4 ms·

The critical aspect about this is, "What can I do about it?" For most hacks, the answer is, more or less, "Nothing." For a social engineering hack like this,

The critical aspect about this is, "What can I do about it?" For most hacks, the answer is, more or less, "Nothing." For a social engineering hack like this, you can be aware and avoid falling victim to this. For me, reading this article, that's the meat of it -- I am trying to figure out how vulnerable I specifically am to this, and what I need to do to stay safe (and what I need to recommend to my family and friends). Sometimes it's "hope the organizations that have your data are secure", but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone."

jrochkind1 5y ago
> but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone." OK, but if the legit banks are actually *asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? Krebs advice to "never give out personal info or 2FA codes when they call you, always call them back at the number on your card" seems like a more useful/actionable appraoch to me than your "never give them personal info or 2FA codes at all". So, anyway, yeah, krebs advice is "actionable", but... it's not easy. To remember, or to do when you're busy and trying to get on with your day dealing with banks and other bureacracies that routinely "legitimately" ask you to do crazy things.
- TameAntelope 5y ago
  > OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? You find independent corroboration of what they're telling you. If the only evidence you can find in your account that something went wrong is what someone is telling you over the phone, it's almost certainly itself an attempt at fraud. If you can't, reveal nothing and reach out to them separately (call the bank back) to find out more.
  - jrochkind1 5y ago
    I think I'm going to go with krebs advice which is just call the bank back right away as first step, not as something you do after you on your own try to "find independent corroboration." Just hang up call them back at the number on the back of your card. Only provide personal info when you've called the known number, not when you've received a call, period. (which is actually different advice than "never provide personal information at all", or "only provide personal information after doing your own independent investigation for corroboration")
    - TameAntelope 5y ago
      Okay, that sounds great. I'm going to continue to do things that include but aren't limited to using a phone and human speech to better understand the situation. I think we'll both be in pretty good shape!
      - jrochkind1 5y ago
        I guess we'll find out only if/when someone tries to use one of those sophisticated phish's on us! Note in the linked krebs story the person thought they were doing that "corroboration".... > But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... He "independently corroborated", they were calling him about fraud, and there WAS fraud! The whole thing is the story of a guy who is actually a security professional and thought he was being smart, and got tricked, and is now really embaressed. I am sure you will reply that you are smarter than him and will never be tricked, you will do the correct corroboration, not corroborate the wrong thing. Everyone who ever gets tricked also thinks that, but you are probably more correct than they. But that's why I think it's better to make the "rules" as simple as possible, not be like, oh, sure, I'm going to embark on some spur-of-the-moment "independent corroboration" investigations... you start playing games, they're probably better at the games than you. (I mean, not you, I know you are better than anyone else, but the other people who may be reading this and may be mere mortals, like me). And still you (I mean "one", not you of course, I'm speaking of typical people) might get tricked, because the system is not set up in such a way that it's easy to avoid universally.

jrochkind1 5y ago

> but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone." OK, but if the legit banks are actually *asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? Krebs advice to "never give out personal info or 2FA codes when they call you, always call them back at the number on your card" seems like a more useful/actionable appraoch to me than your "never give them personal info or 2FA codes at all". So, anyway, yeah, krebs advice is "actionable", but... it's not easy. To remember, or to do when you're busy and trying to get on with your day dealing with banks and other bureacracies that routinely "legitimately" ask you to do crazy things.

TameAntelope 5y ago
> OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? You find independent corroboration of what they're telling you. If the only evidence you can find in your account that something went wrong is what someone is telling you over the phone, it's almost certainly itself an attempt at fraud. If you can't, reveal nothing and reach out to them separately (call the bank back) to find out more.
- jrochkind1 5y ago
  I think I'm going to go with krebs advice which is just call the bank back right away as first step, not as something you do after you on your own try to "find independent corroboration." Just hang up call them back at the number on the back of your card. Only provide personal info when you've called the known number, not when you've received a call, period. (which is actually different advice than "never provide personal information at all", or "only provide personal information after doing your own independent investigation for corroboration")
  - TameAntelope 5y ago
    Okay, that sounds great. I'm going to continue to do things that include but aren't limited to using a phone and human speech to better understand the situation. I think we'll both be in pretty good shape!
    - jrochkind1 5y ago
      I guess we'll find out only if/when someone tries to use one of those sophisticated phish's on us! Note in the linked krebs story the person thought they were doing that "corroboration".... > But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... He "independently corroborated", they were calling him about fraud, and there WAS fraud! The whole thing is the story of a guy who is actually a security professional and thought he was being smart, and got tricked, and is now really embaressed. I am sure you will reply that you are smarter than him and will never be tricked, you will do the correct corroboration, not corroborate the wrong thing. Everyone who ever gets tricked also thinks that, but you are probably more correct than they. But that's why I think it's better to make the "rules" as simple as possible, not be like, oh, sure, I'm going to embark on some spur-of-the-moment "independent corroboration" investigations... you start playing games, they're probably better at the games than you. (I mean, not you, I know you are better than anyone else, but the other people who may be reading this and may be mere mortals, like me). And still you (I mean "one", not you of course, I'm speaking of typical people) might get tricked, because the system is not set up in such a way that it's easy to avoid universally.