News for hackers. Stuff that matters.
Re:I was just subjected to the most credible phishing attemp... by kerng on Wednesday October 09, 2019 @09:32AM (#21203011)
Why would a letter be genuine? That seems easier to spoof then phone or email?
Re:I was just subjected to the most credible phishing attemp... by dredmorbius on Wednesday October 09, 2019 @01:30PM (#21205548)
Cost.

Email is pennies per thousands.

Phone calls are cheap especially for nonconnected or robocalls (which would cost for a postal contact).

Postal mail costs $0.50 US in postage alone. The full-up cost of a mail campaign is often several dollars per mailed item, though in bulk, and with bulk rate, I believe it's closer to $0.40 (postage plus a few cents for paper and envelope).

That would cover many thousands of email contacts, possibly nearly as many phone/VOIP attempts.

And the systems required to successfully and accurately generate a postal response on request are also high.

Low-cost systems are high-fraud systems.

Re:I was just subjected to the most credible phishing attemp... by bearcobra on Wednesday October 09, 2019 @10:27AM (#21203578)
Not sure if it’s true, but I’ve heard that mail (at least in the US) is safer because the cost to send letters is high enough to deter bulk sends vs email/phone, that postal inspectors are relatively effective at catching people, and that the laws around mail fraud make prosecutions easier.
Re:I was just subjected to the most credible phishing attemp... by SuoDuanDao on Wednesday October 09, 2019 @11:30AM (#21204130)
I got a scam letter from someone claiming to be Canada Revenue Agency, so I wouldn't bank on that either.
Re:I was just subjected to the most credible phishing attemp... by sjs382 on Wednesday October 09, 2019 @09:46AM (#21203130)
It might not be genuine. But what one should do to resolve the problem described in the letter is to go to the regular amex website, log in, and update your debit information.
Re:I was just subjected to the most credible phishing attemp... by whoopdedo on Wednesday October 09, 2019 @09:54AM (#21203232)
My preference is to have multiple points of contact. Email+phone and the alert is sent simultaneously both ways. This happened recently when a purchase I made was flagged. I got a text asking to approve the charge. Not trusting SMS I checked my email and saw the same message as the text and a link to take further action.

I was disappointed that no alert was sent through the banking app. That would be the most secure option but is explicitly disallowed in the notification settings.

Re:I was just subjected to the most credible phishing attemp... by ceejayoz on Wednesday October 09, 2019 @01:25PM (#21205475)
It's not so much that the letter is guaranteed to be genuine.

They can include information in the letter they can't include on a phone call, as the mail service is performing the authentication.

My health insurer won't talk to me on the phone without me confirming identity, even if they called me, but they'll happily mail the info.

Never call the number off the letter, though.