive.vn/PPJYW http://archive.vn/PPJYW
- gruez 7y ago
  I wouldn't call it worse. Google maps entries seem to receive less scrutiny than search results, but I also suspect that nobody use as a phonebook. Most people would use google search, or the back of their card.
  - gowld 7y ago
    Google Maps is part of Google Search
Wowfunhappy 7y ago
How is a random fraudster going to suddenly get the top Google result for "Bank of America phone number"? I'm sure it's possible, but it strikes me as a pretty large hurdle. And even if they manage to pull it off, they also need no one from the bank to notice and report it.
- ocdtrekkie 7y ago
  > How is a random fraudster going to suddenly get the top Google result They pay for it. Most people can't distinguish search ads from search results.
  - minot 7y ago
    > They pay for it. Most people can't distinguish search ads from search results. Would the new transparency requirement be useful to go after these fraudsters after the fact? https://news.ycombinator.com/item?id=22955606 https://news.ycombinator.com/item?id=22955606
    - ocdtrekkie 7y ago
      I'm really hoping so, I specified my thoughts on that here: https://news.ycombinator.com/item?id=22955801 https://news.ycombinator.com/item?id=22955801 It depends how aggressively Google pushes on it, and how carefully they verify the actual identity of the entities putting ads up.
- bregma 7y ago
  "Alexa, make me the number one search result on Google for Bank of America." "Alexa, confirm."
- pbhjpbhj 7y ago
  You've got it backwards. One gets a call from the bank, they give you a number to ring, you type the number in to Google search, the results come back listing that number and the bank's name -- identity confirmed!?! The fraudsters just need _a_ website listed by Google. My insurer called me out of the blue: I said I'd call back. Their number was not listed on any of the companies websites. I called the company, and said what has happened, took them about 10 minutes to confirm they'd called me and that the phone number I was called on was valid. As it happened someone was trying to commit insurance fraud, saying we'd crashed in to them; but that's by-the-by (ie not relevant to the main story).

techsupporter 7y ago

I wish the regulators for financial institutions would mandate this. One of the reasons I left, years ago, the much-beloved-for-reasons-I-do-not-understand Pacific Northwest darling credit union BECU is because I got griped at by their customer service rep who called me to ostensibly tell me about fraud on my credit card. When the rep asked me "identity verification" questions, they got most upset when I replied that they should have this information and how do I know I'm actually talking to BECU. "Sir, I'm just trying to help prevent fraud on your account and I need to know that it's actually you who answered the phone." (Yes, there legitimately was fraud but I had no way to know it at the time. I closed the account about a month later after another issue.)

jbverschoor 7y ago
Same with my bank. They should be fined for this, because they will refund 0 if you fall for this, and they’re encouraging this behavior
jdofaz 7y ago
I got a credit card fraud alert sms text once that asked me to call a number that was different than the phone number on my credit card. I called the card number instead and the alert was legit but they still should have used an easily verified phone number.
neltnerb 7y ago
Hospitals are even worse. They would periodically call me with random information about appointments or prescriptions and whatnot and would always start off by asking me my birth date and PII to identify myself to them! They're the ones calling me! I told them as much and after a few years they finally started sending me secure emails asking me to call them. Certainly I wouldn't trust "call back at..." messages claiming to be from a medical provider, even though they're indistinguishable from the real thing because that's the same thing the doctor's office does. It's bizarre considering how security conscious they have to be.
verelo 7y ago
I recently missed a bill due to an error on behalf of my utility company. It ended up at a debt collector, who when calling me insisted i share my date of birth, address and full name before they'd tell me what the call was regarding. I refused, they got mad and acted as if I was trying to avoid paying the bill. I assumed the call was fraud. I found it was in fact not fraud when my credit monitoring service informed me that someone reported I refused to pay a bill. One call to the utility company later, it was resolved...unfortunately i'm still trying to fix the credit report.

grey-area 7y ago

A favourite trick in the UK is for scammers to stay on the line when you hang up, and play simulated noises for a dial tone and connection, then pretend to be your bank when you call the number on your card.

jeffdavis 7y ago
If you hang up, how does that help? Are you talking about them trying to make you think they hung up? If so, it sounds like a long-shot tactic, especially because everyone uses cell phones now.
- ocdtrekkie 7y ago
  The most vulnerable population to fall for scams is seniors. Also the most likely population to still be using land lines.
  - bregma 7y ago
    Most seniors I know have a mobile phone. How else would they be able to show off pictures of their grandkids? Also, that's how hearing aids work these days.
    - outworlder 7y ago
      But they might still have landlines.
    - fortran77 7y ago
      My 87 year old mother can not figure out how to use a cell phone. I tried and tried.
- robjan 7y ago
  In the UK landlines almost always start with 01 or 02 so it's easy to identify who is using a landline. You can also go through the phone book (which only lists landlines) looking for "elderly" names. People who don't bother / know how to opt out of the phone book are probably easier targets as well.

jedimastert 7y ago

Just yesterday there was an article on HN about a guy who was called by someone from the NSA who gave him detailed instructions on how to get back to him through publically availible information like 411

wolco 7y ago
Where? I did see anything like that.
- defen 7y ago
  https://news.ycombinator.com/item?id=22936811 https://news.ycombinator.com/item?id=22936811

seanwilson 7y ago

What about if that puts you into an hour long phone queue where the person who you eventually get through to has trouble helping you with what the initial call was about?

freeone3000 7y ago
Find a bank that doesn't have hour-long phone queues where customer service matters? AMEX has reasonable call response times.
StillBored 7y ago
A lot (Most?) credit card/banks/etc have separate direct dial fraud lines. Example: https://www.discover.com/credit-cards/help-center/faqs/credit-card-fraud.html?ICMPGN=FRAUD_PUB_FAQ_TXT https://www.discover.com/credit-cards/help-center/faqs/credi...
gowld 7y ago
Then switch to a better bank. also, if someone is calling you, they most likely aren't trying to help you.

pdonis 7y ago

> "Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you." This would be great as long as your call back was recognized and immediately routed to the right person instead of being placed on infinite hold, as is usually the case when you call a bank's or credit card company's number.

jaredsohn 7y ago
>as long as your call back was recognized and immediately routed to the right person It would be great if more companies had this functionality. It would also be useful in the situations where you get disconnected while talking with someone.
- TheHypnotist 7y ago
  Most contact centers have some sort of virtual hold - i wonder if they can leverage that tech for this type of functionality.
  - WorldMaker 7y ago
    Or use something really old school such as "extension numbers".
    - jaredsohn 7y ago
      Basically, I'd prefer if pbxes used by these companies providing support did the equivalent of storing short-term 'cookies' that remember you had just called rather than requiring remembering and reentering 'share urls'.
- novok 7y ago
  The callback number would be special and ask you for a special code.
  - 7y ago

izend 7y ago

A few years ago I got a call from Revenue Canada and around the same time it was extremely popular for scammers to pose as Revenue Canada agents. So immediately I just assumed it was a scam and got extremely annoyed and angry at the person... turns out it was a real Revenue Canada agent and I had somehow forgot to submit my taxes a few years back...

kshacker 7y ago
Ha ha same here but I got a call from an FBI agent. I had lost money to someone and 2-3 years later he got caught in some other sting and they wanted me to be another witness since they found my name in his books. For me somehow the connection clicked as soon as the agent mentioned the name of the company (but not when he said I am calling from the FBI). I even got login to I think an FBI website to keep updated on the status. Unfortunately after communication every few months, they decided to not pursue the case, after maybe 2-3 years of elapsed time.

amelius 7y ago

> To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you." Good idea, except now people will think: "yeah, right, that way the call will cost me money".

the_pwner224 7y ago
Where in the world do you still have to pay based on usage of phone minutes?
- Moru 7y ago
  For people that can't afford a new phone every year with a contract. You can buy cheap button-phones and get a phone card that cost you money every time you call but is free while you don't call.
vageli 7y ago
Aren't most of these numbers toll free?

isoskeles 7y ago

That would be preferable. I had a call from my bank once that went like this. > CS: Hello, this is X from Y Bank. Is this Z? > ME: Yes, this is Z. > CS: Z, can you confirm your last 4 digits of your social security number so I can confirm who I am speaking to? > ME: Uh... How do I know you're the bank? I can't just tell any person who calls that information. > CS: Z, we are from your bank, Y Bank. Please provide the last 4 digits of your social. > ME: There has to be another way to do this, right? > CS: Please hold... (puts me on hold for 30 seconds) > CS: Hi Z, I'm back. Can you look up our phone number on Google and give us a call back and ask for me by name, X? > ME: Sounds good. It was them. I got quickly reconnected to the same woman. I'm still concerned that the norm should be something closer to what you commented, even if it adds friction and will probably result in lazier people not calling back for something important. It's better to normalize this than allow for the alternative, which is to normalize people telling random strangers their sensitive, personal information. Any time this topic comes up, I immediately worry about my parents and grandparents falling for this sort of thing if real scammers are out there trying. I realize the last four digits of my social security number are not as great as the whole thing, but as far as I know, it's enough to be dangerous.

Moru 7y ago
In Sweden the whole personal number is public information. Anyone can just call the tax department and get it without any questions asked. Still some use it as proof that you are you...
voiper1 7y ago
lol, something horribly ironic about that. They called your number, but you need to prove it's you. But obviously, they are who they claim to be.

softgrow 7y ago

Used to offer this when working on fraud in <a Big Corp>, but have to give them my name so main number switchboard can route call. Very few people did, but those that did appreciated it. Only costs you a few minutes while they find the old time printed phone book, look up <a Big Corp> and call back.

erikbye 7y ago

My bank’s policy is simple: we will never call you.

Cthulhu_ 7y ago

Or, you know, send a letter or e-mail. Not that e-mails are secure per definition, but services like gmail spend a lot of time and effort on detecting and blocking spam and scams.

richardowright 7y ago

Why not use reverse verbal passwords (i.e. have the bank give you a secret phrase)? That should eliminate a large amount of issues without the need for a call back.