My real estate agent has a @agentname.com domain which all my previous communication has run over.

Last week I got an email notice that a payment was due for a household bill. It came from [email protected] and contained a link to a Google Form which asked for a credit card number. The form itself even has Google's warning not to provide credit card numbers down the bottom. It never even named my agent, where I was living or what the bill was for or anything that made it believable.

I forwarded it to them and said I wanted to report some potential phishing. A legitimate person responded from their mailbox noting that they don't accept excuses like that, and pointing out the bill must be paid and noone else had ever questioned it.

I work so hard to train users about scams but I just have no idea what to do about the rest of the world.

> The form itself even has Google's warning not to provide credit card numbers down the bottom.

I received a PayPal phishing email once which included PayPal's actual security footer at the bottom. It helpfully pointed out that communications from PayPal will always address you by name, never as "Dear customer".

I was amused by this, since the phishing email started off with "Dear customer".

There must be some population of people out there who are looking for the footer, but not bothering to think about what it means. (Or possibly a population of scammers who copy the official formatting without checking whether it's something they really want.)

Don't get me started on Paypal. They send emails from a domain that isn't paypal.com with login links in the email that point to a domain that isn't paypal.com

I genuinely can't distinguish official Paypal emails from phishing emails - and that's because the Paypal emails look like bad phishing emails rather than because phishing emails are so sophisticated.

EDIT: Good write up here: https://cantoriscomputing.wordpress.com/2017/03/04/paypals-e...

I've reported such emails to [email protected] and never got a reply. Maddening. I never open mails from PayPal now - better safe than sorry.

Edit: https://news.ycombinator.com/item?id=15296425

The last time I attempted to sell something on eBay, twice in a row a scammer -- presumably in the Ukraine -- won the auction and then proceeded to send me a spoofed Paypal payment confirmation (from: [email protected]) written in Cyrillic. The mailing address was a drop ship company in New Jersey. Then they were aggressive about sending me messages like, "I paid, have you sent it yet??"

I ignored them and sent the spoofed emails to the spoof addresses at both eBay and Paypal, which seemed to be entirely ignored. After the required amount of time passed I reported the auction winners as non-paying, and I finally got my seller's fees "refunded" to my eBay account.

Then, a couple of weeks ago, I attempted to get eBay to actually transfer my fee credit to my bank account. eBay responded with, "We would really love to help you out with this. but due to COVID-19 we can't."

Somehow one of the fraudulent buyers has had an eBay account since 2012, and it's still active and has a 92% positive feedback rating. Their current auctions include a used gynecological examination chair. It's as if they're flaunting the fact that they can get away with whatever they're doing without being held accountable by either eBay or Paypal.

As a bank we do the same thing. Driven by the fact we don’t want our login emails to come from a domain that also sends “normal” emails in case spam filters start dropping emails from our primary domain.

This isn’t a hypothetical concern either, having spam filter go crazy happens more often than you expect, and some of them drop emails completely rather than putting them into a spam folder (looking at you Microsoft).

Unlike PayPal we make it easy to verify our domains. https://monzomail.com

Oh my god the closure on that link. You couldn't write satire this good. Bureaucracy distilled.

There's a theory about phishing emails that they deliberately make them slightly more obvious in order to weed out people like yourself who are unlikely to fall for them, to increase the average ROI of time spent on dealing with responses.

BTW legit Paypal footer does NOT include such warning at all

From a recent email

> How do I know this is not a Spoof email? PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Spoof or "phishing" emails tend to have generic greetings such as "Dear PayPal member". To learn more, go to the PayPal website and click Security.

-My bank sent an (authentic, it turned out) E-mail including the ‘We’ll always use your first name in our correspondence with you to prove we’re who we claim to be.’

The E-mail started «Dear $FORNAVN...» (Where ‘fornavn’ is Norwegian for ‘first name’)

When I called them up to ask, the helpdesk rep just sighed and suggested that the mail merge script had probably crapped out. Again.

I'm always skeptical of when companies say they will "never" do something. How in the world do all your employees know to never do that thing? Are you constantly reminding people every day in your office of the list of things to never do? Even if you're one person that's an insanely strong promise to make to anyone about your future actions. How does a company have such confidence in the future? The only way I can imagine this working is if they make it impossible for themselves to do that thing, which itself is practically impossible in these cases.

I would assume that only certain employees are authorized to email customers at all, and they have been trained to follow the policies.

I mean, in theory, yes, but I mean, I'm sure you've seen your share of mishaps, right? Like when companies send "Dear $CUSTOMER..."? When something that blatantly obvious can get through, what confidence do you have that training is enough to prevent more subtle things like this for all eternity?

I can't recall an instance of Dear $CUSTOMER sent to me personally. If it has happened it must have been very long ago.

Amusingly enough, I got a Dear %{CUSTFIRSTNAME} from my auto loan provider less than an hour ago.

This isn't even restricted to email.

I have a paper letter here from my dentist, the purpose of which is to explain that they've cancelled all routine appointments, because duh, of course they have.

The letter addresses me as "Mr" in some places and as "MrNicholas" (no space) in other places. But to be fair it also claims the problem is COVID-9 (not COVID-19) so I'm guessing that correctness was not the number one focus of the person typing it.

We had some employees working from a coworking space last year, and we would receive invoices from The coworking biz addressed to "MR Company Name". They would frequently omit our VAT number as well. Of course, we could not pay those invoices, and whenever we got in contact with their support The response would be so delayed that we already had received multiple warnings and threats from their automatic invoicing system. They did eventually get their shit together and voided all The junk invoices they had sent us, but it took three months or so... And this was a huge player in coworking, not a small indie bussiness.

Mail merge is mail merge, be it, to an email, letter or text. Dental practices aren't usually big enough to have a person who devotes such a large percentage of their time to composing mail merge templates as to become slick at the task. Rather than being sarcastic you would be better being grateful that they were courteous enough to go to the bother and expense of writing to you at a time when their business was experiencing complete shutdown and they themselves were facing total loss of income. They probably had more on their mind than pleasing pedants who'd focus on trivia at a time like this.

Did it come across as sarcastic? I certainly didn't intend that, of course they have more important things to worry about. They'd usually come in to do a day's work and now suddenly everything is closed and they've got to write this weird open-ended letter.

It's an NHS dentist, so unless we have millions of deaths I expect the practice will continue to exist and receive funding as before. Such practices are funded partially on the basis of the number of patients who are notionally "theirs" to look after and that hasn't changed even if providing non-emergency services is not a priority now.

I think people might read the footer the first time they get an email. That's why it's there.

And on subsequent emails people only look for rough visual similarity as a sanity check. That's why scams keep it there.

>I just have no idea what to do about the rest of the world.

Assume that it's only going to get worse and act accordingly.

You need to expose that kind of stuff. By hiding them behind @agentname.com you just help them.

In this case wouldn't naming the agent also increase the likelihood that they're targeted? The clients have already been primed to follow the phishing link, so it'd just be a matter of getting a target list. Most agents I'm aware of stick to a local region/market, so targeted ad buys ("people in X county buying homes")/email lists/etc could be worth it for a motivated phisher.

Even when a bank or organisation does have good general security practices, I have, far too many times, encountered CS agents who have leaked information like sieves - given me multiple attempts on passwords, hinted which address I’ve registered with. I get why - many people have no idea about any of this stuff, and if CS don’t cut corners they never get to serve anyone. Many, many people I know can’t recall any passwords, and reset them every single time they need them.

I was recently targeted by I-don’t-know-what. Third party opened a fault ticket on my BT FTTC line, and then through a combination of SMS SC spoofing, real links to BT systems, and false links to very plausible looking “book an engineer visit” screens tried to get me to invite a criminal over to play with my technology.

The idea was likely to get me to welcome some unknown party into my home to mess with my router - I would assume putting some kind of packet sniffer in place to skim data and cards - but I honestly have no idea to what ends.

As a general rule, I ignore all communication from banks and service providers, as I’ve nearly fallen for a “card fraud” scam twice - the second time, they already had my card, and had already done some petty fraud that they wanted to talk to me about, with the hope of me giving them access to my online banking. The worst case in ignoring them is that they will try again. If it’s actually important, they’ll keep trying. If it’s fraud, I’ll notice and will contact them.

HSBC UK fraud department in the UK send you a text message if they believe there is fraudulent use of your card with a number to call.

The problem is that number is nowhere on the website. How do I know that text is actually from HSBC? How do I know the number I’m being asked to call is legit?

I’ve tried to explain to HSBC that they are training their customers to be susceptible to scammers but they just don’t get it. I had this conversation with someone in the fraud department where I said, “at least put that number on your website somewhere, so if I go to Hsbc.co.uk and search it turns up” “we don’t want to publicise the number sir” “Well out it on a page that isn’t displayed on the site, but which still shows up in a search if I search for the number” - “I’ll pass on your concerns”. That was about 10 years ago. They still do it.

This situation is getting better. In the UK now there’s a big push among all the banks to ensure that phone numbers and links are never placed in texts. Rather they will only tell you to “ring the number on the back of your card“.

The banks got rather upset when the gov sent that COVID-19 text with a link in it. Silly move, and we’ve seen plenty of fruadsters take advantage of it.

At least the link was to gov.uk

Yeah, but now people are spoofing the phone number to get other links to appear in the same conversation as the COVID-19 message.

I think the situation has improved in the last 10 years.

When I got a fraud call and was asked to authorise I told the agent that I didn't trust them unless I had a number to call to verify, so the agent on the phone told me to call the number on the back of my debit card. They give every person the number explicitly now.

One glaring example is our online electronic tax forms in the US. Is it at "forms.irs.gov"? Of course not, it's at the not-shady-at-all "freefilefillableforms.com".

I've done that to credit card companies that I even called. They'd say something like "okay I need your full social security number" and I would just say no. There would be a pause, then they would say "okay I can verify you by your recent transactions."

Like why didn't you start with that! Some companies just don't teach their reps to care about security.

If they did it the right way, each call would be longer, and they would have to employ more people to maintain their goal of giving the minimal level of service they can get away with.

I’ve had a similar experience when my bank called me and asked me to verify my identity. I asked them to tell me the sum of the last four digits of my account number. They wouldn’t. I had to call another number and get transferred around a bunch.

Perhaps I should have said: here are five possible transaction amounts and dates. Tell me which one is real and then I’ll verify my identity to you.

It's simpler than that. Ask for their desk extension and then call the number on your bank's website/card and use the extension. I have yet to talk to a bank employee who isn't willing to do that.

This is the best way, but some call centers aren’t set up to give it. (I have intimate knowledge of this topic.)

If you run into one of them, the quickest resolution is calling their preferred services line and saying “I just got a call from the Fraud Department but was disconnected; can you transfer me?”

I asked for this on a recent Wells Fargo call as I got disconnected from the previous one when they put me on hold. They said they don’t do that. Maybe you need a million dollars with them before they do, I don’t know.

Had a similar situation, mobile provider had called me to offer me a deal, was no CLI showing - usual withheld affair, as is the case of many companies alas (though mindful that can be spoofed).

Again, same situation, wanted to very who I was and when I wanted them to verfy who they was we ended up in a circle-dance.

But it is important and getting their number or in your case, a branch to go into - something you can prove with a degree of confidence is important. Many will happily give out information. In my early days of work(before CLI and still analogue exchanges afoot) a friend pulled a joke upon me, phoned up pretending to be TAX office and to verify details. It's easy to fall foul of such things and been a source of many scams against less aware and older people less savy of such.

One way is to partialy give information and ask them for some back that they are verfying againt.

Also if you ask them to verify details they will (legit even) use the data protection law flavour of the country to say they are not allowed to do that and very easy to get into a circle-dance.

Which makes online more secure than the whole phone network with all it's legacy overhead opening up to abuse such as spoofing. Bit like the early days of the internet and spoofing IP's, not so easy today (mostly if routers configured right as most are).

I think this is a significant part of why identifying frauds is hard: normal business phone practices are often surprisingly scam-like (e.g. asking to provide verification info when they are the ones calling). So not only do frauds imitate legit activity, legit activity frequently imitates fraud.

Do banks ever actually do this? It makes no sense and what you describe us identical to a push payment fraud? A bank account number is not private information so there's really no point in creating another account.

I asked if it was really necessary and they said they had to. So perhaps this was a situation where they expected much more fraud if they didn't give me a new account.

I discovered it is a real hassle to change a business operating account number. Providers who, in the past, were happy to start doing ACH through your account with minimal documentation require a lot more to change that ACH account number. In one case, they asked for something I don't think I can provide (a scan of a canceled check) as the bank doesn't send those anymore. I'll have to see if they really only need a void check.