7 ms·

"Privacy & settings – where it lives now – is a natural home for it, but we think it should appear elsewhere too." Seems like the next step would be to send an

by perpil 3y ago

"Privacy & settings – where it lives now – is a natural home for it, but we think it should appear elsewhere too." Seems like the next step would be to send an app push notification before the call and to have a banner that's visible as soon as you log in to the app. Some sort of visual indicator that appears everywhere in the app that you should not be on a call may also reduce an attackers chance of succeeding.

jeroenhd 3y ago
I don't know how iOS handles this, but on Android you can get permissions to check if the user is currently in a call. Often this is done to mute media when you accept a call, but I can also imagine any sensitive apps popping up a message on their home screen to indicate whether or not a real customer support agent is trying to reach out to you. I don't think you can get details about the call that easily (like phone number and such) but with the right permissions it may also be feasible to maintain a scam number list based on user reports that sends out a notification when a known scammer is trying to call you.
- vitus 3y ago
  Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). There are plenty of scams based on impersonating some official (FBI, IRS, etc). It's not hard to imagine a scammer spoofing your bank's phone number [0, 1, 2, 3]. [0] https://www.snbonline.com/about/news/scammers-can-spoof-an-official-phone-number-heres-how-to-tell https://www.snbonline.com/about/news/scammers-can-spoof-an-o... [1] https://www.westernbank.com/fraud-prevention/what-you-should-know-about-caller-id-spoofing/ https://www.westernbank.com/fraud-prevention/what-you-should... [2] https://www.wellsfargo.com/privacy-security/fraud/bank-scams/bank-imposter/ https://www.wellsfargo.com/privacy-security/fraud/bank-scams... [3] https://www.fcc.gov/spoofing https://www.fcc.gov/spoofing
  - Sebb767 3y ago
    > Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). I think this can be solved far more simply by only showing the notification/warning (or showing it more visibly) when the app detects you are in a call.
    - vitus 3y ago
      Right. I was commenting specifically on the effectiveness of > with the right permissions it may also be feasible to maintain a scam number list based on user reports that sends out a notification when a known scammer is trying to call you.
    - lxgr 3y ago
      What if I call the bank from another phone?
- tgsovlerkhgsel 3y ago
  That's my biggest worry about this: That every app on my phone that considers itself important decides to attempt to notify me during every call, leading to a wall of notifications.
  - jeroenhd 3y ago
    Disabling notifications is easy (hold notification, click "disable") so if it rolls out and you don't care, it's quite trivial to get rid of the notification wall. So far, no apps that I know of have any such feature. If only one single app does it, it shouldn't cause a problem for anyone.
    - tgsovlerkhgsel 3y ago
      Many apps make this impractical by not separating the notifications into separate categories, so you either have to accept the spam, or break functionality that spans from convenient (credit card payment notifications) to critical (2FA push prompts that may only be accessible from the notification). > If only one single app does it, it shouldn't cause a problem for anyone. And that's how every app justifies doing it...
      - jeroenhd 3y ago
        > Many apps make this impractical by not separating the notifications into separate categories I can't say I share your experience. There are apps that spam you with notifications and intentionally don't use categories but I generally just uninstall those.
Sebb767 3y ago
> Some sort of visual indicator that appears everywhere in the app that you should not be on a call may also reduce an attackers chance of succeeding. Everywhere would probably be to distracting, but placing it on important screens (such as "verify transaction") would probably be a good idea.
fragmede 3y ago
yeah the UX is wrong. when they're on the phone with you the app should display a loud banner, and nothing when not.
- adammarples 3y ago
  I turn banner notifications off by default so it may not appear for a lot of people
  - fragmede 3y ago
    I mean in the app, not as a hideable OS notification.
- tsimionescu 3y ago
  That's not not the right idea. The absence of a visual indicator is not a good way to let me know my current call is fraudulent. Especially since it's most likely most people will not have a call with their bank almost ever, so they'll not have any familiarity with the fact that such a banner is supposed to be there.
  - fragmede 3y ago
    Unfortunately, the only way people are going to know to check in the buried menu is by reading that link. At which point that link might as well just say "if we are on the phone with you, the app will say so" [screenshot].
- krisoft 3y ago
  I don’t think you have thought this through. The fraudster call you, the app display nothing and you have no indication that anything is amiss.
  - fragmede 3y ago
    yes but there's no way a customer would know to check in the menu in the way they've implemented it to know that the call is valid unless they already knew about it. at which point the customer outreach is the same.

by perpil 3y ago

jeroenhd 3y ago

I don't know how iOS handles this, but on Android you can get permissions to check if the user is currently in a call. Often this is done to mute media when you accept a call, but I can also imagine any sensitive apps popping up a message on their home screen to indicate whether or not a real customer support agent is trying to reach out to you. I don't think you can get details about the call that easily (like phone number and such) but with the right permissions it may also be feasible to maintain a scam number list based on user reports that sends out a notification when a known scammer is trying to call you.

vitus 3y ago
Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). There are plenty of scams based on impersonating some official (FBI, IRS, etc). It's not hard to imagine a scammer spoofing your bank's phone number [0, 1, 2, 3]. [0] https://www.snbonline.com/about/news/scammers-can-spoof-an-official-phone-number-heres-how-to-tell https://www.snbonline.com/about/news/scammers-can-spoof-an-o... [1] https://www.westernbank.com/fraud-prevention/what-you-should-know-about-caller-id-spoofing/ https://www.westernbank.com/fraud-prevention/what-you-should... [2] https://www.wellsfargo.com/privacy-security/fraud/bank-scams/bank-imposter/ https://www.wellsfargo.com/privacy-security/fraud/bank-scams... [3] https://www.fcc.gov/spoofing https://www.fcc.gov/spoofing
- Sebb767 3y ago
  > Phone number is unfortunately not reliable, since it can be spoofed (and phone companies are broadly uninterested in doing more than the bare minimum to address this). I think this can be solved far more simply by only showing the notification/warning (or showing it more visibly) when the app detects you are in a call.
  - vitus 3y ago
    Right. I was commenting specifically on the effectiveness of > with the right permissions it may also be feasible to maintain a scam number list based on user reports that sends out a notification when a known scammer is trying to call you.
  - lxgr 3y ago
    What if I call the bank from another phone?
tgsovlerkhgsel 3y ago
That's my biggest worry about this: That every app on my phone that considers itself important decides to attempt to notify me during every call, leading to a wall of notifications.
- jeroenhd 3y ago
  Disabling notifications is easy (hold notification, click "disable") so if it rolls out and you don't care, it's quite trivial to get rid of the notification wall. So far, no apps that I know of have any such feature. If only one single app does it, it shouldn't cause a problem for anyone.
  - tgsovlerkhgsel 3y ago
    Many apps make this impractical by not separating the notifications into separate categories, so you either have to accept the spam, or break functionality that spans from convenient (credit card payment notifications) to critical (2FA push prompts that may only be accessible from the notification). > If only one single app does it, it shouldn't cause a problem for anyone. And that's how every app justifies doing it...
    - jeroenhd 3y ago
      > Many apps make this impractical by not separating the notifications into separate categories I can't say I share your experience. There are apps that spam you with notifications and intentionally don't use categories but I generally just uninstall those.

Sebb767 3y ago

> Some sort of visual indicator that appears everywhere in the app that you should not be on a call may also reduce an attackers chance of succeeding. Everywhere would probably be to distracting, but placing it on important screens (such as "verify transaction") would probably be a good idea.

fragmede 3y ago

yeah the UX is wrong. when they're on the phone with you the app should display a loud banner, and nothing when not.

adammarples 3y ago
I turn banner notifications off by default so it may not appear for a lot of people
- fragmede 3y ago
  I mean in the app, not as a hideable OS notification.
tsimionescu 3y ago
That's not not the right idea. The absence of a visual indicator is not a good way to let me know my current call is fraudulent. Especially since it's most likely most people will not have a call with their bank almost ever, so they'll not have any familiarity with the fact that such a banner is supposed to be there.
- fragmede 3y ago
  Unfortunately, the only way people are going to know to check in the buried menu is by reading that link. At which point that link might as well just say "if we are on the phone with you, the app will say so" [screenshot].
krisoft 3y ago
I don’t think you have thought this through. The fraudster call you, the app display nothing and you have no indication that anything is amiss.
- fragmede 3y ago
  yes but there's no way a customer would know to check in the menu in the way they've implemented it to know that the call is valid unless they already knew about it. at which point the customer outreach is the same.