6 ms·

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number t

by klik99 1y ago

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of that immediately when I read this article. No dice, he refused to give me a number to call back on, so I knew it was fake. EDIT You can spoof from email addresses and you can spoof phone numbers - if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real.

dec0dedab0de 1y ago
Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.
- klik99 1y ago
  Good to know. The guy who called me on friday felt like a targeted attack, I've been getting a TON of pokes at trying to reset my google password. It really made me feel like there's less and less you can trust online. Scammers are winning the arms race, and have the resources to create really good looking pages.
- skygazer 1y ago
  It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. The web is untrustworthy, and Google transparently passes it to users. We'd probably be better off if Yahoo's quaint curated list of sites had won out.
  - mschuster91 1y ago
    > It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. Well, SEO, I get that this kind of gaming is hard to prevent, not at Google's scale. But the AdWords scams? Or all the other fake ad scams, chumboxes and god knows what? The complete lack of audits around something that actually causes money to change hands should be outright banned. At the high end of ads, think large brand TV spots, you got entire teams of lawyers involved to make sure licensing, actor releases, technical details, corporate identity and a myriad of other things are taken care of. But at the low end? Some rando from St Petersburg can post an ad for a book "uncovering Western lies about NATO expansion", some Indian can post an ad for "Norton Removal", some American an ad for a f2p game with content that clearly does not describe the actual gameplay or some Chinese can post an ad for penile enlargement pills - and none of the four will get even one human eye on the ad before the campaign goes live and the ads are displayed to actual users, even though all four either violate Western laws outright or are at least banned by the providers/networks. And the problem isn't just limited to Google, Youtube, AdWords, Unity Ads [1], Taboola [2], Outbrain [3], Facebook/Insta [4] - it's everywhere, the entire low range of ads is infested to the core. Self-service ad platforms should be shut down, period - the industry has shown that "self regulation" doesn't work. [1] https://discussions.unity.com/t/does-anyone-screen-these-ads/798375 https://discussions.unity.com/t/does-anyone-screen-these-ads... [2] https://www.vice.com/en/article/taboolas-content-chum-boxes-also-spread-disinformation/ https://www.vice.com/en/article/taboolas-content-chum-boxes-... [3] https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-newspaper-sites-have-run-thousands-of-scam-ads/ https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-ne... [4] https://www.vice.com/en/article/instagram-and-facebook-are-overrun-with-thousands-of-scam-ads/ https://www.vice.com/en/article/instagram-and-facebook-are-o...
    - eek2121 1y ago
      Yes, and that same lack of lawyers/friction is what also allows legitimate small businesses to thrive. I've worked for many, and out of those many, none of them had lawyers involved at all. It is all about balance. Google could do more here, however the answer is not as obvious as you might think. Especially in an age where identities get stolen often and the lag time on catching said fraud is quite long. The issue is that the entities mentioned are doing...nothing at all. Not even basic MANUAL identity checks and payment checks. Automated checks work very well until they don't.
  - deleted 1y ago
    [deleted]
- Waterluvian 1y ago
  I find that when it’s legit a consistent thing happens, which smells of careful training: they instruct me to call the number on the back of the card, or on a bill.
  - TOMDM 1y ago
    Obvious next step to me is malicious bills sent to an address
    - incone123 1y ago
      Only worth it for a targeted attack. Even then I might just read the number off a genuine bill instead of their fake one. And that's assuming they have linked my address and number - lots of scam calls are low effort dial every number.
    - euLh7SM5HDFY 1y ago
      You are a bit late with that idea: https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentence...
- kevin_thibedeau 1y ago
  They also typosquat support numbers for people who misread them or assume things like toll-free is always 800 when it can be other area codes. Just because someone answers, don't give them enough PII to use your identity elsewhere.
- gblargg 1y ago
  This happened to me once. I was calling Amazon and did a Google search on mobile. I called the big number that was at the top of search results. After I had given my account email, but nothing critical, I started becoming wary of the questions I was asked because they weren't relevant. I hung up and searched again and the result did not come up again, and Amazon's number was totally different. I looked up the number I called and it didn't find any results. So I'm guessing an ad scam. I definitely don't trust Google results with featured answers for things like that anymore.
  - bcrl 1y ago
    This happened to my father while I was around during the beginning of the COVID lock down. He searched for an Apple support number and was served a targeted ad for a phishing site. Because of the change in search a few years prior, ads now look very much like search results compared to the obvious visual distinction back in the Don't-Be-Evil days. The ad was sufficiently targeted that it only showed up on his device for the search -- nobody else would see it. Ephemeral ads are not a good thing.
    - GoblinSlayer 1y ago
      Ironically today even network engineers of all people can't type speedtest.net without google's help. Set your search engine to wikipedia and see them struggle.
      - bcrl 1y ago
        I feel like we lost the battle for any semblance of hope in matters of security when the URL bar blurred everything into search. There is simply no way to ensure that the browser does what one expects anymore.
- avidiax 1y ago
  Yes, especially do not google the number that you were given on the phone. That is completely certain to turn up the scammer's official looking page and "confirm" the phone number. I have seen Microsoft support forum articles that list the "Facebook official phone number". The fact that it's not from Facebook doesn't make it less authoritative in a panicked person's mind. Google, Meta, Microsoft, and Apple really must start publishing an "official phone number". It is perfectly OK that this phone number just plays a repeating message saying that the user should browse google.com/phone. That website can explain that there is no phone support offered, and provide a bunch of links for common scamming hooks that leads to anti-phishing material.
beeflet 1y ago
> official phone number Great idea unless the attacker has SS7 access.
- klik99 1y ago
  Yeah, if you're a high profile target then you need extra layers of security, but for regular folks that one weird trick is enough to make you just enough of an annoyance to make another target preferred. But in a world with Pegasus, and telecoms in smaller vacation countries selling off SS7, etc, etc - if someone good really wants to target you normal security protocols aren't going to cut it.
  - beeflet 1y ago
    I imagine it will be like SIM swapping attacks where attackers will pool all their money together, gain temporary SS7 access and conduct a ton of attacks in a short window of time. Reducing the per-attack cost. The phone network is just not a secure channel for any sort of communication
    - kevin_thibedeau 1y ago
      They currently lease temporary access to specific numbers from crooked middlemen for the weak claim that they're not "buying" the numbers.
- ElijahLynn 1y ago
  Can you expand on what ss7 means?
  - dmoy 1y ago
    https://en.m.wikipedia.org/wiki/Signalling_System_No._7 https://en.m.wikipedia.org/wiki/Signalling_System_No._7
- wil421 1y ago
  Explain how SS7 access can allow someone intercept my call back to an official number like Bank of America or a number on Fidelity a 401k support page.
mihaaly 1y ago
I have no time and energy for the level of paranoia present web services RQUIRE. I started to cut back. One of the firsts: not accepting Terms and Conditions for a site my company delegated for the sole purpose of delivering my payslips (probably some others too, but marginal compared to this). I'd need to revisit the details to tell what was that exactly, but some sort of sharing some of my data with thrid party (subcontractor) thing. It is a recent develpment, I will see how it flies with my organization, but I'd be surprised if I could be forced to accept T&C just for receiving payslips. We have 2 other admin accounts for reporting time, absence, no more for me with some arbitrary service provider, thanks. (in the previous job of mine our absence tracking system sent me incentivised ads in the dashboard to attract others to their platform and some sort of weird discount system if I buy things here or there, quite repelling)
Braxton1980 1y ago
How can he spoof an email address without Gmail or the like flagging it? I'm not talking about the common name but the actual email address.
- stavros 1y ago
  That's what I'm curious about too. DMARC should make that impossible.
  - hedora 1y ago
    The last I heard, Google relied on spam filters for this. Supposedly, people have been fired after being falsely accused of harassment. The scam works as follows: Send a message to bob@gappsdomain.com and notavictim at the same domain. Arrange for the headers to be “from” bob. Now, notavictim reports Bob to HR. If the google admin is competent, they look at the headers, and note that Bob didn’t send the email. (Not sure if they catch the offender or not.) If they’re incompetent, they see the message in Bob’s from box, and recommend he be fired. This is a feature that enables dubious workflows, where Bob configures spam bots to bother his coworkers, but wants those messages to be auto filed in his sent box. I didn’t think it worked when spoofing unrelated domains like Google though. That’s just dumb. Maybe the attacker had the author’s IMAP gateway password and moved the message into the inbox?
    - calmworm 1y ago
      Google spam filters are terrible because they filter way too much legitimate email. I have been a paying business Gmail user for years, all DMARC, DKIM, etc… in place. My messages still go into client Gmail spam folders. It’s extremely infuriating. Google knows I’m not sending spam. They can’t deliver my email properly to their own inboxes? Nonsense.
doctorpangloss 1y ago
I don't know. Google could solve this all in an afternoon. It controls e-mail delivery, it is the e-mail delivery monopoly. Why deliver these e-mails? It just shouldn't. But because Google delivers spam from senders who spend a lot on Google ads; and e-mail traffic gets laundered into web ads traffic; they just can't do it. And because Superhuman charges more than $0, it can't do it either. Nobody can fix e-mail. If you can't see how phishing and Google Ads are related... you know, this is why it is hard to "just" pass a law. It's not because the law wouldn't fix the problem. It would, if you permit the status quo where Google is the e-mail monopoly. It's this whole A16Z "just pass a law" nonsense, where someone thought he was saying something really insightful because he didn't like Jon Stewart, getting in the way of my inbox zero, and simply never receiving non-personal e-mails at all.
vunderba 1y ago
I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com https://amazon.com, etc.) and look up the phone number there. A little less convenient for a LOT more security.
- bigiain 1y ago
  For some reason I can't seem to find my local Google branch's phone number on their website...
  - MobileVet 1y ago
    This was so much funnier than I wish it was… ugh. Contacting Google. Good luck.
    - cwmoore 1y ago
      Wonder why I've never had that problem.
      - tempodox 1y ago
        Are you saying you can find Google’s phone number?
        cwmoore 1y ago
        Yes.
        figassis 1y ago
        You’re probably worth a lot of money rn. I would start an entire business just selling people Google’s number. Heck, I would start an entire Google support company rn, publish a phone number and proxy calls to Google. I’d screen calls then also sell Google my services. You’re welcome. Build this in 2 months. I want 30% ownership.
8cvor6j844qw_d6 1y ago
> if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real. This reminds me of one time where I got a call from a number I don't know, got yelled at something about spamming calls. Yelling includes threats about getting reported to police or whatever, which was confusing since I never had any history with this number. I suspect my number was spoofed. I'm not sure if there's any defense against that. Now my default is to ignore any unknown numbers.
deleted 1y ago
[deleted]
glxxyz 1y ago
> if someone is calling from a legit number on caller id it means NOTHING I had to tell my bank this once a few years ago, when they called me up and then expected me to give them personal information to confirm my identity.

by klik99 1y ago

dec0dedab0de 1y ago

Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.

klik99 1y ago
Good to know. The guy who called me on friday felt like a targeted attack, I've been getting a TON of pokes at trying to reset my google password. It really made me feel like there's less and less you can trust online. Scammers are winning the arms race, and have the resources to create really good looking pages.
skygazer 1y ago
It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. The web is untrustworthy, and Google transparently passes it to users. We'd probably be better off if Yahoo's quaint curated list of sites had won out.
- mschuster91 1y ago
  > It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. Well, SEO, I get that this kind of gaming is hard to prevent, not at Google's scale. But the AdWords scams? Or all the other fake ad scams, chumboxes and god knows what? The complete lack of audits around something that actually causes money to change hands should be outright banned. At the high end of ads, think large brand TV spots, you got entire teams of lawyers involved to make sure licensing, actor releases, technical details, corporate identity and a myriad of other things are taken care of. But at the low end? Some rando from St Petersburg can post an ad for a book "uncovering Western lies about NATO expansion", some Indian can post an ad for "Norton Removal", some American an ad for a f2p game with content that clearly does not describe the actual gameplay or some Chinese can post an ad for penile enlargement pills - and none of the four will get even one human eye on the ad before the campaign goes live and the ads are displayed to actual users, even though all four either violate Western laws outright or are at least banned by the providers/networks. And the problem isn't just limited to Google, Youtube, AdWords, Unity Ads [1], Taboola [2], Outbrain [3], Facebook/Insta [4] - it's everywhere, the entire low range of ads is infested to the core. Self-service ad platforms should be shut down, period - the industry has shown that "self regulation" doesn't work. [1] https://discussions.unity.com/t/does-anyone-screen-these-ads/798375 https://discussions.unity.com/t/does-anyone-screen-these-ads... [2] https://www.vice.com/en/article/taboolas-content-chum-boxes-also-spread-disinformation/ https://www.vice.com/en/article/taboolas-content-chum-boxes-... [3] https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-newspaper-sites-have-run-thousands-of-scam-ads/ https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-ne... [4] https://www.vice.com/en/article/instagram-and-facebook-are-overrun-with-thousands-of-scam-ads/ https://www.vice.com/en/article/instagram-and-facebook-are-o...
  - eek2121 1y ago
    Yes, and that same lack of lawyers/friction is what also allows legitimate small businesses to thrive. I've worked for many, and out of those many, none of them had lawyers involved at all. It is all about balance. Google could do more here, however the answer is not as obvious as you might think. Especially in an age where identities get stolen often and the lag time on catching said fraud is quite long. The issue is that the entities mentioned are doing...nothing at all. Not even basic MANUAL identity checks and payment checks. Automated checks work very well until they don't.
- deleted 1y ago
  [deleted]
Waterluvian 1y ago
I find that when it’s legit a consistent thing happens, which smells of careful training: they instruct me to call the number on the back of the card, or on a bill.
- TOMDM 1y ago
  Obvious next step to me is malicious bills sent to an address
  - incone123 1y ago
    Only worth it for a targeted attack. Even then I might just read the number off a genuine bill instead of their fake one. And that's assuming they have linked my address and number - lots of scam calls are low effort dial every number.
  - euLh7SM5HDFY 1y ago
    You are a bit late with that idea: https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentence...
kevin_thibedeau 1y ago
They also typosquat support numbers for people who misread them or assume things like toll-free is always 800 when it can be other area codes. Just because someone answers, don't give them enough PII to use your identity elsewhere.
gblargg 1y ago
This happened to me once. I was calling Amazon and did a Google search on mobile. I called the big number that was at the top of search results. After I had given my account email, but nothing critical, I started becoming wary of the questions I was asked because they weren't relevant. I hung up and searched again and the result did not come up again, and Amazon's number was totally different. I looked up the number I called and it didn't find any results. So I'm guessing an ad scam. I definitely don't trust Google results with featured answers for things like that anymore.
- bcrl 1y ago
  This happened to my father while I was around during the beginning of the COVID lock down. He searched for an Apple support number and was served a targeted ad for a phishing site. Because of the change in search a few years prior, ads now look very much like search results compared to the obvious visual distinction back in the Don't-Be-Evil days. The ad was sufficiently targeted that it only showed up on his device for the search -- nobody else would see it. Ephemeral ads are not a good thing.
  - GoblinSlayer 1y ago
    Ironically today even network engineers of all people can't type speedtest.net without google's help. Set your search engine to wikipedia and see them struggle.
    - bcrl 1y ago
      I feel like we lost the battle for any semblance of hope in matters of security when the URL bar blurred everything into search. There is simply no way to ensure that the browser does what one expects anymore.
avidiax 1y ago
Yes, especially do not google the number that you were given on the phone. That is completely certain to turn up the scammer's official looking page and "confirm" the phone number. I have seen Microsoft support forum articles that list the "Facebook official phone number". The fact that it's not from Facebook doesn't make it less authoritative in a panicked person's mind. Google, Meta, Microsoft, and Apple really must start publishing an "official phone number". It is perfectly OK that this phone number just plays a repeating message saying that the user should browse google.com/phone. That website can explain that there is no phone support offered, and provide a bunch of links for common scamming hooks that leads to anti-phishing material.

beeflet 1y ago

> official phone number Great idea unless the attacker has SS7 access.

klik99 1y ago
Yeah, if you're a high profile target then you need extra layers of security, but for regular folks that one weird trick is enough to make you just enough of an annoyance to make another target preferred. But in a world with Pegasus, and telecoms in smaller vacation countries selling off SS7, etc, etc - if someone good really wants to target you normal security protocols aren't going to cut it.
- beeflet 1y ago
  I imagine it will be like SIM swapping attacks where attackers will pool all their money together, gain temporary SS7 access and conduct a ton of attacks in a short window of time. Reducing the per-attack cost. The phone network is just not a secure channel for any sort of communication
  - kevin_thibedeau 1y ago
    They currently lease temporary access to specific numbers from crooked middlemen for the weak claim that they're not "buying" the numbers.
ElijahLynn 1y ago
Can you expand on what ss7 means?
- dmoy 1y ago
  https://en.m.wikipedia.org/wiki/Signalling_System_No._7 https://en.m.wikipedia.org/wiki/Signalling_System_No._7
wil421 1y ago
Explain how SS7 access can allow someone intercept my call back to an official number like Bank of America or a number on Fidelity a 401k support page.

mihaaly 1y ago

I have no time and energy for the level of paranoia present web services RQUIRE. I started to cut back. One of the firsts: not accepting Terms and Conditions for a site my company delegated for the sole purpose of delivering my payslips (probably some others too, but marginal compared to this). I'd need to revisit the details to tell what was that exactly, but some sort of sharing some of my data with thrid party (subcontractor) thing. It is a recent develpment, I will see how it flies with my organization, but I'd be surprised if I could be forced to accept T&C just for receiving payslips. We have 2 other admin accounts for reporting time, absence, no more for me with some arbitrary service provider, thanks. (in the previous job of mine our absence tracking system sent me incentivised ads in the dashboard to attract others to their platform and some sort of weird discount system if I buy things here or there, quite repelling)

Braxton1980 1y ago

How can he spoof an email address without Gmail or the like flagging it? I'm not talking about the common name but the actual email address.

stavros 1y ago
That's what I'm curious about too. DMARC should make that impossible.
- hedora 1y ago
  The last I heard, Google relied on spam filters for this. Supposedly, people have been fired after being falsely accused of harassment. The scam works as follows: Send a message to bob@gappsdomain.com and notavictim at the same domain. Arrange for the headers to be “from” bob. Now, notavictim reports Bob to HR. If the google admin is competent, they look at the headers, and note that Bob didn’t send the email. (Not sure if they catch the offender or not.) If they’re incompetent, they see the message in Bob’s from box, and recommend he be fired. This is a feature that enables dubious workflows, where Bob configures spam bots to bother his coworkers, but wants those messages to be auto filed in his sent box. I didn’t think it worked when spoofing unrelated domains like Google though. That’s just dumb. Maybe the attacker had the author’s IMAP gateway password and moved the message into the inbox?
  - calmworm 1y ago
    Google spam filters are terrible because they filter way too much legitimate email. I have been a paying business Gmail user for years, all DMARC, DKIM, etc… in place. My messages still go into client Gmail spam folders. It’s extremely infuriating. Google knows I’m not sending spam. They can’t deliver my email properly to their own inboxes? Nonsense.

doctorpangloss 1y ago

I don't know. Google could solve this all in an afternoon. It controls e-mail delivery, it is the e-mail delivery monopoly. Why deliver these e-mails? It just shouldn't. But because Google delivers spam from senders who spend a lot on Google ads; and e-mail traffic gets laundered into web ads traffic; they just can't do it. And because Superhuman charges more than $0, it can't do it either. Nobody can fix e-mail. If you can't see how phishing and Google Ads are related... you know, this is why it is hard to "just" pass a law. It's not because the law wouldn't fix the problem. It would, if you permit the status quo where Google is the e-mail monopoly. It's this whole A16Z "just pass a law" nonsense, where someone thought he was saying something really insightful because he didn't like Jon Stewart, getting in the way of my inbox zero, and simply never receiving non-personal e-mails at all.

vunderba 1y ago

I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com https://amazon.com, etc.) and look up the phone number there. A little less convenient for a LOT more security.

bigiain 1y ago
For some reason I can't seem to find my local Google branch's phone number on their website...
- MobileVet 1y ago
  This was so much funnier than I wish it was… ugh. Contacting Google. Good luck.
  - cwmoore 1y ago
    Wonder why I've never had that problem.
    - tempodox 1y ago
      Are you saying you can find Google’s phone number?
      - cwmoore 1y ago
        Yes.
        figassis 1y ago
        You’re probably worth a lot of money rn. I would start an entire business just selling people Google’s number. Heck, I would start an entire Google support company rn, publish a phone number and proxy calls to Google. I’d screen calls then also sell Google my services. You’re welcome. Build this in 2 months. I want 30% ownership.

8cvor6j844qw_d6 1y ago

> if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real. This reminds me of one time where I got a call from a number I don't know, got yelled at something about spamming calls. Yelling includes threats about getting reported to police or whatever, which was confusing since I never had any history with this number. I suspect my number was spoofed. I'm not sure if there's any defense against that. Now my default is to ignore any unknown numbers.

deleted 1y ago

[deleted]

glxxyz 1y ago

> if someone is calling from a legit number on caller id it means NOTHING I had to tell my bank this once a few years ago, when they called me up and then expected me to give them personal information to confirm my identity.