4 ms·

I was at a convention once listening to an FBI agent talk about contacting companies that had been hacked. They would not reply to emails or even open letters l

I was at a convention once listening to an FBI agent talk about contacting companies that had been hacked. They would not reply to emails or even open letters labeled "FBI". The likelihood of a scam was just too high. So they asked the room what it would take for us to believe that an unsolicited communication came from the real FBI. In short, the room wanted Mulder and Scully at the front door, in suits, with badges/guns, and even then many calls would be make before believing a believe a word. That is what the constant stream of online scams has done to people.

irrational 3y ago
I think I’d blame it more on entertainment media. How many tv shows and movies have there been with fake FBI communications and agents?
- sandworm101 3y ago
  >> How many tv shows and movies have there been with fake FBI communications and agents? Technically? All of them. The FBI rarely allows its agents to appear on TV shows.
morkalork 3y ago
Reminds me of a story about an allied sabateur working in occupied France during WWII. They were trying to convince someone that they were indeed the "real deal" and nothing was working until they agreed on a coded phrase to be played on the BBC radio. Only after hearing the message on the radio the next night was their identity trusted.
- fbdab103 3y ago
  I would find it unlikely that a low level guy would have the connections to slip a phrase into the BBC and would think they have to be a spy with high level connections.
  - guappa 3y ago
    Perhaps his boss told him the secret in advance? He didn't corrupt the BBC announcers, they just both worked for the government.
    - morkalork 3y ago
      It was pretty well organized: https://en.wikipedia.org/wiki/Radio_Londres https://en.wikipedia.org/wiki/Radio_Londres
tpurves 3y ago
Yep, try running a marketing contest sometime and then trying to notify people by phone or email that they have won the grand prize.
- NikolaNovak 3y ago
  Mitchell and Webb have that scenario wonderfully covered (2 min sketch) https://youtu.be/xsYoeoEE3ww?si=ZMhfesAPXNFb_hnS https://youtu.be/xsYoeoEE3ww?si=ZMhfesAPXNFb_hnS
neilv 3y ago
And if you do finally get through to them, they can still be kinda jerks. When I briefly was interested in precious metals, I found that a popular gold&silver bullion retailer had a breach, with attacker having customer contact info, and also able to email as the retailer. This seemed like a situation with higher-stakes risks than the usual applications of consumer data breaches.[1] So I felt obligated to alert them. When I talked my way through the company's main phone number, the IT/security people came off as skeptical of me, and kinda doing a tough-guy thing (like they might be dealing with an attacker trying to social them, and didn't want to show weakness or look stupid), before they acknowledged/claimed that they knew about the compromise. Then, when they realized I was legitimately alerting them, not trying to trick them, nor to otherwise get anything from them, they still sounded like I was a jerk for bothering them about this compromise they already knew about. (Though I don't think they disclosed it to affected customers.) I suppose I should be understanding, that they might get BS calls all the time, but, even as a ordinary citizen trying to be helpful, the tone was annoying. I guess the FBI would be rolling their eyes even harder at companies that not only can't do their job of securing sensitive data and systems, but then act like jerks when you try to help them salvage the inevitable fudge-up. [1] This was a vendor to the "if you don't hold it, you don't own it" physical gold&silver buyers fad at the time. If attacker also got the shipping addresses, it's a high-value burglary target list, of homes with high probability of untraceable stores-of-wealth, including ones that could easily be liquidated for (today) around $2,000 per troy ounce. Or the worse variant: target list for home invasion, where badguy threatens/tortures occupants until confident that the victim told them all the hiding locations, not just the decoy safe. Maybe a harder list to sell for that purpose, but more dangerous if it got used for that purpose (rather than, or in addition to, an email scam gold-for-Bitcoin special offer that appeared to be from the retailer and got past spam filters).
OJFord 3y ago
But if I have actually lost my baggage, and I receive an email about lost baggage..? Scam is not going to be front of mind? (..so also excellent time to scam me.. please don't. But also maybe more fruitful just to steal the baggage if you have access to that information.)
- jameshart 3y ago
  Not a lot of money in stolen baggage. But using stolen baggage as an in to socially engineer someone into sending you Target gift cards? That seems like the kind of scam that might happen.
  - OJFord 3y ago
    You get the average bag value from every bag though (on average!), you socially engineer someone into sending you more than that in Target gift cards some tiny fraction of the time. And in this scenario you have to know about their lost baggage anyway. I think if you somehow have access to the lost baggage at a given airport, theft is going to me profitable than scamming. Aaanyway!
    - jameshart 3y ago
      The average bag contains approximately one goodwill donation's worth of clothing and a selection of used toiletries.
technick 3y ago
I was forced to deal with an FBI agent last year. I authenticated him by calling the local FBI office and asking the person who answered to authenticate the agent. I got the number of the FBI office off way back machine.
- njharman 3y ago
  > off way back machine. +1 for practical paranoia!
  - guru4consulting 3y ago
    wayback machine? why not the regular official website? sorry, I don't understand.
- hindsightbias 3y ago
  I wonder how many field office numbers have changed…
- RecycledEle 3y ago
  Respectfully, if you call any law enforcement agency, and totally make up a claim about someone at your door, they will claim that person works for them and is official. Operators lie.
  - sweetgiorni 3y ago
    What? This seems hard to believe. What incentive do operators have to support law enforcement impersonators?
    - RecycledEle 3y ago
      I can not understand the motives of a 911 operator. I am speaking from experience. I have tested this, and always got the same answer.
iudqnolq 3y ago
The German spy who came off a U-Boat and wanted to hand their team in wasn't believed on the phone and had to show up in person at FBI headquarters.
- throwup238 3y ago
  https://en.wikipedia.org/wiki/George_John_Dasch https://en.wikipedia.org/wiki/George_John_Dasch presumably? Tragic story
tnel77 3y ago
My question would be “is this good or bad?” To a certain degree, I feel like it’s good that people are learning to question this stuff. Prime example: everyone at my company received an email about some mandatory training and it was from an unusual source (compared to previous mandatory trainings). The VP that set it all up sent a follow-up email telling us that he was very proud of us for being “diligent,” but that the training was legit and indeed still mandatory.
RecycledEle 3y ago
This is why we should be arresting scammers that we can arrest, and targeting the rest for air strikes.

irrational 3y ago

I think I’d blame it more on entertainment media. How many tv shows and movies have there been with fake FBI communications and agents?

sandworm101 3y ago
>> How many tv shows and movies have there been with fake FBI communications and agents? Technically? All of them. The FBI rarely allows its agents to appear on TV shows.

morkalork 3y ago

Reminds me of a story about an allied sabateur working in occupied France during WWII. They were trying to convince someone that they were indeed the "real deal" and nothing was working until they agreed on a coded phrase to be played on the BBC radio. Only after hearing the message on the radio the next night was their identity trusted.

fbdab103 3y ago
I would find it unlikely that a low level guy would have the connections to slip a phrase into the BBC and would think they have to be a spy with high level connections.
- guappa 3y ago
  Perhaps his boss told him the secret in advance? He didn't corrupt the BBC announcers, they just both worked for the government.
  - morkalork 3y ago
    It was pretty well organized: https://en.wikipedia.org/wiki/Radio_Londres https://en.wikipedia.org/wiki/Radio_Londres

tpurves 3y ago

Yep, try running a marketing contest sometime and then trying to notify people by phone or email that they have won the grand prize.

NikolaNovak 3y ago
Mitchell and Webb have that scenario wonderfully covered (2 min sketch) https://youtu.be/xsYoeoEE3ww?si=ZMhfesAPXNFb_hnS https://youtu.be/xsYoeoEE3ww?si=ZMhfesAPXNFb_hnS

neilv 3y ago

And if you do finally get through to them, they can still be kinda jerks. When I briefly was interested in precious metals, I found that a popular gold&silver bullion retailer had a breach, with attacker having customer contact info, and also able to email as the retailer. This seemed like a situation with higher-stakes risks than the usual applications of consumer data breaches.[1] So I felt obligated to alert them. When I talked my way through the company's main phone number, the IT/security people came off as skeptical of me, and kinda doing a tough-guy thing (like they might be dealing with an attacker trying to social them, and didn't want to show weakness or look stupid), before they acknowledged/claimed that they knew about the compromise. Then, when they realized I was legitimately alerting them, not trying to trick them, nor to otherwise get anything from them, they still sounded like I was a jerk for bothering them about this compromise they already knew about. (Though I don't think they disclosed it to affected customers.) I suppose I should be understanding, that they might get BS calls all the time, but, even as a ordinary citizen trying to be helpful, the tone was annoying. I guess the FBI would be rolling their eyes even harder at companies that not only can't do their job of securing sensitive data and systems, but then act like jerks when you try to help them salvage the inevitable fudge-up. [1] This was a vendor to the "if you don't hold it, you don't own it" physical gold&silver buyers fad at the time. If attacker also got the shipping addresses, it's a high-value burglary target list, of homes with high probability of untraceable stores-of-wealth, including ones that could easily be liquidated for (today) around $2,000 per troy ounce. Or the worse variant: target list for home invasion, where badguy threatens/tortures occupants until confident that the victim told them all the hiding locations, not just the decoy safe. Maybe a harder list to sell for that purpose, but more dangerous if it got used for that purpose (rather than, or in addition to, an email scam gold-for-Bitcoin special offer that appeared to be from the retailer and got past spam filters).

OJFord 3y ago

But if I have actually lost my baggage, and I receive an email about lost baggage..? Scam is not going to be front of mind? (..so also excellent time to scam me.. please don't. But also maybe more fruitful just to steal the baggage if you have access to that information.)

jameshart 3y ago
Not a lot of money in stolen baggage. But using stolen baggage as an in to socially engineer someone into sending you Target gift cards? That seems like the kind of scam that might happen.
- OJFord 3y ago
  You get the average bag value from every bag though (on average!), you socially engineer someone into sending you more than that in Target gift cards some tiny fraction of the time. And in this scenario you have to know about their lost baggage anyway. I think if you somehow have access to the lost baggage at a given airport, theft is going to me profitable than scamming. Aaanyway!
  - jameshart 3y ago
    The average bag contains approximately one goodwill donation's worth of clothing and a selection of used toiletries.

technick 3y ago

I was forced to deal with an FBI agent last year. I authenticated him by calling the local FBI office and asking the person who answered to authenticate the agent. I got the number of the FBI office off way back machine.

njharman 3y ago
> off way back machine. +1 for practical paranoia!
- guru4consulting 3y ago
  wayback machine? why not the regular official website? sorry, I don't understand.
hindsightbias 3y ago
I wonder how many field office numbers have changed…
RecycledEle 3y ago
Respectfully, if you call any law enforcement agency, and totally make up a claim about someone at your door, they will claim that person works for them and is official. Operators lie.
- sweetgiorni 3y ago
  What? This seems hard to believe. What incentive do operators have to support law enforcement impersonators?
  - RecycledEle 3y ago
    I can not understand the motives of a 911 operator. I am speaking from experience. I have tested this, and always got the same answer.

iudqnolq 3y ago

The German spy who came off a U-Boat and wanted to hand their team in wasn't believed on the phone and had to show up in person at FBI headquarters.

throwup238 3y ago
https://en.wikipedia.org/wiki/George_John_Dasch https://en.wikipedia.org/wiki/George_John_Dasch presumably? Tragic story

tnel77 3y ago

My question would be “is this good or bad?” To a certain degree, I feel like it’s good that people are learning to question this stuff. Prime example: everyone at my company received an email about some mandatory training and it was from an unusual source (compared to previous mandatory trainings). The VP that set it all up sent a follow-up email telling us that he was very proud of us for being “diligent,” but that the training was legit and indeed still mandatory.

RecycledEle 3y ago

This is why we should be arresting scammers that we can arrest, and targeting the rest for air strikes.