4 ms·

There was one time I thought I was being scammed, but it turns out there was an actual issue with my bank account. Sitting at my desk at work, I get a phone ca

There was one time I thought I was being scammed, but it turns out there was an actual issue with my bank account. Sitting at my desk at work, I get a phone call from my bank on by cell phone. "Mr. Anechoic, there appears to be a security issue with your bank account. We can resolve it for you. For security purposes, can you give your checking account number and the last four of you SSN"? This is clearly a scam, right? I tell the guy there is no way I'm giving up that info for a random dude that calls me. He stresses again that there is an issue with my bank account, that the account will be frozen, and there is nothing he can do about it without the account and SSN information. I refuse again, and he tells me that I should go to a local bank to get it resolved. I hang up and go back to work. I log into my bank account website, and all seems fine. After about 20 minutes, something is still bothering me, so I leave work to go to a local branch. I speak to a branch manager about what happened, and she agrees with me that it was clearly an attempted scam and the bank would never call me and ask for that information. But just to be safe, she checks my account on her computer. To our surprise, it turns out there was a security flag on my account! She calls the bank security desk, they confirm that there was an attempt by someone in another branch a few states to get money from my account and the call I got was legit and logged in their system. We get the account locked out, and then the manager asks to talk to a security supervisor about the messed-up way they reached out to me. The security person basically said "this is how they do things" and didn't see the problem. The bank manager apologized, said it was messed up and she would try to run things up the chain to improve their process. Damned if you do, damned if you don't.

alana314 5y ago
That's so dumb! No wonder the industry is rife with scams.
exolymph 5y ago
Not the same thing, but relatedly, every legit email I receive from my health insurance is functionally indistinguishable from phishing. They always bounce me through a million weird domains too. It's very discomfiting and makes me worry that I won't be able to pinpoint a legit phishing attempt because it won't stand out.
- bombcar 5y ago
  The weird domain stuff is something related to SSO I feel, and it is HIGHLY indistinguishable from phishing. So all the "just be smarter" talk from ten years ago about checking your domains, etc is out the window. scammerbillz.biz is ACTUALLY your hospital billing service, too bad.
- tempnow987 5y ago
  I love the weird domains - billing is sometimes outsourced through x redirections, and they use weird third party email hosts (CISCO secure email etc) that is halfway broken with CSS for you to upload your employee rosters (complete with socials and DOB's etc). The domains for these are always commically like phising domains (secure-bank-email.valimail.com etc).
- evilduck 5y ago
  In the same vein, every corporate "security training" email I've received that's been outsourced to a third party vendor looks indistinguishable from spam and phishing, the exact things it goes on to train you not to open. I scare-quote that because they're universally worthless training programs used to tick boxes on compliance forms and not actual training, so I happily flag them as spam. I've also recieved company-wide corporate gifts (like $5 digital gift cards) distributed through extremely spammy looking vendors with dubious looking links. The same goes for the overwhelming majority of vendors, recruiters, and outsourcing companies that are cold-emailing me, it all looks like 50 shades of scam.
  - ineedasername 5y ago
    Yes, this! I had an email from a 3rd party telling me about required training, click the link and use my employee credentials to log in. Other training has been posted as a to-do in our individual HR account portal, and this was an external site, so it set off warning flags. Not only that, the name of the 3rd party was a legit company, but the site the email linked to was not that company's domain. Big red flag! Curious as I am, I run whois on both domains. Completely different registration info! So, confident I've identified a phishing attempt and concerned it might have been shotgunned to many people, I notify the appropriate people. Was it a scam? Nope! In fact the person I notified was quite frustrated because a month earlier there had been an email that, sometime in the future, there would be $X training coming up. Yeah, a month later I had no recollection of a generic HR notification that (when I looked in my archive) made no mention that it would not be using the standard secure MFA HR portal used to link out to all other training. This was all about 4 months after a similar required security training, which was accessed via the usual HR portal, and which listed about half a dozen phishing red flags that the new training violated. But not to worry, my workplace takes security seriously. I guess their seriousness is just very unevenly distributed. It's a good thing we're not really a high value target for hackers.
teawrecks 5y ago
"Cool cool, could you go ahead and close my account, please?"
mafuy 5y ago
How about this: "Very well. Please repeat to me in writing that if I receive an unverified call claiming to be from Your bank, and asking for my personal details, that I am to give the information and follow all instructions and will not be at fault for damage that might result from this." As they clearly won't do that, at least the moron will lose face, and quickly so.
- smarx007 5y ago
  "We don't issue written statements to customers, please call another department. We have locked your account for the time being." The kinds of people who do this boring work all day long may not be so receptive to our witty humor.

alana314 5y ago

That's so dumb! No wonder the industry is rife with scams.

exolymph 5y ago

Not the same thing, but relatedly, every legit email I receive from my health insurance is functionally indistinguishable from phishing. They always bounce me through a million weird domains too. It's very discomfiting and makes me worry that I won't be able to pinpoint a legit phishing attempt because it won't stand out.

bombcar 5y ago
The weird domain stuff is something related to SSO I feel, and it is HIGHLY indistinguishable from phishing. So all the "just be smarter" talk from ten years ago about checking your domains, etc is out the window. scammerbillz.biz is ACTUALLY your hospital billing service, too bad.
tempnow987 5y ago
I love the weird domains - billing is sometimes outsourced through x redirections, and they use weird third party email hosts (CISCO secure email etc) that is halfway broken with CSS for you to upload your employee rosters (complete with socials and DOB's etc). The domains for these are always commically like phising domains (secure-bank-email.valimail.com etc).
evilduck 5y ago
In the same vein, every corporate "security training" email I've received that's been outsourced to a third party vendor looks indistinguishable from spam and phishing, the exact things it goes on to train you not to open. I scare-quote that because they're universally worthless training programs used to tick boxes on compliance forms and not actual training, so I happily flag them as spam. I've also recieved company-wide corporate gifts (like $5 digital gift cards) distributed through extremely spammy looking vendors with dubious looking links. The same goes for the overwhelming majority of vendors, recruiters, and outsourcing companies that are cold-emailing me, it all looks like 50 shades of scam.
- ineedasername 5y ago
  Yes, this! I had an email from a 3rd party telling me about required training, click the link and use my employee credentials to log in. Other training has been posted as a to-do in our individual HR account portal, and this was an external site, so it set off warning flags. Not only that, the name of the 3rd party was a legit company, but the site the email linked to was not that company's domain. Big red flag! Curious as I am, I run whois on both domains. Completely different registration info! So, confident I've identified a phishing attempt and concerned it might have been shotgunned to many people, I notify the appropriate people. Was it a scam? Nope! In fact the person I notified was quite frustrated because a month earlier there had been an email that, sometime in the future, there would be $X training coming up. Yeah, a month later I had no recollection of a generic HR notification that (when I looked in my archive) made no mention that it would not be using the standard secure MFA HR portal used to link out to all other training. This was all about 4 months after a similar required security training, which was accessed via the usual HR portal, and which listed about half a dozen phishing red flags that the new training violated. But not to worry, my workplace takes security seriously. I guess their seriousness is just very unevenly distributed. It's a good thing we're not really a high value target for hackers.

teawrecks 5y ago

"Cool cool, could you go ahead and close my account, please?"

mafuy 5y ago

How about this: "Very well. Please repeat to me in writing that if I receive an unverified call claiming to be from Your bank, and asking for my personal details, that I am to give the information and follow all instructions and will not be at fault for damage that might result from this." As they clearly won't do that, at least the moron will lose face, and quickly so.

smarx007 5y ago
"We don't issue written statements to customers, please call another department. We have locked your account for the time being." The kinds of people who do this boring work all day long may not be so receptive to our witty humor.