4 ms·

Nobody in any kind of profession are immune to scamming. People have bad days, you could be hit by a novel scam, or your accounts/systems could already be parti

by d4mi3n 4y ago

Nobody in any kind of profession are immune to scamming. People have bad days, you could be hit by a novel scam, or your accounts/systems could already be partially compromised—allowing an attacker more intel than you would expect them to have. I’d caution any security professional or engineer to think they’re too smart or savvy to avoid this stuff. Assume you will be compromised at some point and make damn sure you can recover accounts or assets that are important to you. Failing that, get insured or figure out ways to mitigate the worst of your liabilities.

hamburglar 4y ago
Security pro here. I came pretty close to falling for the “this is the power company and we are cutting off your power unless you pay the bill in the next 45 minutes” scam. It was late in the day during winter, so I knew if it got cut off, my small children were going to have a miserable night; and I was on a crowded bus and unable to get out my laptop to log into the website. I also knew my credit card had recently been rotated and that maybe I had forgotten to update it on the power company’s site. So I had a couple reasons to believe the situation could be real. The only thing that tipped me off was that they suggested the best way to pay quickly was to go buy iTunes gift cards and read them the numbers over the phone. If these boneheads had a way to take credit cards over the phone I might have been sunk.
- Pyxl101 4y ago
  If they had taken credit cards, and made fraudulent transactions, maybe they could have made a few purchases in retail stores, but as soon as you detected that fraud you’d call the bank and issue a chargeback - a hassle but you’re not out any money. Also, banks are smart. If a single CC is being simultaneously used in multiple physical locations, that’s an immediate red flag for fraud. My bank also asks for OTPs when I make online payments at novel/obscure websites. A scammer who got my full CC number couldn’t make a fake physical card since it’s chip-and-pin; or at least not use it at any mainstream retailer which would require a chip transaction. So they’d be limited to online ones. I suspect the bank might even be passed the IP or other fingerprint details when authenticating the transaction, resulting in OTP requirements when risk is detected (online transaction from foreign country when I live in my country). As long as you have a couple of CCs (so you can still pay for stuff if one gets deactivated due to fraud), CC fraud will typically be detected by the bank and refunded, along with new card issuance. My main CC company will also text me randomly asking if any of the last three charges was unauthorized, with their details. Sometimes the card is paused until I respond. This most typically happens when I’m traveling. If I text back that they’re all legitimate then the card works again immediately; if one is fraudulent then they get me on the phone to confirm the details and issue a new card. The CC companies seem to be pretty good about not having false alarms when you travel any more (though if you’re traveling internationally, giving them a heads up helps avoid issues) - I believe it’s simultaneous use from multiple geos that trips fraud alarms.
  - Gh0stRAT 4y ago
    RE chargebacks: stolen cards are often monetized these days with a scheme known as "triangle fraud". Here's how it works: 0) the scammer somehow acquires Person A's credit card info 1) the scammer sets up an online store on Amazon or similar and sells some popular item at a 20% discount (eg Nespresso pods) 2) the scammer doesn't actually have that item in stock, but when they get an order from Person B, they use the stolen card to place another order with a legitimate seller and set the destination address to Person B's address (basically drop-shipping but where the victim is paying for the cost of the goods being sold) 3) Now the scammer has received already-laundered clean money from an online transaction, and Person B got the product they wanted on-time and at a steep discount. They're happy, and certainly won't be complaining to their credit card company. 4) when Person A reports their card stolen and tries to perform a chargeback, the legitimate seller who acted as an unwitting drop-shipper ends up eating the cost.
    - d4mi3n 4y ago
      DEFCON 27 had a talk on exactly this by Nina Kollars, which I suspect is where the Nespresso reference comes from. It's an excellent overview of the topic of triangle fraud. :) DEF CON 27 - Confessions of an Nespresso Money Mule Free Stuff and Triangulation Fraud: https://www.youtube.com/watch?v=4fYZpRBuh-s https://www.youtube.com/watch?v=4fYZpRBuh-s
    - alexb_ 4y ago
      Almost impressed at the cleverness of this all! Especially since, if it's done right, all parties see "business as usual" - and even if they DO suspect a scam, nobody has any incentive past a moral one to say anything.
      - danachow 4y ago
        Wait what? The person with the stolen credit card will report the fraudulent charge causing a chargeback for the seller - how is that “business as usual”? If the business is getting hit with chargebacks they sure as fuck have a financial motivation if not moral one to report it. This relies on churn and hoping that a percentage of the fraudulent charges go unnoticed. But if it’s oversight then it’s not really that party “seeing” anything.
- teekert 4y ago
  I'm happy enough to live in a country where this is considered so inhumane that this is very obviously a scam. I understand why you'd (almost) fall for this. I think it is wrong to assume you never will. So put safeguards in place, it may be good to start thinking about how those could look like. I have no idea... I'm very afraid my parents will someday waste a lot of money on a scam like this. Or, you know, me.
  - mcv 4y ago
    Yeah, just cutting off power out of nowhere is way too hard for me to believe. You always first get a couple of warnings over the course of a couple of months. I've got to admit, although I'm not a security expert at all, all of these scams sound way too unlikely for to me fall for. But then again, it's easy to think that when you're behind your desk reading an article called "how I got scammed". It's very different when they reach you when you're already stressed and confused. Who knows what I'd fall for. I hope I'll never find out.
fastball 4y ago
I am 100% sure I will never fall for a scam where I am told to read a code SMS'd to me back to them, because I that is just an action I will never do.
- deleted 4y ago
  [deleted]
- unsupp0rted 4y ago
  I'm pretty sure now, but if I haven't slept for 2 days and/or I suspect a family member might be in trouble, I can imagine my brain betraying me.
avianlyric 4y ago
General rule that everyone should apply to phone calls from banks or utilities that they didn’t schedule (and I mean schedule, not just a call you’re expecting at a random time) in advanced is to get the name of company, hang up, search for their number and call back. If you ever the caller ever placed you under and sort of pressure, or makes some sort of threat (E.g. your money is about to be stolen, your power will be cut off, the police will arrest you). Hang up immediately, once a scammer has got their claws into the panic centres of your brain, you’re a lost cause. The longer you’re on the phone, the more time they have to make you panicked.
- rbut 4y ago
  I do this, but the operators get quite rude that I won't give my details right then and now. Afterwards getting back on to the original operator is almost impossible and I have to spend 30 minutes on hold, and department swapping, trying to find someone who knows why they were originally calling me. Banks, and the like, need a system where you can call their (verifiable) number, and then enter a unique code that connects you back to the original operator that was calling you. It shouldn't be this hard to be safe. Especially when they continually preach to us about phone scams that we should be wary of.

by d4mi3n 4y ago

hamburglar 4y ago

Security pro here. I came pretty close to falling for the “this is the power company and we are cutting off your power unless you pay the bill in the next 45 minutes” scam. It was late in the day during winter, so I knew if it got cut off, my small children were going to have a miserable night; and I was on a crowded bus and unable to get out my laptop to log into the website. I also knew my credit card had recently been rotated and that maybe I had forgotten to update it on the power company’s site. So I had a couple reasons to believe the situation could be real. The only thing that tipped me off was that they suggested the best way to pay quickly was to go buy iTunes gift cards and read them the numbers over the phone. If these boneheads had a way to take credit cards over the phone I might have been sunk.

Pyxl101 4y ago
If they had taken credit cards, and made fraudulent transactions, maybe they could have made a few purchases in retail stores, but as soon as you detected that fraud you’d call the bank and issue a chargeback - a hassle but you’re not out any money. Also, banks are smart. If a single CC is being simultaneously used in multiple physical locations, that’s an immediate red flag for fraud. My bank also asks for OTPs when I make online payments at novel/obscure websites. A scammer who got my full CC number couldn’t make a fake physical card since it’s chip-and-pin; or at least not use it at any mainstream retailer which would require a chip transaction. So they’d be limited to online ones. I suspect the bank might even be passed the IP or other fingerprint details when authenticating the transaction, resulting in OTP requirements when risk is detected (online transaction from foreign country when I live in my country). As long as you have a couple of CCs (so you can still pay for stuff if one gets deactivated due to fraud), CC fraud will typically be detected by the bank and refunded, along with new card issuance. My main CC company will also text me randomly asking if any of the last three charges was unauthorized, with their details. Sometimes the card is paused until I respond. This most typically happens when I’m traveling. If I text back that they’re all legitimate then the card works again immediately; if one is fraudulent then they get me on the phone to confirm the details and issue a new card. The CC companies seem to be pretty good about not having false alarms when you travel any more (though if you’re traveling internationally, giving them a heads up helps avoid issues) - I believe it’s simultaneous use from multiple geos that trips fraud alarms.
- Gh0stRAT 4y ago
  RE chargebacks: stolen cards are often monetized these days with a scheme known as "triangle fraud". Here's how it works: 0) the scammer somehow acquires Person A's credit card info 1) the scammer sets up an online store on Amazon or similar and sells some popular item at a 20% discount (eg Nespresso pods) 2) the scammer doesn't actually have that item in stock, but when they get an order from Person B, they use the stolen card to place another order with a legitimate seller and set the destination address to Person B's address (basically drop-shipping but where the victim is paying for the cost of the goods being sold) 3) Now the scammer has received already-laundered clean money from an online transaction, and Person B got the product they wanted on-time and at a steep discount. They're happy, and certainly won't be complaining to their credit card company. 4) when Person A reports their card stolen and tries to perform a chargeback, the legitimate seller who acted as an unwitting drop-shipper ends up eating the cost.
  - d4mi3n 4y ago
    DEFCON 27 had a talk on exactly this by Nina Kollars, which I suspect is where the Nespresso reference comes from. It's an excellent overview of the topic of triangle fraud. :) DEF CON 27 - Confessions of an Nespresso Money Mule Free Stuff and Triangulation Fraud: https://www.youtube.com/watch?v=4fYZpRBuh-s https://www.youtube.com/watch?v=4fYZpRBuh-s
  - alexb_ 4y ago
    Almost impressed at the cleverness of this all! Especially since, if it's done right, all parties see "business as usual" - and even if they DO suspect a scam, nobody has any incentive past a moral one to say anything.
    - danachow 4y ago
      Wait what? The person with the stolen credit card will report the fraudulent charge causing a chargeback for the seller - how is that “business as usual”? If the business is getting hit with chargebacks they sure as fuck have a financial motivation if not moral one to report it. This relies on churn and hoping that a percentage of the fraudulent charges go unnoticed. But if it’s oversight then it’s not really that party “seeing” anything.
teekert 4y ago
I'm happy enough to live in a country where this is considered so inhumane that this is very obviously a scam. I understand why you'd (almost) fall for this. I think it is wrong to assume you never will. So put safeguards in place, it may be good to start thinking about how those could look like. I have no idea... I'm very afraid my parents will someday waste a lot of money on a scam like this. Or, you know, me.
- mcv 4y ago
  Yeah, just cutting off power out of nowhere is way too hard for me to believe. You always first get a couple of warnings over the course of a couple of months. I've got to admit, although I'm not a security expert at all, all of these scams sound way too unlikely for to me fall for. But then again, it's easy to think that when you're behind your desk reading an article called "how I got scammed". It's very different when they reach you when you're already stressed and confused. Who knows what I'd fall for. I hope I'll never find out.

fastball 4y ago

I am 100% sure I will never fall for a scam where I am told to read a code SMS'd to me back to them, because I that is just an action I will never do.

deleted 4y ago
[deleted]
unsupp0rted 4y ago
I'm pretty sure now, but if I haven't slept for 2 days and/or I suspect a family member might be in trouble, I can imagine my brain betraying me.

avianlyric 4y ago

General rule that everyone should apply to phone calls from banks or utilities that they didn’t schedule (and I mean schedule, not just a call you’re expecting at a random time) in advanced is to get the name of company, hang up, search for their number and call back. If you ever the caller ever placed you under and sort of pressure, or makes some sort of threat (E.g. your money is about to be stolen, your power will be cut off, the police will arrest you). Hang up immediately, once a scammer has got their claws into the panic centres of your brain, you’re a lost cause. The longer you’re on the phone, the more time they have to make you panicked.

rbut 4y ago
I do this, but the operators get quite rude that I won't give my details right then and now. Afterwards getting back on to the original operator is almost impossible and I have to spend 30 minutes on hold, and department swapping, trying to find someone who knows why they were originally calling me. Banks, and the like, need a system where you can call their (verifiable) number, and then enter a unique code that connects you back to the original operator that was calling you. It shouldn't be this hard to be safe. Especially when they continually preach to us about phone scams that we should be wary of.