38 ms·

I'm a scam prevention expert and I got scammed

• unixbane 5y ago
  > When discussing scams and social engineering attacks, it's easy for security researchers and experts to present information in a way that implies the victims of these attacks should have known better. Uhhh, when I see any SE I assume it happened because the user / customer is making use of a giant beuracratic system and nobody knows how it works and what is supposed to be private data and what data needs to be sent where, along with government pointing gun at you to send 5 pieces of ID all over the place ASAP without you ever understanding which ones are needed for what purpose. The very reason these broken, impossible to understand systems exist everywhere is because "the user is too dumb, stop being elitist". Imagine if you logged into runescape and instead of entering user / pass, it said you need to have your IP address authorized, then you need to get a runescape license, then they need a picture of your iris. But you also sent your iris to some pizza shop to "prove" you own your house, and you have no idea what steps that pizza shop took to secure your iris photo (none). Then to get your IP "authorized", runescape tells you to login to some weird website you've never heard of before, and send it two pieces of photo ID (which you also sent to a paint shop to order paint), and then that website says "please give us your phone number so you can open our secure phone app", and then you open the "secure phone app" and you have no idea what it just did or what data was sent where or what data about you it just assumed you're now supposed to keep secret. I don't know, is this concept like not obvious to internet people? It's called ungroundedness. The reason I'm writing all this without burning my eyes on this stupid color theme, is because whatever typical bullshit narratives HN will prop up as usual in response to this article here are completely invalid. This classic "boo, hoo, you're an elitist" talking point is irrelevant nonsense because in most cases the user hasn't been tricked; he hasn't been provided with a system that allows him to use it properly. But oh wait I just wrote about this last week as the cliche was made again then. I actually WANT a system that makes "elitists" secure and doesn't care about unqualified people (and I know lots of people who also want this, it's what UN*X users like to think of themselves as): https://news.ycombinator.com/item?id=30780519 https://news.ycombinator.com/item?id=30780519
• fourthark 5y ago
  until he got to the payload of the scam, it was honestly a smoother and more positive and helpful call than any legitimate interaction I've ever had with Wells Fargo (which, in and of itself, probably should have registered as suspiciously too good to be true lol
• throwaway16374 5y ago
  The amazon rep is a scam. Amazon would not waste their time to do a 3-way call with a technician. They always provide you with a refund or direct number if you ask... but that direct number is usually searchable. The fact that they 3-way call suggests they wanted to hide the phone number
• tony2016 5y ago
  This guy is a 'security' expert and doesn't have MFA set up with his bank!? No one can log in into you account unless a code is entered.
• woah 5y ago
  Easy way to avoid this: don't answer the phone
  • nonrandomstring 5y ago
    I think the movie was Phone Booth that begins with the line "A ringing phone demands to be answered" Technology projects a form of authority (disconnected from any real power) in the same way that written words were synonymous to truth for illiterate 13th century peasants. To follow your logic, which I am not criticising as it's a valid approach given how dysfunctional cellphones are as trustable systems, I would say it's better not to have a phone. But there's the road to living in a woodland shack and eating spider and squirrel broth.
    • akeck 5y ago
      The rule in our family for a number of years now has been, "If the number is not in your address book, let it go to voicemail." We have the landline ringer off and always let it go to voicemail. As an 80/20 solution, it's been remarkably effective so far.
      • alana314 5y ago
        The scammer spoofed the wells fargo customer service line in caller ID though.
• troon-lover 5y ago
• nonrandomstring 5y ago
  This is a perfect case of iatrogenic security. When the systems get so complex and remote that security experts are caught out, they do more harm than good. It's also a consequence of solutionism, systematic monotonicity, mother-knows-best and externalising costs such that we: Only add more security solutions on top of existing ones to fix their holes. Deny the user any choice or agency in setting their own security terms Never revoke or remove a feature (that would be admitting defeat) Push the burden in every process on to the user Create fear in the user - that any misstep will cause them more inconvenience and trouble. Make security an authoritarian culture such that user will not question or be sceptical. All of these are antithetical to civic cyber-security that we need available so educated and empowered users can operate technology under their control.
• rolobio 5y ago
  I nearly got taken by a scammer because Amazon transferred me to one. I purchased a set of Reolink cameras on Amazon, (they've been great) one of them failed a couple months in. I contacted Amazon customer support (via my Amazon login and in their interface) and they wanted to troubleshoot with their technical team. Eventually the (very helpful) Amazon technician suggested contacting Reolink for support and started a 3-way call. The "Reolink" technician got my phone number and then said they wanted to call me back. They called me back a minute later (now without Amazon recording the conversation) and asked me for my NVR's serial number so they could connect to my NVR. I was shocked they had a backdoor into my NVR but I figured I'd let it play out. A minute later the technician said that he was having trouble connecting because "an internet virus is corrupting my firewall". I was extremely confused and thought it must be a translation problem. Until he kept insisting it was a problem and became belligerent and angry. He said I needed to pay $300 to have an on-site technician troubleshoot the problem. I got angry because he was making some weird excuse for their camera not working, and wanting to charge me rather than just ship me a replacement. I refused and he started mocking me. I demanded his manager and he ignored me. Eventually I hung up and called Amazon back. The Amazon technician was helpful and shipped me a replacement. I contacted Reolink via email to complain about their technician. They responded that they have no on-site technicians and that it was a scam! I was blown away that Amazon would transfer me to a scammer. I contacted Amazon again and let them know what had happened. Hopefully they will figure out how their guy got this scammers phone number and teach him how to find a 3rd party phone number...
  • Nextgrid 5y ago
    > I was blown away that Amazon would transfer me to a scammer. I contacted Amazon again and let them know what had happened. Hopefully they will figure out how their guy got this scammers phone number and teach him how to find a 3rd party phone number... 1) Amazon is complicit in shady behavior on their platform, whether it's inventory commingling, sketchy sellers repurposing existing, well-reviewed listings for a totally different product or those bribing customers to leave good reviews with gift cards or free stuff. 2) The tech support number could very well be provided by the seller, and you could've bought the camera from a listing from said seller instead of the real Reolink (if the "real" Reolink even sells on Amazon to begin with). Maybe tech support scammers are now using this as a new lead-generation tactic ("legitimately" sell a high-maintenance product but scam anyone that calls for support?).
• iratewizard 5y ago
  This speaks more to the incompetence of supposed experts and less to the sophistication of scams.
  • myfavoritedog 5y ago
  • BenjiWiebe 5y ago
    Agreed. I wish someone would try this level of attack against me - I'm 99% sure I wouldn't have fallen for this particular one, but how can I truly know without going through it? Anyways, I am extremely aware of caller ID spoofing. I use it myself to show a usable callback number on a VoIP outgoing-only line. And the 2FA - I would be incredibly reluctant to give a code over the phone, even if I had initiated the call.
    • benji-york 5y ago
      Sounds like a product idea: Red team for the family
    • Sebguer 5y ago
      I honestly got this exact same scam happen to me, and probably came 50% of the way through falling for it. Especially since it happened just a few weeks after I had actually had my card compromised, and used for fraudulent transactions. I got the same text about "confirming fraud transactions" and then a phone call from "my bank". I nodded along at his script for a few seconds, before I remembered the constant, unending advice of: "if your bank calls you, hang up and call back on the fraud number listed on your card". I told the person I'd do exactly that, and hung up. I then checked my card account and confirmed that there actually weren't any fraudulent transactions, so didn't bother calling. That said, I can absolutely see a world in which a tired or otherwise frustrated me would just follow along the script, and with a similar background to the author (I'm not a security professional, but I work in fintech and on security-adjacent things): > I also find it entirely plausible that Apple (or Google) would require a bank to jump through these kinds of hoops in order to remove a fraudulently-added payment method from someone's account, and that Wells Fargo's system would be so janky and sloppily-built that this is the least awful way they could figure out how to do it. This honestly resonates with me as a plausible thought path. I'm pretty confident that I wouldn't have actually provided the two-factor code, but again, everyone has off days, and everyone makes mistakes. That's the core of all of this, that endless refrain: defense has to work 100% of the time, offense only needs to work once.
• buscoquadnary 5y ago
  Security theater. I had a situation where I had to buy something online from a company in Europe (owl4thunderbird) I placed the charge and then right after I got a text telling me to call a # for a possible fraud alert. That's a big red flag there. So I try and find the phone # of the fraud dept of Citi because anyone can send a text message. Turns out can't find it anywhere in the official Citi site. So I finally give up and call the phone # before they could go further they asked me to confirm a 2FA they would text to me. At that point I noped out and decided if it was a realt problem I'd find out about it another way. The problem is I now know how easy it is to break into any Citi account just send them a text with a # and pretend to be the bank. The worst part is every every every message I get that is actually being secure always says "You will never be asked for this code" and everytime they ask for it. It is security theater of the worst degree by incompetents and MBAs and I am getting sick of it.
  • Loughla 5y ago
    >It is security theater of the worst degree by incompetents and MBAs and I am getting sick of it. It's security theater giving people exactly what they want. People want to feel secure, but they don't want any amount of actual difficulty in getting what they want from Company A. Like it or lump it, but regular people really don't want actual security. They want the ease and convenience of no passwords at all, and want someone to blame in case something goes wrong.
    • rhizome 5y ago
      Of course people want security, how can you say otherwise? What you seem to be talking around is that security researchers have been unable to figure out simpler forms of maintaining a true sense of security, simpler forms of reliability. There is no survey where people say they don't want these things, and if you're relying on the sales figures for Yubi keys or something, that's not a good indicator. And of course people don't want difficulty! That's why we don't hand-crank to start our cars anymore. Blaming people for wanting faster horses[1] is a convoluted anti-intellectualism where the experts who actually know what's possible are let off the hook. All in all, if you ask me this should be a locus of UI/UX research. 1. https://hbr.org/2011/08/henry-ford-never-said-the-fast https://hbr.org/2011/08/henry-ford-never-said-the-fast
• kmeisthax 5y ago
  These 2FA bypass scam calls genuinely unnerve me - because they're specifically designed to trick someone who knows how scams work and has actually put some effort into securing their accounts. Hardware authentication factors are, of course, immune to these sorts of attacks because you can't confuse the victim into forwarding their second factor back to you. However, I don't see why you couldn't construct a specific scam setup for those.
  • GTP 5y ago
    But they could still try to trick the victim into reading the code for them.
  • unixbane 5y ago
    Why are you talking about hardware? Just get rid of these weird snakeoil auth flows and make user / password the be all end all way to authenticate. If there's a problem with that, well there isn't. No company on earth has ever tried it, not even in the 90s.
• gnicholas 5y ago
  > He verified my name, he had the last four digits of my debit card number, and everything generally seemed to follow the normal script of a transaction verification call There's a red flag right there — I've never found a bank willing to provide any verification of who they are when calling me. They call me and ask me to give them a code or card number without providing me with any proof of their identity. I've tried to get them to give the sum of the last 4 numbers of my account, but they won't do it. They always tell me to just call back using the number on my card and try to find my way to the right department. Super annoying.
  • hunter2_ 5y ago
    > sum of the last 4 It's a chicken/egg problem of not wanting to give information first, but a one-way function (hash) is a fantastic idea. The collision possibilities in this particular function are worrisome, though.
    • onaworkcomputer 5y ago
      It'd be unreasonable to ask someone to perform a hash of those last four digits (how would your mom respond if the bank asked her for the sha256 hash of her card number?), but it could be helpful to ask questions that don't reveal too much information, like, "is the sum of the last four digits even?" or "is the sum evenly divisible by 3?" It would be difficult to come up with something you could reasonably ask an account holder to figure out on their own that also wasn't easy to randomly guess.
      • hunter2_ 5y ago
        For sure. I wonder what the state of the art is in human-friendly challenges.
        • Zachsa999 5y ago
          Please select pictures containing a boat.
• katsura 5y ago
  Reminds me of the Darknet Diaries podcast episode 69: https://darknetdiaries.com/episode/69/ https://darknetdiaries.com/episode/69/ Off topic: The site has a contact form and a login page, but no https?
• dade_ 5y ago
  Not much of an expert, caller ID means nothing. Standard procedure for everybody in the last 20 years should be: Whenever I get a call about security or fraud from the bank, I thank them for the notification and tell them I will call them back, and hang up. Then I call the number on my credit /bank card, not the number I was called from. Fortunately there is a lost or stolen cards so there is no queue time and tell them I received a fraud alert notification.
  • mekoka 5y ago
    Simple and effective. It's been over 10 years that I've followed this same protocol. It hasn't failed me yet. I also don't think I've missed anything that could have been better handled, had I chosen to speak to the caller. Just don't say anything, beyond greetings, to the caller.
  • BaseballPhysics 5y ago
    > Not much of an expert, caller ID means nothing They... said that: > The caller ID showed the correct name and number for my bank, but caller ID data is so hilariously easy to spoof that it might as well not even exist. Honestly, what is with the low quality comments attempting to undermine this person's credibility?
    • mardifoufs 5y ago
      So what if they said that? I'm not trying to pile on them but the reason people are questioning their credibility is that they fell for a pretty basic scam. Even if they acknowledged that their assumptions were incorrect (knowing Caller Id is very flawed but still falling for it), it doesn't necessarily make the scam any less obvious. Would you not question the credibility of a doctor who falls for say, crystal healing or homeopathic cures?
      • BaseballPhysics 5y ago
        > I'm not trying to pile on them but the reason people are questioning their credibility is that they fell for a pretty basic scam. Yeah, I've read the armchair quarterbacks around here thinking they wouldn't be the ones to get duped if it was them. Of course, I'll bet if they did get duped, they wouldn't post about it on social media because a bunch of folks would come out of the woodwork to point out how stupid they were. Personally, I read this accounting and thought "You know, for all my own knowledge about how these scams work, I might've been caught by this one." This specific example strayed into spearphishing territory given the knowledge the attacker had of the victim. This wasn't just an average war dialler. And the time investment, alone, on the part of the attacker makes this unusual compared to your average phone same. But hey, maybe I'm just not bright enough to hang with the cool kids around here.
• whimsicalism 5y ago
  Just don't give people 2FA codes? I am never going to give a 2FA code to someone who calls me, no matter what combination of words come out of their mouth.
  • jcoq 5y ago
    Right? There's nothing surprising about getting scammed when you give out the 2FA code.
  • throwra620 5y ago
  • iforgotpassword 5y ago
    As TFA starts out, it is always easy to point out all the mistakes after the fact. People underestimate how prone the mind is to just trying to play down danger, inconvenience and generally unpleasing situations. Even after a few minutes on the phone, after you built up the most basic "relationship" with the person on the other end, you simply don't want this to be a scam. Avoiding cognitive dissonance. Just like when you bought something expensive that doesn't really meet your expectations. Then you must not underestimate the pressure under which you then are, because either way is not a pleasant situation (getting scammed or having been scammed already trying to contain the damage). I fully believe the author that they only skimmed that mail and weren't even aware that this is 2FA. It must have seemed like "just some one-off verification code". Then I think there is also this phenomenon where experts think that just by being an expert on something, they are immune to it. Not consciously, rationally, but lingering in the subconsciousness. It reminds me of the show "the good doctor" where a seasoned oncologist is diagnosed with a brain tumor and completely blocks off any conversation about it and rejecting treatment. I think that very well illustrates what I mean. Another anecdote to add here if that Jim Browning, a YouTuber focused on finding scam call centers, getting into their systems to gather information and shutting them down in the end got his YouTube account taken away from him through a scammer on the phone. So I'd be careful with claiming this could never happen to me because I'd never do X. Until the day you do without realizing.
    • 5y ago
• klik99 5y ago
  There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info and call back the official service number. It annoys the caller sometimes, despite always treating them professionally, but I keep that a hardline rule no matter how real it feels. I heard this from a security guy and was under the impression it was one of the sacred laws of security. If it's not, it should be - it's a rule of thumb that would stop 90% of social engineering attacks I hear about.
  • zamkam 5y ago
    "never give out any info on incoming calls". 100% agree. It's such a simple rule that I don't understand why it's not part of everyone's DNA. Should be taught at home and in schools, same as "look both ways before crossing a street".
  • cjg 5y ago
    Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, etc. My neighbour then did whatever the scammers said - because they couldn't possibly be scammers.
    • ghostly_s 5y ago
      Your neighbor just dialed the new number without hanging up first?
      • AdamTReineke 5y ago
        I could see this working if the other end played a click followed by and dial tone sound.
• nopeYouAreWrong 5y ago
  I'm so skeptical of these "experts" especially if they write a blog post where they hate their bank. I've been with Wells for over a decade. They have never called me. Never. I have had "fraud" alerts hundreds of times. They always happen at certain POS, and it's always a text alert. Some of the stories I read make me viscerally react with "what in the world are you doing with something as simple as a bank account?" Also a fundamental default is "no action". If you are even slightly suspicious, do nothing. It isn't somehow so important that you stop thinking and just act or react. Just stop.
  • buscoquadnary 5y ago
    My wife used Well's Fargo, I've heard about how they don't like to bother customers, in fact they hate it so much they didn't even bother notifying customers when opening new accounts for them, or performing actions on their behalf to generate fees.
    • civilized 5y ago
      Also, no one asked for the account to be opened or for the fee-generating actions to be performed. (They're still not out from under that Federal Reserve asset cap!)
  • ghostly_s 5y ago
    > I'm so skeptical of these "experts" especially if they write a blog post where they hate their bank. There is a nearly endless list of legitimate reasons for one to hate Wells Fargo.
  • mattbee 5y ago
    The author does seem to bang on about his "reasonable assumptions" for how much Wells and Apple Pay suck, so he should continue the call! Like he's just too clever to follow the advice he'd give everyone else to hang up and call back.
    • spicybright 5y ago
• otterley 5y ago
  Scam reports like these really frighten me. If someone of above-average intelligence like the author can nearly be taken for a ride, imagine how easily our friends and family -- who are often far more vulnerable -- can be taken advantage of. As the people most capable of remediating the vulnerabilities in our telecommunication and banking systems, I think we ought to close ranks and insist that our employers do a better job of protecting the innocent, even if it means breaking a few conveniences.
  • jstarfish 5y ago
    > imagine how easily our friends and family -- who are often far more vulnerable -- can be taken advantage of. FUD. Hackers and scammers exist, sure, but your friends and family are always most likely going to be victimized by friends and family. Outsiders have to work to collect intelligence, gain access and obtain your trust. Friends and family already have all three prerequisites. Bernie Madoff didn't become the most prolific con-artist in history by cold-calling strangers. And consider what demographic is most likely to try recruiting you into the latest MLM scheme.
    • otterley 5y ago
      I'm not exactly sure how what you said contradicts my comment. Threats from families are "in addition to," not "instead of."
  • AnIdiotOnTheNet 5y ago
    Why do you assume the author is of above average intelligence just because they work in a technology profession? I work in this industry, and I've met a lot of people even dumber than me in it, so intelligence can't be much of a requirement.
    • otterley 5y ago
      I'm not assuming she's of above-average intelligence because of where she works. The quality of her blog post speaks for itself.
• deleted 5y ago
  [deleted]
• anonymousisme 5y ago
  I had a legitimate call from my credit union last month. They were following up on a problem I had reported with their on-line bill pay system. Toward the beginning of the call, they wanted to verify that it was me and they asked me to provide them with the 2FA code they had just texted to me. I declined and told them that this is what scammers do. They agreed with me and encouraged me to call them back at the number on my ATM card. I thought it was really unprofessional of them to operate this way.
  • harshreality 5y ago
    It's insane for them to request that you read a 2fa code to a human over the phone. Even if you called them. Escalate and get their policies changed, or get them fired if they're violating policy.
• deleted 5y ago
  [deleted]
• sevenf0ur 5y ago
  I have to give credit for sharing your story and how sophisticated these attacks can be. These scams work because we're human and don't always think rationally under pressure.
• deleted 5y ago
  [deleted]
• vmception 5y ago
  > if it was a scam, then this was clearly a bluff to try to reassure me, but he had WAY more information about me than I would expect an average scammer to have you can purchase FULLZ from darkweb marketplaces, these contain name and address and social security number and often come with credit card details too with that, you can do social engineering like this, you can also remote desktop into any computer nearby to their zipcode (from a different darknet marketplace of compromised computers being rented out) and purchase things online from that, making it less likely to be flagged the idea that "scammers intentionally do obviously red flag things to weed out discerning people and just target susceptible people" is just one segment of the market. doing smarter more cunning things is entirely available and entirely lucrative
  • boznz 5y ago
    Be interesting to do a lookup on yourself, is there any information how you go about this ?
    • vmception 5y ago
      I mean you could try to find the large known leaks and go through them yourself People just cross reference them and sell individual ID packs one by one There were 15,000,000 people in the Experian leak alone. Most of that information is still valid, we've just gotten numb to it. Merchants that care about customer support and reviews will just replace an ID for the consumer if its been used before There isn't a way to try to find who is in a database without the source databases yourself. Merchants don't tell you how they found the aggregate data, they just have reviews from people that say if it was accurate data or not. You could try and ask a merchant if they have a particular person, but I doubt many merchants have a way to sort that themselves, as the files are no longer in a parseable database by the time it reaches them. The organized networks are corporations and conglomerates with separations of knowledge and duties. All you would be able to do is purchase a FULLZ and get what you get.
• smm11 5y ago
  Expert.
• throwaway1777 5y ago
  Sounds like they’re not an expert after all, never give out information over the phone unless you initiated the call.
• orkj 5y ago
  > And lastly, if you're reading this, Daniel Coffmane #1687979, whoever you really are: Well played. I went to read the comments here to see if Daniel somehow acknowledged this
• paxys 5y ago
  I expected some crazy new attack vector that was so sophisticated it could fool this Scam Prevention Expert, but this post is laughable. They fell for textbook "scamming 101" that my grandma knows to avoid. Here's one tip for this expert – if you get a 2FA code over text or email that clearly has the line "we will never contact you for this code over phone or text" right under it, DON'T give it to a "support agent" over the phone. > this is clearly a two-factor authentication code, meant to be entered directly into an authentication page. Which is normally not something that would be relayed over a phone call to a customer service rep. A concern that I raised to Daniel. However, he said that it was part of Apple's system, which they only had limited access to. An explanation that, as someone who works with computers, data security, and API integration professionally, I completely bought And after reading multiple paragraphs of this person describing money literally taken out of their account in front of their eyes, you get to this line: > Putting all of this together, the scales started to tip toward this potentially being a scam call, but I still wasn't certain I really hope they don't have a lot of clients
  • feoren 5y ago
    I agree. I nodded along to the part about not assuming it's the victim's fault, and then this "expert" falls for an extremely basic, obvious attack. "Wells Fargo will not contact you by phone or text to request this code." -- maybe that should have been bigger and bolder, but it was there. This guy should not be allowed to call himself a "scam prevention expert" anymore.
    • mort96 5y ago
      There's a lot of text in that e-mail. The text you're referring to is perfectly positioned to be almost invisible -- it's in the last paragraph intermingled with the standard "if you have any questions, call us on blah blah blah" text. My brain skipped the rest of that paragraph the first 5 times I skimmed the e-mail.
      • mdavis6890 5y ago
        Does a "scam prevention expert" really need to read that fine print to know not to provide a one-time code to an inbound caller?
• interfixus 5y ago
  Caller would have gotten about five seconds worth of my time: "That's very nice. Please send an email. Goodbye". But then, I'm not an expert.
• stretchwithme 5y ago
  Why would an expert on scam prevention answer the phone?
  • system2 5y ago
    Turns out our scam prevention expert wasn't an expert at all. She poorly titled herself without proper knowledge of security field. Probably a curious person but not trained in this field at all.
• A7med 5y ago
  "EXPERT"
  • TheHypnotist 5y ago
    That's all I could think. This guy sounds like a typical person prone to scams. Expert my ass.
    • system2 5y ago
      Not a single reader in this forum thinks she is an expert. Let's not hurt her feelings further with insults. She probably knows she isn't an expert, it is just a title she came up with, randomly?
      • ichugwindex 5y ago
        Randomly? No, it was deliberately used to make this article clickbait. Its not that fascinating when a normal person gets scammed. She scammed us by telling us she's a expert when she's clearly not.
• simoneau 5y ago
  I'm surprised at the level of scamming we tolerate as a society. As technologists, we have a good chance of not falling for it, but my parents are sitting ducks. Some combination of new consumer protection laws, infrastructure improvements, and law enforcement attention is desperately needed. I don't know why this doesn't get more attention. Is it just the historical attitude that each of us are responsible for protecting ourselves? Is the line too blurry between a legit business and an outright scam?
  • smoovb 5y ago
    Many of these scammers have made it their life long career. It can become an addiction and driven by the big easy money wins of a successful scam. Imagine doing this for a while - you're unlikely to have many other career options. Not sure this ever gets rooted out of society.
• tempestn 5y ago
  I wish the title hadn't given away that it was a scam call. Perhaps it could have implied it was a gripe about Wells Fargo at first. Reading it while already knowing it was a scam, it seemed blindingly obvious to me, and it was hard to imagine how I could have made the same mistakes. But that could be overconfidence.
  • ziml77 5y ago
    Yes it is overconfidence. You just have to be tired or distracted and it will be incredibly easy to fall victim to one of these scams.
• sshine 5y ago
  I was never attempted scammed online, and I think (naively like the author) that it wouldn't happen to me. But I was pick-pocketed twice in my life. Both failed attempts, but only because of dumb luck. And I thought that would never happen, "because I'm that much present always." One time I'm wearing a hoodie, and a cheery guy distracts me and sticks his hand into a double-ended pocket and my hand, resting in the other side, instinctively grabs his; a trigger-happy hand-shaking mechanism and a bad choice of pocket. I quickly walk off because his grumpy friend looks like someone who would stab you. Another time I'm running for the bus, my phone is thrashing forth and back in my pocket, so while running, I quickly grab the phone and stick it in another pocket; two seconds later, a young guy bumps into me, and his hands reach all the way down in the now empty pocket. We land, we stare at each other, and I run for the bus rather than him; I'd have no chance catching him anyways. So... with some humility: The only way to stay out of trouble is to apply really dumb protocols.
• throwawayHN378 5y ago
  “Expert”
• dangus 5y ago
  The author ("scam prevention expert") was extremely uncomfortable at multiple points in the interaction and just...kept going. I know that this scam is relatively sophisticated compared to others, but I have to think if I was a scam prevention expert that I wouldn't tarnish my own name by putting a story with this much raw honesty out there. They basically violated rule #1 of scam avoidance which is that no legitimate business cold calling you will need you to do anything with urgency. Either that or it's a way to make potential customers feel better about the obvious mistakes they made.
  • aldebran 5y ago
    I think you missed the point. They said circumstances can make it such that you can get scammed so let’s not blame the victim.
  • rollcat 5y ago
    > I have to think if I was a scam prevention expert that I wouldn't tarnish my own name by putting a story with this much raw honesty out there. I think it's an absolutely excellent story to publish. The road to becoming an expert in any field or art is paved with failures, and your own failures tend to be the ones you learn the most from. Plus in a field that primarily deals with dishonesty, being this transparent does help build a positive image.
  • Mawr 5y ago
    > but I have to think if I was a scam prevention expert that I wouldn't tarnish my own name by putting a story with this much raw honesty out there. I wouldn't consider sweeping one's mistakes under the rug a virtue. Quite the opposite - I think it shows integrity. > They basically violated rule #1 of scam avoidance which is that no legitimate business cold calling you will need you to do anything with urgency. There's an overlap between legitimate but dysfunctional systems and very sophisticated scams that can make telling them apart almost impossible. The author points this out repeatedly - is this a super sophisticated scam or are the bank's systems just that bad? For example, other commenters in this thread have pointed out instances where their banks would ask them for information that they should never ask for.
• js2 5y ago
  > Said he was calling from Wells Fargo's Fraud Prevention Department, calling to verify some transactions. He verified my name, he had the last four digits of my debit card number, and everything generally seemed to follow the normal script of a transaction verification call. I recently had to speak with the Zelle FPD because it had frozen my ability to send (but not receive) after I had made some small trial transactions. Also, I use a Google Voice number with Zelle, which Zelle seems not to like. I was shocked at the depth of questions that the Zelle FPD agent asked me. My SSN, DOB, address and recent transactions were expected. But then it went deeper: state where my birth certificate was issued. Fine. Car loans I had. Okay, this is all stuff on my credit report. But then it went past me: where my kids were born and their DOBs; my brother's DOB and age; my wife's DOB and age; my mother-in-law's (!) maiden name. Keep in mind this all after I've authenticated myself to my bank including a phone password I have setup. And, it's for a secondary checking account that I have less than $1000 in. Real bank FPDs have a crazy amount of information on not just you, but also your family members. I personally would hang up if any of my financial institutions called me and I'd call them back.
• luckyorlame 5y ago
  Define expert?
  • system2 5y ago
    I wonder KrebsOnSecurity would write something like this.
• Anechoic 5y ago
  There was one time I thought I was being scammed, but it turns out there was an actual issue with my bank account. Sitting at my desk at work, I get a phone call from my bank on by cell phone. "Mr. Anechoic, there appears to be a security issue with your bank account. We can resolve it for you. For security purposes, can you give your checking account number and the last four of you SSN"? This is clearly a scam, right? I tell the guy there is no way I'm giving up that info for a random dude that calls me. He stresses again that there is an issue with my bank account, that the account will be frozen, and there is nothing he can do about it without the account and SSN information. I refuse again, and he tells me that I should go to a local bank to get it resolved. I hang up and go back to work. I log into my bank account website, and all seems fine. After about 20 minutes, something is still bothering me, so I leave work to go to a local branch. I speak to a branch manager about what happened, and she agrees with me that it was clearly an attempted scam and the bank would never call me and ask for that information. But just to be safe, she checks my account on her computer. To our surprise, it turns out there was a security flag on my account! She calls the bank security desk, they confirm that there was an attempt by someone in another branch a few states to get money from my account and the call I got was legit and logged in their system. We get the account locked out, and then the manager asks to talk to a security supervisor about the messed-up way they reached out to me. The security person basically said "this is how they do things" and didn't see the problem. The bank manager apologized, said it was messed up and she would try to run things up the chain to improve their process. Damned if you do, damned if you don't.
  • alana314 5y ago
    That's so dumb! No wonder the industry is rife with scams.
  • exolymph 5y ago
    Not the same thing, but relatedly, every legit email I receive from my health insurance is functionally indistinguishable from phishing. They always bounce me through a million weird domains too. It's very discomfiting and makes me worry that I won't be able to pinpoint a legit phishing attempt because it won't stand out.
• googlryas 5y ago
  > So, I faithfully relayed the Apple Pay verification code, as requested. I cannot fathom how a tech professional would do this. I mean, I read their justification, but it still doesn't make an ounce of sense to me, other than their brain was shut off for the entire call.
  • renewiltord 5y ago
    I think I can kind of get it. This guy has made his own life so complicated that he no longer knows what a normal guy operates like. A normal person knows that scam calls come in all the time, so they're on the alert for them. A normal person has their MFA device or has MFA on text and they know these two mechanisms have codes they should never relay. If they got an MFA via email they'd immediately have their suspicions up. A normal person, through the normalcy of their system, assumes that if this bank is having trouble dealing with them they'd have trouble dealing with everyone and that's just absurd. But if you're the _abnormal_ person, then you assume your custom setup is the problem. That's because 99% of the time it is the problem. He's fucked himself into being a social engineering target. Back in the day, this was a thing with Linux. You'd encounter a bug in a Windows app hosted through the WINE runtime and you'd think "Well, it's WINE, it can't be perfect. I'll just report it on WineHQ and go about my life". Well, sometimes it wouldn't be WINE. It would just be the app itself. But you assumed that because you're the weird one using WINE. Everyone else is using Windows. So you blame your own setup and your bug doesn't get fixed because it's in the wrong place. So this is my attitude to a lot of security stuff. I want to be the normal user. Huge advantages: - If something is broken for you, it's broken for everyone. So no one will blame you for consequences. - If something is weird about it, it's weird; you should be suspicious - If things go badly for you because of it, no one will blame you because they can relate; you will get help easier
    • mort96 5y ago
      > A normal person has their MFA device or has MFA on text and they know these two mechanisms have codes they should never relay. If they got an MFA via email they'd immediately have their suspicions up. What? I get MFA codes on e-mail all the time. I've got them from Steam, from Mojang, from GitHub, from Square Enix, from Digital Ocean, etc. For a normal person, getting some code you have to relay to some other entity via e-mail is normal. Not to mention that the e-mail was actually a legit 2FA e-mail from Wells Fargo? That's how this scam works after all; you tell the victim that they'll receive a message with a code, then the scammer tries to do some action which requires 2FA, then the victim reads the code from the 2FA message. The fact that you would categorize this e-mail as an obviously fake e-mail which normal people would immediately recognize as suspicious, when it's actually a real 2FA e-mail, is pretty telling I think. > A normal person, through the normalcy of their system, assumes that if this bank is having trouble dealing with them they'd have trouble dealing with everyone and that's just absurd. No, this is absurd. Everyone has experienced having some one-off problem with some account in some system. Not to mention that the case in TFA was explicitly about fraud prevention calling you about suspected fraudulent charges, which seems extremely normal to me. Limiting individual accounts due to suspected fraud, and then notifying the owner of that account, is exactly the purpose of fraud prevention. The only part of this event which the author's unusual set-up is responsible for, is that she gave an unusual level of credibility to the scammer just for calling her phone number. But if it comforts you to think normal people would be immune to this scam just because normal people have their information more readily available on the internet, keep believing that I guess.
• renewiltord 5y ago
  I'm a gullible motherfucker: I have memories of handing a $20 to a random guy walking up to me and saying "Hey, man, my car's stuck and I need some cash for gas". That said, I've had a lot of these calls and fortunately not fallen for them once. The funny thing is that eTrade (I think) has a system where you can ask for a callback but then they'll go right into taking your information. When that happens, I followed the play book: I asked for a phone number that I could find on ETrade that I could add an extension for to get to this person. He gave it to me and everything along with some sort of quick access code I was supposed to use to get whomever I hit to pass me along. Well, I did the whole thing and the person at the other end in the ETrade system that I dialed said "It's okay, I'll just take care of it, sir". I mean, at this point I just sucked it up and went through with the process since I figured I dialed the number from their website to get there and then the extension so surely it has to be legit, right? But I just know someone is going to point out a way that I could have been scammed through this mechanism.
  • denton-scratch 5y ago
    > But I just know [...] That extension could be forwarded to an external number.
    • renewiltord 5y ago
      I suspected there was something like that. Could that be done by someone not inside the organization?
• Natsu 5y ago
  > my bank, Wells Fargo (I know, I know; trust me, they were not my first choice). > aren't phone numbers that Wells Fargo recognizes as valid mobile numbers (one of many things I despise about this bank). > Wells Fargo's system would be so janky and sloppily-built that this is the least awful way they could figure out how to do it. > consistent with similarly nonsensical policies I've encountered with Wells Fargo before (I hate this bank so much I think it might be time to change banks...
• BeefWellington 5y ago
  A tip that may or may not travel well: some banks can set a "security passphrase" or passcode that must be provided before they will do anything for you. A few years back I had someone compromise my credit card and somehow answer enough questions to increase the credit limit on the card substantially. This was the bank's response to this. No bank advertises this from what I can tell.
• denton-scratch 5y ago
  He "relayed" an "Apple Authentication Code" from an email to this Daniel fellow, right? Presumably he read it into the phone? That's where (I hope) I would have stopped; if X sends me an authentication code, the only reasonable place to send it back to is X. Also, I think the real fraud department would be completely OK with me saying "Oh, thanks for spotting it. I'd like to call you back now please - give me your name and the name of your department, and I'll look it up and call you back - what do I do to bypass transfer hell?". Getting on the blower to Wells Fargo on the other line was smart, but you need to have multiple lines at your disposal.
• jordanmoconnor 5y ago
  I never pick up the phone if it's a number that's not in my contacts. You can leave a voicemail.
• chaostheory 5y ago
  Can I get scammed? Sure, but in this specific case, that Wells Fargo scam wouldn’t work on me because I know firsthand that Wells Fargo fraud prevention is terrible. Case in point, a few years back I had in-store mall transactions happening 400 miles and 2600 miles away from my current location within an hour span of my lunch transaction. No fraud alert. It even took me weeks to contest these transactions. This is abysmal compared to virtually every other credit card provider.
• inetknght 5y ago
  What a terrible site to complain about being scammed when you don't even bother to serve over HTTPS!
  • dfsegoat 5y ago
    I know it doesn't matter for reading text, but the look is no bueno. I really think this detracts from the credibility of a "Security expert".
    • system2 5y ago
      She is trying to find an identity in tech. A few years ago she was a "professional web developer". Many of us have been there, titles give some sort of security to people; even if they are not well-fitting.
• TedDoesntTalk 5y ago
  > opened a claim for the fraudulent transaction (frustratingly, there's no immediate reversal; have I mentioned yet that I loathe this bank?). That’s because you have a debit card instead of a credit card. Get rid of the debit card. There are Zero consumer protections.
• Spivakov 5y ago
  Here is an interesting story in which a scammer almost got me but failed because he knew me "too well": One morning in college I was awakened by a call after staying up all night working on some project. The caller claimed to be from my home country's embassy and was investigating a fraud case I was involved in. He started by confirming my personal information such as DOB and passport number and he had them all correctly. He asked me to physically visit consular office, which I told him was impossible because I was in some program. At this point I sort of give in, but he asked if I was preparing for piano/music rehearsal - a huge red flag that awakened me from foggy mind. During adolescence I attempted to becoming a pianist and dedicated lots of time to training and competitions, but this is a past that was never mentioned on resume or to friends. There couldn't be legitimate way to relate that experience to me. I said yes and asked why he knew it. He began talking about my musical experience and what awards I won, without knowing that all these bits sounded to me like a pretentious show of being knowledgeable about my life. One lesson from this and Op's story is that the scammer can attempt an attack at any moment, including downtime of brain activity.
  • 533474 5y ago
    Crazy, was it someone you knew?
    • Spivakov 5y ago
      No, not to my knowledge. It seems that they obtained/built my pre-college profile many years ago, but they attempted scam until later and failed to match it up-to-date
• Giorgi 5y ago
  So... where did they got his/her details that she/he was so surprised by? Was it Bank's breach?
• PopAlongKid 5y ago
  I almost got scammed regarding renewing my software subscription with Intuit. I got a voice message indicating that my credit card on file for the renewal was expired (true) and that I should call back at the number given. That was my big mistake; given that I made the callback, I overlooked the fact that I had not myself looked up the number I was calling. But how did they know my CC number was expired, and that my annual renewal date was coming up soon? When I called, I immediately got connected to a live person. Second mistake: you can never get through the voice menu to a live person so easily. Anyway, the guy sounded convincing, and said I could get a special discount on renewal, so after some further conversation, I commented that I should be able to log in online and get this same deal, which was my preferred method. At that point, he finally put me on hold and then the call disconnected.
• qualudeheart 5y ago
  But who scams the scammers?
• arzeth 5y ago
  Is that "Verify your card in Apple PayⓇ" email real/non-spoofed? On that email's screenshot there's a huge red flag as with other 99.9% scams: bad punctuation. Nobody writes "number:" (1:, 2:, 3:, ...) for lists in English. https://writing.stackexchange.com/questions/5680/is-it-ok-to-use-a-single-parenthesis-after-each-number-in-a-list https://writing.stackexchange.com/questions/5680/is-it-ok-to...
• lucb1e 5y ago
  How often do you guys get calls from your bank? I got called twice in my life, both times in response to a ticket I had filed but didn't necessarily need a response to (firstly a complaint about some new hardware authenticator that was worse than the old one (I was hoping enough complaints might make them pick a better replacement next time), secondly about phishing-but-legitimately aka Sofort which they now, two years later, finally semi-blocked). From the post, since it mentions this being routine and normal, plus the comments here, it sounds like americans are called every month or so. Is that impression correct? Is it because of this credit card system where basically anyone with your account number has withdrawal access identical to what we use 2FA (chip and pin) for? With IBAN it's more of a money destination than a source. Direct debit exists but I have yet to see it abused, not sure how that works exactly, and definitely never got a call to confirm this or that.
• stjohnswarts 5y ago
  ehhhhhhhhhhhh I always call back. Isn't that one of the 1st laws of not getting fucked online/over the phone? I go to the company web page (https only of course) and get a phone number. I mean suppose it's possible for an employee to screw you over, but at least it's (call metadata) probably being logged somewhere. Also if I was into security my blog page would be on https, even if that's not entirely necessary for webpages. It throws up a yellow flag to me.
• kebman 5y ago
  Sure. I've been scammed. It felt really bad. And I consider myself quite knowledgeable. On the other hand, I noticed what was happening before greater harm could have been done. Perhaps that's what distinguishes so-called experts from the regular folks. Because an expert would know sooner, without being impervious. Long story short, I could have ended up with a subscription on a set of questions for 20 dollars a week, which was given only after a set of legitimate surveys were given on behalf of Apple. I of course notified Apple of this, but I never got the 20 first dollars back, before cancelling the "subscription" I had apparently signed up for. I really wanted to track the guys down, but they had been very careful in covering their tracks with proxies and mailbox addresses, so in the end I considered it too much work. But I did spam them. Perhaps I could have even used their mail for even more spam, but I suppose they just use throwaway mails anyway. Not sure how they got through the cracks of Apple, though. IMHO it's pretty damning for the reputation of Apple to work with guys like that.
• gwbas1c 5y ago
  > I'm a scam prevention expert and I got scammed After reading all that... I noticed that the "scam prevention expert" isn't serving their site with proper https.
  • lucb1e 5y ago
    Was the first thing I noticed, but to be fair, there also just isn't really a need for a blog like this. Someone once said something like "I encrypt my innocuous blog because else private becomes suspicious" but by now the internet is largely encrypted and this one blog won't reverse that. And who knows, maybe the person reading along at the NSA will also enjoy the article :)
• EGreg 5y ago
  This is just very weird to read. What was this scammer’s endgame? With all this info they can call up GoDaddy and redirect your domain (and all your emails) to themselves, or call AT&T and sim swap you. Why even call the actual account holder? https://www.zdnet.com/finance/blockchain/fbi-warns-sim-swapping-attacks-are-rocketing-dont-brag-about-your-crypto-online/ https://www.zdnet.com/finance/blockchain/fbi-warns-sim-swapp... As for these “confirmation” emails or SMS — they are so dumb !!! Why don’t they just include a full description of the ACTION you are supposed to have taken, that you are expected to be confirming? In big red letters before the confirmation number. That way the scammer won’t be able to trick you. Sheesh, these companies haven’t figured out to include that?
• KT-222 5y ago
  I was at my local coffee shop yesterday when the manager was on the phone for 10+ minutes with a scammer. Was a new one to me. The landline caller ID showed "Madison Police Dept" - the local police. The caller introduced themselves as an investigator working a case with counterfeit bills. "Don't contact your boss/owner because we are not sure if they are in on it." The caller knew details like employees names and the layout of the store. The manager was going through the cash in the back "confirming" serial numbers when the owner got in touch and cleared things up. I was confused about the end game for the scam, but online I've read a version where they send a courier to pick up the "counterfeit" bills. There's also a version where they convince the employee to purchase moneypak cards to be deposited into an account so that the 6AM audit shows balanced books making up for the counterfeit bills that will be confiscated. [1] To a person that doesn't know caller ID can be spoofed, getting a call that shows up as coming from the local police department can put you in a mental state that it 100% is the police, and it will take a lot of counter information to realize that it isn't. Between that and the convincing reason to "don't tell your boss", I'm afraid this might be an effective scam until it's more widely known. [1] https://old.reddit.com/r/Scams/comments/ryp4fg/i_got_scammed_into_stealing_6000_cash_from_my/ https://old.reddit.com/r/Scams/comments/ryp4fg/i_got_scammed...
  • Nextgrid 5y ago
    There was a recent post on HN about big tech companies being scammed by fake subpoena requests from "police".
  • nullc 5y ago
    Sometimes scammers will have you do varrious bits of busy work that can't possibly result in loss just to get the mark into the flow of doing what the scammer says and distract them from thinking critically.
• BuckRogers 5y ago
  I was scammed by a kid locally. He paid me for a motherboard over Paypal, then months later claimed it wasn't approved. I thought it was fishy he mentioned to me having his little brother pick it up. I said no to that. And I insisted on cash, but eventually relented, thinking it would probably be ok. He filed a PP dispute and lost, as I had text messages proving the sale. Then he did a chargeback and won. I would've filed in small claims court but the filing fee is more than the loss. So I looked up all his family info and addresses, and next time in his neighborhood I'll be knocking on their door for my money. And, I'll just keep finding creative ways to chase him down, online and off, until the day I die. I'm never letting it go and eventually if I had to "take" the money from him through other means (him losing money), that's what I'll do. I'll be sure to double or triple his losses though if it comes to that.
• sjmm1989 5y ago
  > We always say we'd rather people report a thousand false alarms than fail to report a single real emergency, but if the process of filing those reports results in condescending info-dumps or intimidating interrogations, is it really a surprise that so many people have been trained to just not say anything and hope their suspicions were wrong? This is how it is at almost any company I have ever worked for. They always say things like "We prefer that you ask questions if you don't know" or "We would rather get a hundred false reports than miss one valid one." That sort of thing. And then when you follow through with what they ask for, it's just like the quoted part says. > results in condescending info-dumps or intimidating interrogations It's not just a cyber security problem folks. This is pretty much a global problem, because no one ever really wants to be bothered over trivial matters, and no one really wants to believe the boy who cries wolf; even if the wolf is real. None of this will get better until people in general become both intellectually and morally wiser. So get a drink and some popcorn cause this is gonna be a while.
• intrasight 5y ago
  Banks will never call you. It's that simple. And if they do, hang up and call them back. I've had this attempted scam tried on me twice in last 4 months. You know it's a scam for sure when they try to prevent you from hanging up. Also, always disconnect. Don't just listen for a "dial tone" after they hang up.
  • ivanche 5y ago
    This x100! And call them back from a different phone, just in case.
  • unixbane 5y ago
    Yes, 50 people ITT have already pointed out this one weird trick. If anyone actually thinks this fixes the general problem, no it doesn't.
• throwaway2474 5y ago
  I wonder who these well-spoken, educated scammers are and how they’re recruited. Pet theory: voice recordings will be the next fingerprints/DNA, at some point it will be trivial to identify the person based on old recordings. At which point we can retroactively convict these people years or decades later, when they thought they were out of the woods.
  • Nextgrid 5y ago
    With costs of living skyrocketing everywhere and wages stagnating if not decreasing (remote work suddenly brings more competition) I wouldn't be surprised if otherwise legitimate people are tempted or even forced to do this out of desperation.
  • TobyTheDog123 5y ago
    I hope you’re not implying that these voice-recording/identity databases would be a good thing.
  • nullc 5y ago
    > retroactively convict these people years or decades later, when they thought they were out of the woods Limitations exists for most crimes and torts. Prosecuting someone years or decades later when potentially exculpatory evidence is less available (e.g. no one, even themselves can remember their alibis, etc.) would be highly unjust.
• scottmcdot 5y ago
  > he was talking about mobile app payment systems, like Apple Pay and Google Pay. Which, yes, I'm very familiar with, but I don't use and have no interest in using. I think if you're going to be a Scam Prevention Expert, you should at least familiarise yourself with the user experiences of these services so that you can detect when they're potentially being used in a scam.
• killjoywashere 5y ago
  I mean, if you're the test, if you pass 100% of the time, you're not trying hard enough.
• Markoff 5y ago
  On related note - I work for Asian company which sends me money to Europe through their US "offshore" bank account in Wells Fargo. I'm receiving monthly payments, but once payment bounced back because my local EU bank switched their intermediary bank, something normal client shouldn't care about, but I learned about hard way because WF is not updating their database of intermediary banks and routed my payment through outdated intermediary bank. I was pretty pissed about my own bank not informing me about changing intermediary bank, so I changed my receiving bank to different one, although in the end it was Wells Fargo problem not keeping their records up to date. Guess what happens years later after my other bank merger with different bank, Wells Fargo once again ignores new intermediary bank and bounced back the payment. I dunno if this is standard US international banking experience, but I find it extremely unprofessional and unheard in other countries that payments would be bouncing because bank is too lazy to update their intermediary bank database, not sure what operation they are running in Wells Fargo. In the end company made exemption for me and they are sending me money directly from their Asian account, because apparently you can't get worse banking experience than with US banks.
• josephcsible 5y ago
  tl;dr: Someone claiming to be from Wells Fargo contacted her by phone and requested a code that she got emailed. The email with the code said "Wells Fargo will not contact you by phone or text to request this code." She gave him the code anyway.
• verisimi 5y ago
  Is it possible that this is a PR puff piece? I think you could argue that this guy gives us this long (and somewhat implausible) story in order to: a/ support the line of business he is in and b/ to justify all the privacy intrusions and obstructions that banks are undertaking
  • grafporno 5y ago
    Probably, can't wait for the follow up article "How i used social-engineering and HN to growth hack my scam prevention business" or something like that. This is some grade a bullshit.
• shevis 5y ago
  Simple solution to this: Never do anything important or give out info on an incoming phone call. Always hang up, find the proper number online, and call back to continue the conversation.
• thatwasunusual 5y ago
  So. Not an expert, then...
• fierro 5y ago
  interesting post, but tough to take any security-minded blog seriously when served over HTTP
• fleddr 5y ago
  Some of the comments here are cruel and missing the entire point. Well yes, as you're slowly reading this entire case, with the prior knowledge that he is getting scammed, and having all the time in the world to find the mistake or red flag in his actions, sure enough you'll find it. How very smart and vigilant you are. But as the article already explains, those are not the conditions in which a scam happens. You don't know you're being scammed. The person sounds helpful, exploiting your inner desire to be cooperative. There's a sense of urgency, which disrupts calm and clear thinking. It was a very sophisticated and well prepared scam, which increases trust and makes you glance over or "forgive" small oddities. Ironically, the fact that some of you chose to criticize somebody showing vulnerability is very emotional behavior, not rational behavior. Perfect candidates to be scammed. By the way, are Americans still logging into online banking with a username and password? That's it? Please tell me that's a joke.
  • marioletto 5y ago
    > are Americans still logging into online banking with a username and password? For financial institutions identity verification of existing and new customers is a way more complex topic than most people realize. Fraud is an issue but so it’s friction. If it’s too hard to login or to open a new account, people will use/move to a different service. So in the US institutions use “invisible tools” to authenticate users and minimize the risks. Third party services collect huge amounts of user data which is then used to verify customers’ identities in a probabilistic way. (For instance the odds that a fraudster is logging in into your bank account from your phone and from an IP that you have used numerous times in the past are very low) So while the impression is that only a username and a pw are used, that’s not the case. So in short: security is not the only goal of the financial services available to the masses. The goal is finding a balance between security and friction.
• rcurry 5y ago
  It gets even weirder when your bank acts like a scammer. A few weeks ago I was trying to help my wife add her USBank credit card to Apple Pay and Apple Pay said I needed to call this number to finish setting up the card. So I call the number and the guy is very friendly and asks me for a bunch of identity verification details, which I provide to him, but then he asks us to send a code back that will be coming over text messaging - yes, I initiated the phone call, but I suddenly realize that the number Apple directed me to was not the same number on my USBank card. Being a bit paranoid I tell the guy “Look, nothing personal but I get nervous when people ask for a verification code to be read back to them, I’m just going to call the regular number and go from there, okay?” Instead of being friendly, this guy suddenly gets in my face and is like “Oh, you’ll give me all this other info but won’t read that code back to me? I’m Fraud Prevention dude, good luck getting this done calling the main number. Oh, and just for this I’m putting a block on your card.” I hung up immediately and called US Bank’s main number and asked to talk to a supervisor - sure as hell, it turns out the guy I had talked to did work in their fraud prevention department and actually had retaliated against me by locking my credit card. It was the most incredibly ugly thing I’ve ever seen from a customer service department.
  • WorldMaker 5y ago
    Something I learned (almost the hard way) was to always make sure I have a Bank/Credit Card's own app installed (and logged in) before trying to add to Apple Pay. Apple Pay can and will redirect you to verification steps in the app if the app is installed. More often than not, if you initiate "Add to Wallet" from the app itself there's no additional verification step.
    • rexf 5y ago
      The setup flow is hit or miss. With some banks, it was seamless to setup. With another bank, it wasn't clear how to finish setting up Apple Pay. I don't recall if I called them or went through their app to actually set it up. It was definitely confusing, and the Apple Pay onboarding screens didn't provide useful instructions.
      • 5y ago
• TrianguloY 5y ago
  "I was tired" This says it all. You may be the best expert and everything you want, but when you are tired you are no longer an expert, and it's something that practically can't be learnt to self-identify. If you think that X will never happen to you, wait until you are tired and we'll see about that.
  • samfather 5y ago
    Part of being an expert is recognizing your limitations, flaws and vulnerabilities. This was not an expert.
    • system2 5y ago
      I can tell from the comments and from my own observation, the entire HN knows she is not an expert. I think we shouldn't beat the dead horse here. I also agree she shouldn't call herself "expert" of at least the cyber security field.
• swalsh 5y ago
  I got a really weird call yesterday from some place claiming to be the medical center where I was a patient 5 years ago (I go to a new place today). I was a bit suspicious simply because it's been years since I've been a patient there. But there are many plausible legitimate reasons for calling me. However the first thing they did was "verify" me by asking for my date of birth and home address. I was disarmed at first because the lady was clearly American, and sounded bored. But I was still hesitant to give up any information on an incoming call. So I asked for some way for me call them. She gave me a phone number... which was the same one calling me, so I hung up. I looked up the phone number, but it was just a random landline from SC (this was a MA based business). At this point I gave up, and decided if I owed some money they would probably send something in the mail. But it makes me wonder if there's a new class of scammer out there with a bit more sophistication.
• megous 5y ago
  Nah, phone calls are even worse than SMTP here. Caller ID means nothing. It's like a From header on an email with no DKIM. It can be set by the caller to anything, if they have access to some trunk from an operator that allows this. It's another trust based thing, with no automated verification. Trusting caller ID was the initial mistake. Never trust caller ID with your money. It's like trusting sender names in your spam folder mean anything.
• rob_c 5y ago
  I keep seeing this story headline from security admins lecturing me how to not get my estate compromised... please just learn and employ best practices and stop getting on at those with proven track records
• monktastic1 5y ago
  "while I'm no expert, I've never heard of a call center system that can accept touch tones seamlessly while a call is active, and it would take extremely sophisticated audio processing capabilities to be able to do that, since the frequencies used by touch tone keys heavily overlap the frequencies of human speech." "Extremely sophisticated?" The tones are just a sum of two sine waves of known frequencies. That's trivial to detect. What am I missing?
  • Nextgrid 5y ago
    I think his point was that it's difficult for a system to conceal the tones from the other party while not interfering with normal speech.
    • monktastic1 5y ago
      Did you read it in context? It seems very clear to me that he's talking about detecting the tones.
• drdaeman 5y ago
  Hm, interesting. I've had surprising fraudulent charges on a WF card just a few days ago. They texted and emailed me, but I had to call them myself (not that I would've trusted a call, I even wondered for a minute if SMS was a fraud attempt). The issue is, it was a card that I keep only because it's the oldest card I have, that I don't really ever pull out of my wallet anymore. I'm not familiar with the underground stuff but I suppose stolen CC numbers are typically sold reasonably fast (months, not years) and used while they're still fresh? If that's the case, while two random anecdotal data points don't prove anything, I start to wonder if it's possible that WF was recently compromised.
• xarope 5y ago
  Scams are getting more and more sophisticated. We've always known that when you write a playbook, sooner or later the red team will find holes in that playbook. Perhaps that's where ML/AI comes in, since you can train them, but you never really understands what they really "learnt" from that training (/s sort-of, but the famous amazing snow/husky classifier always comes to mind) Personally, I've received such calls before, and the first thing I'd ask for is a case number, and that I would call the support number printed on my credit card, to get back to them. Of course, if someone co-opts that number, then I'm also SOL, but I'd imagine then this would be engineering on a larger scale, rather than a specifically targeted whaling attempt.
• gowld 5y ago
  > I answered, the guy said he was calling from Wells Fargo's Fraud Prevention Department, calling to verify some transactions. He verified my name, he had the last four digits of my debit card number, and everything generally seemed to follow the normal script of a transaction verification call. No legitimate bank would do this. They say "call the number on your card, and mention reference # NNNNN" Wells Fargo is a criminal organization: https://en.wikipedia.org/wiki/Wells_Fargo_account_fraud_scandal https://en.wikipedia.org/wiki/Wells_Fargo_account_fraud_scan... so there's no reason to assume an impostor would be worse.
• megablast 5y ago
  He is not very good then. If the bank calls you, hangup and call the bank number listed on their website.
• BEEdwards 5y ago
  This happened to me the other day too! Different bank, but they had all the basic information, but then started asking for information that I know they don't need (secret questions and answers) and when I told them it was sus they hung up.
• linuxhansl 5y ago
  There is one simple rule: If your bank calls you for anything, tell them you call them back, then look up their number you have (or the one on your credit credit or whatever) and call them back. Period. Even if your bank is really calling you they will still understand if you call them back on the number you have.
• smeej 5y ago
  I got another report from a former colleague about a nearly identical story yesterday. This person was also in the "knows better than to fall for this kind of thing" category. The critical difference, though, is that he reported the scammer read off a list of his actual recent transactions. That part, especially when combined with this second story so soon afterward, makes me think some third-party budgeting tool or something was recently breached and just hasn't announced it yet.
• rdevnull 5y ago
  No offence but as an "expert" there is no excuse to run a webpage/blog etc. with no https. With Vercel, Netlify and many others offering free stating hosting and let's encrypt https certificate there is no excuse to run a site without an SSL certificate. To me the moral of the story and that you should never ever follow instructions by an alleged bank calling you asking to confirm informations and, even worse, give them codes over the phone. Especially if you are an "expert". The most unbelievable part is falling for the idea that if you had called back your whole account would be on hold. That was such a smoke bomb that was easily detectable. If this seemed plausible as your dislike your bank and don't like the service why not take your business elsewhere? From your own story, if anything, Wells Fargo prevented this from becoming a much bigger problem and acted very promptly to your request.
  • unixbane 5y ago
    HTTPS is when you ask 200 companies if either of them know the key for your bank. And they are all run by charlatan boomers who think buying more firewalls and cool security products is equivalent to securing their private cert signing keys. Why on earth would I ever want this? Like hello, have you ever seen ultracorporate tech company culture? They really don't know what they're doing. Why would you trust them let alone trust 200 of them in a way such that even if one of them messes up, all your sites are compromised? Imagine that domain names contained the public key in them. I Google up "mybank", and it gives me https://8c789ad256afa4ca93f1af6436e7adff51cdd1c380de7d7cc78b41e178507a7e:mybank.com/v2/index.aspx https://8c789ad256afa4ca93f1af6436e7adff51cdd1c380de7d7cc78b... This takes <1000 lines of code to implement and already stops the only thing that HTTPS stops: a noob MITM positioned attacker who can't break into CAs. The MITM can't change the Google results, because you already came from https://a4244aa43ddd6e3ef9e64bb80f4ee952f68232aa008d3da9c78e3b627e5675c8:google.com https://a4244aa43ddd6e3ef9e64bb80f4ee952f68232aa008d3da9c78e..., which you somehow obtained before the MITM happened.
  • nullc 5y ago
    HTTPS provides essentially no security to a broad spectrum of attacks-- particularly, any attacker that can position himself between the webserver or name server and any CA is largely unaffected by https. Only attackers that are limited to intercepting between the webserver and end client are meaningfully thwarted. It isn't magical pixie dust. It doesn't appear that this page provides any information or service that would be meaningfully protected by https. The most important reason to have it is to avoid the automatic search engine downraking that google now applies to non-https sites (helpfully elevating all manner of spam and scams over decades of technical documentation). > To me the moral of the story and that you should never ever follow instructions by an alleged bank calling you asking to confirm informations and, even worse, give them codes over the phone. Unfortunately, as pointed out by many others in this thread many banks engage in and even sometimes require you to comply with scam indistinguishable behavior, making your maxim hard to follow. Even ignoring that, everyone makes mistakes, gets distracted, or has bad days... this makes security very hard, even for experts.
• mdavis6890 5y ago
  The author is simply not very good at defending against these scams. A. Fraudulent charges are YOUR BANK's problem, not yours. There is no reason to take any risk or share any information. You can agree that charges are fraudulent, but that's the endpoint of your responsibility. B. Don't give out any information to an inbound caller. None. (except to acknowledge fraudulent charges) C. Don't try to figure things out. You don't need to reason through it. This author spends SO MUCH time trying to reason out whether this is or is not a scam call. WHY??? Just hang up and move on. If it makes you feel better, you can always call you bank back. "Putting all of this together, the scales started to tip toward this potentially being a scam call, but I still wasn't certain. It was all circumstantial and conjecture, and a lot of it seemed very legit, plus the difficulty of accurately putting together the information needed to make an attack like this against me without also including strategic disinformation that would tip me off about where they got their data. I needed more information. It was time to push back on this." >>WHAT??? Why do you need to push back? What's the point? Hang up! "So, I was immediately suspicious, and started asking technical questions; " >> NOW you're suspicious? Again, why ask technical questions here. Who cares? Move on! This author spends FAR FAR too much time trying to outsmart the scammer - and in the process gets outsmarted himself. Edit: Nevertheless, I give the author a WHOLE LOT OF CREDIT for being willing to post this. I'm sure he was a bit embarrassed, but sucked it up for the greater good and education of all of us. Thanks!
• deleted 5y ago
  [deleted]
• jeffparsons 5y ago
  A lot of people seem to be telling similar stories in the comments about how their banks also act like scammers, which trains you to trust the actual scammers. For this reason, I am extremely stubborn about inbound calls. When my bank/superannuation/etc. call me about something and ask for any personal details, I explain to them why it's really not okay for them to be doing this, request a way to call them back via some telephone number that is published on their official website, and then later follow up with a formal complaint. Who knows whether it actually does any good. Probably not. :/ EDIT: I mean, it definitely protects me, but I don't know if any of these orgs have changed their practices.
• StopDarkPattern 5y ago
  >Email is a notoriously fickle protocol, LOLOLOL OP
• 8b16380d 5y ago
  My social anxiety prevents things like this, I never pick up the phone or willingly chat with someone for longer than a minute.
• Mawr 5y ago
  A similar case that happened to Jim Browning: https://www.youtube.com/watch?v=YIWV5fSaUB8 https://www.youtube.com/watch?v=YIWV5fSaUB8 (My channel was deleted... HOW?).
• 1970-01-01 5y ago
  >I checked the caller ID, and it was my bank, Wells Fargo (I know, I know; trust me, they were not my first choice). This was too quickly dismissed. If you know a bank isn't up to your personal standards, don't cave into using them anyway! There are so many alternatives that the decision to keep using them should be seen as the primary or root cause of the problem.
• Mister_Snuggles 5y ago
  I've had calls from my bank's fraud prevention department and, for me, they go down like this: * A call comes in from a number I don't recognize, it goes to voicemail. * The voicemail message says "This is the fraud prevention department at $BANK, please call us back at $NUMBER" * I pull out my physical card, call the number on the back (which does not match $NUMBER). I go through the menu tree to get the fraud department and ask if the call was legit. Interestingly enough, at some point the bank modified the menu system so that when you enter your card and the fraud department has called you they'll bypass the menu completely and transfer the call right to that department. Clearly I'm not the only one that does this and they don't necessarily want to discourage this behaviour.
• 3np 5y ago
  Permanent hug-of-death? > Lupinia Hosting Is Shutting Down Original archived here: https://web.archive.org/web/20220331074459/http://www.lupinia.net/writing/tech/scammed.htm https://web.archive.org/web/20220331074459/http://www.lupini...
  • lupinia 5y ago
    That's an error condition I've never seen before; that page only appears when no corresponding virtual server can be found (leftover from when I used to host friends' websites, a very long time ago), but I'm not sure what would cause it to be displayed without fuzzing the domain name. If the application got overloaded and fell over and died, it should've thrown a 50x error of some sort. Thank you for pointing it out! I'll look into it :) It was already back up when I checked, so I guess whatever happened auto-recovered (hopefully it did that quickly).
    • 3np 5y ago
      FWIW, the TLS certs did not match; it redirected to some other subdomain (and/or cleartext http, don't recall which)
• alex_young 5y ago
  The first thing you should do when someone contacts you about a transaction you don’t recognize or with any kind of account concern is hang up / don’t email back and find a valid number for the company from a reputable source and call them back. If they are legit you’ll connect with them, if not you’re already in the right place to get the id theft investigation started.
• ineedasername 5y ago
  I think when I had fraudulent charges on a credit card I was directed on where to find the appropriate customer service # on my credit card and the options to choose for a fraud issue, and proceed from there knowing that I was talking to the real company. Seemed like a pretty good way to avoid all sorts of scams like this.
• smoovb 5y ago
  A key bit of info "he also had a distinctly North American accent". It is real easy to dismiss scammers you can't understand well, but when speaking to another native speaker, your guard comes down several notches.
• grog454 5y ago
  Interesting that even in the addendum at the end of the article (which I only skimmed) there is no mention of the most glaring oversight of the author. From his own screenshot: "[...] Wells Fargo will not contact you by phone or text to request this code." To be fair, that should be about as large as the title text, and displayed before the code. And the scammer was likely doing a good job of keeping the author distracted enough to miss that.
  • system2 5y ago
    Author doesn't seem to understand the basics of phishing.
• StopHammoTime 5y ago
  ALWAYS CALL BACK. If they are legitimate, advise they should block the transactions until you've been able to reconnect with them. Get their details, and advise you will call back on the company's dedicated fraud prevention hotline. NEVER give details over the phone on a call you didn't initiate EVER.
  • istjohn 5y ago
    Yes, but banks shouldn't be using these insecure processes in the first place. I got a legit fraud text alert from my bank directing me to call a certain number. It should have asked me to call the number on my card.
• eek2121 5y ago
  Uh, I'm not a scam prevention expert, yet I would NOT have followed your steps. If a bank (or ANY entity) calls me up claiming to be X, I usually ask them what the issue is, then hang up and call the number listed on my card, the official website or documentation, etc. You should never give out ANY information on the receiving end of a phone call. Period. Ask what their name is, what department they are in, hang up, call the number you were provided prior, and ask for the same department/person and describe the details of the call.
• WalterBright 5y ago
  Yes, it's normal for even the best to make mistakes. That's why pilots have checklists and copilots, for example.
  • sombremesa 5y ago
    The best pilot would not rationalize for even a second why their instrument readings did not match their intuition. They would fall back on their training immediately in the face of ambiguity. This person is not even close to being the best…which is irrelevant, since they should have known better anyway. That being said, bad stuff can happen to anyone regardless of who they are.
• alienchow 5y ago
  It's actually also quite frustrating when financial institutions don't have proper secure practices in place. If you've ever wired money from SFCU, you'd know they would ask you to fill out a form with a handwritten wire password. You submit the form and someone from the credit union would call you to verify your wire password. When I received the call from them, they asked for my date of birth and other information. I explained that I'm not comfortable revealing my details to an incoming call and to give me their extension instead. When I did this with BoA or Chase, they'd immediately understand my concern. The SFCU person on the line, however, gave me some passive aggressive statement about me causing extra work. This was followed by me calling their official number on their web page and having to wait about 20-30 minutes to get through to the extension number to the same person, which proved that the previous call was legit. However, said person proceeded to mock me for having wasted our time. I love SFCU but they really need to understand how scammers work.
  • nullc 5y ago
    To be charitable, it may well have been a waste of time simply because of how terrible the rest of the bank security is. I've had close to 100% success social engineering confidential information out of financial services companies and other service providers about myself using only information that would be available to a scammer. So, if a scammer knowing your name and address could call your bank and talk them into giving out your DOB, then going through the effort of calling them back before giving it to them really would have been a waste of time.
• ale42 5y ago
  Relating to this sentence in the article: > I've never heard of a call center system that can accept touch tones seamlessly while a call is active, and it would take extremely sophisticated audio processing capabilities to be able to do that, since the frequencies used by touch tone keys heavily overlap the frequencies of human speech. It's actually happening all the time. VoIP systems _do_ extract touch tone (DTMF) from the call and convert them to appropriate out-of-band messages (either on RTP or SIP, there are multiple standards). This might also happen with VoLTE, although I didn't verify it myself. So, while the request was indeed weird, there's nothing technically strange about typing touch tones at any point in a call. Regarding the fact that those frequencies overlap with human speech, it's expected because they were designed to be transferred over phone lines, which are made for human speech frequencies. Since landlines here in Switzerland have been converted to VoIP several years ago, I often hear DTMF tones appearing from nowhere in the middle of a call and covering the voice of the other person. The reason is easy: some intermediate system detected a tone and sent the corresponding SIP/RTP message, while also filtering the tone out of the audio. On the other end of he line, that out-of-band message triggered the generation of an actual in-band tone, whence the result.
  • feanaro 5y ago
    Yeah, I'm confused, isn't "To get help with problems relating to your account, press 4." and similar just par for the course in almost every automated call system?
    • ale42 5y ago
      Yes it is. I think the author was supposing that the phone system will listen for DTMF tones only at that specific moment. But in fact in most cases those tones (at least nowadays) are detected at any time in the call (and of course ignored, if there's no reason to make use of them like in an automated call system menu).
• LinAGKar 5y ago
  Haven't read it yet, but do I want to trust security advice from someone serving their site with a self-signed certificate? Edit: looks like accessing it over HTTPS just gives you a broken looking site saying "Lupinia Hosting Is Shutting Down".
  • system2 5y ago
    Makes me wonder how many "security" clients the author has. No https, outdated site, 2FA over the phone. Her other post also mentions "I'm a professional web developer". Unsure what she does for living. Her site shows lots of interest for tech but not at a professional level.
• richardfey 5y ago
  I think we should understand how users get scammed with study, research and empathy and not because we get scammed ourselves. Having bias that it's the stupid user's fault us just that, bias, and doesn't help in the pursuit of any scientific results.
• system2 5y ago
  How can a Scam Prevention Expert gives information, a 2FA, over the phone? Isn't it like the #1 rule of scam prevention?!
• rhacker 5y ago
  8 years ago I got a call from Discover card asking if I wanted to extend my credit limit. I immediately asked for his name and said I would call Discover with the phone number on their website. I got through and asked for him and our call continued. It was not a scam. I can't believe this person is an expert.
• adrian17 5y ago
  > he confirmed that no one by the name of "Daniel Coffman" or "Daniel Coffmane" works at Wells Fargo. This part sounds weird to me; surely helpdesk employees don't have access to full employee records? Further, if the scammer already had this much information, couldn't they have used a name of any helpdesk employee who actually does work there?
• retSava 5y ago
  I've been scammed by a car salesman while, I thought, I was really read up on signs and paying attention. I was buying a 2 yo Toyota car at an official Toyota salesplace. Before this, I've bought three used cars, looked at tons of videos (eg Chris fix on youtube) on how to check the car itself so I don't buy something that risks needing expensive repairs two years later. I wasn't super prepared against the salesman before though. But he wasn't looking like, and behaving like, a salesguy. He was a bit uncertain in his way to talk, and it felt like I was more sure of the buying process than he was. I had two main concerns - I didn't want to buy a lemon ("Monday specimen") or a crashed+repaired car. The latter may mean things like bearings being slightly out of alignment and leading to wear quicker. So I voiced those two concerns and asked whether this car had ever been repaired, "No, nope.". I asked about service subscription, the guy whispered "I shouldn't say this, but it's better you get it at the other place which is closer to you" (also an official Toyota place). Since my daughter has allergies, I asked about smoking or animals, "njet, nada, nopes". Well, a month later the car was completely registered to me and I got access to the Toyota digital registers and surely enough, it had been smacked along the side by a truck. It also already had a service sub pre-payed on it, so that was him getting out of a 350€ service at their place. A final insult was that, as the chemical perfume smell of the cleaning agent came off, it had a foul pungent smell of wet dog. I confirmed this with the previous owner too, she'd had a dog in the car. Had to buy a replacement air filter and clean the car internally, but at least my daughter doens't call it the "smelly car" anymore. Pretty happy with the car, and would likely have bought it even if he was completely truthful, but having been lied to, and fallen for it, makes me pretty angry. Feels good to share the story :). Don't forget to like and subscribe.
• MrYellowP 5y ago
  There's always someone smarter than you. Always.
• ricardobayes 5y ago
  I think I'm adequately protected from this as I don't take phone calls at all. I will call my bank and providers on my own time.
  • haspok 5y ago
    I take this to the next level, and never even call any banks or providers. I just walk in and deal with them in person. Probably takes more time and effort, but is totally worth it IMHO.
• ciroduran 5y ago
  I have been almost successfully scammed and there is one thing that stood out of all this text that I can relate: the author was mentally tired. I wasn't tired, but I got a call at 8AM on a Saturday as I was just about to wake up, and I hadn't slept very well. You may be very aware of all the latest security practices, but in the end you are human, a big bag of emotions swirling around. And it only takes a moment where you are vulnerable to scam you successfully. The lesson here, I think, is: it could happen to you.
• rob_c 5y ago
  ** ** ** really an _expert_ relaying a DO NOT SHARE 2-factor code with someone in _ANY_ situation is someone who deserves to be called out for this! This is not expert behaviour. I think a lot of sysadmins following best practices (not every box or estate on the net are compromised, and this is not to say zero-days don't exist) are getting frustrated with security "experts" like this who simply can't even be bothered to practice what they preach... There isn't a more polite way of phrasing this really...
• sgjohnson 5y ago
  For a variety of reasons (this being one of them) I never pick up calls from unknown phone numbers, banks, and other insitutions. They always go to voicemail, and I often immediately call back.
• reportgunner 5y ago
  What a fail. Once they asked for the confirmation code she should have hung up and called her bank to verify if the call was legit.
• ptsneves 5y ago
  I honestly do not understand why anyone having a fraud call, would not bother to go to the bank itself. That is my rule and would have avoided the situation. I had a call similar to the article's and in the end I just said I will go to the bank myself and sort the issue in person. As i did not see any communication in my bank's page, nor app(it has push notification), nor any letter I never bothered to waste more time. I put the effort on the bank, as the bank has the duty to safeguard my money, not the other way around. The bank's responsibility on suspicion of fraud is to block the transaction and summon the account holder. I use the bank's channels for communication and this does not include random calls. It communicates with me through the bank's web page and app and it has never sent me any email. This is true for my experience in Poland and Portugal. The Portuguese bank used to have a crappy web-banking system and even this worked properly. When I got contacted by my bank, it was an in-person summon with no ability to discuss through the phone, the end. Being so "remote" these days that we do not consider it important to go to the bank in person is maybe the issue. It is ridiculous one's ability to handle one's fortune in a phone call. It should be bureaucratic by nature. I can understand being busy but not a single time the article's writer mentioned he will go and sort things himself in the bank. Are physical banks rare in the United States?
• whywhywhywhy 5y ago
  Honestly I’m shocked a scam prevention expert would talk to anyone who initiated a call to them. Even if I get a text message flagging a purchase that I initiated I still won’t call the number they text me with I’ll always go to their website via url I type and call the number there. Surprised an expert isn’t doing the same.
• jakub_g 5y ago
  It's fun how the expertise of the person ("I know how those various systems work, and how everything is duct-taped together"), and being accustomed to things being shit with the banks, has turned against them.
• dwild 5y ago
  > even offered to transfer me to his supervisor, which is not something a scammer would usually be able to do, but I had not yet actually challenged any of it. This tactic is actually used by so many scammer, it's weird that a scam prevention expert is saying that kind of things. His sentence prove how effective transferring it to someone else is powerful, how could they transfer us to a supervisor?! They are working in call centers, they just give their phone to someone else, often time someone with more experience with scams thus better to convince you. In some case I have seen situation where they use that tactic as good cop / bad cop, where the first one is threatening, this bad thing will happens if you don't act quick, etc... and the next one is more on your side, he believe you, but you need to works with him. I even seen some where they say that they have no other choice but to open a police report with your local police, and ask you your local police phone number, act like they talk with them on a second phone (as if they couldn't put you on hold and initiate the call directly on their system) and then say that the police want to talk with you and they will call you directly (I guess using fake caller id again but with the police phone number). It's all part of their tactic.
• jfrbfbreudh 5y ago
  I nearly got phished by Citi recently because their call center gave/sold my info to a phishing network. I had called their support line to dispute a charge, spoke to an agent for a bit, and they put me in the dispute queue, and then hung up on me after 20 mins waiting. I call back, repeat the process, wait 20 mins and got hung up on again. Then an hour later, I received text message telling me that my Citi account was frozen, with a (phishing) link to reactivate it. I had called Citi using a new phone line (not linked to my existing Citi account), so for the phisher to text this new number means that the call center must have leaked it soon after intentionally hanging up on me. It’s possible that my number was randomly targeted, but the timing was very very suspicious.
• weissed 5y ago
  If someone calls from the bank, take their name and purpose for calling, hang up and call the bank yourself.
• gsej 5y ago
  There are some odd things here. How can someone be a "scam prevention expert" and not be aware that caller id can be spoofed, and therefore should never be trusted for anything important? How can someone be a "scam prevention expert" and not know (even if you only "skim" the email) that you don't read out 2FA authentication codes to someone who calls you and asks you for them? These are surely the two most basic methods used to scam people...
• ChoGGi 5y ago
  If anyone ever calls you don't "verify" info, you call them back with a public number.