6 ms·
A few reminders bear repeating: — no support group from a big company is going to call you. Ever. — never give out codes sent to use via sms or push notificat
by sroussey 1y ago
A few reminders bear repeating:
— no support group from a big company is going to call you. Ever.
— never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!
— Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party like 1Password or similar.
— Don’t have the same email you use banking and investments be the email that the world knows. Create a new email for that. If you use Chrome, even use a separate profile with that email, and only have your password manager as an extension. No others.
- gpt5 1y ago> never give out codes sent to use via sms or push notifications to someone requesting them via phone Unfortunately, some call centers DO use that for verification in some cases (i.e. you call them, and they send you a code to your email/phone that you read back).
- sroussey 1y agoI’ve personally never had that happen. It should go on a name and shame list.
- scrollaway 1y agoStripe Support does it for certain specific cases (email & phone). However, whenever they do it, it's a bilateral code generation: The support agent also gets a code they have to read out to the end user, which is featured prominently to them, saying the agent will have to read it out to get authentified.
- troc 1y ago- godaddy
- octo888 1y agoWho still uses GoDaddy LOL
- koakuma-chan 1y agoSmall business owners
- jay_kyburz 1y agoAlso me. Every 10 years my domains expire, and I can just pay a few hundred bucks again and forget about it, or I can do a bunch of work to move them somewhere and adjust A records and fuck around with stuff I don't remember and potentially have downtime.
- UltraSane 1y agoUse AWS Route53 it is so much better.
- koakuma-chan 1y agoBetter than CF?
- UltraSane 1y agoIf you mean cloudflare I have never used it.
- koakuma-chan 1y agoCheck it out, it's much easier to use and they don't charge any markup.
- UltraSane 1y agoOne thing I like about Route53 is how granular the permission can be. This lets you automate things more easily and securely.
- adrr 1y agoMy bank does it. Chase will send OTP via the bank app to verify you're identity for phone support.
- clysm 1y agoChase bank…
- UncleMeat 1y agoChase did this to me. A million alarm bells but even after hanging up and restarting the conversation from a phone number publicly listed on their website as a support contact they still did it. Wild.
- rscrawfo 1y agoFidelity does as well, although the message switches to state only read the code if you've called them directly.
- jasode 1y ago>I’ve personally never had that happen. It should go on a name and shame list The key situation for giving out an SMS code that the gp is pointing out is the customer initiates the call to the support center. For example, suppose somebody wants to add a credit-card to their smartphone digital wallet. They have to call the bank issuing their credit-card to do that. Once the customer support person answers the call, a common security verification (e.g. Chase Bank does this) is for them to send you a 6 digit code to your phone. You then repeat this code back to the support person on the call. They want proof of your identity and also proof that you physically have the smartphone with you. Repeating the SMS code to the customer support person is safe because the customer called the official 1-800 number on the back of their card. That's a totally different sequence of steps from receiving a random call from somebody claiming they are from Chase Bank. Yes, in those cases, you never give out SMS codes to that untrusted person on the phone.
- NikolaNovak 1y agoI agree with everything you said. Note, however, that those are two "totally different sequences of steps" to you and I, and "completely analogous / equivalent sequences of steps" to my father in law :-/
- vehementi 1y agoJustifiable in a vacuum, but the end result is grandma knows "sometimes it's OK to give the code to the person on the phone"
- cced 1y agoThey should have users receive the code and then submit said code into the application for verification, with clear instructions that this code is produced as a result of a support call, and to confirm you are on an existing call when submitting the code. Doing so would not force users to divulge codes over the phone, and enable support staff to verify identity all without training users that reading codes over the phone is acceptable. Thoughts on that?
- deleted 1y ago
- delfinom 1y agoA lot of credit unions using a certain call center / credit card provider use this exact authentication mechanism over the phone.
- ApolloFortyNine 1y agoGoogle support actually did ask me for that code when I had them disable energy savings on my nest thermostat. (it's insane that this had to be done through support, it's the setting where the power company can essentially control your thermostat in exchange for savings) To their credit/discredit, when I said no I'm not giving that out it says not to they just moved on. Not sure why they even asked then.
- fvgvkujdfbllo 1y agoYes, it is so easy to enable this setting, they even keep sending us notifications to enable it. But once enabled, it is impossible to disable it. It is a setting that let your power company to change your temperature settings when grid is under load. We wouldn’t mind it but they turned our heat way down during one freezing night while we were sleeping. Everyone woke up with cold next day.
- dragonwriter 1y agoThe asymmetry in activating/deactivating may be because power companies discount rates (don't know if it is automatic or you have to contact the provider) for people with that setting active, and removing it dusqualifies you from the discount, so there is at least potentially an asymmetrical financial impact of toggling it one way vs the other.
- Loughla 1y agoGoogle business support called me to close the loop on an issue I had with a business listing. It was from a very busy and loud call center, and was made by someone with a heavy accent. It's like they want us to get scammed?
- mandeepj 1y agoInclude SPAM call blocker in that list! Notably, both iOS and Android have that feature. Never pick the first call from an unknown number! If it's urgent and they are genuine, they'd leave either a voicemail or a text.
- ajross 1y ago> — never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that! I tried making this point downthread but it bears repeating higher up. Per OP, this was account with Authenticator enabled. If you have a working authenticator setup, they aren't going to "ask for a code", since by definition you're already authenticated. And while I'm no expert, I really don't think there is such a thing. Recovery for a lost account never goes back to device-in-hand once you have enabled full 2FA. Something is being skipped in the description of the phish here. I don't think OP is being completely honest.
- davidscoville 1y agoThe code I read to them was a Google account recovery code. That’s how they accessed my Google account. I, mistakenly, believed they needed to confirm I was still alive and the rightful owner of the account. Then the attacker used Google SSO to perform the initial log in to my coinbase account. Then they opened Google Authenticator, signed in as me, to get the coinbase auth code so they could complete coinbase’s 2fac.
- ajross 1y agoBut... that's an email that would be sent to a non-gmail address, the one on file that you originally registered your account with. And while I don't have copies of the transactions in front of me, these things are not unclear as to their purpose or intent. They tell you straight up that they're resetting the authentication for the account and to be sure you are doing it intentionally. They're also accompanied by warnings that would be simultaneously sent to your active gmail address and to the Authenticator app. I really think you're reaching here trying to ascribe blame. You... just got phished.
- 827a 1y agoHonestly if someone from Google Support calls me, my immediate response would be: "Google... Support? Now there's two words I've never heard in the same sentence before."
- traceroute66 1y ago> Always use a third party like 1Password or similar. Or even better, don't rely on a third-party hosted service. I've been a Codebook[1] user since the old-days when they used to call it Strip. They are old-school, local-system storage. With sync/backup done how you like it (all three encrypted before it leaves your computer): - Dropbox - Google Drive - Local folder (which you can then sync with using your own mechanism) - Recently (only this year) they introduced a totally optional hosted subscription cloud-sync option for those who want it [1] https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/
- no_wizard 1y agoThere’s something to be said for the setup and largely forget it nature of 1Password There’s good reasons to use it over self managed solutions, just like there are other good reasons to use a self managed system like this. Neither should be strictly dictated as better without first ascertaining what the user is looking for
- lokar 1y agoThe backup of a TOTP is just the seed, right? Print it out and keep it with your other sensitive papers
- thinker1972 1y ago[dead]
- MrDarcy 1y ago> — no support group from a big company is going to call you. Ever > - never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that. Chase bank still, as of last week, asks for these codes over inbound calls. Drives me mad. They do so when calling me about fraud alerts, not the other way around.
- schneems 1y agoYou can hang up and call the number on the back of your card
- gennarro 1y ago100% this. Do it every time.
- bdangubic 1y agoNEVER answer - like NEVER :) absolutely NEVER answer... calls or text... it is really simple. I also have Chase and I have blocked just about every single number they called me from (probably like 12 over the last decade)
- kevin_thibedeau 1y agoIf you initiated the call (to the correct number) then SMS verification has a low likelihood of being a scam.
- fxtentacle 1y agoExcept that a few weeks ago, I got a phone call - from a number with no results on Kagi search - claiming to be the online banking support of my bank - asking me to read them a code sent to me via SMS and when I refused to do that, they blocked my login credentials for online banking and sent me a sternly worded (paper) letter that my account could not be upgraded automatically for their software system migration because I had refused to engage with their support agent. I then had to create a new login in their app, call the phone number on their letter and read that guy the SMS code and, to my surprise, that was the only !!! authentication needed to activate the new login credentials that I had just created. (BTW, this was one of the top 100 largest banks worldwide) It's almost like some companies are training you to fall for scams. EDIT: This specific instance was Deutsche, but Chase has the exact same horrible habit of calling and then asking for an OTP code.
- tartoran 1y agoCan you name the bank?
- gcr 1y agoWhich bank was this? Please name them so I can avoid doing business
- fxtentacle 1y agohttps://www.deutsche-bank.de/ub/kontakt-und-service/service/neues-banking-unternehmensbank/new-banking.html https://www.deutsche-bank.de/ub/kontakt-und-service/service/... "New online banking and new app From 25 August 2025, you will benefit from the upgrade for online banking and Deutsche Bank app. [..] From 25 August, you will be able to simply reset your PIN yourself. [..] after logging in, you can also see accounts for which you are an authorised signatory." But out of fairness, let me just mention that Chase behaves the same way. I think all of them just don't really care about small- and medium-sized businesses.
- anonymousiam 1y agoI've had this same issue with BECU (Boeing Employee's Federal Credit Union). They're a really good financial institution, but like many, they suffer from nearsightedness. They know that they're "the good guys", so they feel that it's unnecessary for them to properly authenticate themselves to you. So it's asymmetrical security and asymmetrical trust. The worst part of this (for BECU) is that they've been warning their customers about phishing attacks from entities claiming to be BECU.
- speeder 1y agoI used to manage the Google Ads account of a business I had in the past. Google Support would call me all the time, and then first thing they would do is ask me to open the interface and repeat some code or another.
- cmurf 1y agoAMEX fraud support group called me. A real live agent. Capital One texts codes during live calls and requests the customer read the code to them. A health care provider sends emails with links to 3rd party domain to provide encrypted email, because a) regular email isn’t supposedly not HIPAA compliant and b) apparently the health care provider’s web and app infrastructure which provides secure messaging is not secure enough for certain messages. It’s indistinguishable from a phishing attack. Hospital direct invoicing by email, also includes 3rd party links, which takes the user to a site asking for personal information including SSN. It’s certainly phishing. Right? Nope, it’s legit, and no option to get a mailed bill once volunteering an email address. I think half of mobile device users don’t know or can’t handle a best practices workflow. The reality is the tech industry sucks, it’s bad at its job, gives shitty advice to everyone then goes and violates all of it leading to loss of trust.
- reaperducer 1y agoregular email isn’t supposedly not HIPAA compliant It isn't. I work in healthcare, and if anyone in the company sends an email with PHI or PII in it, we're supposed to alert the Security department, or lose our jobs.
- klik99 1y agoI am a big fan of keepass which I sync with dropbox, good apps exist for iphone/android/mac/windows/linux. But I don't know if that's more secure than a password provider like 1password. At least not fitting into the typical profile, and being able to control the data, open source code, and offline access feels like the optimal way for me.
- krashidov 1y agoMy phone is set to Do Not Disturb by default. Only 5 numbers can reach me direct to ring and that is immediate family only. I never answer calls from unsaved numbers. If they really need to reach me they can leave a voicemail. When you answer a call your brain kinda loses its ability to step back and think. Almost like the same trick that those people who ask for directions and steal your watch do. Security is not the main reason I do this but it has been nice knowing I can't be reached directly by scammers and hackers.
- anal_reactor 1y agoI stopped answering unknown numbers because everything that's important comes via email anyway. But a friend of mine has a job that requires them to answer calls from weird numbers, so it's tough.
- wiredpancake 1y ago[dead]
- everybodyknows 1y agoDoesn't any legit caller always leave a message? That way, you can think through the security issue before responding.
- IshKebab 1y agoYeah except I used to get legitimate calls from my bank's fraud department starting with "can you confirm your date of birth and address". Yeah, insane. I think it was HSBC. This was a couple of decades ago so maybe they've fixed that. I don't bank with them any more.
- ajsnigrutin 1y agoYep. But over here our bank has also been sending out leaflets on how to avoid scams, and the top two are "if you need to call, call the number written on the back of the card" and "if you're not sure, come to the bank in person". Same thing I tought my parents, and my mom actually got a call about some "personal info they needed to verify", said she'll come to a bank in person, they said "ok", she went in person, and they actually needed to verify some data (some EU regulation, she hasn't visited a bank in years).
- sowbug 1y agoHas anyone invented something like the TLS three-way handshake, or a U2F challenge, that can use spoken words as a transport layer? People could then be "safely" tricked into reading back "correct-horse-battery-staple" or whatever, because they actually wouldn't have the ability to generate a usable sequence unless the attacker first provided something that only the real site owner could provide. I'm imagining something with the non-phishability of U2F but the usability of an SMS 6-digit code. Maybe that's U2F.
- ctennis1 1y agoI'm in the midst of a transfer of enterprise account ownership with with Apple, and I can assure you, the only way to complete it is to wait for a phone call from Apple Support from 1-512-884-5022. You can call this number back and verify it is indeed Apple Support and get notified it does not accept inbound calls, only outbound.
- zamadatix 1y agoThe danger with stating this in terms of absolutes like: > no support group from a big company is going to call you. Ever. Is, eventually, you probably will get a call from a support group at a big company, as many have noted in response, and then all of the other absolutes in the list also become "well, people say never, but I think this is one of those exceptions" instead of "it's never worth taking the risk of assuming it's the company who really called you". A company, even big one people joke about having a complete lack of actual human support agents, may really call you one day. The other 364 days of the year it's probably a scam. The safe bet is to take the issue they called about and contact the official support channel yourself (being careful to get a real one and not an ad/fake site if you need to Google it). It may not always seem the most convenient, but it only takes one mistake to end up in a much more inconvenient place one day.
- odie5533 1y agoDuring a Tracfone support call I made recently, they sent a 2FA text to me. I said to the rep, "The text says 'Don't share this code with anyone.' Can I share it with you?" They laughed and said yes. It was completely legit as I had called Tracfone for some service changes. So some of these systems are very poorly designed.
- LeafItAlone 1y ago>never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that! Some services even say that when they are indeed codes you are _supposed_ to read back to them. Which clearly helps further train people to ignore that language.