6 ms·

Like many scams, it depends on the victims being polite, perhaps more much than them being naive. The fraudulent message asks for a yes or no reply but does no

by ljm 5y ago

Like many scams, it depends on the victims being polite, perhaps more much than them being naive. The fraudulent message asks for a yes or no reply but does not care about the answer spefically; only that there was an answer. So the victims are the people who couldn't ignore the message and had to say no. Most likely the people who say yes are still taken into account , because they confirmed there was a person behind the number. They'll get a new scam later on. But the people saying no are the target. A lot of people feel bad if they don't answer the phone, or a message, or the doorbell. So you prey on their niceness. How to fight back? Don't. The way to defeat the scam is to not acknowledge it. Ignore whatever primal urge you have to get involved, or teach them whippersnappers a lesson, and cast it into the void.

krebsonsecurity 5y ago
I agree with your point about not acknowledging these scam attempts. Just wanted to point out the "fight back" bit of the story was advice for people who've already been victimized and are being told their bank won't cover the loss.
SavantIdiot 5y ago
I'd be really curious to know how many people actually answer calls they aren't expecting, on their personal phones (e.g., non-work phones where you must answer customers). I bet that graph is U-shaped of % of people that answer unknown messages vs. age. Kids want to be social, and old people don't know any better. With salty Gen-Xers in the middle. 99.99% of the time I let it go to voicemail. I have since the days of cassette-tape answering machines. The only time I don't is if some just texted and said they are calling. Even when my insurance company hold line asks if I want a callback, I'm too paranoid that a scammer could have infiltrated the callback process.
- chillwaves 5y ago
  I just realized I can keep my phone on DND 24/7 and it's wonderful (rings for contacts only). The bonus of it only ringing for your contacts is that when your phone does ring, you know it's something relatively important. Completely changed my relationship with my phone.
- perl4ever 5y ago
  >I'd be really curious to know how many people actually answer calls they aren't expecting What do you do when your counterpart won't answer their phone? I answer calls I'm not expecting when I'm expecting a call. Like from a plumber, a recruiter, a paving company, etc. If I don't, at best I get to play phone tag, and at worst, the other person gets ticked off and I lose an opportunity. I don't like leaving voice mail, particularly the second or third time. It would be nice if everyone legit had their main number show up to identify them, and it would be nice if they all answered their phone all day, but they don't.
  - jrnichols 5y ago
    I'm a Paramedic here in Northern California and we recently went on a welfare check to an apartment - us, fire dept, and law enforcement - for a family that could not get ahold of their grandmother. Grandma was fine, fortunately, and she simply turned her phone off because it was ringing constantly with scam phone calls. She was sick of the auto warranty spam all the time, so she unplugged entirely. The elderly are the ones that still have landlines and cell phones too, so they often get hit multiple times. It's harder for them to disconnect the landline due to things like Life Alert requiring a landline.
    - maxerickson 5y ago
      Medical alert devices that use cellular connections are widely available. There going to be areas where coverage is poor, but for many people, working out of the home is going to be a considerable improvement.
      - jrnichols 5y ago
        They are widely available but not as common. We will run on 2-3 lifeline calls a day sometimes and while resetting them, we rarely see a wireless one.
    - perl4ever 5y ago
      I got a call recently about my student loans. It was...erm...remarkable in its high production values. Even compared to the auto warranty ones, which I don't get often, but every now and then. I also got a "hello...hello...hello" call, and seven hangup/no message calls the same afternoon. I assume the call I answered was a scammer, but a few months ago, I got one just like that and it turned out it was from my physician's office, and I had some trouble getting ahold of them.
- ljm 5y ago
  I don't answer a single call unless I'm told to expect it, or I can antipate one coming (e.g. I ordered takeout and the delivery driver is gonna ping me, or I asked a recruiter to call me at X time). If the call comes out of nowhere, or if it's from a hidden number, then I'll silence it rather than declining (i.e. hit the power button rather than actually acknowledging the call, so it carries on ringing in silence until they give up instead of being told I'm busy). If it's important they'll leave voicemail or send an email.
- suction 5y ago
  Me too. I consider it rude to be called on my phone, actually, even by people I know.
- deleted 5y ago
  [deleted]
jonas21 5y ago
I don't think the issue is people being polite. It's that these messages look similar to the legitimate fraud alerts that credit card companies and banks send. What happens if you don't respond to those? Presumably, the transaction will be blocked -- but can you be sure? It would cause me a lot of anxiety not to resolve the issue right away.
paxys 5y ago
It's not about niceness. When you get a text about a potential scam there's an urgency to reply. And you can't just ignore it. All major banks send out official text messages to confirm large transactions. This has happened to me multiple times with Chase, and just recently I blocked a fraudulent ATM withdrawal using exactly the method outlined in the article (someone skimmed my debit card when abroad, I got a text from Chase when they tried to use it, I replied no, got a call from the customer service rep). Only thing missing was reading out the OTP, obviously, which I would not have done.
- ohazi 5y ago
  > Only thing missing was reading out the OTP, obviously, which I would not have done. This is the real red flag here. No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field.
  - deleted 5y ago
    [deleted]
  - chime 5y ago
    Last week I had to call Wells Fargo to change my home address. They texted me a code to read it back to them to confirm my identity. Their standard text messages for auth codes say: Wells Fargo will NEVER call or text you for this code. DON'T share it. Enter code 123456 online to send $1.00. Their verification text said: Free Msg: Use Wells Fargo verification code 123456 to verify your identity. Reply STOP to stop msgs. Call 1-800-869-3557 if you didn't request this code.
    - underwater 5y ago
      It should explicitly say that the code is intended to be shared with one.
  - JumpCrisscross 5y ago
    > No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field If I place a large wire with my bank, they text me a code and ask me to read it back to them. Granted, I will only do that if I initiated the call.
curtisf 5y ago
In some cases, banks have trained us not to panic instead of taking time to understand what's happening. A while ago, I scheduled a wire transfer through Chase to go through the next day. While asleep, I got an automated call from Chase asking me to confirm that the wire transfer was placed by me. By the time I had woken up, my online banking and my bank cards had been shut off. This is not consumers fault. Everyone is used to banks not being completely impatient and expecting immediate responses. For some other example, by law, you only have two days after a transaction to respond to fraud, or else you could be looking at $500 lost instead of $50. Not immediately answering the phone could make a difference of $450!

by ljm 5y ago

krebsonsecurity 5y ago

I agree with your point about not acknowledging these scam attempts. Just wanted to point out the "fight back" bit of the story was advice for people who've already been victimized and are being told their bank won't cover the loss.

SavantIdiot 5y ago

I'd be really curious to know how many people actually answer calls they aren't expecting, on their personal phones (e.g., non-work phones where you must answer customers). I bet that graph is U-shaped of % of people that answer unknown messages vs. age. Kids want to be social, and old people don't know any better. With salty Gen-Xers in the middle. 99.99% of the time I let it go to voicemail. I have since the days of cassette-tape answering machines. The only time I don't is if some just texted and said they are calling. Even when my insurance company hold line asks if I want a callback, I'm too paranoid that a scammer could have infiltrated the callback process.

chillwaves 5y ago
I just realized I can keep my phone on DND 24/7 and it's wonderful (rings for contacts only). The bonus of it only ringing for your contacts is that when your phone does ring, you know it's something relatively important. Completely changed my relationship with my phone.
perl4ever 5y ago
>I'd be really curious to know how many people actually answer calls they aren't expecting What do you do when your counterpart won't answer their phone? I answer calls I'm not expecting when I'm expecting a call. Like from a plumber, a recruiter, a paving company, etc. If I don't, at best I get to play phone tag, and at worst, the other person gets ticked off and I lose an opportunity. I don't like leaving voice mail, particularly the second or third time. It would be nice if everyone legit had their main number show up to identify them, and it would be nice if they all answered their phone all day, but they don't.
- jrnichols 5y ago
  I'm a Paramedic here in Northern California and we recently went on a welfare check to an apartment - us, fire dept, and law enforcement - for a family that could not get ahold of their grandmother. Grandma was fine, fortunately, and she simply turned her phone off because it was ringing constantly with scam phone calls. She was sick of the auto warranty spam all the time, so she unplugged entirely. The elderly are the ones that still have landlines and cell phones too, so they often get hit multiple times. It's harder for them to disconnect the landline due to things like Life Alert requiring a landline.
  - maxerickson 5y ago
    Medical alert devices that use cellular connections are widely available. There going to be areas where coverage is poor, but for many people, working out of the home is going to be a considerable improvement.
    - jrnichols 5y ago
      They are widely available but not as common. We will run on 2-3 lifeline calls a day sometimes and while resetting them, we rarely see a wireless one.
  - perl4ever 5y ago
    I got a call recently about my student loans. It was...erm...remarkable in its high production values. Even compared to the auto warranty ones, which I don't get often, but every now and then. I also got a "hello...hello...hello" call, and seven hangup/no message calls the same afternoon. I assume the call I answered was a scammer, but a few months ago, I got one just like that and it turned out it was from my physician's office, and I had some trouble getting ahold of them.
ljm 5y ago
I don't answer a single call unless I'm told to expect it, or I can antipate one coming (e.g. I ordered takeout and the delivery driver is gonna ping me, or I asked a recruiter to call me at X time). If the call comes out of nowhere, or if it's from a hidden number, then I'll silence it rather than declining (i.e. hit the power button rather than actually acknowledging the call, so it carries on ringing in silence until they give up instead of being told I'm busy). If it's important they'll leave voicemail or send an email.
suction 5y ago
Me too. I consider it rude to be called on my phone, actually, even by people I know.
deleted 5y ago
[deleted]

jonas21 5y ago

I don't think the issue is people being polite. It's that these messages look similar to the legitimate fraud alerts that credit card companies and banks send. What happens if you don't respond to those? Presumably, the transaction will be blocked -- but can you be sure? It would cause me a lot of anxiety not to resolve the issue right away.

paxys 5y ago

It's not about niceness. When you get a text about a potential scam there's an urgency to reply. And you can't just ignore it. All major banks send out official text messages to confirm large transactions. This has happened to me multiple times with Chase, and just recently I blocked a fraudulent ATM withdrawal using exactly the method outlined in the article (someone skimmed my debit card when abroad, I got a text from Chase when they tried to use it, I replied no, got a call from the customer service rep). Only thing missing was reading out the OTP, obviously, which I would not have done.

ohazi 5y ago
> Only thing missing was reading out the OTP, obviously, which I would not have done. This is the real red flag here. No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field.
- deleted 5y ago
  [deleted]
- chime 5y ago
  Last week I had to call Wells Fargo to change my home address. They texted me a code to read it back to them to confirm my identity. Their standard text messages for auth codes say: Wells Fargo will NEVER call or text you for this code. DON'T share it. Enter code 123456 online to send $1.00. Their verification text said: Free Msg: Use Wells Fargo verification code 123456 to verify your identity. Reply STOP to stop msgs. Call 1-800-869-3557 if you didn't request this code.
  - underwater 5y ago
    It should explicitly say that the code is intended to be shared with one.
- JumpCrisscross 5y ago
  > No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field If I place a large wire with my bank, they text me a code and ask me to read it back to them. Granted, I will only do that if I initiated the call.

curtisf 5y ago

In some cases, banks have trained us not to panic instead of taking time to understand what's happening. A while ago, I scheduled a wire transfer through Chase to go through the next day. While asleep, I got an automated call from Chase asking me to confirm that the wire transfer was placed by me. By the time I had woken up, my online banking and my bank cards had been shut off. This is not consumers fault. Everyone is used to banks not being completely impatient and expecting immediate responses. For some other example, by law, you only have two days after a transaction to respond to fraud, or else you could be looking at $500 lost instead of $50. Not immediately answering the phone could make a difference of $450!