7 ms·
You receive a call on your phone. The caller says they're from your bank. You hang up and call back to the bank yourself. End of story. If the caller objects to
by grishka 3y ago
You receive a call on your phone. The caller says they're from your bank. You hang up and call back to the bank yourself. End of story. If the caller objects to you doing that, that by itself is an enormous red flag. You never, EVER take incoming calls from "your bank" seriously.
I myself have an additional rule that I always reject calls from unknown numbers, unless I expect one (delivery, taxi, etc).
- pants2 3y agoThe other day I got a call from my bank, thought it was probably a scam. I hung up and tried calling back but it was a labyrinth of menu options, I gave up. Turned out that the first call was legit and I spent another day playing phone tag to get back to him. There needs to be a better way to verify.
- shermozle 3y agoSome years ago I had one of these calls and the guy told me to turn over my card and call the phone number printed on it, then as for a specific extension number. I got back through to him in moments. This isn't that hard. However the caller didn't do this until I asked him to prove he was calling from the bank. The banks (and utilities etc) are training the Boomers that they will call and claim to be from the bank.
- cam_l 3y agoI got an security awareness email from my bank yesterday saying they will never SMS or email with links to login or payment, as these are often spoofed by scammers. Directly next to this paragraph was a link to the login for the bank. I. have. no. words.
- monkeyfun 3y agoYou should screenshot that and just edit out any even vaguely personal info that might be there -- sounds amazing to see posted somewhere.
- yencabulator 3y agoI got a letter from the county treasurer that their payment details have changed, and to send new property tax payments to a different PO box, in the major city 3h away. It mentioned a website with domain like foohost.net. It was legit.
- yonatan8070 3y agoSomething like HTTPS but for phone calls could be great, so when you recieve a call, your phone could show that this is actually from whoever is claiming it's from. I have no idea about phone systems so this mighy be out of touch
- kmoser 3y agoThis won't work since Caller ID is too easy to spoof.
- ranger_danger 3y agohttps://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN
- meepmorp 3y ago> The Federal Communications Commission requires use of the protocols by June 30, 2021 Well, then, looks like the problem was solved nearly three years ago!
- Scion9066 3y agoIt probably needs to be transmitted in parallel, out of band, rather than trying to integrate it into the existing phone system. That's how Google's Verified Calls thing they were touting a few years ago worked to give you context about a call by having the company placing the call relay data through Google and to an Android device's phone app with additional info like the reason for the call.
- pridkett 3y agoThis is what STIR/SHAKEN is supposed to do. Your phone and carrier in the US probably support it, but it’s not obvious. On iPhones there will be a little check mark under the number for inbound calls on your recent call list. This doesn’t carry over to things like voicemail however - where the check isn’t shown. This model also doesn’t work for businesses that route all outgoing calls through one number, as that is essentially caller ID spoofing.
- noisy_boy 3y agoWe use 2FA where we can see rotating numbers which we use to validate our login. That means on the server side they have the ability to get the number at any point of time which will match the number on my phone - if that is correct, then why can't the caller quote the number and if it is matches, it is the bank since only they have the ability to get the number. Of course if your phone is compromised then its game over anyway. And there is the added challenge of technically non-savvy people being able to do all this.
- deleted 3y ago[deleted]
- verve_rat 3y agoBut how does that stop this sort of man in the middle attack, the other scamer on the other call just asks the real bank for the number?
- noisy_boy 2y agoGood point - I think one approach that may work is for banks to have the calling feature within the app - only they can initiate such calls. It bypasses all the issues with regular call spoofing etc but excludes customers who do not use the app (for them, just hang-up and call back, which has its own issues).
- deleted 3y ago[deleted]
- lloda 3y agoMy bank's app has a built in messaging system, but they seem to hate using it themselves. When they want to contact me they always call, or they send me paper letters. If I contact them through the app, they don't reply there but call me about it. It's bizarre.
- yencabulator 3y agoUS banks generally give you a "reference number" you can read back when you call them back, and they'll forward your call to the right person.
- DAMunzy 2y agoI received a call from Capital One recently. Dude was trying to tell me that I had charges made in Georgia, have I been to been to Georgia recently, they think it's fraud. The phone connection was terrible, his Indian accent was THICK, I could hear other people in the call center. I've dealt with CO fraud department before- they didn't sound at all like this. I asked him for the last four of the card number used because I have multiple cards with them. He gives me the first six numbers. I tell him that only tells me that it is a Visa/MC/Amex/Discover and what bank. Stop trying to scam me. He got upset and hung up. I called CO directly and they had no idea what I was talking about. Just another scammer.
- defrost 3y agoWe agree about official calls, I also call back (independantly sourcing an official number) and advise my father ( ~90 ) to do the same. > I myself have an additional rule that I always reject calls from unknown numbers I'm highly skeptical of unknown numbers and they're almost always telemarketers or scam calls but ... my circle includes people who can lose phones, have batteries go flat, ask others to pass on a message, etc - fully whitelisting isn't always an option.
- cperciva 3y agoindependantly sourcing an official number Be careful about this. Scammers have bought Google adverts to advertise fake phone numbers for banks, so "ask Google what my bank's phone number is" unfortunately isn't secure against scammers. I mean, yes, you need to independently source the official number; just make sure that your father knows how to do that and doesn't try to do it in a way which may be compromised.
- defrost 3y agoCheers. He has actual paper phone books, several address books, and spent some time as a naval signals officer .. We're both of generations that have always been skeptical of infomation on computers ... I can't imagine life as someone who'd ask google what my banks number is.
- cperciva 3y agoGood good. Just wanted to check since it's a mistake a lot of people have made!
- Scion9066 3y agoIt's not just ads or banks, here's a talk from someone who used fake Google Maps listings to intercept phone calls between law enforcement: Wiretapping the Secret Service Can Be Easy and Fun | Bryan Seely | TEDxKirkland https://www.youtube.com/watch?v=5c6AADI7Pb4 https://www.youtube.com/watch?v=5c6AADI7Pb4
- 3y ago
- jeffwass 3y agoThis. You can avoid 99% of all phone scams by never giving personal information out on an unsolicited call. Regardless of what the caller’s phone number appears as. A legit caller won’t care if you call back yourself.
- mo_42 3y agoI have the rule to not provide my phone number and email address to certain institutions (e.g., banks, the government, insurances). If there's a phone call or email, I know for sure that it's not from them. They mostly don't need to or shouldn't contact me anyways. And if they really need to, they can send a letter.
- grishka 3y ago> I have the rule to not provide my phone number and email address to certain institutions (e.g., banks, the government, insurances). Where do you live that this is possible? I'm genuinely curious. In most places a phone number is required to open a bank account or use most/any government services.
- ghnws 3y agoSame thing works for email/text alerts that tell you to open a link. I go to the service my self and see if the message is there.
- AbortedLaunch 3y agoThis may not be sufficient; some phone systems delay the disconnect, keeping you connected to the scammer on your outgoing call.
- MissTake 3y agoOlder POTS maybe - and I’m old enough to have experienced that back in the 1980s, but I’m pretty sure that that’s no longer the case today - triply so with mobiles.
- viraptor 3y agoYeah, it would have to be a "real" POTS all the way too. These days you're likely using VoIP under the covers anyway.
- grishka 3y agoThat's odd, I've never heard of this. On landlines I used, when the other side hangs up, you hear the busy tone, with no other choice than to hang up too.
- AbortedLaunch 3y agoIt was discussed in https://news.ycombinator.com/item?id=6124056 https://news.ycombinator.com/item?id=6124056
- grishka 2y agoOkay, so different countries had their phone systems work differently. In Russia, even back when we had electromechanical telephone exchanges, it's always been such that hanging up would instantly disconnect your line from the call, no matter the direction of the call. I just assumed it worked this way all over the world.
- tim333 3y agoI occasionally get calls from my bank. They are always from the security department saying there was some charge to my card. Was it me or not? I don't have much problem with those.
- lamontcg 3y agoYou receive a call on your phone. You never answer your phone except for friends and family. It goes to voicemail. If you ever need to talk to the bank you call the number that you have in your contacts list.
- NikkiA 2y agoAnd if the bank ever needs to call me, they a) call and get unanswered, b) leave a note in my bank account's message system which c) sends me an email telling me I have an unread note and to log in to read it. The few times this has happened, the note is simply 'call the bank's 0800 number and quote your account number', their robo menu will then automatically forward me to whoever is trying to reach me as soon as I hit the 'speak your account number' menu point (and if for some reason that fails, it then goes to a human operator who will then forward me to whoever was trying to reach me. I've never even had a whiff of them being annoyed by this chain of events the 3 or 4 times it's triggered (always due to steam triggering fraud protection)
- xnx 2y agoNever answer the phone period. If it's important, they'll leave a message.
- namaria 2y agoI only answers calls from immediate family. If I get called by a friend I'm immediately suspicious of foul play. Except during big events. My friends only use calls to shout at each other that they are lost in a crowd.