20 ms·

The ‘Zelle fraud’ scam: how it works, how to fight back

277 points by picture 5y ago

ralph84 5y ago
My girlfriend got hit with this one. According to her the scammer was very convincing on the phone. American accent. Empathetic tone. "Don't worry, we'll get your money back, we just need to make sure it's really you not the person trying to steal your money." Luckily her credit union was quick to restore the funds with minimal hassle.
josephcsible 5y ago
Don't these sorts of emails already say things like "nobody legitimate, including our employees, will ever ask you to tell them this code"? I'm not sure how to stop scams that are already only possible because of people's lack of reading.
- dmitrygr 5y ago
  There are only space for so many characters available in an SMS, so they may not include this very important warning.
  - deleted 5y ago
    [deleted]
  - ollien 5y ago
    Ally's message does. > Ally: As Security measure, we will never ask for this number over the phone. Security code: xxyyzz. Call 1-877-247-2559 if you did not request a code.
  - djbusby 5y ago
    Wells Fargo has a warning in their SMS - for Zelle and non-Zelle things.
  - djrogers 5y ago
    Cap1 does this: “Capital One won't call you for this code. The temporary code you requested to sign-in is 091657. Please use this code to complete your request.” IIRC, there was one time I did have to verify a code over the phone, and the message that came with it was completely different.
- bullfightonmars 5y ago
  The problem is that banks totally ask for codes when you call them to do things like password resets.
- paxys 5y ago
  Major ones have it, but there are thousands of banks in the US and I'd wager almost all of them provide some form of online banking experience. Outside the larger ones security isn't really up to par.
_jal 5y ago
I've gotten these texts twice, so far. There was another one that came in between them that felt the same (language that I think of as "conversational robotese"), but appeared to be VPN phishing.
nnf 5y ago
Any telco people here that can explain the technicals of how or why it’s still possible to spoof a phone number? Is this just how the whole system works? When I use Twilio, I have to prove to them that I control a phone number before I can use Twilio make outbound calls or send SMS messages that appear to originate from my number. This suggests to me that the system is built with assumed trust, like email was originally. Is everything too ingrained at this point to add some type of authentication that would prevent this type of spoofing? Something similar to a CAA record, where the owner of a phone number could say “legitimate calls from this number will only originate from $TELCO and $SMS_PROVIDER” would be nice.
- djbusby 5y ago
  There are some PSTN gateway providers that you can basically makeup your outgoing CID on. Les.net used to let me do that for example - no validation. Twilio is doing their own enforcement to help their reputation.
  - wildrhythms 5y ago
    These gateway providers, in addition to simply spoofing the outgoing number, will also sell blocks of legitimate domestic numbers to the scammers- knowingly- to use for callback numbers. Truly disgusting https://www.justice.gov/opa/pr/district-court-enters-permanent-injunction-shutting-down-telecom-carriers-who-facilitated https://www.justice.gov/opa/pr/district-court-enters-permane...
    - djbusby 5y ago
      Yea, I wasn't tryna call anyone out, there are legit use-case and I like Twilio approach and yet, it's so easy so fake a CID :(
- DaiPlusPlus 5y ago
  The PSTN is frozen-in-time: despite SIP and fancy intra-3G/4G/5G tech everything else is built around Signalling System 7 from 1975: https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
mindslight 5y ago
> Consumers who suffer unauthorized transactions are entitled to Regulation E protection, and banks are required to refund the stolen money. This isn’t a controversial opinion, and it was recently affirmed by the CFPB here [0]. If you are reading this story and fighting with your bank, start by providing that link to the financial institution. Props for including this in the article! All too often the basic legal situation is never explained, leaving victims to believe that blatantly illegal crap is "just the way it is". For example, "identity theft" and fraudulent medical bills. [0] https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/ https://www.consumerfinance.gov/compliance/compliance-resour...
yumraj 5y ago
I recently had a weird issue: some random dude sent me $1.xx over PayPal. Naturally I refunded it and thought matter closed. Then, some days later I got 3 more payments in similar $1.xx amounts. I refunded 2, but for the 3rd one PayPal wanted to charge some fees. At which point I just blocked the dude. No idea if this was a genuine mistake or a scam. Anyone knows??
- sushid 5y ago
  Not sure but I think what they want is for you to pay them $1.xx back (rather than refund). Then they can try and initiate a refund on their end, which allows them to pocket the amount you gave them for free.
- bluedino 5y ago
  I've had things for sale and then buyer sends the money, then wants me to ship to some foreign country, always a pain in the ass to refund them
- hamiltonians 5y ago
  THey are probbly checking to see if it is active.
  - 2muchcoffeeman 5y ago
    I used to deal with some online merchant facilities. I used to see loads of $1.xx charges on clients that were not careful with their merchant details.
- SavantIdiot 5y ago
  I once panicked that someone was getting ready to withdraw funds from my account because I saw those two <$1.00 auth charges. I called my bank, and they panicked, and immediately created a new account, moved the money into it, and closed the other one. Like within 5 minutes. Turns out I forgot I told a friend to reimburse me for beers we had a few weeks before that, and his payment service was verifying my account. Online banking and all of this digital access to my monies makes me nervous as heck. Double-edged sword. (Yes, I have 2TF hard tokens on all major accounts.)
ljm 5y ago
Like many scams, it depends on the victims being polite, perhaps more much than them being naive. The fraudulent message asks for a yes or no reply but does not care about the answer spefically; only that there was an answer. So the victims are the people who couldn't ignore the message and had to say no. Most likely the people who say yes are still taken into account , because they confirmed there was a person behind the number. They'll get a new scam later on. But the people saying no are the target. A lot of people feel bad if they don't answer the phone, or a message, or the doorbell. So you prey on their niceness. How to fight back? Don't. The way to defeat the scam is to not acknowledge it. Ignore whatever primal urge you have to get involved, or teach them whippersnappers a lesson, and cast it into the void.
- krebsonsecurity 5y ago
  I agree with your point about not acknowledging these scam attempts. Just wanted to point out the "fight back" bit of the story was advice for people who've already been victimized and are being told their bank won't cover the loss.
- SavantIdiot 5y ago
  I'd be really curious to know how many people actually answer calls they aren't expecting, on their personal phones (e.g., non-work phones where you must answer customers). I bet that graph is U-shaped of % of people that answer unknown messages vs. age. Kids want to be social, and old people don't know any better. With salty Gen-Xers in the middle. 99.99% of the time I let it go to voicemail. I have since the days of cassette-tape answering machines. The only time I don't is if some just texted and said they are calling. Even when my insurance company hold line asks if I want a callback, I'm too paranoid that a scammer could have infiltrated the callback process.
  - chillwaves 5y ago
    I just realized I can keep my phone on DND 24/7 and it's wonderful (rings for contacts only). The bonus of it only ringing for your contacts is that when your phone does ring, you know it's something relatively important. Completely changed my relationship with my phone.
lost-found 5y ago
One other red flag: your bank asking you for your username. At least for me, my bank would never use anything other than my real name.
hn_throwaway_99 5y ago
I wish there was a coordinated public service campaign around "Hang up, Look up, Call back". I feel like if we could really ingrain those 6 words that it would go a long way to blocking these types of phishing scams. Number one thing I tell folks in my security training is to never respond or click a link on an inbound message. Instead, look up your bank or service provider and make an outbound call (or direct URL navigation) to them.
- coderintherye 5y ago
  There is, sort of: https://scamspotter.org/ https://scamspotter.org/ Discussed here earlier today: https://news.ycombinator.com/item?id=29278411 https://news.ycombinator.com/item?id=29278411
- JulianK 5y ago
  I recently heard about an incident where hanging up turned out to be more difficult than it should have been. Stay calm. Call from another phone perhaps? https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone-scam-1.5375708 https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...
  - david_allison 5y ago
    Definitely call from another phone if using a landline. https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...
    - tzs 5y ago
      If you don't have another phone would it be safe to first call some other known number and see if that goes through? If it does, then you should be able to infer that the previous inbound call has (probably [1]) hung up, and it is now safe to call your bank. [1] A sophisticated enough scammer could hold the line, give a fake dial tone, detect that the number you are dialing is not the bank number they expected you to dial, dial that number themselves on a different line, and relay between that line and yours to convince you that you really did have a clear line, and then keep holding the line when you then hang up and try to call the bank.
hamiltonians 5y ago
Regarding crypto fraud, why isn't anyone talking about the massive amount of Elon Musk spam and hacked twitter accounts. https://scaminvestigations.substack.com/p/better-than-the-mafia-twitter-crypto https://scaminvestigations.substack.com/p/better-than-the-ma...
- cyral 5y ago
  Probably because those scam accounts have been going on for years and nothing has been done
bob331 5y ago
This is not an “increasingly clever” attack, it is monumentally oblivious to anyone but a luddite
deleted 5y ago
[deleted]
supernova87a 5y ago
Well, my opinion is that a ridiculous root cause of all this is the lack of a central, government-supervised, secure, instantaneous, free, direct payments system. Such that all these stupid private bank-based services are attempting to fill that void and don't get it right when they do it. Not to say that such a service would not also have vulnerabilities. But you hear about all the bounced check / advance fee / text message validation scams going on now, and you would think that the banks would want to get this liability off their hands and into a central service that they can just be rid of the responsibility. (ok, on the other hand, having an irrevocable transfer system might introduce new problems as well, but still...) I find it unfathomable why we continue to saddle ourselves with one of the most ancient check-writing based systems in the world that people in other countries laugh at us for (or ask in puzzlement, "what is that?"), and have to make all these terrible workarounds to deal with.
- rootusrootus 5y ago
  This scam doesn't seem to have anything to do with actual Zelle aside from using it to enhance the social aspect of the phishing. If Zelle didn't exist, they'd use some other service that gave their scam a patina of truth.
thowaway959125 5y ago
I fell for this, and I have never fallen for a computer scam in my life, nor even had so much as a virus in the last two decades. However, it is very sophisticated. They somehow managed to actually get a fraudulent charge on my card. When I got the spoofed message from "my bank", the first thing I did was log onto my legitimate account. Sure enough, there was a charge I did not recognize. The rest was just a series of unfortunate "rookie" mistakes on my part. But the person who called me was highly professional, easily could have been a real customer support representative and spoke English perfectly with no accent. They took the max, $5,000. My bank thankfully refunded it.
- vmception 5y ago
  (They still got the $5,000 and won't be arrested) I always thought there was an underserved market if scammers are just filtering for gullible people. So, about time to see more sophisticated scammers casting a broader net.
- tedunangst 5y ago
  If you're already looking at the website, why not just click "dispute" on the bad charge?
  - judge2020 5y ago
    When I was with Bank of America in 2019, there was no dispute button. Any attempt to dispute went to their help center that said 'call the number'.
  - perfectstorm 5y ago
    You can't dispute a charge until it's posted (at least with two of my banks) and it can take up to 2-3days before a charge is posted. A charge will almost always show up immediately on my bank's website as pending.
  - thowaway959125 5y ago
    Can't dispute until posted, and the way the scam works is they get you on the phone as quickly as they can in order to continue to the scam. Obviously, in hindsight the correct way to handle this is to call the bank yourself. The way the scam works is they spoof your bank's caller ID, and you get a standard "do you recognize this charge? Press YES if you recognize, NO if not". When you type NO, you get a message stating "our fraud team will be reaching out to you momentarily to resolve this issue", followed immediately by a call from a very convincing "customer support" person, again coming in as a caller ID from your bank. At this point, I made some "rookie" mistakes as I'd mentioned, but hindsight is 20/20 in these cases where they are trying to keep you on your toes.
vmception 5y ago
Is asking for the texted passcode really necessary? Can't they just SS7 hack that part since all SMS is vulnerable to this? Or is it really necessary to just carry the conversation flow forward by asking the victim themselves.
throw7 5y ago
"many credit unions offer it by default as part of online banking" I remember I had to opt-in to get zelle transfers activated. Information, terms of the service, and separate activation of email/phone were done at that time just for zelle. I suppose nowadays it's streamlined... which is not so good if customers don't even know what zelle is.
MR4D 5y ago
I have had a crazy theory for awhile now. It goes like this… Scammers have a do not call list. The only people on it are violent drug lords and members of congress. The first will kill them, the second will kill their business (by fixing the phone system).
jedimastert 5y ago
My parents just got hit for a couple thousand dollars. Somehow someone got ahold of their online banking info, pulled money from a savings account to a debit card, and send the money God knows where through "Remitly", a services I've never heard of until tonight. Their bank is contacting Remitly, but they have to nuke all of their accounts and cards and start over, and they're out the cash until the bank comes through. It's really awful to see. What's wild is my parents aren't the phishing victim types. They know about not reusing passwords, not sending passwords, not trusting phone calls, all of that good stuff. I'm really curious how they got got.
- orhmeh09 5y ago
  This isn’t really helpful, I know, but Remitly is a real company and I’ve met someone who worked there — it sounded pretty legit. But like with Western Union, pretty much anything that lets you transfer money internationally is prone to misuse. It sounds really stressful what your family us going through and I hope they get their money back.
  - jedimastert 5y ago
    Yeah, from what I could tell there wasn't much Remitly could have done to prevent this outside of like checking citizenship documents and contacting the bank. They seem legit enough.
cgijoe 5y ago
> The caller’s number will be spoofed so that it appears to be coming from the victim’s bank. I feel like this is a solvable problem. Don't allow anyone to spoof the caller ID. Ever.
- paxys 5y ago
  That part is pretty inconsequential. How many people even save their bank's number on their phone?
- smileysteve 5y ago
  But this makes it more complex. If the bank's phone number can't be "spoofed" then it can only have 1 outgoing call at a time, otherwise, each agent will have an independent line and a unique number.
  - kzrdude 5y ago
    Good, maybe they will pay the operator for allocating 500 outgoing lines Bank #1 - Bank #500 for them
ravel-bar-foo 5y ago
> “In the background, they’re using the username with the forgot password feature, and that’s going to generate one of these two-factor authentication passcodes,” Otsuka said. “Then the fraudster will say, ‘I’m going to send you the password and you’re going to read it back to me over the phone.'” It seems like a simple mitigation on the bank's end would be to add warning text to the 2 factor authentication. "You have requested to change your password via our web portal at yourbank.com. If you did not request to change your password via the web portal, or if someone asked you to give them this number, then it is possible that someone pretending to be a bank representative is attempting to hack your account. The code to change your password is ..... Do not share this code with anyone."
- gurchik 5y ago
  The 2FA messages I get from my bank are already something like "Your security code is 0123456. Do not share with anyone. We will never call to ask for this code." But it wouldn't surprise me if victims are too scared to read it properly, so some improvement could be helpful. It doesn't help that other banks regularly ask for SMS codes over the phone, entraining into people to do it without thinking. I would personally feel a lot better if every bank had the ability to only allow 2FA via OTP, or only physical key, or even email. My bank uses a "Security Word" which is crazy to me.
  - underwater 5y ago
    The scammers get you panicked and hold you in that state so that you're stressed out and not thinking rationally. They also exploit a small slip up and escalate it into a catastrophic one. For example the scam might start with the assumption that caller ID is accurate, or the assumption that because there is fraud on your account the person is actually from the "fraud department", or the assumption that hanging up a landline terminates the call. Each of those are small slipups, but they get people bought into the fiction, and then as the scam escalates they don't stop and think through the sequence and realise that the initial assumption was flawed.
- rocqua 5y ago
  Note that, in this case, the SMS code is not a second factor. It is a single factor that is enough to get full control of the account. Besides that, I think you are right. Binding 'signatures' to what you are authorizing is one of the ways to prevent your authorization from being re-used. There are parallels in cryptography where you sign not just data but also what it will be used for. Otherwise an attacker might reuse your signature.
johnnyApplePRNG 5y ago
+1 for crypto logins. No way a fake banker can get you to sign a nonce for them using your private key.
- 0des 5y ago
  Sure, easy for us to say that, but imagine teaching someone less technically competent what that even means.
- somebodythere 5y ago
  https://cryptonews.com/news/thief-steals-usd-8-2m-from-nexus-mutual-founder-in-a-targete-8612.htm https://cryptonews.com/news/thief-steals-usd-8-2m-from-nexus...
bredren 5y ago
> If a criminal initiates a Zelle transfer…that fraud is covered by Regulation E, and banks should restore the stolen funds,” This seems great but there’s value in these transfers as well. I had a pair of Apple Watches I was selling and someone wanted to use Zelle to pay for them. No one has ever wanted to pay for a p2p transaction with me using Zelle. I said since they had the money in the bank, they would just need to pull it out on the way over. (It was still during banking hours) They wouldn’t do it. Kept pushing Zelle as a safe way to send money. By targeting people who will trade real items for Zelle transfers, it doesn’t matter if the compromised account owner gets their cash back.
- skinnymuch 5y ago
  I’m confused about this. What’s the target here? It’s shady/weird to want to use Zelle, but couldn’t this have been a legit person wanting to use Zelle?
  - bredren 5y ago
    Yes. But if they have the cash and bank hours are open, why not just get the cash out? I even offered to meet them at the bank. They were scamming. The target is the unaware seller, who has no recourse when the funds magically disappear from their account. They are out whatever goods they had for sale. It is not typical to take down the license plate or copy the drivers license of someone buying something from you.
patio11 5y ago
Circle that bit of advice around Regulation E folks. (Not a lawyer but I have had a lot of experience citing Regulation E on behalf of various folks. It, unsurprisingly, works the way that regulators say it does.)
rocqua 5y ago
It seems like a 'simple' case of using SMS codes as a single factor. If it is enough for a password reset, it's a single factor. It seems to me that SMS codes are much more often abused like this than other second factors are.
supersunshine 5y ago
What could go wrong with mandatory digital IDs?
Wowfunhappy 5y ago
It seems to me the actual issue here is the banks are using a second-factor code as a single factor. That isn’t 2FA.
fbanon 5y ago
Can we just address the fact that the PSTN is a completely insecure, Wild West tier, broken mess? Number spoofing, delayed disconnect, SIM hijacking, wtf? The fact that banks use that as a second authentication factor is beyond baffling, and all liability should land on them.
yardstick 5y ago
Would it help if the text message included the reason for the code? “This is <bank>, you requested a password reset. Your code for this is 123456. Using this code will change your password. Call us if that’s not what you want.” Or something along those lines. Yeah it’s still a fundamentally flawed process, but until they replace the entire process with something better, a slight change in wording would help save some people.
- jrib 5y ago
  I agree this would be an improvement. Many people won't actually read the message but for those who do it adds some security. At the very least there should be distinct codes for identity verification when on the phone with your bank and when performing other activities.
- notahacker 5y ago
  One of my banks actually sends two SMSes, a generic warning one, with the actual code following a minute later (the website tells you this will happen). Annoying when you're short of time, but I suspect it's very successful at countering this sort of social engineering. You open the message the scammers tell you they've sent, and it just tells you to beware of people ringing you up and asking for codes. Probably you don't stay on the line waiting for the actual security code.
programmer_dude 5y ago
Why would I ever need to talk over the phone if I can do everything online? This looks like a US only problem.
ransom1538 5y ago
I love how the article omitted an important fact: zelle has a daily and monthly transfer limits. The max this scam can make is ~1k. After the first zelle send - these scammers reset your password, you are sent an email your password is reset, so! you most likely will login to see what happened etc. It is an interesting scam but nothing compared to wiring money.
mndgs 5y ago
It's so strange to read this is still happening in US. I live in Europe - 95% of such attacks are prevented by something called Strong Customer Authentication, which anybody serving or providing access to an account (cards including) must implement. Basically, that's 2FA implemented in myriad different ways. So, this Zelle thing wouldn't be possible at all: Zelle would have to ask for a SCA verification from the customer, just to connect/use his/her account in the first place. That would eliminate ground for such scamming messages ever appearing (if the customers knew and were accustomed to SCA). Though to be fair, scamming is still present here, typically involving calling older people and trying to persuade them to reveal bank access codes during a phone call. There two differences with US banks here: - banks are required never to ask for access credentials over insecure channel (phone/email) (though SMS is also not perfect in this regard); - banks are required to educate customers that they never ask for such credentials, educate about fraud scenarios, etc. And they do (at least the reputable ones) Seems that the PSD2 regulation (including SCA) are really making payments much safer in Europe when you compare to rest of the world. Also, to admit: I'm a head of financial institution here, quite knowledgeable of the field, both on regulatory and on technical level.
- sschueller 5y ago
  I have the feeling there is no interest in fixing these things in the US. Too many people making money of certain outdated services. From printing paper checks to minting pennies. Like everything, it will require a gigantic scandal before anything is fixed/changed and it will open the door for new issues.
  - thathndude 5y ago
    It will change when it becomes the economically rational choice for banks. I won’t bore with details, but I’m a lawyer who primarily sues banks for customers. And I’ve seen the lawsuits I file lead/contribute to changes in bank behavior and policy. The regulatory protections are there. Now lawyers need to punch banks on the nose until they decide they want to do more to stop the fraud in the first instance. But it’s strange, clients have almost like a Stockholm syndrome with the banks. Their rational is often something like “I don’t want to sue them and make them mad, because that might mean I won’t get my money back” But you’re not going to get your money back unless you sue. Meanwhile deadlines pass and then you’re screwed (and embarrassed)
vegetablepotpie 5y ago
> the victim has never even heard of Zelle, nor did they realize they could move money that way. Financial institutions do not take security seriously, and they don’t take their customers time seriously. The onus is always on the consumer to protect their accounts. When institutions decide to change their features the customer is not at the table, they’re on the menu.
swat535 5y ago
This may sound very simplistic but I block all calls that are not in my contacts list on my iPhone. It directly goes to voicemail and they can leave a message if it's important. Should the message involves anything that I might consider important, I simply call my bank and ask for a follow up. If it's an absolutely critical matter and I don't call or follow up, the bank will send a letter instead which I can then either call or go to the bank for further inquiries I do the same thing if I get a suspicious email / text from my bank. Finally, I never really click the links in the emails because I have my bank's website as a bookmark so I'll just use that.
EGreg 5y ago
You know — they could have fixed it by just saying in the text message: “Someone is trying to log in as you. Do NOT provide this login code if someone asks you, regardless of the reason: ABCDE” Simply describe the action being taken and its significance. Not just a random code message.

277 points by picture 5y ago

My girlfriend got hit with this one. According to her the scammer was very convincing on the phone. American accent. Empathetic tone. "Don't worry, we'll get your money back, we just need to make sure it's really you not the person trying to steal your money." Luckily her credit union was quick to restore the funds with minimal hassle.

josephcsible 5y ago

Don't these sorts of emails already say things like "nobody legitimate, including our employees, will ever ask you to tell them this code"? I'm not sure how to stop scams that are already only possible because of people's lack of reading.

dmitrygr 5y ago
There are only space for so many characters available in an SMS, so they may not include this very important warning.
- deleted 5y ago
  [deleted]
- ollien 5y ago
  Ally's message does. > Ally: As Security measure, we will never ask for this number over the phone. Security code: xxyyzz. Call 1-877-247-2559 if you did not request a code.
- djbusby 5y ago
  Wells Fargo has a warning in their SMS - for Zelle and non-Zelle things.
- djrogers 5y ago
  Cap1 does this: “Capital One won't call you for this code. The temporary code you requested to sign-in is 091657. Please use this code to complete your request.” IIRC, there was one time I did have to verify a code over the phone, and the message that came with it was completely different.
bullfightonmars 5y ago
The problem is that banks totally ask for codes when you call them to do things like password resets.
paxys 5y ago
Major ones have it, but there are thousands of banks in the US and I'd wager almost all of them provide some form of online banking experience. Outside the larger ones security isn't really up to par.

_jal 5y ago

I've gotten these texts twice, so far. There was another one that came in between them that felt the same (language that I think of as "conversational robotese"), but appeared to be VPN phishing.

nnf 5y ago

Any telco people here that can explain the technicals of how or why it’s still possible to spoof a phone number? Is this just how the whole system works? When I use Twilio, I have to prove to them that I control a phone number before I can use Twilio make outbound calls or send SMS messages that appear to originate from my number. This suggests to me that the system is built with assumed trust, like email was originally. Is everything too ingrained at this point to add some type of authentication that would prevent this type of spoofing? Something similar to a CAA record, where the owner of a phone number could say “legitimate calls from this number will only originate from $TELCO and $SMS_PROVIDER” would be nice.

djbusby 5y ago
There are some PSTN gateway providers that you can basically makeup your outgoing CID on. Les.net used to let me do that for example - no validation. Twilio is doing their own enforcement to help their reputation.
- wildrhythms 5y ago
  These gateway providers, in addition to simply spoofing the outgoing number, will also sell blocks of legitimate domestic numbers to the scammers- knowingly- to use for callback numbers. Truly disgusting https://www.justice.gov/opa/pr/district-court-enters-permanent-injunction-shutting-down-telecom-carriers-who-facilitated https://www.justice.gov/opa/pr/district-court-enters-permane...
  - djbusby 5y ago
    Yea, I wasn't tryna call anyone out, there are legit use-case and I like Twilio approach and yet, it's so easy so fake a CID :(
DaiPlusPlus 5y ago
The PSTN is frozen-in-time: despite SIP and fancy intra-3G/4G/5G tech everything else is built around Signalling System 7 from 1975: https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7

mindslight 5y ago

> Consumers who suffer unauthorized transactions are entitled to Regulation E protection, and banks are required to refund the stolen money. This isn’t a controversial opinion, and it was recently affirmed by the CFPB here [0]. If you are reading this story and fighting with your bank, start by providing that link to the financial institution. Props for including this in the article! All too often the basic legal situation is never explained, leaving victims to believe that blatantly illegal crap is "just the way it is". For example, "identity theft" and fraudulent medical bills. [0] https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/ https://www.consumerfinance.gov/compliance/compliance-resour...

yumraj 5y ago

I recently had a weird issue: some random dude sent me $1.xx over PayPal. Naturally I refunded it and thought matter closed. Then, some days later I got 3 more payments in similar $1.xx amounts. I refunded 2, but for the 3rd one PayPal wanted to charge some fees. At which point I just blocked the dude. No idea if this was a genuine mistake or a scam. Anyone knows??

sushid 5y ago
Not sure but I think what they want is for you to pay them $1.xx back (rather than refund). Then they can try and initiate a refund on their end, which allows them to pocket the amount you gave them for free.
bluedino 5y ago
I've had things for sale and then buyer sends the money, then wants me to ship to some foreign country, always a pain in the ass to refund them
hamiltonians 5y ago
THey are probbly checking to see if it is active.
- 2muchcoffeeman 5y ago
  I used to deal with some online merchant facilities. I used to see loads of $1.xx charges on clients that were not careful with their merchant details.
SavantIdiot 5y ago
I once panicked that someone was getting ready to withdraw funds from my account because I saw those two <$1.00 auth charges. I called my bank, and they panicked, and immediately created a new account, moved the money into it, and closed the other one. Like within 5 minutes. Turns out I forgot I told a friend to reimburse me for beers we had a few weeks before that, and his payment service was verifying my account. Online banking and all of this digital access to my monies makes me nervous as heck. Double-edged sword. (Yes, I have 2TF hard tokens on all major accounts.)

ljm 5y ago

Like many scams, it depends on the victims being polite, perhaps more much than them being naive. The fraudulent message asks for a yes or no reply but does not care about the answer spefically; only that there was an answer. So the victims are the people who couldn't ignore the message and had to say no. Most likely the people who say yes are still taken into account , because they confirmed there was a person behind the number. They'll get a new scam later on. But the people saying no are the target. A lot of people feel bad if they don't answer the phone, or a message, or the doorbell. So you prey on their niceness. How to fight back? Don't. The way to defeat the scam is to not acknowledge it. Ignore whatever primal urge you have to get involved, or teach them whippersnappers a lesson, and cast it into the void.

krebsonsecurity 5y ago
I agree with your point about not acknowledging these scam attempts. Just wanted to point out the "fight back" bit of the story was advice for people who've already been victimized and are being told their bank won't cover the loss.
SavantIdiot 5y ago
I'd be really curious to know how many people actually answer calls they aren't expecting, on their personal phones (e.g., non-work phones where you must answer customers). I bet that graph is U-shaped of % of people that answer unknown messages vs. age. Kids want to be social, and old people don't know any better. With salty Gen-Xers in the middle. 99.99% of the time I let it go to voicemail. I have since the days of cassette-tape answering machines. The only time I don't is if some just texted and said they are calling. Even when my insurance company hold line asks if I want a callback, I'm too paranoid that a scammer could have infiltrated the callback process.
- chillwaves 5y ago
  I just realized I can keep my phone on DND 24/7 and it's wonderful (rings for contacts only). The bonus of it only ringing for your contacts is that when your phone does ring, you know it's something relatively important. Completely changed my relationship with my phone.

lost-found 5y ago

One other red flag: your bank asking you for your username. At least for me, my bank would never use anything other than my real name.

hn_throwaway_99 5y ago

I wish there was a coordinated public service campaign around "Hang up, Look up, Call back". I feel like if we could really ingrain those 6 words that it would go a long way to blocking these types of phishing scams. Number one thing I tell folks in my security training is to never respond or click a link on an inbound message. Instead, look up your bank or service provider and make an outbound call (or direct URL navigation) to them.

coderintherye 5y ago
There is, sort of: https://scamspotter.org/ https://scamspotter.org/ Discussed here earlier today: https://news.ycombinator.com/item?id=29278411 https://news.ycombinator.com/item?id=29278411
JulianK 5y ago
I recently heard about an incident where hanging up turned out to be more difficult than it should have been. Stay calm. Call from another phone perhaps? https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone-scam-1.5375708 https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...
- david_allison 5y ago
  Definitely call from another phone if using a landline. https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...
  - tzs 5y ago
    If you don't have another phone would it be safe to first call some other known number and see if that goes through? If it does, then you should be able to infer that the previous inbound call has (probably [1]) hung up, and it is now safe to call your bank. [1] A sophisticated enough scammer could hold the line, give a fake dial tone, detect that the number you are dialing is not the bank number they expected you to dial, dial that number themselves on a different line, and relay between that line and yours to convince you that you really did have a clear line, and then keep holding the line when you then hang up and try to call the bank.

hamiltonians 5y ago

Regarding crypto fraud, why isn't anyone talking about the massive amount of Elon Musk spam and hacked twitter accounts. https://scaminvestigations.substack.com/p/better-than-the-mafia-twitter-crypto https://scaminvestigations.substack.com/p/better-than-the-ma...

cyral 5y ago
Probably because those scam accounts have been going on for years and nothing has been done

bob331 5y ago

This is not an “increasingly clever” attack, it is monumentally oblivious to anyone but a luddite

deleted 5y ago

[deleted]

supernova87a 5y ago

Well, my opinion is that a ridiculous root cause of all this is the lack of a central, government-supervised, secure, instantaneous, free, direct payments system. Such that all these stupid private bank-based services are attempting to fill that void and don't get it right when they do it. Not to say that such a service would not also have vulnerabilities. But you hear about all the bounced check / advance fee / text message validation scams going on now, and you would think that the banks would want to get this liability off their hands and into a central service that they can just be rid of the responsibility. (ok, on the other hand, having an irrevocable transfer system might introduce new problems as well, but still...) I find it unfathomable why we continue to saddle ourselves with one of the most ancient check-writing based systems in the world that people in other countries laugh at us for (or ask in puzzlement, "what is that?"), and have to make all these terrible workarounds to deal with.

rootusrootus 5y ago
This scam doesn't seem to have anything to do with actual Zelle aside from using it to enhance the social aspect of the phishing. If Zelle didn't exist, they'd use some other service that gave their scam a patina of truth.

thowaway959125 5y ago

I fell for this, and I have never fallen for a computer scam in my life, nor even had so much as a virus in the last two decades. However, it is very sophisticated. They somehow managed to actually get a fraudulent charge on my card. When I got the spoofed message from "my bank", the first thing I did was log onto my legitimate account. Sure enough, there was a charge I did not recognize. The rest was just a series of unfortunate "rookie" mistakes on my part. But the person who called me was highly professional, easily could have been a real customer support representative and spoke English perfectly with no accent. They took the max, $5,000. My bank thankfully refunded it.

vmception 5y ago
(They still got the $5,000 and won't be arrested) I always thought there was an underserved market if scammers are just filtering for gullible people. So, about time to see more sophisticated scammers casting a broader net.
tedunangst 5y ago
If you're already looking at the website, why not just click "dispute" on the bad charge?
- judge2020 5y ago
  When I was with Bank of America in 2019, there was no dispute button. Any attempt to dispute went to their help center that said 'call the number'.
- perfectstorm 5y ago
  You can't dispute a charge until it's posted (at least with two of my banks) and it can take up to 2-3days before a charge is posted. A charge will almost always show up immediately on my bank's website as pending.
- thowaway959125 5y ago
  Can't dispute until posted, and the way the scam works is they get you on the phone as quickly as they can in order to continue to the scam. Obviously, in hindsight the correct way to handle this is to call the bank yourself. The way the scam works is they spoof your bank's caller ID, and you get a standard "do you recognize this charge? Press YES if you recognize, NO if not". When you type NO, you get a message stating "our fraud team will be reaching out to you momentarily to resolve this issue", followed immediately by a call from a very convincing "customer support" person, again coming in as a caller ID from your bank. At this point, I made some "rookie" mistakes as I'd mentioned, but hindsight is 20/20 in these cases where they are trying to keep you on your toes.

vmception 5y ago

Is asking for the texted passcode really necessary? Can't they just SS7 hack that part since all SMS is vulnerable to this? Or is it really necessary to just carry the conversation flow forward by asking the victim themselves.

throw7 5y ago

"many credit unions offer it by default as part of online banking" I remember I had to opt-in to get zelle transfers activated. Information, terms of the service, and separate activation of email/phone were done at that time just for zelle. I suppose nowadays it's streamlined... which is not so good if customers don't even know what zelle is.

MR4D 5y ago

I have had a crazy theory for awhile now. It goes like this… Scammers have a do not call list. The only people on it are violent drug lords and members of congress. The first will kill them, the second will kill their business (by fixing the phone system).

jedimastert 5y ago

My parents just got hit for a couple thousand dollars. Somehow someone got ahold of their online banking info, pulled money from a savings account to a debit card, and send the money God knows where through "Remitly", a services I've never heard of until tonight. Their bank is contacting Remitly, but they have to nuke all of their accounts and cards and start over, and they're out the cash until the bank comes through. It's really awful to see. What's wild is my parents aren't the phishing victim types. They know about not reusing passwords, not sending passwords, not trusting phone calls, all of that good stuff. I'm really curious how they got got.

orhmeh09 5y ago
This isn’t really helpful, I know, but Remitly is a real company and I’ve met someone who worked there — it sounded pretty legit. But like with Western Union, pretty much anything that lets you transfer money internationally is prone to misuse. It sounds really stressful what your family us going through and I hope they get their money back.
- jedimastert 5y ago
  Yeah, from what I could tell there wasn't much Remitly could have done to prevent this outside of like checking citizenship documents and contacting the bank. They seem legit enough.

cgijoe 5y ago

> The caller’s number will be spoofed so that it appears to be coming from the victim’s bank. I feel like this is a solvable problem. Don't allow anyone to spoof the caller ID. Ever.

paxys 5y ago
That part is pretty inconsequential. How many people even save their bank's number on their phone?
smileysteve 5y ago
But this makes it more complex. If the bank's phone number can't be "spoofed" then it can only have 1 outgoing call at a time, otherwise, each agent will have an independent line and a unique number.
- kzrdude 5y ago
  Good, maybe they will pay the operator for allocating 500 outgoing lines Bank #1 - Bank #500 for them

ravel-bar-foo 5y ago

> “In the background, they’re using the username with the forgot password feature, and that’s going to generate one of these two-factor authentication passcodes,” Otsuka said. “Then the fraudster will say, ‘I’m going to send you the password and you’re going to read it back to me over the phone.'” It seems like a simple mitigation on the bank's end would be to add warning text to the 2 factor authentication. "You have requested to change your password via our web portal at yourbank.com. If you did not request to change your password via the web portal, or if someone asked you to give them this number, then it is possible that someone pretending to be a bank representative is attempting to hack your account. The code to change your password is ..... Do not share this code with anyone."

gurchik 5y ago
The 2FA messages I get from my bank are already something like "Your security code is 0123456. Do not share with anyone. We will never call to ask for this code." But it wouldn't surprise me if victims are too scared to read it properly, so some improvement could be helpful. It doesn't help that other banks regularly ask for SMS codes over the phone, entraining into people to do it without thinking. I would personally feel a lot better if every bank had the ability to only allow 2FA via OTP, or only physical key, or even email. My bank uses a "Security Word" which is crazy to me.
- underwater 5y ago
  The scammers get you panicked and hold you in that state so that you're stressed out and not thinking rationally. They also exploit a small slip up and escalate it into a catastrophic one. For example the scam might start with the assumption that caller ID is accurate, or the assumption that because there is fraud on your account the person is actually from the "fraud department", or the assumption that hanging up a landline terminates the call. Each of those are small slipups, but they get people bought into the fiction, and then as the scam escalates they don't stop and think through the sequence and realise that the initial assumption was flawed.
rocqua 5y ago
Note that, in this case, the SMS code is not a second factor. It is a single factor that is enough to get full control of the account. Besides that, I think you are right. Binding 'signatures' to what you are authorizing is one of the ways to prevent your authorization from being re-used. There are parallels in cryptography where you sign not just data but also what it will be used for. Otherwise an attacker might reuse your signature.

johnnyApplePRNG 5y ago

+1 for crypto logins. No way a fake banker can get you to sign a nonce for them using your private key.

0des 5y ago
Sure, easy for us to say that, but imagine teaching someone less technically competent what that even means.
somebodythere 5y ago
https://cryptonews.com/news/thief-steals-usd-8-2m-from-nexus-mutual-founder-in-a-targete-8612.htm https://cryptonews.com/news/thief-steals-usd-8-2m-from-nexus...

bredren 5y ago

> If a criminal initiates a Zelle transfer…that fraud is covered by Regulation E, and banks should restore the stolen funds,” This seems great but there’s value in these transfers as well. I had a pair of Apple Watches I was selling and someone wanted to use Zelle to pay for them. No one has ever wanted to pay for a p2p transaction with me using Zelle. I said since they had the money in the bank, they would just need to pull it out on the way over. (It was still during banking hours) They wouldn’t do it. Kept pushing Zelle as a safe way to send money. By targeting people who will trade real items for Zelle transfers, it doesn’t matter if the compromised account owner gets their cash back.

skinnymuch 5y ago
I’m confused about this. What’s the target here? It’s shady/weird to want to use Zelle, but couldn’t this have been a legit person wanting to use Zelle?
- bredren 5y ago
  Yes. But if they have the cash and bank hours are open, why not just get the cash out? I even offered to meet them at the bank. They were scamming. The target is the unaware seller, who has no recourse when the funds magically disappear from their account. They are out whatever goods they had for sale. It is not typical to take down the license plate or copy the drivers license of someone buying something from you.

patio11 5y ago

Circle that bit of advice around Regulation E folks. (Not a lawyer but I have had a lot of experience citing Regulation E on behalf of various folks. It, unsurprisingly, works the way that regulators say it does.)

rocqua 5y ago

It seems like a 'simple' case of using SMS codes as a single factor. If it is enough for a password reset, it's a single factor. It seems to me that SMS codes are much more often abused like this than other second factors are.

supersunshine 5y ago

What could go wrong with mandatory digital IDs?

Wowfunhappy 5y ago

It seems to me the actual issue here is the banks are using a second-factor code as a single factor. That isn’t 2FA.

fbanon 5y ago

Can we just address the fact that the PSTN is a completely insecure, Wild West tier, broken mess? Number spoofing, delayed disconnect, SIM hijacking, wtf? The fact that banks use that as a second authentication factor is beyond baffling, and all liability should land on them.

yardstick 5y ago

Would it help if the text message included the reason for the code? “This is <bank>, you requested a password reset. Your code for this is 123456. Using this code will change your password. Call us if that’s not what you want.” Or something along those lines. Yeah it’s still a fundamentally flawed process, but until they replace the entire process with something better, a slight change in wording would help save some people.

jrib 5y ago
I agree this would be an improvement. Many people won't actually read the message but for those who do it adds some security. At the very least there should be distinct codes for identity verification when on the phone with your bank and when performing other activities.
notahacker 5y ago
One of my banks actually sends two SMSes, a generic warning one, with the actual code following a minute later (the website tells you this will happen). Annoying when you're short of time, but I suspect it's very successful at countering this sort of social engineering. You open the message the scammers tell you they've sent, and it just tells you to beware of people ringing you up and asking for codes. Probably you don't stay on the line waiting for the actual security code.

programmer_dude 5y ago

Why would I ever need to talk over the phone if I can do everything online? This looks like a US only problem.

ransom1538 5y ago

I love how the article omitted an important fact: zelle has a daily and monthly transfer limits. The max this scam can make is ~1k. After the first zelle send - these scammers reset your password, you are sent an email your password is reset, so! you most likely will login to see what happened etc. It is an interesting scam but nothing compared to wiring money.

mndgs 5y ago

It's so strange to read this is still happening in US. I live in Europe - 95% of such attacks are prevented by something called Strong Customer Authentication, which anybody serving or providing access to an account (cards including) must implement. Basically, that's 2FA implemented in myriad different ways. So, this Zelle thing wouldn't be possible at all: Zelle would have to ask for a SCA verification from the customer, just to connect/use his/her account in the first place. That would eliminate ground for such scamming messages ever appearing (if the customers knew and were accustomed to SCA). Though to be fair, scamming is still present here, typically involving calling older people and trying to persuade them to reveal bank access codes during a phone call. There two differences with US banks here: - banks are required never to ask for access credentials over insecure channel (phone/email) (though SMS is also not perfect in this regard); - banks are required to educate customers that they never ask for such credentials, educate about fraud scenarios, etc. And they do (at least the reputable ones) Seems that the PSD2 regulation (including SCA) are really making payments much safer in Europe when you compare to rest of the world. Also, to admit: I'm a head of financial institution here, quite knowledgeable of the field, both on regulatory and on technical level.

sschueller 5y ago
I have the feeling there is no interest in fixing these things in the US. Too many people making money of certain outdated services. From printing paper checks to minting pennies. Like everything, it will require a gigantic scandal before anything is fixed/changed and it will open the door for new issues.
- thathndude 5y ago
  It will change when it becomes the economically rational choice for banks. I won’t bore with details, but I’m a lawyer who primarily sues banks for customers. And I’ve seen the lawsuits I file lead/contribute to changes in bank behavior and policy. The regulatory protections are there. Now lawyers need to punch banks on the nose until they decide they want to do more to stop the fraud in the first instance. But it’s strange, clients have almost like a Stockholm syndrome with the banks. Their rational is often something like “I don’t want to sue them and make them mad, because that might mean I won’t get my money back” But you’re not going to get your money back unless you sue. Meanwhile deadlines pass and then you’re screwed (and embarrassed)

vegetablepotpie 5y ago

> the victim has never even heard of Zelle, nor did they realize they could move money that way. Financial institutions do not take security seriously, and they don’t take their customers time seriously. The onus is always on the consumer to protect their accounts. When institutions decide to change their features the customer is not at the table, they’re on the menu.

swat535 5y ago

This may sound very simplistic but I block all calls that are not in my contacts list on my iPhone. It directly goes to voicemail and they can leave a message if it's important. Should the message involves anything that I might consider important, I simply call my bank and ask for a follow up. If it's an absolutely critical matter and I don't call or follow up, the bank will send a letter instead which I can then either call or go to the bank for further inquiries I do the same thing if I get a suspicious email / text from my bank. Finally, I never really click the links in the emails because I have my bank's website as a bookmark so I'll just use that.

EGreg 5y ago

You know — they could have fixed it by just saying in the text message: “Someone is trying to log in as you. Do NOT provide this login code if someone asks you, regardless of the reason: ABCDE” Simply describe the action being taken and its significance. Not just a random code message.