5 ms·

The other day I got a call from my bank, thought it was probably a scam. I hung up and tried calling back but it was a labyrinth of menu options, I gave up. Tur

by pants2 2y ago

The other day I got a call from my bank, thought it was probably a scam. I hung up and tried calling back but it was a labyrinth of menu options, I gave up. Turned out that the first call was legit and I spent another day playing phone tag to get back to him. There needs to be a better way to verify.

shermozle 2y ago
Some years ago I had one of these calls and the guy told me to turn over my card and call the phone number printed on it, then as for a specific extension number. I got back through to him in moments. This isn't that hard. However the caller didn't do this until I asked him to prove he was calling from the bank. The banks (and utilities etc) are training the Boomers that they will call and claim to be from the bank.
- cam_l 2y ago
  I got an security awareness email from my bank yesterday saying they will never SMS or email with links to login or payment, as these are often spoofed by scammers. Directly next to this paragraph was a link to the login for the bank. I. have. no. words.
  - monkeyfun 2y ago
    You should screenshot that and just edit out any even vaguely personal info that might be there -- sounds amazing to see posted somewhere.
  - yencabulator 2y ago
    I got a letter from the county treasurer that their payment details have changed, and to send new property tax payments to a different PO box, in the major city 3h away. It mentioned a website with domain like foohost.net. It was legit.
yonatan8070 2y ago
Something like HTTPS but for phone calls could be great, so when you recieve a call, your phone could show that this is actually from whoever is claiming it's from. I have no idea about phone systems so this mighy be out of touch
- kmoser 2y ago
  This won't work since Caller ID is too easy to spoof.
  - ranger_danger 2y ago
    https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN
    - meepmorp 2y ago
      > The Federal Communications Commission requires use of the protocols by June 30, 2021 Well, then, looks like the problem was solved nearly three years ago!
- Scion9066 2y ago
  It probably needs to be transmitted in parallel, out of band, rather than trying to integrate it into the existing phone system. That's how Google's Verified Calls thing they were touting a few years ago worked to give you context about a call by having the company placing the call relay data through Google and to an Android device's phone app with additional info like the reason for the call.
- pridkett 2y ago
  This is what STIR/SHAKEN is supposed to do. Your phone and carrier in the US probably support it, but it’s not obvious. On iPhones there will be a little check mark under the number for inbound calls on your recent call list. This doesn’t carry over to things like voicemail however - where the check isn’t shown. This model also doesn’t work for businesses that route all outgoing calls through one number, as that is essentially caller ID spoofing.
noisy_boy 2y ago
We use 2FA where we can see rotating numbers which we use to validate our login. That means on the server side they have the ability to get the number at any point of time which will match the number on my phone - if that is correct, then why can't the caller quote the number and if it is matches, it is the bank since only they have the ability to get the number. Of course if your phone is compromised then its game over anyway. And there is the added challenge of technically non-savvy people being able to do all this.
- deleted 2y ago
  [deleted]
- verve_rat 2y ago
  But how does that stop this sort of man in the middle attack, the other scamer on the other call just asks the real bank for the number?
  - noisy_boy 2y ago
    Good point - I think one approach that may work is for banks to have the calling feature within the app - only they can initiate such calls. It bypasses all the issues with regular call spoofing etc but excludes customers who do not use the app (for them, just hang-up and call back, which has its own issues).
deleted 2y ago
[deleted]
lloda 2y ago
My bank's app has a built in messaging system, but they seem to hate using it themselves. When they want to contact me they always call, or they send me paper letters. If I contact them through the app, they don't reply there but call me about it. It's bizarre.
- pas 2y ago
  can you make an appointment with them at the branch office?
  - mlrtime 2y ago
    Reminds me of nana going to the bank (Seinfeld) https://youtu.be/63zSYqmLuhE?si=w5zSiEog-jxw7VIe&t=47 https://youtu.be/63zSYqmLuhE?si=w5zSiEog-jxw7VIe&t=47
yencabulator 2y ago
US banks generally give you a "reference number" you can read back when you call them back, and they'll forward your call to the right person.
DAMunzy 2y ago
I received a call from Capital One recently. Dude was trying to tell me that I had charges made in Georgia, have I been to been to Georgia recently, they think it's fraud. The phone connection was terrible, his Indian accent was THICK, I could hear other people in the call center. I've dealt with CO fraud department before- they didn't sound at all like this. I asked him for the last four of the card number used because I have multiple cards with them. He gives me the first six numbers. I tell him that only tells me that it is a Visa/MC/Amex/Discover and what bank. Stop trying to scam me. He got upset and hung up. I called CO directly and they had no idea what I was talking about. Just another scammer.

by pants2 2y ago

shermozle 2y ago

Some years ago I had one of these calls and the guy told me to turn over my card and call the phone number printed on it, then as for a specific extension number. I got back through to him in moments. This isn't that hard. However the caller didn't do this until I asked him to prove he was calling from the bank. The banks (and utilities etc) are training the Boomers that they will call and claim to be from the bank.

cam_l 2y ago
I got an security awareness email from my bank yesterday saying they will never SMS or email with links to login or payment, as these are often spoofed by scammers. Directly next to this paragraph was a link to the login for the bank. I. have. no. words.
- monkeyfun 2y ago
  You should screenshot that and just edit out any even vaguely personal info that might be there -- sounds amazing to see posted somewhere.
- yencabulator 2y ago
  I got a letter from the county treasurer that their payment details have changed, and to send new property tax payments to a different PO box, in the major city 3h away. It mentioned a website with domain like foohost.net. It was legit.

yonatan8070 2y ago

Something like HTTPS but for phone calls could be great, so when you recieve a call, your phone could show that this is actually from whoever is claiming it's from. I have no idea about phone systems so this mighy be out of touch

kmoser 2y ago
This won't work since Caller ID is too easy to spoof.
- ranger_danger 2y ago
  https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN
  - meepmorp 2y ago
    > The Federal Communications Commission requires use of the protocols by June 30, 2021 Well, then, looks like the problem was solved nearly three years ago!
Scion9066 2y ago
It probably needs to be transmitted in parallel, out of band, rather than trying to integrate it into the existing phone system. That's how Google's Verified Calls thing they were touting a few years ago worked to give you context about a call by having the company placing the call relay data through Google and to an Android device's phone app with additional info like the reason for the call.
pridkett 2y ago
This is what STIR/SHAKEN is supposed to do. Your phone and carrier in the US probably support it, but it’s not obvious. On iPhones there will be a little check mark under the number for inbound calls on your recent call list. This doesn’t carry over to things like voicemail however - where the check isn’t shown. This model also doesn’t work for businesses that route all outgoing calls through one number, as that is essentially caller ID spoofing.

noisy_boy 2y ago

We use 2FA where we can see rotating numbers which we use to validate our login. That means on the server side they have the ability to get the number at any point of time which will match the number on my phone - if that is correct, then why can't the caller quote the number and if it is matches, it is the bank since only they have the ability to get the number. Of course if your phone is compromised then its game over anyway. And there is the added challenge of technically non-savvy people being able to do all this.

deleted 2y ago
[deleted]
verve_rat 2y ago
But how does that stop this sort of man in the middle attack, the other scamer on the other call just asks the real bank for the number?
- noisy_boy 2y ago
  Good point - I think one approach that may work is for banks to have the calling feature within the app - only they can initiate such calls. It bypasses all the issues with regular call spoofing etc but excludes customers who do not use the app (for them, just hang-up and call back, which has its own issues).

deleted 2y ago

[deleted]

lloda 2y ago

My bank's app has a built in messaging system, but they seem to hate using it themselves. When they want to contact me they always call, or they send me paper letters. If I contact them through the app, they don't reply there but call me about it. It's bizarre.

pas 2y ago
can you make an appointment with them at the branch office?
- mlrtime 2y ago
  Reminds me of nana going to the bank (Seinfeld) https://youtu.be/63zSYqmLuhE?si=w5zSiEog-jxw7VIe&t=47 https://youtu.be/63zSYqmLuhE?si=w5zSiEog-jxw7VIe&t=47

yencabulator 2y ago

US banks generally give you a "reference number" you can read back when you call them back, and they'll forward your call to the right person.

DAMunzy 2y ago

I received a call from Capital One recently. Dude was trying to tell me that I had charges made in Georgia, have I been to been to Georgia recently, they think it's fraud. The phone connection was terrible, his Indian accent was THICK, I could hear other people in the call center. I've dealt with CO fraud department before- they didn't sound at all like this. I asked him for the last four of the card number used because I have multiple cards with them. He gives me the first six numbers. I tell him that only tells me that it is a Visa/MC/Amex/Discover and what bank. Stop trying to scam me. He got upset and hung up. I called CO directly and they had no idea what I was talking about. Just another scammer.