12 ms·

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'

• zamkam 5y ago
  "never give out any info on incoming calls". 100% agree. It's such a simple rule that I don't understand why it's not part of everyone's DNA. Should be taught at home and in schools, same as "look both ways before crossing a street".
• cjg 5y ago
  Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands. The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline. The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, etc. My neighbour then did whatever the scammers said - because they couldn't possibly be scammers.
  • ghostly_s 5y ago
    Your neighbor just dialed the new number without hanging up first?
    • AdamTReineke 5y ago
      I could see this working if the other end played a click followed by and dial tone sound.
    • harshreality 5y ago
      Unless both sides hang up, there's something like a 10-20 second window where the call is held open. Hanging up, picking up within 10 seconds and dialing, means you're still connected to the original caller. If they're clever, the might even detect the click of you hanging up, and play a dialtone for when you pick back up, and stop playing it when you start to dial.
      • ghostly_s 5y ago
        Citation needed. I don't recall any land line phone I've used behaving in this way.
    • lostlogin 5y ago
      No dial tone and no ring… Seems a difficult mistake to make but then again, I regularly surprise myself with my errors.
      • bragr 5y ago
        There's nothing technical that prevents the other side from playing dial tone and ring sounds
  • e40 5y ago
    The neighbor hung up, but the scammers didn't, and the call was not disconnected? That's not my experience. Is this what you meant?
    • deleted 5y ago
      [deleted]
    • afiori 5y ago
      Apparently it is a feature Called Subscriber Held (CSH). https://security.stackexchange.com/a/100342/143105 https://security.stackexchange.com/a/100342/143105 TL;DR It was just how analog phone worked, users came to rely on it, digital exchanges reimplemented it (with a timeout)
    • BeefWellington 5y ago
      Yes, and this is how it works as another responder mentions. The thinking by phone companies is essentially: guy calling pays for the call, so we can milk each call for a few extra cents each time even if they're shady or a wrong number.
  • mdoms 5y ago
    Your neighbour dialed a new number without hanging up his ongoing call? Is this his first time operating a telephone? The scammers mustn't have believed their luck when they realised that was happening. Did they mimic a "brnnnnggg brnnnggg" sound when he dialed?
    • function_seven 5y ago
      The connection isn't always torn down immediately. Different switches behave differently in this regard. I remember a long time ago being trolled by a friend of mine who refused to hang up. I wanted to call someone else, but every time I picked up the handset to dial out, he was still on the line laughing at me. So if you're served by a switch that operates this way, the scammer just holds the line open, plays dialtone and ringback tones appropriately, and you're none the wiser.
    • post-it 5y ago
      > Did they mimic a "brnnnnggg brnnnggg" sound when he dialed? Yes: https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone-scam-1.5375708 https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone... Looks like you would have fallen for it.
  • camtarn 5y ago
    For the people who are confused: this is a fairly common thing on landlines in some countries, where the telephone exchange doesn't drop the connection until both ends have hung up, or in some cases when the caller hangs up but not the callee. So it's possible to put your own phone down, but when you pick it up again your phone is still connected to the scammer's telephone. If they play a convincing dial tone, then change to a ring tone when they hear DTMF, you'd be none the wiser. The workaround to this is to use another phone (e.g. switch to mobile), or if that's not possible, apparently you can wait several minutes until the exchange times out the connection. https://security.stackexchange.com/questions/100268/does-hanging-up-on-a-uk-landline-call-not-terminate-the-connection https://security.stackexchange.com/questions/100268/does-han...
    • hunter2_ 5y ago
      It even makes the news [0] periodically. Watch the video, especially 2:22-2:36 which reiterates the PSTN behavior. [0] https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone-scam-1.5375708 https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...
    • afiori 5y ago
      I can confirm that at least once this happened to my family in Italy about 20 years ago. The most anecdotal statement ever, but a data point nonetheless.
    • sometimeshuman 5y ago
      I accidentally won a radio contest many years ago in this way. I heard "you are caller 2" and then the DJ hung up. I stayed on because I was confused and then a few seconds later he picked up again and said you are "caller 4". So I just stayed on and eventually said I was caller 10 and the 10th caller won the prize. I assume he was switching back and forth between two internal phone lines. I was confused because I was calling to make a song request and had no idea that this contest was initiated because they had just played a certain song.
      • Spooky23 5y ago
  • mekoka 5y ago
    So your neighbor hung up to proceed with a follow up call, which, if they're like most people, consists in just pressing the switch with a finger, while keeping the handset to their ear. But then upon releasing the switch, they just started dialing without waiting for the dial tone? And after they finished dialing and never heard the ringing tone, they didn't find that unusual? Forgive my skepticism, but something's missing from that story. Edit: Just read up on the disconnect time (10 seconds for some providers) and yes, a sophisticated scammer could indeed emulate the various tonalities.
    • AdamN 5y ago
      scammer plays a dial tone after the 'hang up' and while dialing.
  • easytiger 5y ago
    Was this in the UK? I think they dropped the timeout to help mitigate this. KNow someone else it happened to
  • megablast 5y ago
    I guess we need to teach people how to use a phone line??
• deleted 5y ago
  [deleted]
• antiframe 5y ago
  Yes, this is what I do too. I say "Thank you for the information. For security reasons I won't discuss this matter on this incoming call but I will immediately contact your fraud department on the number I have." They've never been annoyed about this. In fact, mostly they've been positively surprised.
  • geek_at 5y ago
    Another solution would be to find out who the scammers parents are and write them. Worked for me https://blog.haschek.at/2016/how-a-scammer-stole-500-dollars-from-me/ https://blog.haschek.at/2016/how-a-scammer-stole-500-dollars...
• wccrawford 5y ago
  Agreed. No matter how tired and annoyed I was, I'd have stopped dead at the confirmation code that they asked for. There's absolutely no way I'd have given that to them, even if it meant cancelling my account and using a different bank. That seems a bit extreme, but if their procedures are so crazy as to require circumventing another system's security procedures, I'm not going to bank with them. I actually had a bank send me an email asking for information that came from another domain, had a header that looked liked it had been badly scanned in, and had links to domains they don't own. When I ignored it, I eventually got a notice that my car loan was in jeopardy because I hadn't provided that information. They had no clue why I was so upset about that email. I paid off my loan immediately and never looked back, even though the interest was less than I make off the stock market.
  • yuliyp 5y ago
    I think this is a statement easier to conclude in hindsight, especially as you are primed with "this story is describing a scam, definitely". The author describes the thought process and what ended up nudging them toward believing the scammer about the workflow. A code sent like this in a legitimate workflow could be plausible. Maybe it's a requirement to ensure that the customer is indeed acknowledging the operation and the CSR isn't taking actions behind the customer's back, for instance. The author had a lot of signals pointing toward legitimacy to counteract their natural skepticism, it was a stressful situation and the nature of a phone call puts time pressure into the decision making, increasing the odds of a mistake. Your example points out that false positives on the "scam or ham" decision do have a cost to the contact recipient too, so "never respond to anything" comes with risks and costs too. It's hard to be perfect.
  • tgsovlerkhgsel 5y ago
    1) You don't hear about the stories where the scam is stopped. 2) As you have noticed yourself, legitimate banks do what they can to make their actual requests indistinguishable from scams, and "not falling for that" can have severe consequences.
  • fatnoah 5y ago
    > In order to do that, I needed to relay a confirmation code that would be texted to me. Everything up to that point matches exactly what happened when I got a call from my own bank (Charles Schwab) regarding fraudulent charges. However, whenever Schwab sends me a code (or Bank of America, Coinbase, etc) the code comes with a message stating that an employee will never ask you for this code. The fact that OP is an "expert" yet fell for this shows me that they are in fact not an expert here. Don't get me wrong, the execution by the scammer was slick, but I would expect an "expert" to be familiar with their own bank's policies: "Wells Fargo will not call or text you requesting an access code. We may ask for an access code when you call Wells Fargo customer service. Always contact us using a trusted number on the back of your card or wellsfargo.com."
• alskdjflaskjdhf 5y ago
  Yes, this is scam prevention 101. Anyone who called you is always unverified. It's hard for me to take seriously a "scam prevention expert" who doesn't seem to know or follow this rule, which by itself is enough to protect you from most scams. Normally I try not to victim blame people for getting scammed, but when you've made a declaration like that you forfeit that right. I'll also point out that the author seems to have some complicated arrangement for their phone number(s), presumably in the name of security, that in fact got in the way of identifying this to be a scam.
  • kmonsen 5y ago
    I can see a normal person falling for this, but in my opinion this person called themselves a scam expert is a scam in itself. The claim that this has only been praise since 2018 is absurd, even if true being four years behind on current practices is making you a no longer expert.
  • klik99 5y ago
    Regarding the complex phone arrangement: There's an effect, the name escapes me, that adding security can make threats less frequent but more dangerous. Sounds like he was more complacent because he had trust in his phone system. And I agree about author - if he had said that he violated an easy rule and owned that I would take his credentials more seriously. Everyone makes mistakes, but he didn't list this simple, well-known rule as a way of preventing this.
• roozbeh18 5y ago
  I am a security guy by profession, the other day my wife singed up for a tesla and they ran her credit. next day we get a random call from wellsfargo regarding an auto application and wanted to verify her information. my wife confused why wellsfargo calling, did what I always ask her to do. tell the individual to provide her with the case number and she will call back and they do not need to provide her the call back number. This is easy to remember for most people and She did just that. It turned out tesla has multiple financier which tesla failed to mention that one is wellsfargo.
• blondin 5y ago
  surprised too, once i read it all started with a phone call from author's bank. your bank will "almost" never ask you for your info on the phone. if they do, you don't have to provide it. you can ask to go to a branch in-person, or log onto the website to provide the required information. all banks should often remind their customers of this. mine does. banks and phone carriers should do scam and fraud trainings for customers. or friendly reminders.
• tempestn 5y ago
  This is good advice, despite it being a pain sometimes! I once got a voicemail from the fraud department at my bank, with a number to call back. I googled the number and all that came up were stories about being scammed. So I was 95% sure it was a scam, but called my bank directly just in case. The person who answered assured me they hadn't contacted me, and it was indeed a scam. I later got a follow-up voicemail from the "fraud department", from the same supposed scam number, which I ignored. Then, the next time I went to use my card, it was blocked. I called the bank again and spoke to someone new, who informed me that the original calls had been legitimate - they had the same reference number and everything - and the card had been blocked due to lack of response! Obviously a false positive on the scam detector is less of a problem than a false negative, but was still pretty incredible. No idea what was with all the people talking about being scammed from that number online; I can only assume that they (like the first rep) assumed it was a scam, since if the bank needs to call you, they should tell you to call back using the number on your card, not some random number they give you. But apparently that's exactly what they did.
  • aceazzameen 5y ago
    I had something similar. One time I got a phone call from a "Scam Likely" and decided to answer it. And it was an automated message from my bank asking if some purchases in another state were real or fraudulent. At this point I began to second guess if it was a scam or not, but had to assume it still was. I ended up logging into my account and seeing the same fraudulent purchases that it listed over the phone. So I called the number on my card and had it all settled. I found it weird that the original call was a false positive though.
    • MerelyMortal 5y ago
      Probably because the phone number is calling about a scam (fradulant charge), and then when they hang up, people report the phone number as a scam because they don't understand the difference.
      • underwater 5y ago
• Isthatablackgsd 5y ago
  I have the same rule for online chat support. Last week, I cancelled my Netflix subscription and been trying to remove my credit card details from my account to prevent surprise reactivation in the future. There wasn't an option to do it online, so I went in their chat support and ask them to remove my CC information from my account. Then they asked me to provide my CC number to validate who I am. I told the rep that I am not comfortable sharing my CC information over the chat and prefers only give out my service code or alternative information. This rep kept ensuring that it is secured and they can't see what I am typing in. I asked them to initiate it and I will decide if it is trustworthy to put it down. I got the prompt and it asked for a full CC number. I declined the prompt and told them that I'm not comfortable doing that. And it didn't help that the rep are unintentionally behaving like a scammer. I shared my concerns about the rep behavior and remarks that scammers can say those things. The rep understand my concerns and asked for other information like the email address that is linked in the account and what are two recent activity on the device I uses. I gave out the information and validated I am the accountholder. Then the rep processed my request and I see my CC information is removed from my Netflix account.
• nilsbunger 5y ago
  Banks and health care providers have aggressively trained customers to be ok with giving sensitive info in a received call. It's a real disservice to the community, but kind of a tragedy of the commons. I also do a callback (verifying the number they give me via a google search) but it seems like almost no one else does. On one of these calls from a bank, I asked the agent whether anyone else asked to do a callback, and they said no one ever did this.
  • unixbane 5y ago
    > it seems like almost no one else does Nope, I do basic stuff like this too. And it's basic stuff. As in, can be defeated by simple wiretaps in infrastructure outside your control.
• thathndude 5y ago
  Agreed. It’s easy to play Monday morning quarterback, but the author of this article made some pretty big blunders for an expert.
• aceazzameen 5y ago
  That's good advice. I'm also wary of providing information over a customer service chat. A recent example that comes to mind was when I was price matching a product on Best Buy's website over a chat session. The rep confirmed the price match was valid and began to initiate it. And then he started asking for all of my personal details including, phone number, address, and credit card. When I politely refused, he thought I didn't want the price match anymore. I confirmed I still did, and he said he needed all of the info to place the order for me. I had assumed I would be sent a personalized link to order the product, or it would just be added to my cart (since I was signed in). But no, he needed personal info which would live in a chat log. I ended up ordering from the other retailer. Anyways, maybe there was nothing wrong with providing those details. Maybe they were already available to him on his screen. But the act of asking for that info and making it commonplace for people to just provide it is how so many scams are successful. I don't know how we get away from bad security practices being the norm.
• pmoriarty 5y ago
  "There's one easy rule that could have avoided all of this - never give out any info on incoming calls." Also: Just call your official bank/card phone number yourself. This number should be on the back of your debit/credit card.
• jesusthatsgreat 5y ago
  Or better yet, just don't answer incoming calls that you're not expecting
  • doyouevensunbro 5y ago
    But I might miss out on a sweet extended warranty deal for my car.
• zzzeek 5y ago
  what information is actually being asked of people on incoming calls these days? I never seem to get any of these calls, but banks and credit cards etc. by now should be clued in enough to this stuff that when they actually call a customer, they do nothing more than alert that customer to proper channels they should initiate and follow to resolve the issue.
  • wildrhythms 5y ago
    Entire generation of older Americans who will happily read out their credit card number over the telephone.
    • zzzeek 5y ago
      that was not the point. the point was, the actual banks should at least no longer be asking people for information on initiated phone calls. so that we can in fact tell people, "never give information to anyone that calls you", no need for awkward arguments with legitimate callers, because no legitimate caller would ever do that.
• JKCalhoun 5y ago
  > In order to do that, I needed to relay a confirmation code that would be texted to me. Yeah, BZZZT! End of conversation. Hang up.
• smeej 5y ago
  My doctor's office has a note in my file about this now. Every time they call me, they just say, "Hi smeej, it's NAME at Dr. NAME's office. We have an update for you, so go ahead and hang up and call us back." Works like a charm!
• jon_richards 5y ago
  You literally can’t set up Xfinity internet service without accepting an inbound call and then clicking on a shortened link they text you. I asked for a callback number instead. They hung up and made me go through the entire process again, culminating in a new inbound call a day later and a new sms.
• wyattpeak 5y ago
  I don't know, I maintain that policy fairly strictly, but I can imagine falling for this. I won't as a policy give out information to an incoming call, and I do call back if they want any info from me. But my working memory is not endless. The topic of discussion had changed three times before he was asked for any information, and the information still wasn't PII, it was a confirmation code. The scammer knew enough about him that he wasn't especially on alert. I can well imagine that flag in my mind that I was on an incoming call having been lost before we got to that point. And I suspect that's exactly how the scam was designed.
• ineedasername 5y ago
  >call back the official service number I thought that was fairly standard in banking/credit card fraud as well. That's how I was directed to proceed when I got a call from my CC company about fraud: "please call the service number on the back of your card regarding potentially fraudulent transactions"
• r0fl 5y ago
  Excellent, simple advice! I don’t believe anyone who calls me with a problem, ever! Overdue bill? Okay cool thanks, I’ll call back and ask to speak to someone, hang up. Compromised card? Okay cool thanks, I’ll call the number on the back of my visa, hang up. (This one happened to me) Relative in another country is dying of cancer and needs money for some obscure procedure and doesn’t want to tell anyone else about it only me so don’t call anyone about it? Okay cool, I’ll check and get back to you. I don’t care how important the matter is; your house could be on fire! If you are calling me and need any type of personal info whatsoever, I hang up and call you or someone I know related to you or just Google that thing! Same with door to door salespeople. No thank you goodbye. Hi, the government is giving $5000 credits for people to add insulation, blah blah blah. Can we do a free evaluation? No! I would have heard of this free money falling from the sky from someone I know. No thank you, hang up, give zero info don’t even confirm my name, close the door or hang up. Goodbye, won’t phish me.
  • fphhotchips 5y ago
    > Hi, the government is giving $5000 credits for people to add insulation, blah blah blah. This is... occasionally a real thing. Drives me nuts that they choose to implement it this way though.
    • r0fl 5y ago
      I just don't care. I don't want to risk getting scammed for a few bucks that I was not expecting. Give the $5000 to someone else, I'm fine.
• TheSpiceIsLife 5y ago
  I go one step further and tell them I don't talk to unauthenticated callers, ask them for a reference number and an published return phone number that I can authentic using the usual methods (website, advertising material), explain to them that unaurhticated / cold calls are unethical, and then end the call.
• msluyter 5y ago
  Am I alone in just never answering my phone? Like, ever, for _any_ unknown number. Seems like that alone solves a certain class of problems.
  • navjack27 5y ago
    That's what I do. If it's actually important I'll get physical mail or a knock on my door. If I didn't request the communication then the communication is not legit.
• chrismcb 5y ago
  I feel like the author made two mistakes that anyone who goes after scammers should know. First is to never trust the caller. Didn't matter what info they have. Second is never give your 2fa. Who cares if some third party product has some wonky scheme that requires it. Don't do it.
• deleted 5y ago
  [deleted]
• jimt1234 5y ago
  Better rule: NEVER answer the phone.
• mettamage 5y ago
  > There's one easy rule that could have avoided all of this - never give out any info on incoming calls. When I don't recognize a number, I don't pick up. I tell them to email me/text me and that they provide when they called and with what number. Then I might call them back. Asking extra effort from unknown people will do a few things: - Scammers won't do it (not yet anyway) - Spammers won't do it either - Anyone lazy won't do it
• mns 5y ago
  I think I read about this rule here on HN and have been following it since a couple of years. The funny thing is, banks do scammer like things so often. I had a yearly subscription that tried to renew and they tried to charge me first for 0, and bank rejected it. 2 hours later I get a call from a weird number from my city (when my bank is in another city and all official numbers are from there) from apparently the fraud department of another bank that now handles fraud prevention from my bank. I refused to give them any info, told them I will call the bank back and just called the number on my card, which is the default support number for my bank and sorted everything out in 5 minutes.
• Cthulhu_ 5y ago
  I feel like all banks and other such institutions should give trainings / information at least once a year on how they will contact you in the case of e.g. fraud. I think that any phone calls from a bank about fraud should only be a notification and them telling you to "go to the website, the Contact page, there you will find a number to call in case of fraud". Without naming a web address. And the search engines should mark bank websites and the like as protected, so neither competitors nor scammers can buy ad space when people search for a bank by name.
• HWR_14 5y ago
  I find there being little risk to giving a yes/no for "is this charge fraudulent" although maybe that's a higher risk than I anticipate.