7 ms·

In the linked article on the words "the scammers can get around that, too" [1], there's an account that claims the legit bank did in the past ask for the 2FA on

In the linked article on the words "the scammers can get around that, too" [1], there's an account that claims the legit bank did in the past ask for the 2FA on a phone call, in pretty much exactly the same way the scammers did. > Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code. The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". It is very hard for the end-user to tell what 2FA request is "for no reason". I think we need to focus not on what the "reason" is or if it's "out of the blue", but, the equivalent of "call them back" for online too -- don't click on a link in an email, etc. No matter what, it's not easy, especially for less technical users. The linked account is a security professional that fell for it -- I personally don't have the hubris to think I never would. There have been times when an actual bank asks me to do something I know is insecure, and I consider resisting it, but I just didn't have the energy for it, I figured it really was the real bank just being idiotic and I wanted to get on with my day (and guess what, it was, I was right). [1]: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...

londons_explore 5y ago
While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.
- smiley1437 5y ago
  So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?
  - idiotsecant 5y ago
    What, and trust that they didn't compromise the hardware manufacturing supply chain? Not today, criminals! I design and construct my own one time burner phone from silicon I personally extracted and refined, it's the only way to be secure!
    - jrochkind1 5y ago
      You have to find the address of the call center, and go there and ring their bell.
      - nucleardog 5y ago
        But don’t just google the location! The scammers are onto this now and have set up fake call centres and banking branches to trick you. You need to start from a reasonable root of trust like your local government. Go down to city hall and ask them to pull the business license for the organization, and visit the address on file there and work your way down through the organization to the department you’re trying to contact.
- jetpackjoe 5y ago
  If your threat vector is someone hacking/infiltrating your phone network, you have bigger problems.
- pdonis 5y ago
  > An advanced enough attacker can totally redirect your outbound calls How?
  - londons_explore 5y ago
    The attacker rings your phone company up, impersonates you, and gets your phone line added to a company plan where all dialled phone numbers are first passed to a company phone system to allow the mobile phone to act like an internal phone - so for example you can dial "753" to ring the phone in room 753 of your company office. Calls will only go to the external phone network if the internal company one rejects them. Then the attacker can intercept any outgoing call.
    - Piskvorrr 5y ago
      Feasible. Far more work required, and the plan switch should trigger all sorts of red flags (and thus verifications) before you even place a single phone call.
    - ziml77 5y ago
      Is this even possible? An external number's calls getting routed around to the internal side of a PBX without explicitly dialing into the PBX?
      - bluGill 5y ago
        Possible, you need to convince the phone company, but it is done just often enough for real reasons that it is posisble
- mortenjorck 5y ago
  Perhaps orders of magnitude more likely than someone getting root on your telecom network is someone simply convincing you that an attacker's VOIP number is the official support number you wanted to call.
- rwmj 5y ago
  You shouldn't be downvoted because you're right, although for a slightly different reason. Scammers definitely have been using this trick: https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...
skeeter2020 5y ago
That's not the same thing! Here the scammer's app is saying "enter the one-time token generated by your device", then passing that on to the phisher. Your quote is about letting the bank know that the device is in the possesion of the person they are talking to.
- jrochkind1 5y ago
  From the OP: > OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”) What are you saying is the distinction that an ordinary user should be expected to distinguish, between a phone call that says it's from your bank alerting you to fraud and asking you to read back a 2FA code, and... a different kind of phone call that says it's from your bank alerting you to fraud and asking you to enter an OTP code in a different way? It's a pretty similar thing. In these particular cases, you and I could realize that a bot asking you to use keypad to enter the code is more suspicious than a human asking you to read it. But it's not like humans can't scam you too, as in the other story I linked to from krebs. And it's all a bit subtle and overwhelming for the average user (who of course encounter bot voice systems all the time when dealing with 'legitimate' businesses these days).
TameAntelope 5y ago
The critical aspect about this is, "What can I do about it?" For most hacks, the answer is, more or less, "Nothing." For a social engineering hack like this, you can be aware and avoid falling victim to this. For me, reading this article, that's the meat of it -- I am trying to figure out how vulnerable I specifically am to this, and what I need to do to stay safe (and what I need to recommend to my family and friends). Sometimes it's "hope the organizations that have your data are secure", but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone."
- jrochkind1 5y ago
  > but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone." OK, but if the legit banks are actually *asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? Krebs advice to "never give out personal info or 2FA codes when they call you, always call them back at the number on your card" seems like a more useful/actionable appraoch to me than your "never give them personal info or 2FA codes at all". So, anyway, yeah, krebs advice is "actionable", but... it's not easy. To remember, or to do when you're busy and trying to get on with your day dealing with banks and other bureacracies that routinely "legitimately" ask you to do crazy things.
  - TameAntelope 5y ago
    > OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? You find independent corroboration of what they're telling you. If the only evidence you can find in your account that something went wrong is what someone is telling you over the phone, it's almost certainly itself an attempt at fraud. If you can't, reveal nothing and reach out to them separately (call the bank back) to find out more.
croes 5y ago
It's always the same. Don't click a link, type it yourself, of course your banks address and not the link from the mail. Don't answer a phone call, call them back.
tshaddox 5y ago
> The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". Don't forget that you have to call them back by looking up your bank's phone number yourself from a trusted source (perhaps their HTTPS website). Obviously just calling back the number they called you from (or provided to you) is useless.
- jfengel 5y ago
  It baffles me that their fraud alert texts include a callback number. It's like training users to be gullible. It should say "Call us back at the number on the back of your card", or some such. I'm sure they're afraid that a lot of users won't figure that out, but it still seems like a weird tradeoff.
  - tinus_hn 5y ago
    Unfortunately not having a phone number on the back of the card saves a ton of money on customer service calls.
    - jfengel 5y ago
      My cards all have a toll-free number on the back of the card. When I get a call, text, or email from my CC company that requires a phone call, I call them at that number.
      - tinus_hn 5y ago
        That’s great! Most banks do not have that because it might be toll-free for you, it definitely isn’t free for them.
        jrochkind1 5y ago
        Hm, in the USA I've never seen a credit or debit card without a customer service phone number on the back.
gertrunde 5y ago
I have received such a phishing call recently. The script went something along the lines of: "Hi, we need to authenticate a recent transaction of $high_value_item, well send you a verification code to prove we are $company_x." <receipt of OTP code via SMS from $company_x> "Can you repeat the verification code to authenticate?" "Of course this isn't a scam, we must be $company_x, how else could I send you the verification code?" I can definitely see general members of the public falling for this sort of scam - because they are being led to believe it's not a one-time-password that they're relaying at all, and some organisations do use verification codes of that sort, although usually it's to verify ownership of a particular mobile telephone number when setting up an account or pairing an app or similar. I wouldn't expect non-technically savvy folk to immediately spot the difference between a verification code and a one-time-password. It might be good if the OTP SMS message had text along the lines of "Do not give this code to anyone under any circumstances, regardless of who they claim to be employed by." - not that I would expect it to help in all cases. (tbh - I was actually quite impressed, the English skills of the person on the other end of the telephone were significantly better than the average tech support call center person).
defaultcompany 5y ago
Instead of asking me for my 2FA code If the bank told me what the code was and I confirmed it on my device then would I be able to trust them? Is there any reason 2FA can’t be used in “reverse” like that?
- dorgo 5y ago
  Then the bank would give out 2FA codes to un-authenticated people??

londons_explore 5y ago

While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.

smiley1437 5y ago
So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?
- idiotsecant 5y ago
  What, and trust that they didn't compromise the hardware manufacturing supply chain? Not today, criminals! I design and construct my own one time burner phone from silicon I personally extracted and refined, it's the only way to be secure!
  - jrochkind1 5y ago
    You have to find the address of the call center, and go there and ring their bell.
    - nucleardog 5y ago
      But don’t just google the location! The scammers are onto this now and have set up fake call centres and banking branches to trick you. You need to start from a reasonable root of trust like your local government. Go down to city hall and ask them to pull the business license for the organization, and visit the address on file there and work your way down through the organization to the department you’re trying to contact.
jetpackjoe 5y ago
If your threat vector is someone hacking/infiltrating your phone network, you have bigger problems.
pdonis 5y ago
> An advanced enough attacker can totally redirect your outbound calls How?
- londons_explore 5y ago
  The attacker rings your phone company up, impersonates you, and gets your phone line added to a company plan where all dialled phone numbers are first passed to a company phone system to allow the mobile phone to act like an internal phone - so for example you can dial "753" to ring the phone in room 753 of your company office. Calls will only go to the external phone network if the internal company one rejects them. Then the attacker can intercept any outgoing call.
  - Piskvorrr 5y ago
    Feasible. Far more work required, and the plan switch should trigger all sorts of red flags (and thus verifications) before you even place a single phone call.
  - ziml77 5y ago
    Is this even possible? An external number's calls getting routed around to the internal side of a PBX without explicitly dialing into the PBX?
    - bluGill 5y ago
      Possible, you need to convince the phone company, but it is done just often enough for real reasons that it is posisble
mortenjorck 5y ago
Perhaps orders of magnitude more likely than someone getting root on your telecom network is someone simply convincing you that an attacker's VOIP number is the official support number you wanted to call.
rwmj 5y ago
You shouldn't be downvoted because you're right, although for a slightly different reason. Scammers definitely have been using this trick: https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...

skeeter2020 5y ago

That's not the same thing! Here the scammer's app is saying "enter the one-time token generated by your device", then passing that on to the phisher. Your quote is about letting the bank know that the device is in the possesion of the person they are talking to.

jrochkind1 5y ago
From the OP: > OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”) What are you saying is the distinction that an ordinary user should be expected to distinguish, between a phone call that says it's from your bank alerting you to fraud and asking you to read back a 2FA code, and... a different kind of phone call that says it's from your bank alerting you to fraud and asking you to enter an OTP code in a different way? It's a pretty similar thing. In these particular cases, you and I could realize that a bot asking you to use keypad to enter the code is more suspicious than a human asking you to read it. But it's not like humans can't scam you too, as in the other story I linked to from krebs. And it's all a bit subtle and overwhelming for the average user (who of course encounter bot voice systems all the time when dealing with 'legitimate' businesses these days).

TameAntelope 5y ago

The critical aspect about this is, "What can I do about it?" For most hacks, the answer is, more or less, "Nothing." For a social engineering hack like this, you can be aware and avoid falling victim to this. For me, reading this article, that's the meat of it -- I am trying to figure out how vulnerable I specifically am to this, and what I need to do to stay safe (and what I need to recommend to my family and friends). Sometimes it's "hope the organizations that have your data are secure", but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone."

jrochkind1 5y ago
> but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone." OK, but if the legit banks are actually *asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? Krebs advice to "never give out personal info or 2FA codes when they call you, always call them back at the number on your card" seems like a more useful/actionable appraoch to me than your "never give them personal info or 2FA codes at all". So, anyway, yeah, krebs advice is "actionable", but... it's not easy. To remember, or to do when you're busy and trying to get on with your day dealing with banks and other bureacracies that routinely "legitimately" ask you to do crazy things.
- TameAntelope 5y ago
  > OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? You find independent corroboration of what they're telling you. If the only evidence you can find in your account that something went wrong is what someone is telling you over the phone, it's almost certainly itself an attempt at fraud. If you can't, reveal nothing and reach out to them separately (call the bank back) to find out more.

croes 5y ago

It's always the same. Don't click a link, type it yourself, of course your banks address and not the link from the mail. Don't answer a phone call, call them back.

tshaddox 5y ago

> The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons". Don't forget that you have to call them back by looking up your bank's phone number yourself from a trusted source (perhaps their HTTPS website). Obviously just calling back the number they called you from (or provided to you) is useless.

jfengel 5y ago
It baffles me that their fraud alert texts include a callback number. It's like training users to be gullible. It should say "Call us back at the number on the back of your card", or some such. I'm sure they're afraid that a lot of users won't figure that out, but it still seems like a weird tradeoff.
- tinus_hn 5y ago
  Unfortunately not having a phone number on the back of the card saves a ton of money on customer service calls.
  - jfengel 5y ago
    My cards all have a toll-free number on the back of the card. When I get a call, text, or email from my CC company that requires a phone call, I call them at that number.
    - tinus_hn 5y ago
      That’s great! Most banks do not have that because it might be toll-free for you, it definitely isn’t free for them.
      - jrochkind1 5y ago
        Hm, in the USA I've never seen a credit or debit card without a customer service phone number on the back.

gertrunde 5y ago

I have received such a phishing call recently. The script went something along the lines of: "Hi, we need to authenticate a recent transaction of $high_value_item, well send you a verification code to prove we are $company_x." <receipt of OTP code via SMS from $company_x> "Can you repeat the verification code to authenticate?" "Of course this isn't a scam, we must be $company_x, how else could I send you the verification code?" I can definitely see general members of the public falling for this sort of scam - because they are being led to believe it's not a one-time-password that they're relaying at all, and some organisations do use verification codes of that sort, although usually it's to verify ownership of a particular mobile telephone number when setting up an account or pairing an app or similar. I wouldn't expect non-technically savvy folk to immediately spot the difference between a verification code and a one-time-password. It might be good if the OTP SMS message had text along the lines of "Do not give this code to anyone under any circumstances, regardless of who they claim to be employed by." - not that I would expect it to help in all cases. (tbh - I was actually quite impressed, the English skills of the person on the other end of the telephone were significantly better than the average tech support call center person).

defaultcompany 5y ago

Instead of asking me for my 2FA code If the bank told me what the code was and I confirmed it on my device then would I be able to trust them? Is there any reason 2FA can’t be used in “reverse” like that?

dorgo 5y ago
Then the bank would give out 2FA codes to un-authenticated people??