6 ms·

That can still be gamed by any malicious SEO wizard. People will trust the top Google hit for "bank of america phone number" before they bother with finding it

That can still be gamed by any malicious SEO wizard. People will trust the top Google hit for "bank of america phone number" before they bother with finding it on the website.

karthikb 7y ago
I’ve been asked to “call the number printed on the back of [my] card” which would be much harder to spoof.
- mc32 7y ago
  But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number.
  - gruez 7y ago
    > But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number. How long are bank cards valid? I'd say they expire within 5 years? Also, if there is a merger, wouldn't they send you a new card with updated branding?
  - karthikb 7y ago
    > But numbers can change They could, but I just tried calling the numbers on the back of two cards from merged/acquired banks and they both forwarded to the acquiring bank. Yes it's a small sample size, but I suspect that there's enough money on the line and enough legacy contracts and systems that banks keep their communication channels active for some time.
  - yellowapple 7y ago
    Credit cards typically expire after some number of years, and mergers will typically include those phone numbers. If for some reason the acquiring company decides it wants to sunset its acquired phone numbers, it just needs to do so after the expiration date for the last card issued with that number still printed.
- schwap 7y ago
  Yeah, every time my credit card provider has needed to contact me, they send me an recorded message telling me to call the number on my card.
  - Moru 7y ago
    I've had different cards for 35 years at least, never got a call. What do they call about generally?
    - chipsa 7y ago
      Suspicious activity. Suddenly using your card in the UK, when you're in the US. "Swipes" several hundred miles from your normal location, but also occurring in your normal location on the same day.
      - Moru 7y ago
        Ah, I never use my real card on the net, maybe that's why. I used to get a virtual card unique for every purchase but that has been discontinued now. Got a separate card for online usage that I only put money on when I want to buy something. Also needs to be opened up for Internet usage and many places require an electronic signature with the bank id app. Hoping this will be mandatory soon.
vlovich123 7y ago
Should be solvable by making sure there's an easy, reliable, uniform way to get this info within the call. > "Hello. Please find the callback number on boa.com/contact. Please enter code XYZ to be connected directly to the agent regarding this matter. Thank you & goodbye." It's not perfect & you'll still have some percentage of fraud that goes through, but I'd be interested to see the impact this has on fraud rates. * EDIT: Callback number via the card as the other commentor noted probably works too.
- mdszy 7y ago
  There is a very large number of people who would not be able to do this properly and would completely bone up the process at some point.
sytse 7y ago
Even worse than SEO, fraudsters edited Google Maps bank information directly http://archive.vn/PPJYW http://archive.vn/PPJYW
- gruez 7y ago
  I wouldn't call it worse. Google maps entries seem to receive less scrutiny than search results, but I also suspect that nobody use as a phonebook. Most people would use google search, or the back of their card.
  - gowld 7y ago
    Google Maps is part of Google Search
Wowfunhappy 7y ago
How is a random fraudster going to suddenly get the top Google result for "Bank of America phone number"? I'm sure it's possible, but it strikes me as a pretty large hurdle. And even if they manage to pull it off, they also need no one from the bank to notice and report it.
- ocdtrekkie 7y ago
  > How is a random fraudster going to suddenly get the top Google result They pay for it. Most people can't distinguish search ads from search results.
  - minot 7y ago
    > They pay for it. Most people can't distinguish search ads from search results. Would the new transparency requirement be useful to go after these fraudsters after the fact? https://news.ycombinator.com/item?id=22955606 https://news.ycombinator.com/item?id=22955606
    - ocdtrekkie 7y ago
      I'm really hoping so, I specified my thoughts on that here: https://news.ycombinator.com/item?id=22955801 https://news.ycombinator.com/item?id=22955801 It depends how aggressively Google pushes on it, and how carefully they verify the actual identity of the entities putting ads up.
- bregma 7y ago
  "Alexa, make me the number one search result on Google for Bank of America." "Alexa, confirm."
- pbhjpbhj 7y ago
  You've got it backwards. One gets a call from the bank, they give you a number to ring, you type the number in to Google search, the results come back listing that number and the bank's name -- identity confirmed!?! The fraudsters just need _a_ website listed by Google. My insurer called me out of the blue: I said I'd call back. Their number was not listed on any of the companies websites. I called the company, and said what has happened, took them about 10 minutes to confirm they'd called me and that the phone number I was called on was valid. As it happened someone was trying to commit insurance fraud, saying we'd crashed in to them; but that's by-the-by (ie not relevant to the main story).

That can still be gamed by any malicious SEO wizard. People will trust the top Google hit for "bank of america phone number" before they bother with finding it on the website.

karthikb 7y ago

I’ve been asked to “call the number printed on the back of [my] card” which would be much harder to spoof.

mc32 7y ago
But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number.
- gruez 7y ago
  > But numbers can change (lapses of mergers), is website would be best as card info can become stale over time —and enterprising outfits could scoop up that number. How long are bank cards valid? I'd say they expire within 5 years? Also, if there is a merger, wouldn't they send you a new card with updated branding?
- karthikb 7y ago
  > But numbers can change They could, but I just tried calling the numbers on the back of two cards from merged/acquired banks and they both forwarded to the acquiring bank. Yes it's a small sample size, but I suspect that there's enough money on the line and enough legacy contracts and systems that banks keep their communication channels active for some time.
- yellowapple 7y ago
  Credit cards typically expire after some number of years, and mergers will typically include those phone numbers. If for some reason the acquiring company decides it wants to sunset its acquired phone numbers, it just needs to do so after the expiration date for the last card issued with that number still printed.
schwap 7y ago
Yeah, every time my credit card provider has needed to contact me, they send me an recorded message telling me to call the number on my card.
- Moru 7y ago
  I've had different cards for 35 years at least, never got a call. What do they call about generally?
  - chipsa 7y ago
    Suspicious activity. Suddenly using your card in the UK, when you're in the US. "Swipes" several hundred miles from your normal location, but also occurring in your normal location on the same day.
    - Moru 7y ago
      Ah, I never use my real card on the net, maybe that's why. I used to get a virtual card unique for every purchase but that has been discontinued now. Got a separate card for online usage that I only put money on when I want to buy something. Also needs to be opened up for Internet usage and many places require an electronic signature with the bank id app. Hoping this will be mandatory soon.

vlovich123 7y ago

Should be solvable by making sure there's an easy, reliable, uniform way to get this info within the call. > "Hello. Please find the callback number on boa.com/contact. Please enter code XYZ to be connected directly to the agent regarding this matter. Thank you & goodbye." It's not perfect & you'll still have some percentage of fraud that goes through, but I'd be interested to see the impact this has on fraud rates. * EDIT: Callback number via the card as the other commentor noted probably works too.

mdszy 7y ago
There is a very large number of people who would not be able to do this properly and would completely bone up the process at some point.

sytse 7y ago

Even worse than SEO, fraudsters edited Google Maps bank information directly http://archive.vn/PPJYW http://archive.vn/PPJYW

gruez 7y ago
I wouldn't call it worse. Google maps entries seem to receive less scrutiny than search results, but I also suspect that nobody use as a phonebook. Most people would use google search, or the back of their card.
- gowld 7y ago
  Google Maps is part of Google Search

Wowfunhappy 7y ago

How is a random fraudster going to suddenly get the top Google result for "Bank of America phone number"? I'm sure it's possible, but it strikes me as a pretty large hurdle. And even if they manage to pull it off, they also need no one from the bank to notice and report it.

ocdtrekkie 7y ago
> How is a random fraudster going to suddenly get the top Google result They pay for it. Most people can't distinguish search ads from search results.
- minot 7y ago
  > They pay for it. Most people can't distinguish search ads from search results. Would the new transparency requirement be useful to go after these fraudsters after the fact? https://news.ycombinator.com/item?id=22955606 https://news.ycombinator.com/item?id=22955606
  - ocdtrekkie 7y ago
    I'm really hoping so, I specified my thoughts on that here: https://news.ycombinator.com/item?id=22955801 https://news.ycombinator.com/item?id=22955801 It depends how aggressively Google pushes on it, and how carefully they verify the actual identity of the entities putting ads up.
bregma 7y ago
"Alexa, make me the number one search result on Google for Bank of America." "Alexa, confirm."
pbhjpbhj 7y ago
You've got it backwards. One gets a call from the bank, they give you a number to ring, you type the number in to Google search, the results come back listing that number and the bank's name -- identity confirmed!?! The fraudsters just need _a_ website listed by Google. My insurer called me out of the blue: I said I'd call back. Their number was not listed on any of the companies websites. I called the company, and said what has happened, took them about 10 minutes to confirm they'd called me and that the phone number I was called on was valid. As it happened someone was trying to commit insurance fraud, saying we'd crashed in to them; but that's by-the-by (ie not relevant to the main story).