10 ms·
You receive a call on your phone. The caller says they're from your bank
- gnabgib 2y agoThis seems like a riff on How I got scammed[0](56 points, 86 days ago, 12 comments) - if it can happen to Cory Doctorow [0]: https://news.ycombinator.com/item?id=39269559 https://news.ycombinator.com/item?id=39269559
- simonblack 2y agoWhat riles me is when the Bank rings me and demands that I identify myself so they know it's me they are talking to. What's your full name? What's your date of birth? Etc. The Bank lady on the other end of the phone one day was most put out when I asked those same questions so that she should identify herself to me also. I would hang up and verify the phone number and then call them back if it checks out, or more usually I ring the Bank using my own version of the Bank's phone number and ask to speak to 'Charlene' or whoever it was.
- ranger_danger 2y agoI love it when telemarketers call so I can ask them what time they eat dinner, so I can call them back then.
- electric_mayhem 2y agoI don’t get telemarketer calls anymore. But when I used to, I turned it into an even more fun game that you described My goal was to waste as much of their time, and as little of mine, as possible. Hi, this is so-and-so from DIRECTV. We’re calling with a special offer…. Oh sweet! I’m so annoyed with my cable company That I let them get into their spiel A quick sec, I got a pot on the stove Disappear for 30s Oh hey, sorry, you were saying about 150 channels? Let them get going Ah, shit. Paperboy is at the door. Gimme a sec I’ll be right back, this sounds like an awesome deal And so on, with longer and longer gaps between each fake reason for disappearing, and more enthusiasm for his pitch each time I returned I remember the DIRECTV example in particular because I tied That dude up for over 40 minutes. Barely impeded my watching Farscape and kept him from harassing anyone else for the duration.
- cynicalsecurity 2y agoYou are a hero. We need a personally secretary app that would identify spam calls and keep them waiting forever, plying To Elise music in the background.
- Wistar 2y agoOne morning a few years ago as I was getting ready to get in the shower a spam call comes in to my landline. I don’t remember the exact bogosity but I think it was the ol’ your computer has a virus thing. When he asks for payment I say I will get my credit card but it is down in my car and will he wait? He agrees and damned if he wasn’t still waiting for me when I got out of the shower 20 minutes later.
- yowzadave 2y agoSeems like something we could ask an AI assistant to do—just stall them endlessly until they go insane.
- simonblack 2y agoMy goal was to waste as much of their time, My personal best was 2 hours and 10 minutes before it was me that got sick of playing them. After that I put the "This Number Out of Service" tones (http://www.k3pgp.org/telezap.htm http://www.k3pgp.org/telezap.htm) on my answering message. That knocked out a lot of the spam diallers. Usually I don't answer any number that's not on my contacts list, and let them go to voice-mail. If they really need me, they'll leave a message.
- askvictor 2y agoSome banks in Australia (probably globally) use credit-card fraud prevention services. So say I buy something from overseas, for a large-ish value, that service will call me to verify it was me. And request the same identification etc. But it's not even the bank that is calling.
- kaliqt 2y agoThat always happens with 2FA these days AFAIK.
- mavamaarten 2y agoThis was such a massive headache for me while I was on the other side of the globe. I let my bank know in advance that I was going to travel to a specific country, and got a special gold credit card with all sorts of services. Yet after one day abroad, they blocked my card and needed me to call them and have them call me a couple of times to validate my identity and purchases. _During their office hours, meaning in the middle of the night for me_.
- tgittos 2y agoI moved out of Australia and let my bank know that I would likely be using credit cards overseas for a while. Sure enough, as I was trying to buy furniture for my new place, the same thing happened to me. They blocked the card and when I called them they scolded me for not letting them know that I was traveling. I told the agent that I did in fact let them know, and asked them to update the account to note that I lived overseas. Some 5 years later I needed to use one of those accounts again. I diligently phoned the bank, let them know I lived overseas and that I was going to use the card. I used the card, the transaction was blocked, I called and was again scolded for not telling them that I went on holiday. I swear the 'notes' they add to your account are just an eye-roll and then a call disconnect.
- darth_avocado 2y agoThis happened to me too. They called. They ask me for my personal info to verify me. I said I was uncomfortable, could they verify who they are. They said they can’t for security reasons for MY account. I refused to give out info. They hung up. Turns out, it WAS the bank. In 2023, I’d assume this should be figured out. Especially, since they send out like a 100 emails about “your bank will never call you and ask for your personal info”.
- yzydserd 2y agoEven more so in 2024.
- kmoser 2y agoI recently used a website to do something that required 2FA. They texted me a code, and the text included some wording to the effect of "we will never ask for this information!" The website then asked me to enter that information which they said they would never ask for. I knew enough to read between the lines, but on the surface it sure was confusing to be asked for something they said they would never ask for.
- kristopolous 2y agoNever reveal information to an incoming caller. It's such a simple rule. Even if they ask "hello is this so-and-so" just say "how can i help you" ... don't answer any information based question. zero of them. It doesn't have to be awkward or weird.
- GauntletWizard 2y agoI dropped Chase literally this weekend because of this. Their security questions were useless, and in one case, wrong - they had an estimate of how much I owed on my mortgage, that didn't take into account additional principal payments, so made me go through a second three rounds (either that, or the cs rep screwed up one of the address questions). About ten years ago (it was my top Google+ post, if that dates it for you) I emailed one of their emails to me to their fraud department, because it was so ridiculous, urgent calls to action, obfuscated links, no identifying information that only the bank would have known. They're fraud department thanked me for reporting this obviously fraudulent message, to which I replied that it wasn't fraudulent, to which they were flabbergasted.
- deleted 2y ago[deleted]
- JaDogg 2y agoPixel phone's ability to answer calls for you is very useful. Rarely scammers want to talk to a bot. Does any of you know similar software for (non-google) Android?
- geocrasher 2y agoIndeed, the call screening feature is one reason that when my pixel 4a 5G gives up, I'll be getting another pixel.
- grishka 2y agoDoes any of you know how to force-enable this feature on a Pixel 4a, preferably without tripping SafetyNet? And does it support languages other than English?
- blendergeek 2y agoI don't know of a non-Google option for this, but my Moto G7 can do this using it's stock ROM.
- jimbobthrowawy 2y agoIs there anything about that phone in particular, or is google just device-locking features to differentiate their devices? (or subsidizing something that runs on their server)
- Kwpolska 2y agoPixel phones are not Nexus phones, they aren't just running stock Android — they have custom features to convince users to buy them.
- solardev 2y agoIt's just a differentiator. It's actually tied to the Phone by Google app, but some features only work on Pixels (and maybe other phones that have it pre-installed as the default dialer, but I don't know which those are). https://play.google.com/store/apps/details?id=com.google.android.dialer https://play.google.com/store/apps/details?id=com.google.and... It does work well though. I get a lot of spam calls and texts a month (the result of my political donations, which I didn't realize were public info and easily harvested by spammers, sigh... fucking NGP Van). The Pixel filters out the overwhelming majority of them, thankfully. The call screening works exceptionally well for spam calls, since most just hang up. The Pixel is a perfectly generic phone, IMO, but the spam blocking is amazing. I switched to an iPhone for a few months, but the spam (even with several third party apps) made it unusable and I eventually got another Pixel instead. About the only thing it consistently does better.
- deleted 2y ago[deleted]
- smgit 2y agoDeaf people don't have to deal with this shit. Maybe they will repopulate the earth after everyone else has been scammed.
- geocrasher 2y agoAre you implying that deaf people only give birth to deaf children?
- Dylan16807 2y agoI don't see how "repopulate the earth" implies that.
- Jerrrry 2y agoIt implies that - or that all deaf people will spawn non-scamming progeny simultaneously, coincidentally as the non-deaf get selected against by lethal scamming simultaneously (then all scam themselves).
- Dylan16807 2y ago1. Why "simultaneously"? You could have all the hearing die over 10 years, and the deaf can work on repopulation over the following decades (and arguably those time periods can overlap too). 2. The scenario is that the deaf will repopulate, not that they will specifically repopulate with "non-scamming progeny".
- denkmoon 2y agoI can see hereditary deafness giving an evolutionary advantage of not having to listen to the noise inflicted on our world, so why not.
- yencabulator 2y agoIt's See (2019) (https://www.imdb.com/title/tt7949218/ https://www.imdb.com/title/tt7949218/) but different & opposite. Almost everyone is deaf and the society has adjusted. Rare few people are gifted with the ability to hear and are now better fighters because they can hear the others accidentally making loud noises.
- croes 2y agoAsk for their name and department. Hang up. Call your bank. Let yourself be put through to the caller.
- cycomanic 2y agoWhich banks make that actually easy/straight forward?
- sen 2y agoCBA (largest bank in Australia) is very good about this and has scam info on the front page of their website, and drills it into you that they’ll never ask for any information over the phone and to call them on the main number if you’re ever asked. I’ve had a call from them before and when they first greeted me they made it clear they know my full name and details, and told me up front if I have any doubts before continuing I can call the main number and use the voice-assistant to ask for a specific department. I did, and was put through in under a minute. My previous bank wouldn’t even do 2FA other than via SMS, and also would only let you do 8 character alphanumeric passwords. The contrast between banks is wild for this day and age.
- defrost 2y agoCan confirm. There are other reasons to rip into CBA but on this they are doing well.
- jimbobthrowawy 2y agoAsking for a specific employee is considered a red flag in AML training. I don't think many banks will even allow you to do that.
- amanzi 2y agoThe original Reddit post is here: https://www.reddit.com/r/UKPersonalFinance/comments/1cih3kd/been_scammed_over_18000_through_my_chase_account/ https://www.reddit.com/r/UKPersonalFinance/comments/1cih3kd/... It's a pretty clever idea for the scammers to exploit the in-app notification to fool the end-user. I wouldn't blame them for being scammed in this manner. However, the post then goes on to say: > Then he asked me to confirm the last 12 digits of my card number, cvv and expiry date. That to me is a big red flag, and I hope that I would have spotted it if I was the one being scammed. If it was really someone from the bank, they would already have access to this information and wouldn't need an end-user to give it to them. Although in this case, it may have been too late by that time to limit the damage. They may have been asking for this info as just the cherry on top. I'm assuming that responding to the in-app notification was probably the main thing they needed to extract the savings.
- kioshix 2y agoYeah, the reddit post is worth a read. Yes, they did exploit the banks notification, but the rest of the scam seems pretty normal. Why would the bank need to move your funds? They could just block the account I would assume. And the whole "tell me all of your credit card details except the first 4 numbers that only identifies your bank"-thing should immediately scream scam.
- grishka 2y agoYou receive a call on your phone. The caller says they're from your bank. You hang up and call back to the bank yourself. End of story. If the caller objects to you doing that, that by itself is an enormous red flag. You never, EVER take incoming calls from "your bank" seriously. I myself have an additional rule that I always reject calls from unknown numbers, unless I expect one (delivery, taxi, etc).
- pants2 2y agoThe other day I got a call from my bank, thought it was probably a scam. I hung up and tried calling back but it was a labyrinth of menu options, I gave up. Turned out that the first call was legit and I spent another day playing phone tag to get back to him. There needs to be a better way to verify.
- shermozle 2y agoSome years ago I had one of these calls and the guy told me to turn over my card and call the phone number printed on it, then as for a specific extension number. I got back through to him in moments. This isn't that hard. However the caller didn't do this until I asked him to prove he was calling from the bank. The banks (and utilities etc) are training the Boomers that they will call and claim to be from the bank.
- cam_l 2y agoI got an security awareness email from my bank yesterday saying they will never SMS or email with links to login or payment, as these are often spoofed by scammers. Directly next to this paragraph was a link to the login for the bank. I. have. no. words.
- monkeyfun 2y agoYou should screenshot that and just edit out any even vaguely personal info that might be there -- sounds amazing to see posted somewhere.
- 2y ago
- renewiltord 2y agoI always thought I wouldn't fall for this trick. Then one day a lady called about something I'd done on Coinbase. It's true, I had transferred money to Coinbase. She then said she wanted me to login to the app and get to a screen where I had to do something. I hung up. Months later I got a call from the Income Tax Department saying I was in big trouble. I had done something very bad. I hung up. But the third time was wild. Something was wrong with my credit card. They had to replace it. They were even able to trigger a 2FA code. I hung up and changed my password. Turns out I was right. I don't fall for this trick.
- raymondgh 2y agoYou receive a call on your phone. The caller says they’re from your bank. You never notice because you ignore unexpected calls that aren’t from family and you don’t check your voicemail.
- klipklop 2y agoI got a call from “my bank” I noticed the number was of a local branch…but had a different country code. Crafty.
- cellis 2y agoGot the coinbase scam just a few days ago. Surprisingly well thought out. First I got a call which I picked up out of curiosity (I kind of enjoy seeing which kinds of schemes are out in the open, so I pick up unknown calls here and there). The call was an automated, pre-neural-ai phone voice that said "This is Coinbase support, we've noticed a suspicious transaction originating from 'Salt Lake City, Utah'. If this was you, press 1. If not, press 2'". I pressed 2 but it proceeded anyway with "We see that you did not initiate this transfer, please expect a call from Coinbase within 3 minutes". After about 10 minutes a man with an American accent (ironic given that Coinbase support routes you to an Indian call center) called claiming to say something about how Coinbase was compromised and I needed to change my passkey and move my funds to a custodial wallet. I logged into my Coinbase account and said "I don't see any transfers". He said "yes, we don't show them to you because they've been flagged, but they were in the amount of <off by an order of magnitude of what I have in Coinbase>". I asked him "how do I know you're Coinbase?", and he said "certainly I can send you a verification email", which he did. The domain name wasn't verified and gmail flagged it as spam. He stayed on the call then said, "next I'll send you a reset password link". Then I asked "how about you tell me how much I have in each currency". He said a number that was off by an order of magnitude. Then I hung up. He tried calling back but I didn't pick up. Later, I checked my email and saw there was indeed a "reset coinbase passkey" email in my spambox.
- TechDebtDevin 2y agoWell if I know your email, which they obviously did since they sent you unofficial mail, all I have to do is type the email in and push reset password.
- sen 2y agoIt should be irrelevant what details the scammers did/didn’t use and how convincing their spiel is. We should be educating everyone that the SECOND anyone asks for your card details, or asks you to pay for something (gift cards included) that it’s a scam. Doesn’t matter how “real” it seems. The step people fail at isn’t ID’ing whether a caller is “real”, but by handing over their card details to anyone at all without personally contacting them via a known channel.
- jhgg 2y agoLarge banks like chase are motivated to make social engineering attacks like this more difficult. However, they need to do so while also considering the friction and potential frustration that additional security/verification measures might cause for their customers. One idea that would mitigate against this, while also not imposing significant burden to the customer is to have the procedure be that the app simply instructs you to hang up your call, and then after dials a randomly selected number from a large pool of numbers the bank controls, that has been wired up to (given your phone number) connect you back to the bank and directly to the agent that has called you. If your phone number dials any other number from the pool during this time (the attacker is trying to race you to call back the bank while spoofing your number), then the account flagged as being potentially under attack.
- amadeuspagel 2y agoBut why use the phone system at all? We have WebRTC now. It should be possible to call right from your bank's web app.
- nunez 2y agoNot everyone has or knows how to use the app
- landgenoot 2y agoI can call one of my banks from the app. They will generate a phone number followed by a , and an appended code. No need to identify during the call.
- jhgg 2y agoBecause it's significantly easier to just ask the phone to make a call, than it is to build VOIP calls into the app. As well, you get a lot of things for free: - user is familiar with the phone UI, and knows how to mute/use speaker phone. - put the call on hold if another incoming call comes in, - able to call someone and make it into a conference call, - more reliable on shitty internet.
- TechDebtDevin 2y agoMy bank has literally never called me in 20 years.
- lysp 2y agoI had a similar cold call years ago. It may have been my bank or possibly a utility, and the call was related to fraud of some sort. When I asked to call them back to verify, they said (from memory): - Call us back on the main line, you can find it on website. - Press option 9 - Enter the five-digit code: 51762 And got transferred straight back to the caller. I thought this was a fantastic idea.
- junto 2y agoThe funny thing is that corporate PABX’s have been offering this for over 40 years.
- miki123211 2y agoThis is actually one kind of fraud that could easily be solved if not for draconian app sandboxing rules. If your banking app could easily see if you're in a call and who you are calling / who is calling you, this would be a lot easier. Even without that info, banks could solve this by requiring all customers to initiate all calls from the app. In case a customer lost their mobile device, they'd let them proceed on the phone, but send a bunch of alerts to the device that it was just reported stolen and to immediately hang up if you were still the owner.
- Scion9066 2y agoThe banking app (or any other app) having access to see that you're in a call or who is calling you seems like another data mining point that I don't think they should have. Having a way to initiate the communications through the banking app seems like a good idea though.
- grishka 2y agoThis is technically possible to do on Android.
- hanche 2y agoThe dialog missed some important text: If this is not YOU calling US, it’s a scam. Hang up immediately. Or words to that effect. I was called by my bank once. They wanted to know if I had spent two thousand euros in a fashion store in Rome. No, I said. They needed no sensitive information for what came next: They cancelled my card and sent me a new one. Later, I logged in at the bank, saw the fraudulent charge, and used their standard protocol for disputing the charge. It was soon reversed. End of story. I see no reason why the bank would have to verify my identity for something like this, or why I would have to verify theirs.
- TheLoafOfBread 2y agoThis is a perk of coming from non-English speaking country. I will get call from my bank? Great I can switch to my original language. Too bad that scammer likely does not know how to speak it...
- em500 2y agoThere were stories in local newspapers here in the Netherlands about similar scams. The victims mentioned that the scammers spoke perfect accentless Dutch.
- AnimalMuppet 2y agoThe GP said "coming from", not "being in". And it sounds like they're still banking with some bank in their country of origination. So, you call me and say you're my bank? Great; let's switch to Swahili/Twampa/Tamil/whatever language is prominent in that country, I'm sure we'll both be more comfortable talking that way. Oh, you wouldn't because <lame excuse>? Yeah, you're probably not my bank then.
- P1000874751 2y ago[flagged]
- nrvn 2y ago1. The notification must have included the phone number. 2. The bank must have the registered number/s for customers and clear procedures on how to deal with calls from numbers unknown to bank. 3. Attackers clearly knew the above flaws of the banking system and processes. 4. Chase must take immediate actions for pp. 1 and roll out the update. But then I am not sure how about nowadays but 10 years ago it was pretty easy to spoof callerid.