3 ms·

> OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what w

> OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that? You find independent corroboration of what they're telling you. If the only evidence you can find in your account that something went wrong is what someone is telling you over the phone, it's almost certainly itself an attempt at fraud. If you can't, reveal nothing and reach out to them separately (call the bank back) to find out more.

jrochkind1 5y ago
I think I'm going to go with krebs advice which is just call the bank back right away as first step, not as something you do after you on your own try to "find independent corroboration." Just hang up call them back at the number on the back of your card. Only provide personal info when you've called the known number, not when you've received a call, period. (which is actually different advice than "never provide personal information at all", or "only provide personal information after doing your own independent investigation for corroboration")
- TameAntelope 5y ago
  Okay, that sounds great. I'm going to continue to do things that include but aren't limited to using a phone and human speech to better understand the situation. I think we'll both be in pretty good shape!
  - jrochkind1 5y ago
    I guess we'll find out only if/when someone tries to use one of those sophisticated phish's on us! Note in the linked krebs story the person thought they were doing that "corroboration".... > But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... He "independently corroborated", they were calling him about fraud, and there WAS fraud! The whole thing is the story of a guy who is actually a security professional and thought he was being smart, and got tricked, and is now really embaressed. I am sure you will reply that you are smarter than him and will never be tricked, you will do the correct corroboration, not corroborate the wrong thing. Everyone who ever gets tricked also thinks that, but you are probably more correct than they. But that's why I think it's better to make the "rules" as simple as possible, not be like, oh, sure, I'm going to embark on some spur-of-the-moment "independent corroboration" investigations... you start playing games, they're probably better at the games than you. (I mean, not you, I know you are better than anyone else, but the other people who may be reading this and may be mere mortals, like me). And still you (I mean "one", not you of course, I'm speaking of typical people) might get tricked, because the system is not set up in such a way that it's easy to avoid universally.
    - deleted 5y ago
      [deleted]

jrochkind1 5y ago

I think I'm going to go with krebs advice which is just call the bank back right away as first step, not as something you do after you on your own try to "find independent corroboration." Just hang up call them back at the number on the back of your card. Only provide personal info when you've called the known number, not when you've received a call, period. (which is actually different advice than "never provide personal information at all", or "only provide personal information after doing your own independent investigation for corroboration")

TameAntelope 5y ago
Okay, that sounds great. I'm going to continue to do things that include but aren't limited to using a phone and human speech to better understand the situation. I think we'll both be in pretty good shape!
- jrochkind1 5y ago
  I guess we'll find out only if/when someone tries to use one of those sophisticated phish's on us! Note in the linked krebs story the person thought they were doing that "corroboration".... > But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... He "independently corroborated", they were calling him about fraud, and there WAS fraud! The whole thing is the story of a guy who is actually a security professional and thought he was being smart, and got tricked, and is now really embaressed. I am sure you will reply that you are smarter than him and will never be tricked, you will do the correct corroboration, not corroborate the wrong thing. Everyone who ever gets tricked also thinks that, but you are probably more correct than they. But that's why I think it's better to make the "rules" as simple as possible, not be like, oh, sure, I'm going to embark on some spur-of-the-moment "independent corroboration" investigations... you start playing games, they're probably better at the games than you. (I mean, not you, I know you are better than anyone else, but the other people who may be reading this and may be mere mortals, like me). And still you (I mean "one", not you of course, I'm speaking of typical people) might get tricked, because the system is not set up in such a way that it's easy to avoid universally.
  - deleted 5y ago
    [deleted]