3 ms·

Recently had to call Discover because of unauthorized use of card, apparently to buy Facebook ads of all things. They didn't call me, just locked my account and

Recently had to call Discover because of unauthorized use of card, apparently to buy Facebook ads of all things. They didn't call me, just locked my account and said I had to call them. I couldn't even pay the balance until I did. Anyway they needed to verify my identity, so they ask me for some info from the back of the card and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. The text message says that the bank will NEVER ask for the code over the phone. They ask for the code, I give it to them, identity verified.

FireBeyond 1y ago
Background check for a new employer resulted in me getting an email to my personal account: "Hi, I'm XYZ from XYZ background checks, I'm conducting your pre-employment check, and I just want to confirm that your full name is V, your DOB is W, your place of birth is X, your address is Y and your full SSN is Z... ... and that this is the correct email address for you. Please confirm." Holy hell. Thankfully I reached out to the employer about this (and the background check company's attempt to reach out to my partner on Facebook for ... something? This wasn't a security check, just a regular employment background) and they were as horrified as me, apologized, and fired their background check provider.
- bigfatkitten 1y ago
  Sounds like the sort of thing Hireright would do.
- cycomanic 1y ago
  Hah, my employer in Sweden recently started using one of these security training companies. They send you emails with some online courses you're supposed to do and then send occasionally phishing attempts etc. and when you fall for one they send you an email what you did wrong. Out of interest I clicked on the link in one of their "phishing" emails and I was redirected to a link where they essentially told me "never click on links in emails, you never know where they lead to". One week later I get an email "please click on this link to complete the second part of your course". Obviously I never completed their course, they told me never to click on links. What's even worse is that they don't even use their own domain for the courses, but some random looking domain.
  - Sammi 1y ago
    I'm a software dev. When I get phising mails I often click the links to check out what the scam is. I open in a separate browser I don't usually use, so there isn't anything in it for the phising site to gobble up. And yeah I trust that the browser sandbox I good enough, that no one is going to waste a zero day exploit on me in order to break it - hackers also have economic constraints. If I was working on something super sensitive, then I should use a vm, but I'm not so I don't. I also did this at work, and yeah it was a fake phising mail sent by a security company, and I had to do a quick 20 min online course on email security best practices. Yay. Me and like 3 other dudes, who clearly all also understood it was phising and were just curious about the scam.
    - wink 1y ago
      When they introduced the weird fake phishing mails at my last work place I checked the email headers and just filed it into a separate folder. My coworkers were happy to get rid of the spam as well. Just shows how bad they are at faking it.
lxgr 1y ago
> and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. This regularly blows my mind. Presumably it’s some data broker or phone carrier integration, because for me, the answer is usually “sorry, we can’t verify that number, is this a postpaid contract in your name?” No, it’s not. Oh, that’s a requirement for doing business with you? In that case, I won’t.
- SoftTalker 1y ago
  People get new phones and new phone numbers. Frequently, compared to landline days. The alternative is to be permanently locked out of everything if you get a new phone number.
  - lxgr 1y ago
    Well, I’m not doing business with a company that trusts any random phone carrier’s identity assertion more than me in determining what is and isn’t my phone number, so I guess it works out nicely. And if a company can’t be bothered to have a fallback verification flow in case I do lose access to my phone number somehow, that doesn’t increase confidence either. I’m a person, not a phone number.
    - Henchman21 1y ago
      So, if I may ask, do you have a smartphone? What kind and who is your carrier? It seems to me your stance would preclude owning a smartphone?
      - lxgr 1y ago
        I do, but that doesn't mean I need to participate in ridiculous forms of authentication.
      - ethbr1 1y ago
        The parent's gripe is presumably about many bad SMS-based 2FA implementations banning non-post-paid numbers from use. E.g. Blizzard (assuming they still do this) If they want to be aggressive about fraudulent activity, fine, but don't restrict perfectly valid phone numbers from being used in their required 2FA scheme.
fallinghawks 1y ago
Wells Fargo too. Every other banking institution says never to give an OTP to someone on the phone, but that's exactly how WF verifies you when you call them. The only thing is that they do text the number already on file with them, not a number you give them on the fly, but that's only microscopically more secure.

FireBeyond 1y ago

Background check for a new employer resulted in me getting an email to my personal account: "Hi, I'm XYZ from XYZ background checks, I'm conducting your pre-employment check, and I just want to confirm that your full name is V, your DOB is W, your place of birth is X, your address is Y and your full SSN is Z... ... and that this is the correct email address for you. Please confirm." Holy hell. Thankfully I reached out to the employer about this (and the background check company's attempt to reach out to my partner on Facebook for ... something? This wasn't a security check, just a regular employment background) and they were as horrified as me, apologized, and fired their background check provider.

bigfatkitten 1y ago
Sounds like the sort of thing Hireright would do.
cycomanic 1y ago
Hah, my employer in Sweden recently started using one of these security training companies. They send you emails with some online courses you're supposed to do and then send occasionally phishing attempts etc. and when you fall for one they send you an email what you did wrong. Out of interest I clicked on the link in one of their "phishing" emails and I was redirected to a link where they essentially told me "never click on links in emails, you never know where they lead to". One week later I get an email "please click on this link to complete the second part of your course". Obviously I never completed their course, they told me never to click on links. What's even worse is that they don't even use their own domain for the courses, but some random looking domain.
- Sammi 1y ago
  I'm a software dev. When I get phising mails I often click the links to check out what the scam is. I open in a separate browser I don't usually use, so there isn't anything in it for the phising site to gobble up. And yeah I trust that the browser sandbox I good enough, that no one is going to waste a zero day exploit on me in order to break it - hackers also have economic constraints. If I was working on something super sensitive, then I should use a vm, but I'm not so I don't. I also did this at work, and yeah it was a fake phising mail sent by a security company, and I had to do a quick 20 min online course on email security best practices. Yay. Me and like 3 other dudes, who clearly all also understood it was phising and were just curious about the scam.
  - wink 1y ago
    When they introduced the weird fake phishing mails at my last work place I checked the email headers and just filed it into a separate folder. My coworkers were happy to get rid of the spam as well. Just shows how bad they are at faking it.

lxgr 1y ago

> and a phone number that they can send the OTP to. I give them a phone number, it's not even the one on the account, they send the text to it. This regularly blows my mind. Presumably it’s some data broker or phone carrier integration, because for me, the answer is usually “sorry, we can’t verify that number, is this a postpaid contract in your name?” No, it’s not. Oh, that’s a requirement for doing business with you? In that case, I won’t.

SoftTalker 1y ago
People get new phones and new phone numbers. Frequently, compared to landline days. The alternative is to be permanently locked out of everything if you get a new phone number.
- lxgr 1y ago
  Well, I’m not doing business with a company that trusts any random phone carrier’s identity assertion more than me in determining what is and isn’t my phone number, so I guess it works out nicely. And if a company can’t be bothered to have a fallback verification flow in case I do lose access to my phone number somehow, that doesn’t increase confidence either. I’m a person, not a phone number.
  - Henchman21 1y ago
    So, if I may ask, do you have a smartphone? What kind and who is your carrier? It seems to me your stance would preclude owning a smartphone?
    - lxgr 1y ago
      I do, but that doesn't mean I need to participate in ridiculous forms of authentication.
    - ethbr1 1y ago
      The parent's gripe is presumably about many bad SMS-based 2FA implementations banning non-post-paid numbers from use. E.g. Blizzard (assuming they still do this) If they want to be aggressive about fraudulent activity, fine, but don't restrict perfectly valid phone numbers from being used in their required 2FA scheme.

fallinghawks 1y ago

Wells Fargo too. Every other banking institution says never to give an OTP to someone on the phone, but that's exactly how WF verifies you when you call them. The only thing is that they do text the number already on file with them, not a number you give them on the fly, but that's only microscopically more secure.