5 ms·

Related. I listed something for sale on Craigslist recently and got a bunch of messages right away that asked obvious questions that were in the listing. One su

Related. I listed something for sale on Craigslist recently and got a bunch of messages right away that asked obvious questions that were in the listing. One suggested that his wife pick it up, and can I take Zelle? Went silent when I said cash only. But the most interesting scammer said: "for my safety, can I send you a 6-digit number, and you confirm it, so I know the listing is not fake?" I say yes, unsure what the scam was going to be, but sure it was a scam. Moments later I got an SMS from Google Voice asking me to verify my phone number. Mofo tried to steal my number, presumably to use it to scam other people. I was pissed and impressed.

nicoburns 4y ago
I got a similar scam via instagram DMs recently. They claimed to need me to confirm a code so that they could log in, but actually just triggered my own password reset. Message sent from an actual friend's account (which they had presumably successfully scammed) too. Certainly made me think about how password reset emails are worded!
- jeromegv 4y ago
  Most of those are crypto scams. The IG account starts posting about how they got rich on crypto. This is a very prevalent scam.
  - asdff 4y ago
    I see a lot of these too. They take over regular people's accounts, e.g. people from school I still follow, probably brute forcing passwords, then they post all this content how they are self made off crypto but the person in the videos doing the prostelyzation is in no way shape or form the same person who previously held the account. Clearly they do this to get a decent follower count initially for their spam bots, but my word is anyone who follows John Doe actually going to believe a scam video that is clearly not John Doe coming from John Doe's account claiming to be him? There has to be more effective angles.
    - thamer 4y ago
      I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts. It might be instead that your friends re-used a password that was leaked/stolen from somewhere else; anyone with a non-trivial number of online accounts using the same email will be listed in multiple leaks on aggregators like https://haveibeenpwned.com/ https://haveibeenpwned.com/.
    - rtkwe 4y ago
      Part of it is they're just looking for the lowest hanging suckers that won't notice, easier victims mean less wasted effort on someone who might bite initially but won't convert into real cash. Also I'm betting it's to legitimize their existing spam accounts with follows from (formerly) authentic users.
ilololed 4y ago
So, how many fake 6-digit codes did you give them before they caught on?
- noveltyaccount 4y ago
  My exact reply was "lol fuck you"
- water8 4y ago
  500,000 on average
aaronwalker 4y ago
Hmm. Makes me wonder about the security of two factor authentication schemes. For scams like these it's pretty obvious that someone is trying to access your account, but I do wonder if there are more secure ways to verify your identity when changing account settings.
- tialaramex 4y ago
  It will depend on the authentication strategy. For WebAuthn it isn't a problem, short of sending you their physical authenticator (e.g. their Yubikey, or their iPhone) they can't help you sign in as them even if they wanted to, so this makes it very hard to fool ordinary users into helping crooks.
asdff 4y ago
A few years ago one of my friends pulled a prank on another friend and made a fake craigslist listing for some truck with his info. I don't think his phone has recovered from the spam to this date. There must be a thousand crawlers combing every single craigslist ad there is looking for information to add to these databases.
minimaxir 4y ago
2FA scams are common on /r/Scams
usmannk 4y ago
They were not trying to steal your number. They were using your number to back a new google voice account, so that they could get another free number from google. It’s a common scam, used on facebook marketplace sellers as well, and actually works best if the victim has never used google voice before.
- sshine 4y ago
  >> Mofo tried to steal my number, presumably to use it to scam other people. > They were not trying to steal your number. They were using your number to back a new google voice account I interpreted "steal my number" as "sign up using my number". Perhaps the more accurate wording would be "impersonate me". Either way, thanks for clarifying.
- noveltyaccount 4y ago
  That's a fair clarification, I figured they were trying to move my number to Google voice, but now that you mention it I think that would require more paperwork. I did cross-post to Facebook Marketplace :)
s0rce 4y ago
I've got both those scams. The Zelle person sent me a fake email claiming to be from my bank and that to verify I needed to send them money so they could send me money, right...
jvanderbot 4y ago
my wife had the same thing happen. when she said no, the sender cussed her out a bunch. after TFA I can see why he may have been desperate and venting.
- dylan604 4y ago
  well, at least they ended the charade quickly by behaving that way rather than continuing the charade in an attempt to convince.
Jailbird 4y ago
"How about you send a 13-digit number instead"?
- water8 4y ago
  How about you just send a freaking RSA key
nsenifty 4y ago
I don't understand why the 2FA texts don't clearly state what the intent of the code is? Something on the lines of "you or someone tried to create a new Google voice number. Please enter this code xyz on the form to proceed".
- water8 4y ago
  Do you really need a message like that? If you didn’t try to sign in But you get a notification, it’s pretty freaking clear what’s going on. Alternatively if you just signed up a new account you should probably expect a message like that
  - Vanit 4y ago
    A common attack is to impersonate a trusted institution and ask for confirmation via an SMS code. The attacker is going through the lost your password recovery flow for 2FA, but pretends it's just for confirmation of identity. If they're smart they can even perform the attack twice and change the 2FA number for your account. If the code was accompanied by an explanation of the intent it would mitigate the attack, that's why.
  - Sakos 4y ago
    Clear to whom? Have you ever worked with the average user?
    - water8 4y ago
      It doesn’t matter how many notifications you give the average user if that’s your argument
- glogla 4y ago
  Around here all banks that used SMS for 2FA did that. You'd get sms detailing the transaction - whether it's log in, transfer or anything. In case it is a transfer, the text included the amount and destination account. Everyone mostly went to "authentication apps" now but those still show what are you confirming. Not sure why it is not a common practice.
deleted 4y ago
[deleted]
shartshooter 4y ago
This just happened to me, yesterday, for the very first time! Watch out!

nicoburns 4y ago

I got a similar scam via instagram DMs recently. They claimed to need me to confirm a code so that they could log in, but actually just triggered my own password reset. Message sent from an actual friend's account (which they had presumably successfully scammed) too. Certainly made me think about how password reset emails are worded!

jeromegv 4y ago
Most of those are crypto scams. The IG account starts posting about how they got rich on crypto. This is a very prevalent scam.
- asdff 4y ago
  I see a lot of these too. They take over regular people's accounts, e.g. people from school I still follow, probably brute forcing passwords, then they post all this content how they are self made off crypto but the person in the videos doing the prostelyzation is in no way shape or form the same person who previously held the account. Clearly they do this to get a decent follower count initially for their spam bots, but my word is anyone who follows John Doe actually going to believe a scam video that is clearly not John Doe coming from John Doe's account claiming to be him? There has to be more effective angles.
  - thamer 4y ago
    I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts. It might be instead that your friends re-used a password that was leaked/stolen from somewhere else; anyone with a non-trivial number of online accounts using the same email will be listed in multiple leaks on aggregators like https://haveibeenpwned.com/ https://haveibeenpwned.com/.
  - rtkwe 4y ago
    Part of it is they're just looking for the lowest hanging suckers that won't notice, easier victims mean less wasted effort on someone who might bite initially but won't convert into real cash. Also I'm betting it's to legitimize their existing spam accounts with follows from (formerly) authentic users.

ilololed 4y ago

So, how many fake 6-digit codes did you give them before they caught on?

noveltyaccount 4y ago
My exact reply was "lol fuck you"
water8 4y ago
500,000 on average

aaronwalker 4y ago

Hmm. Makes me wonder about the security of two factor authentication schemes. For scams like these it's pretty obvious that someone is trying to access your account, but I do wonder if there are more secure ways to verify your identity when changing account settings.

tialaramex 4y ago
It will depend on the authentication strategy. For WebAuthn it isn't a problem, short of sending you their physical authenticator (e.g. their Yubikey, or their iPhone) they can't help you sign in as them even if they wanted to, so this makes it very hard to fool ordinary users into helping crooks.

asdff 4y ago

A few years ago one of my friends pulled a prank on another friend and made a fake craigslist listing for some truck with his info. I don't think his phone has recovered from the spam to this date. There must be a thousand crawlers combing every single craigslist ad there is looking for information to add to these databases.

minimaxir 4y ago

2FA scams are common on /r/Scams

usmannk 4y ago

They were not trying to steal your number. They were using your number to back a new google voice account, so that they could get another free number from google. It’s a common scam, used on facebook marketplace sellers as well, and actually works best if the victim has never used google voice before.

sshine 4y ago
>> Mofo tried to steal my number, presumably to use it to scam other people. > They were not trying to steal your number. They were using your number to back a new google voice account I interpreted "steal my number" as "sign up using my number". Perhaps the more accurate wording would be "impersonate me". Either way, thanks for clarifying.
noveltyaccount 4y ago
That's a fair clarification, I figured they were trying to move my number to Google voice, but now that you mention it I think that would require more paperwork. I did cross-post to Facebook Marketplace :)

s0rce 4y ago

I've got both those scams. The Zelle person sent me a fake email claiming to be from my bank and that to verify I needed to send them money so they could send me money, right...

jvanderbot 4y ago

my wife had the same thing happen. when she said no, the sender cussed her out a bunch. after TFA I can see why he may have been desperate and venting.

dylan604 4y ago
well, at least they ended the charade quickly by behaving that way rather than continuing the charade in an attempt to convince.

Jailbird 4y ago

"How about you send a 13-digit number instead"?

water8 4y ago
How about you just send a freaking RSA key

nsenifty 4y ago

I don't understand why the 2FA texts don't clearly state what the intent of the code is? Something on the lines of "you or someone tried to create a new Google voice number. Please enter this code xyz on the form to proceed".

water8 4y ago
Do you really need a message like that? If you didn’t try to sign in But you get a notification, it’s pretty freaking clear what’s going on. Alternatively if you just signed up a new account you should probably expect a message like that
- Vanit 4y ago
  A common attack is to impersonate a trusted institution and ask for confirmation via an SMS code. The attacker is going through the lost your password recovery flow for 2FA, but pretends it's just for confirmation of identity. If they're smart they can even perform the attack twice and change the 2FA number for your account. If the code was accompanied by an explanation of the intent it would mitigate the attack, that's why.
- Sakos 4y ago
  Clear to whom? Have you ever worked with the average user?
  - water8 4y ago
    It doesn’t matter how many notifications you give the average user if that’s your argument
glogla 4y ago
Around here all banks that used SMS for 2FA did that. You'd get sms detailing the transaction - whether it's log in, transfer or anything. In case it is a transfer, the text included the amount and destination account. Everyone mostly went to "authentication apps" now but those still show what are you confirming. Not sure why it is not a common practice.

deleted 4y ago

[deleted]

shartshooter 4y ago

This just happened to me, yesterday, for the very first time! Watch out!