4 ms·

Are there banks/companies proactively trying to trick customers? Call, then throw up some red flags, then educate? Especially for older customers a "near-miss"

by V__ 3y ago

Are there banks/companies proactively trying to trick customers? Call, then throw up some red flags, then educate? Especially for older customers a "near-miss" might be helpful to lower the risk of them getting scammed.

amelius 3y ago
Pentesting for the elderly? Sounds like a cool service.
timenova 3y ago
Banks in my country send all sorts of emails with "scammy" subjects, and then when you open them their banner says "Don't fall for such scams" or "Scams start this way". Maybe if they added an option to opt-out of such emails, it would be pretty nice! Now it's just more inbox noise. And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder.
- lambertsimnel 3y ago
  Banks in the UK do all sorts of scammy things, not for that purpose, but as part of their usual business Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof They call customers and ask for security information They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do All of the above risk causing customers to lower their guard to fraud They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard) They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying
  - switch007 3y ago
    > They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof Prime example, Santander From: Santander <santander@email2.yoursantander.co.uk> Subject: Know more about Facebook Scams Congratulations Santander, you've now trained your customers to trust emails from domains like "email2.your<business>.co.uk"
    - deleted 3y ago
      [deleted]
  - expertentipp 3y ago
    I thought that only in my country the banks' "security" turned fucking retarded but it seems it's a global trend. Recently I received legit email from my bank with warning against scammers and the title was "The first step of the scammer will be will be sending an email, text message, or calling you". Is it a double intelligence test or they just admitted to being scammers?
- tsimionescu 3y ago
  > And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder. Perhaps you meant this the other way around? Either way, I have received quite a steady stream of rather obvious phishing attempts directly to my inbox on Outlook.com. Once our twice a month I have a missed Amazon package, or some horrible debt, or an being investigated for tax fraud or other such.
  - timenova 3y ago
    No I mean that if my bank sends me an email with a scammy subject, it won't get caught in the spam filter because everything else is legit, like the From field, their verified domain, email signatures, and the body content. They use the same domain and presumably the same email address to send such emails and other important emails too. But if a scammer sends me a fake email, it'll probably get caught in the spam filter of my email provider (hopefully).
celeritascelery 3y ago
Not for customers per se, but the company I work for will regularly send “scam” emails to us. If you click on the link you get assigned mandatory corporate phishing trainings. Makes you extra cautious.
- mcny 3y ago
  One time at work I forwarded what I thought was a genuine phishing attempt to abuse at stupid corporate email like I was supposed to and they dinged my manager because I had remote images enabled or something. I don't remember changing this setting and this was on a computer they owned. There is no winning with these people. I have since turned off remote images in emails. If you have remote images in messages to my work email, I won't see them. I refuse to turn on remote images because as far as I'm concerned, that's my security policy. I still forward all these "training" emails to abuse at corporate because if I'm doing extra work, they're doing extra work. Recently, they've automated this though because when I email abuse, I immediately get a reply saying congratulations, this was a test message. If this were a real bla bla... Anyway, I think it is safer to forward to abuse just in case.
deleted 3y ago
[deleted]
tgsovlerkhgsel 3y ago
Several banks I use do this all the time. Except they don't do it as a teaching experience, but as part of their normal operations, and if you refuse to do the extremely sketchy, red-flag, never-do-this thing, you will not be able to get your task done. I've been required to provide part or all my online banking PIN on the phone and my credit card PIN on a random sketchy website (as part of 3DSecure). Different banks. Both legit and repeated.

by V__ 3y ago

amelius 3y ago

Pentesting for the elderly? Sounds like a cool service.

timenova 3y ago

Banks in my country send all sorts of emails with "scammy" subjects, and then when you open them their banner says "Don't fall for such scams" or "Scams start this way". Maybe if they added an option to opt-out of such emails, it would be pretty nice! Now it's just more inbox noise. And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder.

lambertsimnel 3y ago
Banks in the UK do all sorts of scammy things, not for that purpose, but as part of their usual business Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof They call customers and ask for security information They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do All of the above risk causing customers to lower their guard to fraud They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard) They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying
- switch007 3y ago
  > They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof Prime example, Santander From: Santander <santander@email2.yoursantander.co.uk> Subject: Know more about Facebook Scams Congratulations Santander, you've now trained your customers to trust emails from domains like "email2.your<business>.co.uk"
  - deleted 3y ago
    [deleted]
- expertentipp 3y ago
  I thought that only in my country the banks' "security" turned fucking retarded but it seems it's a global trend. Recently I received legit email from my bank with warning against scammers and the title was "The first step of the scammer will be will be sending an email, text message, or calling you". Is it a double intelligence test or they just admitted to being scammers?
tsimionescu 3y ago
> And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder. Perhaps you meant this the other way around? Either way, I have received quite a steady stream of rather obvious phishing attempts directly to my inbox on Outlook.com. Once our twice a month I have a missed Amazon package, or some horrible debt, or an being investigated for tax fraud or other such.
- timenova 3y ago
  No I mean that if my bank sends me an email with a scammy subject, it won't get caught in the spam filter because everything else is legit, like the From field, their verified domain, email signatures, and the body content. They use the same domain and presumably the same email address to send such emails and other important emails too. But if a scammer sends me a fake email, it'll probably get caught in the spam filter of my email provider (hopefully).

celeritascelery 3y ago

Not for customers per se, but the company I work for will regularly send “scam” emails to us. If you click on the link you get assigned mandatory corporate phishing trainings. Makes you extra cautious.

mcny 3y ago
One time at work I forwarded what I thought was a genuine phishing attempt to abuse at stupid corporate email like I was supposed to and they dinged my manager because I had remote images enabled or something. I don't remember changing this setting and this was on a computer they owned. There is no winning with these people. I have since turned off remote images in emails. If you have remote images in messages to my work email, I won't see them. I refuse to turn on remote images because as far as I'm concerned, that's my security policy. I still forward all these "training" emails to abuse at corporate because if I'm doing extra work, they're doing extra work. Recently, they've automated this though because when I email abuse, I immediately get a reply saying congratulations, this was a test message. If this were a real bla bla... Anyway, I think it is safer to forward to abuse just in case.

deleted 3y ago

[deleted]

tgsovlerkhgsel 3y ago

Several banks I use do this all the time. Except they don't do it as a teaching experience, but as part of their normal operations, and if you refuse to do the extremely sketchy, red-flag, never-do-this thing, you will not be able to get your task done. I've been required to provide part or all my online banking PIN on the phone and my credit card PIN on a random sketchy website (as part of 3DSecure). Different banks. Both legit and repeated.