5 ms·

Outside of the obvious, the tragedy of the young woman losing her life, the fact that the scammers likely will not be impacted at all, etc. a couple of other th

Outside of the obvious, the tragedy of the young woman losing her life, the fact that the scammers likely will not be impacted at all, etc. a couple of other thoughts. - It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties. Email/phone call scams have been around for a long time. They’re very easy to fall prey to. There’s no reason our phones shouldn’t be able to inform us that a certain number is officially from the IRS, Cops, Verizon, etc. - This is a form of Swatting. Delivery companies, and also the police, etc need to do better in ensuring the people demanding services are where they’re demanding the service and/or the person who lives there is aware and genuinely needs to be visited. - We need a bit of a broken windows policing for online/digital scams. The reason they are blowing up is there is hardly a risk of being caught. And the cost/benefit analysis probably suggests that th police really shouldn’t be involved in most of the individual cases or expend too many resources. However, this blows up the number of cases so the aggregate cost does indeed grow too high. So there needs to be an effort to prosecute and expend resources even on low level cases so the criminals get the message that they’re not gonna get away with it.

Neywiny 8mo ago
In re your first point, it's tricky because the advice is to call them back on the publicly available number. Problem is, I know somebody who fell for a SEO hijack and called a fake number. Not everybody knows how to spot a scam. The guy here did though, and he used my techniques (ask questions they'd know the answer to). He knew he was getting scammed. I think it was just an emotional override with weighing the risks. This one is very different than a call saying the IRS wants Google Play gift cards or whatever. Especially with the scammers having the woman actually show up. That's next level in all the wrong ways
- xethos 8mo ago
  You didn't say, and I wouldn't want to assume the situation, but calling the number on the back of a bank or credit card would work better here (in case it was a bank). This is also an argument in favour of paper bills, or logging in to a customer portal as a best-of-the-worst option
  - Neywiny 8mo ago
    Correct. We all told the person after that they should've called the number from previous communications. But there's so much diligence that's needed in these stressful times and it only takes one mistake to get fooled. Wasn't nearly as bad as this though...
coldtea 8mo ago
We need a high trust society. Everything else is band aids on a broken one.
- nathanaldensr 8mo ago
  Agreed. We (meaning the United States) used to have this for the most part. It doesn't scale to mediate all human interactions with authentication/authorization.
  - cucumber3732842 8mo ago
    Trust seems to decline specifically because we seek to replace it with alternative systems.
- jhanschoo 8mo ago
  Cah you clarify the mechanisms by which a high trust society reduces the incidence of scams/becoming victims to scams?
  - coldtea 8mo ago
    A high trust society reduces the incidence of scams/becoming victims to scams by reducing the number of scammers and increasing the number of honest people and honest behavior. That's what a high trust society is and does by definition. If you want "mechanics", that would be an increased focus on community, with positive community best-behavior incentives (reputation, pride in work, solidarity, rewarding good behavior) and negative ones (shame, ostracism, punishing bad actors), social cohesion, and an emphasis on duty and morality, while reducing cynicism, and selfish individualism. This includes the appropriate role models and media/entertainment landscape.
    - jhanschoo 8mo ago
      > A high trust society reduces the incidence of scams/becoming victims to scams by reducing the number of scammers and increasing the number of honest people and honest behavior. Considering that the scammers in this instance haven't been identified, there's a good possibility that the phone scammers belong to an out-group (e.g. infamous Indian/Nigerian scammers) of the victim's society. In fact, it seems to me that trusting more (because the in-group are honest) without appropriate safeguards preventing out-group members from impersonating in-group members exacerbates the problem. So I do not really see the connection between your solution and the problem.
alephnerd 8mo ago
> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties Because this would add compliance and regulatory overhead which the Telco industry has lobbied against, and activist organizations like the EFF will screetch muh liberties while taking donations from those very companies, and HNers will dutifully complain about the descent into authoritarianism. Additionally, a large portion of smaller essentially fly-by-night VoIP vendors and MSPs have an incentive to not ask questions about who is purchasing their services despite attempts at regulation by the FCC [0]. [0] - https://docs.fcc.gov/public/attachments/DA-24-1235A1.pdf https://docs.fcc.gov/public/attachments/DA-24-1235A1.pdf
MagicMoonlight 8mo ago
Phone scams shouldn’t even be a thing. Every phone number has to be registered to a company. Simply hold those companies to account for all crimes committed using them. If you sell numbers to Indian scammers, then you take the hit for all the scams, because why are you selling phone numbers to scammers?
magicalhippo 8mo ago
> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties. My alarm company had me come up with challenge and response words. Yet when they call they want me to say my word first. Like how do I know they are who they say they are? Caller ID can easily be spoofed. So so much for that idea...
- mindslight 8mo ago
  The security model here is different than usual. The goal of the challenge is to authenticate you to them - in case they are calling a landline, or a left-at-home mobile phone that the burglar is now answering. So this actually makes sense. If they call, you say you word, then they can't authenticate themselves to you, it seems like you must then change your word. For active man-in-the-middle, I don't think this protocol is designed to protect against that.

Neywiny 8mo ago

In re your first point, it's tricky because the advice is to call them back on the publicly available number. Problem is, I know somebody who fell for a SEO hijack and called a fake number. Not everybody knows how to spot a scam. The guy here did though, and he used my techniques (ask questions they'd know the answer to). He knew he was getting scammed. I think it was just an emotional override with weighing the risks. This one is very different than a call saying the IRS wants Google Play gift cards or whatever. Especially with the scammers having the woman actually show up. That's next level in all the wrong ways

xethos 8mo ago
You didn't say, and I wouldn't want to assume the situation, but calling the number on the back of a bank or credit card would work better here (in case it was a bank). This is also an argument in favour of paper bills, or logging in to a customer portal as a best-of-the-worst option
- Neywiny 8mo ago
  Correct. We all told the person after that they should've called the number from previous communications. But there's so much diligence that's needed in these stressful times and it only takes one mistake to get fooled. Wasn't nearly as bad as this though...

coldtea 8mo ago

We need a high trust society. Everything else is band aids on a broken one.

nathanaldensr 8mo ago
Agreed. We (meaning the United States) used to have this for the most part. It doesn't scale to mediate all human interactions with authentication/authorization.
- cucumber3732842 8mo ago
  Trust seems to decline specifically because we seek to replace it with alternative systems.
jhanschoo 8mo ago
Cah you clarify the mechanisms by which a high trust society reduces the incidence of scams/becoming victims to scams?
- coldtea 8mo ago
  A high trust society reduces the incidence of scams/becoming victims to scams by reducing the number of scammers and increasing the number of honest people and honest behavior. That's what a high trust society is and does by definition. If you want "mechanics", that would be an increased focus on community, with positive community best-behavior incentives (reputation, pride in work, solidarity, rewarding good behavior) and negative ones (shame, ostracism, punishing bad actors), social cohesion, and an emphasis on duty and morality, while reducing cynicism, and selfish individualism. This includes the appropriate role models and media/entertainment landscape.
  - jhanschoo 8mo ago
    > A high trust society reduces the incidence of scams/becoming victims to scams by reducing the number of scammers and increasing the number of honest people and honest behavior. Considering that the scammers in this instance haven't been identified, there's a good possibility that the phone scammers belong to an out-group (e.g. infamous Indian/Nigerian scammers) of the victim's society. In fact, it seems to me that trusting more (because the in-group are honest) without appropriate safeguards preventing out-group members from impersonating in-group members exacerbates the problem. So I do not really see the connection between your solution and the problem.

alephnerd 8mo ago

> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties Because this would add compliance and regulatory overhead which the Telco industry has lobbied against, and activist organizations like the EFF will screetch muh liberties while taking donations from those very companies, and HNers will dutifully complain about the descent into authoritarianism. Additionally, a large portion of smaller essentially fly-by-night VoIP vendors and MSPs have an incentive to not ask questions about who is purchasing their services despite attempts at regulation by the FCC [0]. [0] - https://docs.fcc.gov/public/attachments/DA-24-1235A1.pdf https://docs.fcc.gov/public/attachments/DA-24-1235A1.pdf

MagicMoonlight 8mo ago

Phone scams shouldn’t even be a thing. Every phone number has to be registered to a company. Simply hold those companies to account for all crimes committed using them. If you sell numbers to Indian scammers, then you take the hit for all the scams, because why are you selling phone numbers to scammers?

magicalhippo 8mo ago

> It’s strange that we still haven’t setup any sort of authenticated form of communication with official parties. My alarm company had me come up with challenge and response words. Yet when they call they want me to say my word first. Like how do I know they are who they say they are? Caller ID can easily be spoofed. So so much for that idea...

mindslight 8mo ago
The security model here is different than usual. The goal of the challenge is to authenticate you to them - in case they are calling a landline, or a left-at-home mobile phone that the burglar is now answering. So this actually makes sense. If they call, you say you word, then they can't authenticate themselves to you, it seems like you must then change your word. For active man-in-the-middle, I don't think this protocol is designed to protect against that.