4 ms·

Bank scammers using genuine push notifications to trick their victims

40 points by edent 2y ago

rockbruno 2y ago
Maybe it's because I'm from a country that is full of 2FA scams exactly like this (particularly for WhatsApp), so I could immediately tell it was a scam, but I didn't find this convincing at all. If the person actively reached out to you on your phone number, it doesn't make sense that they would require you to further authenticate yourself
- jxcl 2y ago
  Financial institutions in the US do this constantly. They call you, and then they ask you for stuff like the last four of your SSN and what loans you might have with them to prove that they're speaking to the right person. They act surprised when you don't want to answer because they called you.
  - HnUser12 2y ago
    I assume they do this to make sure the number hasn't changed/being answered by someone else?
    - jorgemendes 2y ago
      Yes, the client could be a "sim swap" victim, and in that case you would be talking to an attacker. So the identity validation can be useful in that case.
karaterobot 2y ago
I like their solution, that should be implemented. The best strategy is still to hang up and call the phone number on the bank's website yourself.
- MarkusWandel 2y ago
  That too could be played when people were still using landlines. It is obsolete with cell phones. If a landline call was hung up at the receiving end but not at the calling end, it took about 30 seconds to time out and disconnect. Probably a feature that allows the callee to hang up and pick up again on a different extension phone. So the scammer would call; you would rightly hang up and call the 1-800 number printed on your credit card. Only you were "calling" through the scammer's fake telco dialing sequence and... still be online with the scammer.
  - deleted 2y ago
    [deleted]
  - hiatus 2y ago
    > So the scammer would call; you would rightly hang up and call the 1-800 number printed on your credit card. Only you were "calling" through the scammer's fake telco dialing sequence and... still be online with the scammer. Wouldn't the scammer also have to play a dial tone on the line (and eventual ring) to keep the ruse going?
    - crtasm 2y ago
      That's what they're referring to by fake telco dialing sequence.
ilrwbwrkhv 2y ago
The real problem with all this is the fact that banks underhire their customer support. There should be laws on wait times for essential services to be less than 5 minutes. The fact that you have to wait for hours at times to talk to your bank or the IRS is bogus.
ChrisArchitect 2y ago
[dupe] More discussion: https://news.ycombinator.com/item?id=40242379 https://news.ycombinator.com/item?id=40242379
moi2388 2y ago
Suddenly pigeons don’t seem such a bad idea anymore huh?

40 points by edent 2y ago

Maybe it's because I'm from a country that is full of 2FA scams exactly like this (particularly for WhatsApp), so I could immediately tell it was a scam, but I didn't find this convincing at all. If the person actively reached out to you on your phone number, it doesn't make sense that they would require you to further authenticate yourself

jxcl 2y ago
Financial institutions in the US do this constantly. They call you, and then they ask you for stuff like the last four of your SSN and what loans you might have with them to prove that they're speaking to the right person. They act surprised when you don't want to answer because they called you.
- HnUser12 2y ago
  I assume they do this to make sure the number hasn't changed/being answered by someone else?
  - jorgemendes 2y ago
    Yes, the client could be a "sim swap" victim, and in that case you would be talking to an attacker. So the identity validation can be useful in that case.

karaterobot 2y ago

I like their solution, that should be implemented. The best strategy is still to hang up and call the phone number on the bank's website yourself.

MarkusWandel 2y ago
That too could be played when people were still using landlines. It is obsolete with cell phones. If a landline call was hung up at the receiving end but not at the calling end, it took about 30 seconds to time out and disconnect. Probably a feature that allows the callee to hang up and pick up again on a different extension phone. So the scammer would call; you would rightly hang up and call the 1-800 number printed on your credit card. Only you were "calling" through the scammer's fake telco dialing sequence and... still be online with the scammer.
- deleted 2y ago
  [deleted]
- hiatus 2y ago
  > So the scammer would call; you would rightly hang up and call the 1-800 number printed on your credit card. Only you were "calling" through the scammer's fake telco dialing sequence and... still be online with the scammer. Wouldn't the scammer also have to play a dial tone on the line (and eventual ring) to keep the ruse going?
  - crtasm 2y ago
    That's what they're referring to by fake telco dialing sequence.

ilrwbwrkhv 2y ago

The real problem with all this is the fact that banks underhire their customer support. There should be laws on wait times for essential services to be less than 5 minutes. The fact that you have to wait for hours at times to talk to your bank or the IRS is bogus.

ChrisArchitect 2y ago

[dupe] More discussion: https://news.ycombinator.com/item?id=40242379 https://news.ycombinator.com/item?id=40242379

moi2388 2y ago

Suddenly pigeons don’t seem such a bad idea anymore huh?