3 ms·

> So, I faithfully relayed the Apple Pay verification code, as requested. I cannot fathom how a tech professional would do this. I mean, I read their justifica

> So, I faithfully relayed the Apple Pay verification code, as requested. I cannot fathom how a tech professional would do this. I mean, I read their justification, but it still doesn't make an ounce of sense to me, other than their brain was shut off for the entire call.

renewiltord 5y ago
I think I can kind of get it. This guy has made his own life so complicated that he no longer knows what a normal guy operates like. A normal person knows that scam calls come in all the time, so they're on the alert for them. A normal person has their MFA device or has MFA on text and they know these two mechanisms have codes they should never relay. If they got an MFA via email they'd immediately have their suspicions up. A normal person, through the normalcy of their system, assumes that if this bank is having trouble dealing with them they'd have trouble dealing with everyone and that's just absurd. But if you're the _abnormal_ person, then you assume your custom setup is the problem. That's because 99% of the time it is the problem. He's fucked himself into being a social engineering target. Back in the day, this was a thing with Linux. You'd encounter a bug in a Windows app hosted through the WINE runtime and you'd think "Well, it's WINE, it can't be perfect. I'll just report it on WineHQ and go about my life". Well, sometimes it wouldn't be WINE. It would just be the app itself. But you assumed that because you're the weird one using WINE. Everyone else is using Windows. So you blame your own setup and your bug doesn't get fixed because it's in the wrong place. So this is my attitude to a lot of security stuff. I want to be the normal user. Huge advantages: - If something is broken for you, it's broken for everyone. So no one will blame you for consequences. - If something is weird about it, it's weird; you should be suspicious - If things go badly for you because of it, no one will blame you because they can relate; you will get help easier
- mort96 5y ago
  > A normal person has their MFA device or has MFA on text and they know these two mechanisms have codes they should never relay. If they got an MFA via email they'd immediately have their suspicions up. What? I get MFA codes on e-mail all the time. I've got them from Steam, from Mojang, from GitHub, from Square Enix, from Digital Ocean, etc. For a normal person, getting some code you have to relay to some other entity via e-mail is normal. Not to mention that the e-mail was actually a legit 2FA e-mail from Wells Fargo? That's how this scam works after all; you tell the victim that they'll receive a message with a code, then the scammer tries to do some action which requires 2FA, then the victim reads the code from the 2FA message. The fact that you would categorize this e-mail as an obviously fake e-mail which normal people would immediately recognize as suspicious, when it's actually a real 2FA e-mail, is pretty telling I think. > A normal person, through the normalcy of their system, assumes that if this bank is having trouble dealing with them they'd have trouble dealing with everyone and that's just absurd. No, this is absurd. Everyone has experienced having some one-off problem with some account in some system. Not to mention that the case in TFA was explicitly about fraud prevention calling you about suspected fraudulent charges, which seems extremely normal to me. Limiting individual accounts due to suspected fraud, and then notifying the owner of that account, is exactly the purpose of fraud prevention. The only part of this event which the author's unusual set-up is responsible for, is that she gave an unusual level of credibility to the scammer just for calling her phone number. But if it comforts you to think normal people would be immune to this scam just because normal people have their information more readily available on the internet, keep believing that I guess.

renewiltord 5y ago

I think I can kind of get it. This guy has made his own life so complicated that he no longer knows what a normal guy operates like. A normal person knows that scam calls come in all the time, so they're on the alert for them. A normal person has their MFA device or has MFA on text and they know these two mechanisms have codes they should never relay. If they got an MFA via email they'd immediately have their suspicions up. A normal person, through the normalcy of their system, assumes that if this bank is having trouble dealing with them they'd have trouble dealing with everyone and that's just absurd. But if you're the _abnormal_ person, then you assume your custom setup is the problem. That's because 99% of the time it is the problem. He's fucked himself into being a social engineering target. Back in the day, this was a thing with Linux. You'd encounter a bug in a Windows app hosted through the WINE runtime and you'd think "Well, it's WINE, it can't be perfect. I'll just report it on WineHQ and go about my life". Well, sometimes it wouldn't be WINE. It would just be the app itself. But you assumed that because you're the weird one using WINE. Everyone else is using Windows. So you blame your own setup and your bug doesn't get fixed because it's in the wrong place. So this is my attitude to a lot of security stuff. I want to be the normal user. Huge advantages: - If something is broken for you, it's broken for everyone. So no one will blame you for consequences. - If something is weird about it, it's weird; you should be suspicious - If things go badly for you because of it, no one will blame you because they can relate; you will get help easier

mort96 5y ago
> A normal person has their MFA device or has MFA on text and they know these two mechanisms have codes they should never relay. If they got an MFA via email they'd immediately have their suspicions up. What? I get MFA codes on e-mail all the time. I've got them from Steam, from Mojang, from GitHub, from Square Enix, from Digital Ocean, etc. For a normal person, getting some code you have to relay to some other entity via e-mail is normal. Not to mention that the e-mail was actually a legit 2FA e-mail from Wells Fargo? That's how this scam works after all; you tell the victim that they'll receive a message with a code, then the scammer tries to do some action which requires 2FA, then the victim reads the code from the 2FA message. The fact that you would categorize this e-mail as an obviously fake e-mail which normal people would immediately recognize as suspicious, when it's actually a real 2FA e-mail, is pretty telling I think. > A normal person, through the normalcy of their system, assumes that if this bank is having trouble dealing with them they'd have trouble dealing with everyone and that's just absurd. No, this is absurd. Everyone has experienced having some one-off problem with some account in some system. Not to mention that the case in TFA was explicitly about fraud prevention calling you about suspected fraudulent charges, which seems extremely normal to me. Limiting individual accounts due to suspected fraud, and then notifying the owner of that account, is exactly the purpose of fraud prevention. The only part of this event which the author's unusual set-up is responsible for, is that she gave an unusual level of credibility to the scammer just for calling her phone number. But if it comforts you to think normal people would be immune to this scam just because normal people have their information more readily available on the internet, keep believing that I guess.