3 ms·

"Just give the caller ridiculous answers in response to their first few queries and see if they balk." Sure, you me and many others on HN could try this or be

"Just give the caller ridiculous answers in response to their first few queries and see if they balk." Sure, you me and many others on HN could try this or be defensive when we get asked for our information but the common customer wouldn't balk. They would just rattle off the information and continue the conversation. The point of the article is that this style of marketing is training customers to feel comfortable with giving out personal information when they're on the receiving end of a call.

tomrod 14y ago
Crazy. Are there any news articles where these type of social engineering scams have been successful?
- MichaelApproved 14y ago
  I remember when it was a big deal on AIM and other IM services. You'd get a message from an official sounding screen name asking you to verify your password. These types of attacks are why you typically see messages like "we will never ask for your personal information" from service providers.
  - alister 14y ago
    "we will never ask for your personal information" It's a nice first step, but then they break the security model by sending emails with a link to click on. Every single service provider, bank, credit card, airline, or utility that sends me email, sends it with embedded links. Customers have now been trained to click on links and give their passwords to login screens if they look halfway authentic.
    - MichaelApproved 14y ago
      At least in this case, I'm calling the bank. Meaning, I'm vising their page and I can confirm that it's actually the bank that I'm communicating with. Browsers have been getting better about protecting users when it comes to online bank phishing attacks. Secure connections are emphasized more and getting rid of basic auth in the URL helps defend the customer from spoofing tactics.
- trhtrsh 14y ago
  http://news.ycombinator.com/item?id=4612022 http://news.ycombinator.com/item?id=4612022

tomrod 14y ago

Crazy. Are there any news articles where these type of social engineering scams have been successful?

MichaelApproved 14y ago
I remember when it was a big deal on AIM and other IM services. You'd get a message from an official sounding screen name asking you to verify your password. These types of attacks are why you typically see messages like "we will never ask for your personal information" from service providers.
- alister 14y ago
  "we will never ask for your personal information" It's a nice first step, but then they break the security model by sending emails with a link to click on. Every single service provider, bank, credit card, airline, or utility that sends me email, sends it with embedded links. Customers have now been trained to click on links and give their passwords to login screens if they look halfway authentic.
  - MichaelApproved 14y ago
    At least in this case, I'm calling the bank. Meaning, I'm vising their page and I can confirm that it's actually the bank that I'm communicating with. Browsers have been getting better about protecting users when it comes to online bank phishing attacks. Secure connections are emphasized more and getting rid of basic auth in the URL helps defend the customer from spoofing tactics.
trhtrsh 14y ago
http://news.ycombinator.com/item?id=4612022 http://news.ycombinator.com/item?id=4612022