3 ms·
> I knew that I should hang up and call the number on the back of my card Everything after this, where the guy DIDN'T call the number on the card, is where it
by walrus01 5y ago
> I knew that I should hang up and call the number on the back of my card
Everything after this, where the guy DIDN'T call the number on the card, is where it went wrong.
The guy went along with the social engineer who was calling him inbound, and used a SMS-based password token reset to get into his account. After that, it was game over.
- jabbany 5y agoYou'd think that services should be aware of the security concerns in this inbound vs outbound distinction, but I've had cards where after calling the number on the card, customer service person actually instructed me to hang up and await a callback from them... Which almost always came from some other line with some other number... OTOH in hindsight it could be because they don't trust caller id on their side and want to verify that the call is really made from/to a phone number that's on file.