5 ms·

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you d

by smeej 5y ago

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example. Make sure you're talking to the people you think you are. Otherwise they can phish all kinds of info out of you.

localhost 5y ago
I remember many years ago getting a random phone call from someone who claimed they were a detective investigating a case. The detective sensed my skepticism right away over the phone and suggested that I look up the phone number for his police department, and to ask for badge number ZZZ when I call. I called back, everything was above board, they came and interviewed me (they wanted to see if I still had something in my possession which I thankfully did), they made a mark on the item to indicate that they had seen it already and I never heard from them again. Though I wonder if they ever caught whoever it was that was using that item ...
- glenneroo 5y ago
  You can't drop a story like that on us and not tell us what "the item" was ;)
  - sweetbitter 5y ago
    I found a video of the GP: https://youtube.com/watch?v=3VlyZIywY9c https://youtube.com/watch?v=3VlyZIywY9c
- xwdv 5y ago
  All this could be faked, this could have been an elaborate scam.
  - deleted 5y ago
    [deleted]
  - gojomo 5y ago
    Yes, if the stakes were large enough, & the adversary sufficiently skilled/resourced, it is possible an impersonator could also intercept & redirect your call to "the police" – for example by compromising phone network systems or the police-department's switchboard. (Or, somehow corrupt your usual means of looking up that police number.)
  - folkrav 5y ago
    How could they fake the receiving end of the call of a legit precinct number without some massive resources lol?
matt_heimer 5y ago
So many callers get offended when you try to tell them that you aren't going to give you personal information to some random caller unless they can validate themselves first. And many times their direct call back number (if they have one) isn't the one published to the company website. I get the feeling that most people don't question them.
- mark-r 5y ago
  If someone can't prove who they are, I don't care if I offend them or not.
jontas 5y ago
It can even be a problem if you do initiate the call. My mom got taken in by a scam where she googled "American Express phone number" and a scammer's website or paid ad (she isn't sure which it was) was showing at the top of the results with the wrong number.
- soco 5y ago
  Yet another example of the often discussed "Google search results infestation"...
  - edmundsauto 5y ago
    Also possible if they gave malware on the computer, and it modifies search results in the browser. That’s always seemed like a serious vector although I haven’t heard much in the way of in the wild exploits.
    - b3morales 5y ago
      Computer malware + phone scam sounds like a remarkably targeted, technically broad, and labor intensive attack.
      - edmundsauto 5y ago
        It is, which means it targets higher net worth individuals. I just listened to a darknet diaries episode where they talk about how much these attacks cost to execute - some are $10-100k per target.
- weaksauce 5y ago
  that's why you only call the number on the back of your card if you can help it. and double check that you entered it correctly
grendelt 5y ago
This. A while ago, my wife got a call from a collections agency on my phone. They asked for her name, I asked "which one?" She said "I can only talk to ____." I said, "I understand but which one would are you looking for the older or younger?" "I can't share that information." "Then I can't put you in touch with who you're looking for if you can't tell me who you're looking for." "I can only speak with ____." I said "Ok, tell me the last 4 of her social and I'll know which one you're looking for." "That's private information, sir." "No, that's the public portion of a social security number. Tell you what, since you're learning how this works, I'll make it easy on you: I'll give you the first digit and you tell me the last. That way we both know we have the same 'protected information'. If I give you the wrong starting number or you give me the wrong ending number, we both know we have the wrong person." "I need to speak with _____." I gave her the starting number but she didn't budge. I finally said "okay, since you can't verify who you're looking for, I'm going to just tell you you have the wrong number. This is my cell phone, not ____'s. You may send a letter, but this is not the correct phone number for who you're looking for. Please, do not call me again." While all this was going on she gave me the name of the collection company which I was able to Google and determine it was a legit operation and located not too far away. A medical provider never got our correct address, but it just showed me how overly trusting some companies expect people to be. Nah, this is a two-way verification. If you're gonna call me, you need to give a little to prove to me you're legit.
- ceejayoz 5y ago
  > No, that's the public portion of a social security number. It really isn't.
  - abofh 5y ago
    Indeed, the first three are dependent on the state that issued your SSN, and the next two often are sequence bits roughly correlating to when it was issued. If anything, those are the public bits
    - 0des 5y ago
      They are not numbered by state anymore
noneeeed 5y ago
Also, if you were rung on a landline, ring back on your mobile. I'm not sure if it's always the case, but I believe that a call to a landline only terminates when the caller hangs up. This certainly used to be the case. This allows scammers to ask you to hang up and call them back on the number on your card (for example), but they just mimic the dial-tone and ring, then they have another scammer answer the phone. This is not an issue on a mobile.
- throwawayboise 5y ago
  Or if you can't use a different line or mobile phone, intentionally dial a different number, if it rings through to "the bank" then you know they have hijacked your line.
- hungryforcodes 5y ago
  I haven't seen a landline in ages...
  - jonsen 5y ago
    They are buried.
    - zeruch 5y ago
      Ah, puns. I dig it.
- alx__ 5y ago
  Ah yeah I remember that trick. If you didn't hang up after talking to a friend, you'd could "haunt the line". Works best if someone is waiting to use the only phone in the house. Which is a phrase you don't hear that often :D
  - xwdv 5y ago
    Ah, a ghost in the wire.
- 5y ago
BeefWellington 5y ago
> Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example. Make sure you're talking to the people you think you are. This is not foolproof either. In some older landlines even hanging up doesn't necessarily disconnect you. This means an attack works like: 1. Attacker dials their victim, alleging to be "Interpol", "VISA Card Services" or some other similar thing. 2. Victim takes this advice, "hangs up" and picks up and dials back. 3. After victim hangs up, attacker plays dialtone noise down the line, which they have not disconnected. 4. Victim picks up and "dials" the actual thing they want to be sure of, but is really just listening to a fake call the attackers play to them. 5. Attacker answers "Thanks for calling X". This isn't to my knowledge true of mobile calls but it's important to know it's not foolproof either. There's some discussion of that here: https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...

by smeej 5y ago

localhost 5y ago

I remember many years ago getting a random phone call from someone who claimed they were a detective investigating a case. The detective sensed my skepticism right away over the phone and suggested that I look up the phone number for his police department, and to ask for badge number ZZZ when I call. I called back, everything was above board, they came and interviewed me (they wanted to see if I still had something in my possession which I thankfully did), they made a mark on the item to indicate that they had seen it already and I never heard from them again. Though I wonder if they ever caught whoever it was that was using that item ...

glenneroo 5y ago
You can't drop a story like that on us and not tell us what "the item" was ;)
- sweetbitter 5y ago
  I found a video of the GP: https://youtube.com/watch?v=3VlyZIywY9c https://youtube.com/watch?v=3VlyZIywY9c
xwdv 5y ago
All this could be faked, this could have been an elaborate scam.
- deleted 5y ago
  [deleted]
- gojomo 5y ago
  Yes, if the stakes were large enough, & the adversary sufficiently skilled/resourced, it is possible an impersonator could also intercept & redirect your call to "the police" – for example by compromising phone network systems or the police-department's switchboard. (Or, somehow corrupt your usual means of looking up that police number.)
- folkrav 5y ago
  How could they fake the receiving end of the call of a legit precinct number without some massive resources lol?

matt_heimer 5y ago

So many callers get offended when you try to tell them that you aren't going to give you personal information to some random caller unless they can validate themselves first. And many times their direct call back number (if they have one) isn't the one published to the company website. I get the feeling that most people don't question them.

mark-r 5y ago
If someone can't prove who they are, I don't care if I offend them or not.

jontas 5y ago

It can even be a problem if you do initiate the call. My mom got taken in by a scam where she googled "American Express phone number" and a scammer's website or paid ad (she isn't sure which it was) was showing at the top of the results with the wrong number.

soco 5y ago
Yet another example of the often discussed "Google search results infestation"...
- edmundsauto 5y ago
  Also possible if they gave malware on the computer, and it modifies search results in the browser. That’s always seemed like a serious vector although I haven’t heard much in the way of in the wild exploits.
  - b3morales 5y ago
    Computer malware + phone scam sounds like a remarkably targeted, technically broad, and labor intensive attack.
    - edmundsauto 5y ago
      It is, which means it targets higher net worth individuals. I just listened to a darknet diaries episode where they talk about how much these attacks cost to execute - some are $10-100k per target.
weaksauce 5y ago
that's why you only call the number on the back of your card if you can help it. and double check that you entered it correctly

grendelt 5y ago

This. A while ago, my wife got a call from a collections agency on my phone. They asked for her name, I asked "which one?" She said "I can only talk to ____." I said, "I understand but which one would are you looking for the older or younger?" "I can't share that information." "Then I can't put you in touch with who you're looking for if you can't tell me who you're looking for." "I can only speak with ____." I said "Ok, tell me the last 4 of her social and I'll know which one you're looking for." "That's private information, sir." "No, that's the public portion of a social security number. Tell you what, since you're learning how this works, I'll make it easy on you: I'll give you the first digit and you tell me the last. That way we both know we have the same 'protected information'. If I give you the wrong starting number or you give me the wrong ending number, we both know we have the wrong person." "I need to speak with _____." I gave her the starting number but she didn't budge. I finally said "okay, since you can't verify who you're looking for, I'm going to just tell you you have the wrong number. This is my cell phone, not ____'s. You may send a letter, but this is not the correct phone number for who you're looking for. Please, do not call me again." While all this was going on she gave me the name of the collection company which I was able to Google and determine it was a legit operation and located not too far away. A medical provider never got our correct address, but it just showed me how overly trusting some companies expect people to be. Nah, this is a two-way verification. If you're gonna call me, you need to give a little to prove to me you're legit.

ceejayoz 5y ago
> No, that's the public portion of a social security number. It really isn't.
- abofh 5y ago
  Indeed, the first three are dependent on the state that issued your SSN, and the next two often are sequence bits roughly correlating to when it was issued. If anything, those are the public bits
  - 0des 5y ago
    They are not numbered by state anymore

noneeeed 5y ago

Also, if you were rung on a landline, ring back on your mobile. I'm not sure if it's always the case, but I believe that a call to a landline only terminates when the caller hangs up. This certainly used to be the case. This allows scammers to ask you to hang up and call them back on the number on your card (for example), but they just mimic the dial-tone and ring, then they have another scammer answer the phone. This is not an issue on a mobile.

throwawayboise 5y ago
Or if you can't use a different line or mobile phone, intentionally dial a different number, if it rings through to "the bank" then you know they have hijacked your line.
hungryforcodes 5y ago
I haven't seen a landline in ages...
- jonsen 5y ago
  They are buried.
  - zeruch 5y ago
    Ah, puns. I dig it.
alx__ 5y ago
Ah yeah I remember that trick. If you didn't hang up after talking to a friend, you'd could "haunt the line". Works best if someone is waiting to use the only phone in the house. Which is a phrase you don't hear that often :D
- xwdv 5y ago
  Ah, a ghost in the wire.
5y ago

BeefWellington 5y ago

> Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example. Make sure you're talking to the people you think you are. This is not foolproof either. In some older landlines even hanging up doesn't necessarily disconnect you. This means an attack works like: 1. Attacker dials their victim, alleging to be "Interpol", "VISA Card Services" or some other similar thing. 2. Victim takes this advice, "hangs up" and picks up and dials back. 3. After victim hangs up, attacker plays dialtone noise down the line, which they have not disconnected. 4. Victim picks up and "dials" the actual thing they want to be sure of, but is really just listening to a fake call the attackers play to them. 5. Attacker answers "Thanks for calling X". This isn't to my knowledge true of mobile calls but it's important to know it's not foolproof either. There's some discussion of that here: https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...