10 ms·

Why I willingly handed over my credit card and PIN to a fraudster

• zorlem 13y ago
  A clever scam with the land-line call. I wonder where the fraudsters have got all his personal info (including his land-line phone number) from. Even if they got a hold of his receipt that shouldn't contain enough info to get all the other details.
  • jrockway 13y ago
    The government doesn't make much of an effort to keep your personal information secure. Let's see an example: http://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey=3460235 http://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey... Yup, that's my home address!
    • cjfont 13y ago
      Apparently you don't make much of an effort yourself ;)
      • katbyte 13y ago
        he doesn't have much of a choice if he want to have his ham radio license.
        • techsupporter 13y ago
          The FCC (and a bunch of other government agencies in the U.S.) will happily take a post office box as an address. That's the official address on my ham ticket.
          • katbyte 13y ago
            The GP did use a PO box, and even if you use a PO box you still now know someones name, state and general area pretty much unless you are willing to drive far away for some remote box.
    • Groxx 13y ago
      > whois jrock.us Yep, that's... a whole lot more info, actually.
      • jrockway 13y ago
        I used my employer's address there, since .us demands that you be able to receive their physical mail. Kind of pointless with my ham radio information on the web, though.
    • jlgaddis 13y ago
      You can be my roommate at the Post Office: http://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey=765681 http://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey... (Thanks for making me realize that I'll need to renew my license in a few months, I quite possibly would have forgotten.)
      • jrockway 13y ago
        Love the WWV suffix! I'll be looking for you on the internationally allocated standard carrier frequencies.
        • jlgaddis 13y ago
          Back when I was actually active, I was constantly asked by others what the time was. =) Most assumed that it was a vanity callsign but it's actually what the FCC assigned to me nearly 20 years ago.
  • greenyoda 13y ago
    He says they cloned his card, so they probably either had a card skimmer installed on top of the ATM's card slot or a tiny hidden camera to photograph the card. Now they have his name and account number. They then followed him home to get his address. Then they looked him up in the phone directory to get his land-line number.
    • desas 13y ago
      That's not what the article said. It said that the initial fraudulent call claimed that they had cloned it. Getting a name and phone number is easy. After you've followed the person home, poke through their waste paper bin until you find a letter/bill with the info. If the person is listed in the phonebook (often the default) then you just need the surname from the bin and the town/village of the house you're stood in front of.
      • prawn 13y ago
        Date of birth would be a bit harder to get. Not on the average bill or in a phone book. I guess someone could go through social media once they had your name, but it might not work for everyone.
        • djeikyb 13y ago
          I'm in the US. Online, I've obtained birth and death dates and lists of mailing addresses of specific persons. In one case, I started with the subject's name and county where they died (the goal was to find the burial plot of a relative). Other cases I started with a name and current city of residence (ie, googling myself and family members). I didn't search social networks. Iirc, most of my success came from online county records.
    • zorlem 13y ago
      That doesn't match what the article said. Also, if they already had his card then there would be no need to send a courier to his place and pick it up, that only increases their exposure and the risk of getting caught.
  • agilebyte 13y ago
    You have to realize that we do not hear about all the other cases where they cased someone but did not learn enough info in the end.
• nemothekid 13y ago
  >If you call a landline, it’s up to you to end the call. If the other person, the person who receives the call, puts down the receiver, it doesn’t hang up the call, meaning that when I went to find my bank card, the fraudster was still on the other end, waiting for me to pick up the phone and call ‘the bank’. Can someone explain this? This seems like a pretty glaring and obvious issue that I'm sure I would have experienced before. Is he saying that if he hangs up the phone and picks it up again and the person at the other end doesn't hang up, then the conversation isn't over?
  • zelliot 13y ago
    Yes, that's what happens here in Australia (and I assume the UK). If the receiver doesn't hang up the call disconnects. The exchange disconnects the call after 1 or 2 minutes. What I don't understand is how the scammers got his landline number?
    • greenyoda 13y ago
      If it's a listed number, you can just look it up in the phone directory if you know the name and address.
      • pigscantfly 13y ago
        Have we forgotten phone books so quickly?
        • Dylan16807 13y ago
          Phone directory = phone book, I'm not sure what your question is.
          • lostlogin 13y ago
            Is this a UK versus US thing?
    • mattzito 13y ago
• hartator 13y ago
  Something similar has happened to me. I was in Barcelona, regular tourist. Here come a guy saying he is a cop, in civil but showing some kind of ID. Saying I might have stolen my own credit card and asking to dial the PIN on his phone. I've fallen for it. They've taken 400 euros from my bank account. I guess we don't have to blame ourself, scheme exists, we might fall for we might not fall for it. This guys have training we don't, we have good reason to not act in the smartest way! I hate Barcelona.
  • prawn 13y ago
    If the average nervous person read a page about Barcelona scams and thieves before booking their trip, they'd never go!
  • kaoD 13y ago
    Why do you tourists choose Barcelona? Spain has many places to go, but Barcelona seems to be the first choice... while it isn't even the capital city!
    • vehementi 13y ago
      Because it's beautiful as fuck and has a lot of cool art / architecture.
    • megablast 13y ago
      It is a fantastic city, has a beautiful beach right there in the city, a great old town, fantastic events on all the time, nice parks, good food, great architecture, is easy for Europeans to get too. And as long as you are a bit savvy, and don't accept whatever some strange guy coming up to you says, you will be fine.
      • omegant 13y ago
        Also ALWAYS keep a look at your wallet. Keep it in front of your pants and the hand over it when walking the most touristical places. Also keep an eye while eating or having a coffee. They are very fast and creative.
• D9u 13y ago
  I was once SE'd (socially engineered) into providing the caller with my full name, address, DOB, but no financial information. The caller had spoofed their caller ID to reflect a police agency, albeit out of my jurisdiction, but like the OP it was early on a weekend morning and I was quite well hungover, so I readily supplied the requested info. It was a valuable learning experience and I admit to being "schooled" by the perpetrator but seeing that no actual harm was done I let the matter drop like the lead it was worth.
• cupcake-unicorn 13y ago
  Wow, that admittedly had a lot of effort going into it. I'd like to say that I wouldn't have fallen for it, but I'm not so sure. I think I wouldn't have physically given them the card, though. Something about the whole thing just seems really odd they'd go so much out of their way for one victim. But is this something more common in the UK, perhaps? The only scams I run into are these laughable phone calls I get from time to time - recorded messages like, "This is card services from (fake phone static). Your card has been compromised. Please call us back." I never called the number back but from looking up online it seems that pretty much straight off the bat they ask you for your SSN, and I'm guessing they wouldn't have any personal info about you.
  • jakejake 13y ago
    It's a pretty convincing scam for sure - especially if they get you to think that you called your own bank. I wouldn't be surprised if they got this information from a receipt or something rather than following him home though. As he said, it would be easier to just mug the guy in that case. Following somebody home seems like a lot of investment and risk for a scam that only works on certain percentages of the victims.
    • harshreality 13y ago
      Mugging: - Less effort but requires willingness to use force. - Doesn't require any knowledge of the phone system or victim's details beforehand - High risk, since violent crimes can go bad. - Police care more (although depending on jurisdiction they may take a report and be unable to do anything unless you get lucky and there are leads for them to follow). Con game: - Requires more preparation and knowledge - Allows more time to abuse the card because the victim doesn't know anything's wrong for days. - Virtually zero risk during the acquisition of the card - Police care less... these crimes are more difficult to solve/clear.
      • jakejake 13y ago
        I shouldn't have mentioned mugging because that wasn't really my point - and I usually know better than to provide ammunition for arguing a tangential point! Anyway, I was trying to muse that spying and following somebody to their home is a lot of work and carries the risk of being noticed and/or caught on camera, getting attacked by their dog, or at the very least consuming your entire evening. Who knows if the victim is going to drive 10 miles out of town or stay at the bar until 4am. Maybe they'll go to their girlfriends place instead leaving you with a bogus address. Maybe they'll notice you from the bar and wonder what the fuck you're doing following them..? It just seems impractical just to get your address. Whereas getting info from a receipt could be safe & easy and you don't have to get physically close to a victim until you have them on the hook. You could pre filter. You probably don't even need to be at any particular location. Just go through a pile of receipts in the comfort of your own home. But then again what do I know? Maybe it's ridiculously easy to find a mark and then follow them home.
• taf2 13y ago
  This is why I'm terrible to my bank over the phone... I always ask them to prove to me they are from the bank and when they can't - i hang up. It's kind of annoying except I work above my bank so it's pretty easy to walk downstairs. Maybe someday the bank will implement a kind of certificate to help me identify i'm really talking to the bank...
  • bhauer 13y ago
    Precisely. I've had the legitimate fraud-prevention department of my bank contact me but be unable/unwilling to authenticate themselves. I told them that until they were willing to authenticate, they would never receive any identifying information from me. At some point I said that I would accept the account number as authentication and they were unwilling to provide that. I don't know why they--a legitimate fraud-prevention department--expected to be able to cold-call a customer and receive identifying information. They should be actively working to prevent customers from turning over this information to "just anyone who rings them at home." I ended the call and contacted my bank via their online banking system and via that system they vouched for the original call and provided a number to call back. I lodged my complaint that their own fraud department was calling customers without any ability to self-authenticate. Not sure what happened from there; I've not had to deal with that process again since.
    • lessnonymous 13y ago
      I challenge my bank all the time. The answer I get is "Certainly sir. The best way to validate is to find our free-call phone number in a place you trust - the phone book, or anywhere else you trust - then call it and type in the following number: X X X X X. That will route the call directly back to me".
      • cheeseprocedure 13y ago
        > "[...] call it and type in the following number: X X X X X. That will route the call directly back to me." I wish every bank did this as standard practice! Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep. Better yet, print instructions right on the back of the card: "don't engage any support representative you did not call directly." Training customers to do this (perhaps even through proactive callouts?) would work to significantly reduce this kind of fraud.
• harshreality 13y ago
  The phone thing I can understand, but why would a bank ever send a courier to pick up a card (and why would someone believe that they would)? I've never heard of such a thing. Even if it's got a chip, what could possibly be stored on the chip's memory that would help? If there's a problem with a card being compromised or cloned, they issue a new one.
  • smsm42 13y ago
    In Israel it is actually pretty common occurrence to get a card from the bank by courier. Of course, not personal courier sent just for somebody, but the mode of delivery is like this. Of course, Israel is a pretty small country :) So it's wouldn't sound that outrageous for me. Especially if a courier would give me a time like 10am to 3pm and would come at 3:15pm :) Of course, other parts where they need my card for some kind of examination would sound weird. But I imagine I personally could have fallen for that if the other guy is really good, if not for tiny detail that I don't have a landline for about last 10 years... But the trick with calling back really adds a lot to the deal, all the rest s not that suspicious given that.
  • toble 13y ago
    That's the part the alerted me the most. You are always told to destroy the card, not even throw it away. Getting the customer to call a number is another, they could have transferred the customer. Instead, they wanted to provide a shot of confidence before extracting info that no one, not even the bank should ask for.
    • coldpie 13y ago
      > Getting the customer to call a number is another, they could have transferred the customer. No way. If someone claiming to be a bank cold-calls you, you tell them you'll call them back at their official number. Only deal with bank information on a call that you initiated. I don't know how to work around the flaw in the article. Luckily it's not something we have to deal with here in the US, as far as I know. What a dumb "feature."
      • 13y ago
• Aqueous 13y ago
  I wouldn't be too hard on yourself. I would have probably fallen for it after the phone call. The answer isn't that you're stupid - the answer is, when other human beings exert a ton of effort to deceive you, sometimes you're going to be deceived. Especially if it's out of the blue and you're not on guard. Human beings are pretty cunning and deceitful bastards.
  • Sven7 13y ago
    People taking advantage of people is why legal systems emerged. If they didnt the law would be redundant. And who can even imagine such a world...
    • eru 13y ago
      Not quite. There are other uses for the law, too. Like, just setting defaults and clarifying rights.
• lifeformed 13y ago
  Who pays for fraud cases? Do the credit card companies end up paying for all the merchandise when they reinstate the victims cards and forgive his debts?
  • zizee 13y ago
    Normally the merchants are on the hook.
  • m_eiman 13y ago
    In the chip+PIN case the card company pays, IIRC. If it's a signature purchase the merchant gets no money.
• ChuckMcM 13y ago
  Pretty dicey, I can see a day when your bank calls and you say, "Thanks for calling, I know you're my bank but I wonder if you wouldn't mind answering a couple of security questions for me ..." The big risk though is going out to pick up your card, that gives you the opportunity to film them. If you know which ATM they are watching you set up a sting to catch them in the act.
• prawn 13y ago
  I imagine that a great many of us would be fooled by that sequence. It's easy to consider yourself paranoid or careful and then be thrown off-guard by a well-optimised routine.
• wnevets 13y ago
  I like to think having to send my card so they can inspect it would of been a huge red flag. What is there to inspect?
• EGreg 13y ago
  "As for the call, well, credit where it’s due, it’s pretty clever. If you call a landline, it’s up to you to end the call. If the other person, the person who receives the call, puts down the receiver, it doesn’t hang up the call, meaning that when I went to find my bank card, the fraudster was still on the other end, waiting for me to pick up the phone and call ‘the bank’. As I did this, he first played a dial tone down the line, and then a ring tone, making me think it was a normal call. He will have been sitting next to the first person that called me, no doubt laughing their heads off at how stupid I’d been." Wow, what? This seems pretty crazy. I was wondering how they did it until I got to this point.
  • TwoBit 13y ago
    That seems like a severe security flaw in the phone system.
  • damian2000 13y ago
    I seem to remember Kevin Mitnick making use of this feature at some point, I think it was the time he's trying to make more than one phone call from inside prison; he basically never hung up.
  • Anderkent 13y ago
    Indeed, I had the same reaction - and I live in UK! I haven't ever used a landline though. I'd be more than happy to cooperate with a bank when I'm calling them (though asking for PIN would probably make it suspicious - AFAIK there are ways of intercepting calls anyway, so by that point I'm all 'actually, I'll just come over to your branch').
• Groxx 13y ago
  Phones in general are ridiculous for authentication. You can spoof nearly every bit of data, and there's no way to know, and little weird bits of flotsam like this float to the surface occasionally and make it even worse than it normally seems. If only I could ask them what their favorite restaurant is, maybe we'd finally have two-way verification. Nobody else picked McDonalds, right? That's a safe choice?
• jasey 13y ago
  It wasn't explained how the crims got the pin number after he entered them into his phone. I assume because each number on the keypad has a unique tone, they could extrapolate which keys were pressed? Also how did they get his phone number? The phone directory? Most shocking is how did they get date of birth and mothers maiden name!?!?
  • matthiasl 13y ago
    About the PIN: your guess is right. The tone system for dialling numbers works like this: there are four "low" frequencies (697, 770, 852, 941 Hz) and four "high" frequencies (1209, 1336, 1477, 1633 Hz). Each key plays exactly one "low" and one "high" frequency, e.g. when you press "1", your phone plays 697 and 1209 Hz. The telephone exchange listens for those tone combinations to know what number you're dialling. If you have an audio recording of a number being dialled, you can actually figure out the number just by listening to each tone separately and comparing it to the sound made by pressing keys on your own phone. Wouldn't surprise me if the fraudsters did just that, or maybe they used a "spectrum analysis" feature on a PC audio program.
    • sophacles 13y ago
      There are programs that will do this for you... probably even for your smartphone. I mean - it is built into asterisk and other pbx software already, code for it can't be that hard to find.
  • robmcm 13y ago
    Someone suggested they went through his rubbish once they were standing out side his house. Seems like a bit of a gamble though as by this point they would have invested quite a bit of time following him etc. And how many people these days (young and living in a shared house in Islington especially) still have a land line, and are even in the phone book?
• sitharus 13y ago
  I once got an SMS to the tone of "This is <my bank>, you have to call us urgently on <some 0800 number> and quote reference <blah>". So the first thing I did was ring the number printed on my card and have a nice talk to them. Turns out it was the bank, but they don't do themselves any favours.
  • jlgaddis 13y ago
    I've received similar (legitimate) texts from Chase a few times. A couple months ago I was in the pharmacy to pick up a prescription. I handed the pharmacist my card and she walked back to her computer to run it. A moment later, as she gets back to the counter where I'm standing, my phone (which I was holding) buzzes. I look down at an SMS "fraud alert" from Chase just as she says, "I tried running it twice but it won't go through." The SMS from Chase had the name of the pharmacy and the total amount and told me I could reply to the message to state whether it was a legitimate transaction (I don't recall exactly what I had to reply with but effectively I was responding "yes" or "no"). I quickly sent back a reply stating it was legitimate and almost instantaneously received a "thanks" message. I asked the pharmacist to run the card again and it went right through.
    • Avenger42 13y ago
      I got the same from Discover once; I was at a computer shop picking up a new PC. They ran it once and told me "it didn't work" as my phone started ringing. It was an automated call asking me whether the charge was legitimate. I told it "yes" and asked them to run it again. Makes sense considering that to Discover, it's an out-of-the-blue $1k+ purchase at a store I rarely visit.
  • nodata 13y ago
    I've had this with my bank: they called me and asked to "take me through security". I explained to them that I'd have to take them through security first, since I had no idea if they were really my bank. They didn't get it. I ended the call.
    • tehwalrus 13y ago
• James_Duval 13y ago
  I found the title slightly misleading. I was expecting an interesting article about a deliberate handing-over of credit card and PIN to a known fraudster, in an attempt to examine their behavioural patterns and maybe offer some anecdotal insight. I felt the actual article was much less interesting.
• Kurtz79 13y ago
  A good strategy is not to depend on a single bank or account. At least in Europe it's fairly easy to find banks offering accounts with no maintenance/transactions costs , just open two accounts at two different banks, keep the same level of cash in both and if something happens you don´t have to go on a diet of canned beans waiting for the compromised account to be restored. (Then again, some might argue that now you have twice the chance of being targeted by a scammer).
  • TeMPOraL 13y ago
    > (Then again, some might argue that now you have twice the chance of being targeted by a scammer). Twice the chance for half the money. Significantly less for the whole sum (assuming scams are independent events). I think it's a good tradeoff ;).
• noonespecial 13y ago
  Wait: The fraudster gave you his license plate number?!
  • brazzy 13y ago
    Stolen car?
    • noonespecial 13y ago
      And a description of the driver? That's bold.
    • fnordfnordfnord 13y ago
      or a taxi?
• mathattack 13y ago
  Social engineering trumps hacking.