Did a quick Google search the next day and figured the process is legit but people out there have gotten higher bills than before.

Moral is to fight the human-interaction pressures and be adamant on doing your own research. No shame in that.

The only thing that will sometimes peak my interest enough to listen to the pitch, is if they offer non-monetary upside.

Before I lived "here", every weekend, guaranteed, at least 4-5 knocks on the door on Saturday & Sunday afternoon (combined). Trying to sell me something that I didn't need, didn't want, and often it felt like a scam.

https://www.consumer.ftc.gov/blog/2015/08/door-door-sales-an...

I'm thinking of preparing an mp3 of a chaotic household (think 10 kids screaming and fighting) for improved effect in the future.

Before they can speak, I say, "Are you selling solar, politics, or religion?"

They always protest, "But I'm not selling anything..." and go into their sales pitch.

I interrupt with again with, "Solar, politics, or religion?"

90% of the time it's solar. I tell them I rent, and they go away.

But the caveat there is that if I were to do a one-time donation, they would still have my information and the permission to receive mail on file.

Charities are marketing companies; they collect money and advertising permission, and give you direct mailed marketing in return.

If you don't have a badge and a gun, I'm not opening the door for any reason. If you have a badge and a gun, I'm probably not opening the door.

Or OMG what if somebody needs a boost because their car battery is dead? Oh man, I couldn't bear it if I became that guy who didn't give someone a boost.

Signed, A Canadian HN user

I’d be quite worried if I ever became stranded in a white neighborhood and had to knock on a random door for assistance.

"I once got lost in typical U.S. suburbia and the first door I knocked the guy wouldn't tell me the direction I needed to go but insisted on driving me there.

I was conscious of being percieved as a potential threat in that situation. But me being percieved as a likely nuisance to be ignored didn't cross my mind."

My concern is neither racist or irrational, based on my particular racial mix and phenotype.

I totally get not wanting to talk to people who are trying to sell you something, but if you are such a bad ass, living in your wild west world, why don't you try bringing up the courage to just tell someone at your door that you won't buy anything from them? Seems easy enough to me.

If I'm in the market for a service, I'll do the research and reach out.

This problem, at least at that level of magnitude, does not exist in other parts of the world.

- to sell me on religion

- to solicit money for some kind of commercial service, charity, non-profit fundraiser

- to sign me up for political stuff

And they do this several times a week (pre-COVID). So I never open the door to surprise strangers. It's not paranoia; it's just preventing the waste of my time and emotional energy. I'm not interested in worshipping a sky demon. It's not incumbent on me to figure out whether the service is legit, rent-seeking grift on top of a legit service, or a total scam. I don't have to figure out how to gently turn them down just to keep junk food out of the house.

I was conscious of being percieved as a potential threat in that situation. But me being percieved as a likely nuisance to be ignored didn't cross my mind.

Then when your irrigation system has sprung a leak and is spewing water all over the side of my house, I'm going to go to the valve on the sidewalk in front of your house and turn off the water to your house while your family is trying to shower and make breakfast.

That's exactly what happened when my neighbor refused to answer his door one morning at 6am.

Assuming they knock and announce they have a warrant as opposed to knocking the door down, you open the door and they start coming in immediately. You can read the warrant, they'll likely shove it in your face. You should be on the phone to an attorney or the local bar association before the last officer in past the threshold, anyway.

I'm pretty shocked an attorney would suggest doing something that can very likely be construed as stalling for time when tensions are likely pretty high.

Nor do they have to allow you time to call a "watch commander to verify it".

What is likely, however, is that you're gonna be shopping for a new front door if you don't open up by about the second knock -- if they give you that long.

Obviously this isn't legal advice, but it's what defense lawyer friends have suggested if it ever comes up.

I think that popular video about "never talk to cops" mentions something like it too?

I assume if they don't wait, it helps your court case. They could always go with the "probable cause" argument, but again this can help your case if you can prove they didn't have actual cause.

Pro-tip: if they're at your door with a warrant, they have probable cause.

https://www.motherjones.com/politics/2010/09/aiyana-stanley-...

Think about it: say someone has a bunch of drugs, you wouldn't want to give them time to start flushing it down the toilet while they call up and verify the warrant is valid. You kick the door in, arrest them, and secure the scene for forensics and evidence collection.

Hence the saying "get your foot in the door" for getting an opportunity to talk to someone.

"We do not buy things at the door"

I had a call from a guy claiming to be from PECO (my power co) with a good deal to switch off of PECO. Indeed we do have alternate generation supplier options, but this smelled. So I asked him several times if he worked for them and he insisted. Finally i agreed and he wanted to route me to a neutral, recorded line, agreement gathering company, but he said it would identify as "xyz energy". Whoops, deal's off, fat liar.

At this point we can call the cops on them and the cops can issue a citation. I haven't seen them since the ordinance was passed.

If they get you on the line, you're going to fight against a professional liar on an uphill territory made of cultural norms and basic politeness. Turns out disengaging from a conversation isn't easy. But how do they get you on the line in the first place?

Like anyone, you probably have frequent periods of time when you have a lot of errands in progress. Maybe you've ordered a bunch of things on-line, booked a trip, just sent documents to your accountant, and posted your car for sale. Any of these can face roadblocks that generate a phone call. In such periods of time, you'll be more likely to pick up that unknown number calling in, because maybe it's one of the vendors calling with an issue that can either be resolved in 30 seconds on the phone, or 2 days via e-mail.

For the bad actors (marketers), it's a numbers game. Personally, I also don't take calls from numbers I don't know... except whenever I run any kind of errand remotely, which is when they usually manage to catch me (only for me to wait until they tell me what they want, at which point I hang up).

I haven't picked up an unsolicited phone call or answered the door in 25 years and I never had a problem with it.

I've been in situations when I don't have access to my cell phone and I need help from friends, so I call from a stranger's cellphone. I never get an answer. I have to text them from the stranger's phone (and see their text messages), wait for them to see the message, then accept the call. It's incredibly frustrating.

I'd like for you to spend a day at my grandmother's house.

She's had the same landline number for probably 50 years and gets - no kidding -- probably 20 of these calls a day. It may not "take more than 5 seconds" but it gets real f'in' annoying real f'in' quick.

She now only answers calls from numbers she recognizes. She will pick up if you yell at her on the answering machine, though!

Also, as of iOS 13 (or whenever it was they introduced the feature), I am -- thankfully -- no longer even aware of calls or text messages from numbers that aren't in my contacts until I pick up my phone and look. My phone doesn't beep, ring, or ding if I receive a call or text from an "unknown number" -- and I could not be happier about that!

It took me decades to learn this. I mean, to really learn it.

Barring emergencies (like blood squirting out of puncture wound, or part of your house is on fire):

NOTHING is ever urgent.

You set the pace of your life. You speak when you are ready. You act when you are ready. Take as much time as you need to think.

My dad: "It's worth nothing to you tomorrow."

Tree guy: "You're not gonna have Christmas?"

Unless it's the Joint Chiefs calling me up from the war room to stop a meteor from destroying the planet, I'd rather go back to sleep. Even then I still might: they can fire me in the morning if there is one.

Saves so much time and energy, and you rarely if ever actually miss out on anything good.

I have yet to find a use for some advanced math school tried to teach me when I was a teen, while basic life skills like how to manage finances, deal with scams, etc are invaluable.

Sometimes you really do need to think things over before making a decision. "No" closes doors before you've had a chance to consider.

How does "I'll get back to you after considering" let "weasley salesdroids" take advantage, as long as you hold firm? If you're not the type of person to hold firm after saying that, you won't hold firm after saying "No" either.

Anyway I went with one of the "source" power suppliers who instead offer a loyalty discount that builds up over time. I'm sure switching suppliers every year will be a bit cheaper in the long run but I choose reliability and convenience in this case. Also because the reseller companies tend to pop up and be bought up / merge constantly. Besides, it gives me some moral peace of mind that I'm paying the company producing electricity directly instead of a marketing middle man.

Standard sales pitch tactic: "manufacture a sense of urgency"

The bank employee asked me to give him my passport number and acted annoyed when I refused. He couldn't understand why I would not give this kind of private information on a phone call and why it was a breach of security. I then called the bank's customer service hotline and they had no record of the call from the fraud department being made because it's a separate department and they didn't have access to that data. It took 3 days before I got a confirmation from my bank that that call had indeed been legitimate (and that's only because I have a relationship manager)...

So I think Banks are part of the problem, they need to massively step up their training in security so as not to make this kind of demands on phone calls they have themselves initiated.

It's not just banks - I get the same spiel from my insurers, who say they have to check the information "for data protection" - oblivious of the fact that them regularly doing this means that they're setting the scene for people inadvertently leaking the information they take as sacrosanct!

Whenever they've phoned me and I've told them I don't want to give out my info they just tell me to call the number on the back of my card. Never had anyone act annoyed towards me. Maybe it's because I never act annoyed or accusatory towards them, so they don't act the same towards me. I just tell them that I'd rather not give my info out to someone who's phoned me

Is it any surprise that institutions would not know how to handle their customers seeking verification when it is rare and at least some of the people who claim to want verification have a very low standard for evidence?

I suspect part of the problem is the minimal effort put into most scams, which is where this story is sobering. The people involved in this scam were clearly willing to lay down the framework to take a smaller scale crime and escalate it into something more profitable. While many of us may seek solace in our own practices being able to filter out the type of scam described in this story, the real question is when (rather than whether) these people will find an approach that exploits our own vulnerabilities.

Unencrypted email.

Indeed. This is far too common in the UK. The banks call people, introduce themselves to be from a $bank, and then start asking security questions. I have had to tell the other side a couple of times that is not how it goes - they called me, they should first authenticate themselves before starting to ask for details that are part of customer authentication.

The first time I called back through the banking app. (The ability to initiate a call to bank's customer service from a trusted app is a good idea.) It took their end about 40 minutes to sort out who the first caller was. To my bank's credit, at least they didn't make me wait on the line, but sent me a notification SMS once they had the information ready. Then I called back again.

The second time I knew better and asked for a direct reference code that I could use to make the callback verification tango easier on their end.

But at least with the banks they mostly understand that customers may be suspicious about unsolicited calls. The ISPs on the other hand...

I hope they're working on a new standard for telecom that allows unspoofable caller verification. That, and secure / verified e-mails. But that too is a standard challenged by 60 years of legacy (I had to do a quick wikipedia check).

I was reconciling a firms bank account. I had four transactions from their payroll company, but the last payroll was weeks ago.

I called the payroll. The first person I spoke can explain one charge is a tax reconciliation, but don't know about the other three. The next human in another division explains a service fee. Because I'm not authorized, I won't be able to get more information about the last two charges.

Each group is compartmentalized and siloed. Each department is focused on administering their part, but no one person can accounting for the bank activity.

Banks are horrible. Their security measures have been and will continue to be defeated by any targeted attack. Not only that, they act very entitled to people's personal information because they want to protect against fraud. Apparently, that is more important than any other concern.

My bank's authentication system is so convoluted people will just write down the stuff they have to type in. This is so normal, the bank employees print out the passwords and hand them out. This happened to me yesterday: I have two sets of passwords in my wallet. They actually print a message saying they will never ask for this information over the phone but it wouldn't surprise me if they did it anyway. The ATMs ask people trivial stuff like dates of birth as if it was proof of identity. The mobile app wants complete access to my phone, including file system, contacts, camera, microphone and call management. They have a "security" browser plugin that's actually a rootkit: it contains a kernel mode driver module which intercepts all network traffic, reducing performance noticeably. I assume it records the traffic and leaks the information back to the bank. If this thing isn't installed and running, the bank's website won't let users log in.

I thought it was fraud, so hung up and called them using the number on the card. Turned out it was a legitimate call. I wrote them a detailed explanation of why their process was indistinguishable from a scam and never got a response. Great.

The whole thing was BS as it was because they wanted to verify that I owned the external checking account I was using to fund the new accounts -- one that I registered on their portal ~7 years ago and have consistently used since then to pay off my Chase credit cards.

I did have a very good experience with American Express when they called me about a fraudulent charge on my card. They solved this identity issue by putting a note in their customer support system and had me call the number on the back of the card. On the callback they did their usual phone identity verification and then transferred me back to the fraud department to solve things. Was very confidence inspiring in their security.

[1] I am not exactly sure how it works, but this Wikipedia article mentions that there are different issuers, of which HSBC is the largest: https://en.wikipedia.org/wiki/Banknotes_of_the_Hong_Kong_dol...

https://en.m.wikipedia.org/wiki/Banknotes_of_Scotland

I am skeptical of training because I've seen a lot of people do the training sessions and parrot out the knowledge (thus pass any tests) despite not understanding the underlying reasons, so when faced with a slightly different situation than the one in the training session they will fail spectacularly.

I got a letter the other day (yes, snail mail) from my bank (which is one of the more technologically forward ones out there, I've worked for them (as a developer-for-hire) for a couple of years). They said they were rejigging an investment account product I'm using, but all they mentioned is that I should go to the webapp for it and it'll tell me more.

I mean there's nothing on there yet but hey.

Banks could normalize this behavior by having their customer service reps ask customers to do this at the beginning of every call.

"Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."

This would be great as long as your call back was recognized and immediately routed to the right person instead of being placed on infinite hold, as is usually the case when you call a bank's or credit card company's number.

I really, really thought it was fraud at first until they basically said "yep, go for it, use the number on the back of your card then give us this code".

It would be great if more companies had this functionality. It would also be useful in the situations where you get disconnected while talking with someone.

Most call centres want you off the phone as soon as possible, regardless of whether the problem is solved or not. Making it easy for you to call them isn't in their best interests.

As long as the first csr puts a note on the account about what's going on, any csr can resume from there.

i.e. a note like "20200423 - asked customer to call back to discuss recent large transactions on credit card".

Yes, going to exactly the same person is not always required (depends on how good their customer notes are--in my experience there's quite a bit of variability there).

Going to the right department immediately instead of being placed on infinite hold like someone who just randomly called in is required for something like this to work.

So it's definitely possible.

"Sir, I'm just trying to help prevent fraud on your account and I need to know that it's actually you who answered the phone."

(Yes, there legitimately was fraud but I had no way to know it at the time. I closed the account about a month later after another issue.)

I found it was in fact not fraud when my credit monitoring service informed me that someone reported I refused to pay a bill. One call to the utility company later, it was resolved...unfortunately i'm still trying to fix the credit report.

It sounds like that option has passed for the parent comment, but you did just try disputing it right? Force them to come up with the proof.

I am not sure whether it's even legal for them to mark you as refusing to pay without making a formal payment demand by mail.

I told them as much and after a few years they finally started sending me secure emails asking me to call them. Certainly I wouldn't trust "call back at..." messages claiming to be from a medical provider, even though they're indistinguishable from the real thing because that's the same thing the doctor's office does. It's bizarre considering how security conscious they have to be.

That said, with far-side supervision, I suspect that the call would actually time out after something like 20-30 seconds of either party hanging up. I'd just make it a habit to go put the kettle on and make some tea before placing another call.

If the call doesn't time out, well, it's time to ask BT some hard questions as to why they're allowing that sort of nuisance on their telephone network. AT&T managed to get rid of it here just fine.

Sure, but that only works for landlines. Is this still a common thing in the UK?

This trick only works if the receiving caller is on a landline. It will not work on mobile phones.

So, say, if I called you and you picked up, I would be able to prevent you from calling anyone else by not hanging up indefinitely?

Just great. Will the system not disconnect if you dial 999, too?

Originally there was a grace period because of pulse dialling. Each "pulse" is actually a hangup - so the system had to tolerate that hangup != disconnect. But the grace period was far too long, and eventually end-users adopted it as a feature - if you wanted to take this on your bedroom phone instead of your hallway phone, you could hang up the phone, go up stairs, and pick up the bedroom phone.

So now we have two problems. One is that the bug has been adopted as a feature. The other is that precisely because of 999/e911 systems, the phone system is incredibly backwards compatible. Most exchanges still support pulse-dialling - it's never dropped intentionally (some exchanges don't, because they're too modernized. But it's not a conscious "lets turn this off now" thing.)

There has been a move in recent years to reduce the grace period, precisely because of this abuse. But until it's dropped short enough to be a non-issue, my advice for anyone who thinks a call is suspect, is to call the talking clock (123 in the UK). It is a paid service, but I don't like bothering the operator for such things. But if you call 123, and reach your bank, you know summat's up.

No no no no no.

Hang up and use another phone. End of. Any advice that you call another number first or whatnot is bad advice. If such advice got widespread, what would scammers do?

Obviously, they would have a DTMF decoder on the other end and they would patch the call through to the number you called. These are sophisticated people who send fake security officers to people's houses to "pick up the compromised card". Call forwarding is trivial.

Good that the UK is moving away from this "feature".

(I still remember that to take a call on another phone, you could just leave the receiver up on the phone you too the call on, provided you're not too lazy to hang it up later).

From what I remember, repeatedly pressing the button under the receiver in quick succession eventually disconnects the call.

Most of the US uses either near-end, where the recipient hanging up will end the call, or both-end supervision, on POTS/landline systems.

0 - https://www.youtube.com/watch?v=bUIiUXvnkUQ - This video was filmed at the excellent Museum of Telecommunications in Seattle, located in a CenturyLink switching office. When travel is available again, I encourage all phone geeks to come here and check it out.

https://forums.theregister.co.uk/forum/1/2009/09/19/phone_di...

I believe no other country has that feature.

Note to kids: we used to have our phones anchored to the wall with these coiled ropes so you couldn't walk away with them To counter that, we had multiple phones in various rooms of the house. They also made the phones so big the wouldn't fit in your pocket as another way to prevent stealing them. They didn't have screens because the vacuum tubes drew too much current and they would get too hot when pressed to your ear.

https://www.cbc.ca/news/canada/ottawa/line-in-trapping-techn...

Some locations in Brazil worked like that, depending on which timeframe we are talking about. Pretty annoying.

I guess this depends on the equipment used, not the country.

I'm sure there are other European landline phone systems which behave the same. I don't know about the U.S.

If so, it sounds like a long-shot tactic, especially because everyone uses cell phones now.

Glitchy landline behavior from the 90s?

https://www.openreach.co.uk/orpg/home/updates/briefings/down...

> CS: Hello, this is X from Y Bank. Is this Z?

> ME: Yes, this is Z.

> CS: Z, can you confirm your last 4 digits of your social security number so I can confirm who I am speaking to?

> ME: Uh... How do I know you're the bank? I can't just tell any person who calls that information.

> CS: Z, we are from your bank, Y Bank. Please provide the last 4 digits of your social.

> ME: There has to be another way to do this, right?

> CS: Please hold... (puts me on hold for 30 seconds)

> CS: Hi Z, I'm back. Can you look up our phone number on Google and give us a call back and ask for me by name, X?

> ME: Sounds good.

It was them. I got quickly reconnected to the same woman. I'm still concerned that the norm should be something closer to what you commented, even if it adds friction and will probably result in lazier people not calling back for something important. It's better to normalize this than allow for the alternative, which is to normalize people telling random strangers their sensitive, personal information.

Any time this topic comes up, I immediately worry about my parents and grandparents falling for this sort of thing if real scammers are out there trying. I realize the last four digits of my social security number are not as great as the whole thing, but as far as I know, it's enough to be dangerous.

Example: https://www.discover.com/credit-cards/help-center/faqs/credi...

also, if someone is calling you, they most likely aren't trying to help you.

They could, but I just tried calling the numbers on the back of two cards from merged/acquired banks and they both forwarded to the acquiring bank. Yes it's a small sample size, but I suspect that there's enough money on the line and enough legacy contracts and systems that banks keep their communication channels active for some time.

How long are bank cards valid? I'd say they expire within 5 years? Also, if there is a merger, wouldn't they send you a new card with updated branding?

I'm sure it's possible, but it strikes me as a pretty large hurdle. And even if they manage to pull it off, they also need no one from the bank to notice and report it.

One gets a call from the bank, they give you a number to ring, you type the number in to Google search, the results come back listing that number and the bank's name -- identity confirmed!?!

The fraudsters just need _a_ website listed by Google.

My insurer called me out of the blue: I said I'd call back. Their number was not listed on any of the companies websites. I called the company, and said what has happened, took them about 10 minutes to confirm they'd called me and that the phone number I was called on was valid.

As it happened someone was trying to commit insurance fraud, saying we'd crashed in to them; but that's by-the-by (ie not relevant to the main story).

They pay for it. Most people can't distinguish search ads from search results.

Would the new transparency requirement be useful to go after these fraudsters after the fact? https://news.ycombinator.com/item?id=22955606

It depends how aggressively Google pushes on it, and how carefully they verify the actual identity of the entities putting ads up.

But I admit-- having just done a search for every institution I could think of, it seems Google AMP has done a lot to promote legitimate numbers. It used to be sites like GetHuman competing with or outranking the actual company website for contact information.

"Alexa, confirm."

> "Hello. Please find the callback number on boa.com/contact. Please enter code XYZ to be connected directly to the agent regarding this matter. Thank you & goodbye."

It's not perfect & you'll still have some percentage of fraud that goes through, but I'd be interested to see the impact this has on fraud rates.

* EDIT: Callback number via the card as the other commentor noted probably works too.

Good idea, except now people will think: "yeah, right, that way the call will cost me money".

If Verizon can't stop people from spoofing their own customer support number on their own network, we're all screwed.

The incoming message was automated, asking for (person who lives here) with a visa debit card that has fraudulent transactions. The caller id was a number not listed on the back of the card.

Pressing “1” puts you into the next phase, which asks you to “verify” your identity by - guess what - typing in your full 16 digit debit card number!

At this point I am convinced this is a scam. You google the phone number and you see tons of links saying it’s a scam.

The person calls their regular number on the back of her card and they claim no fraudulent activity.

A few days later I still get these calls so I decide to investigate. Pressing zero a bunch and asking for an agent finally gets me to a live individual. He claims they’re from pnc and they are a different section not connected to the “main” number. He’s able to recite details about the account that only pnc would know, so now I’m not sure.

I email [email protected] asking them to please either say the calls are fraudulent or acknowledge that the phone number associated with these calls is legitimate (it doesn’t appear anywhere on pnc’s web site)

I did get a response - good! But they didn’t actually change the site ... so I suppose in this case anyone who receives notification of fraud on their pnc debit card should email [email protected] to validate the calls are legitimate?

Note that faking the number you are calling from is fairly trivial, so do not trust the callerid as proof of identity.

But yeah their fraud detection is lacking and reporting it was a pain, and they are slow to resolve anything. They did not detect the fraud at all.

Your experience reinforces my impression.

That's the creepy part. There is so much of our info available on the darkweb that even engaging with scammers potentially verifies it and makes it more valuable, although it is unlikley a purchaser of a phishing database is going to provide feedback to the point of origin, they may feed it forward if they resell and augmented dbase. [For example, if someone buys 1,000,000 phone numbers, and that person finds 250,000 are bogus, they can sell the "cleaned" database again claiming it's been slightly sanitized. DefCon has taught me to fear the world.]

Jesus Christ. This is some Inception-level shit. I do not operate on this many levels of meta in real life.

Getting you to browse your computer for 10-20 minutes and then log into your bank account could be enough to gain access to your account.

And 2FA is proven insecure with SIM hijacking. These methods have a high up front time investment but will take even less effort than Mitch's gambit once deployed.

https://www.cs.cornell.edu/~shmat/courses/cs6431/zhuang.pdf [0]

The mentioned paper contains a remark:

> While recording from the third keyboard, we get several seconds of unexpected noise from a cellphone nearby.

But that's the only mention of a phone in the paper ...

It seems VoIP will be the first low-hanging fruit: https://arxiv.org/pdf/1609.09359.pdf

Huh, this reminds me that a major US bank verifies people on the phone by asking them to log on to online banking.

I love the convenience, but it's never crossed my mind that it was a huge vulnerability waiting to happen.

Google is one example of companies that asks its GSUITE admins to login to confirm support ticket codes.

Something about that conversation didn’t seem right, and so Mitch decided to use another phone to place a call to his bank’s customer service department — while keeping the first caller on hold.

“When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch,” he said. “But as it turned out, that other call was the attackers also talking to my bank pretending to be me.”

What happened is that the attackers made one call to Mitch, and another call to the bank posing as Mitch. When Mitch called the real bank to check up if there was a call in progress, they said yes (the call with the attackers).

My understanding is this happened:

1. Attacker got a hold of Mitch’s bank card, PIN, and some personal details.

2. Attacker starts pulling out money and buying things here and there to see if Mitch ever notices.

Mitch never notices so...

3. Attacker calls Mitch on Friday and pretends to be Mitch’s bank. Attacker doesn’t ask for any details, just alerts Mitch that something was going on with his account to get him to think the bank was looking into it.

4. Attacker calls Mitch’s bank and also Mitch at the same time the next day.

5. Attacker asks the bank to send the SMS verification code to Mitch.

6. Mitch gets the code and reads it back to the Attacker.

7. Attacker repeats code to the bank.

I don't think I've ever had an identifiable repeat call, from which I conclude it's both effective and has a low false positive rate.

If it is about finances, YOU call them at a number on your billing statement that you know is correct, or just go to the bank.

Never make a decision / give info if "they" called you.

Last time I checked, carriers have until June 2021 to implement it. https://arstechnica.com/tech-policy/2020/04/ajit-pai-follows...

> STIR/SHAKEN, or SHAKEN/STIR, is a suite of protocols and procedures intended to combat caller ID spoofing on public telephone networks.

> ...

> As of 2019, SHAKEN/STIR is a major ongoing effort in the United States, which is suffering an "epidemic" of robocalls. The Federal Communications Commission is requiring use of the protocols by June 2021.

---

[0]: https://en.wikipedia.org/wiki/STIR/SHAKEN

> “But as it turned out, that other call was the attackers also talking to my bank pretending to be me.”

I don't understand this part - the _actual_ bank said that he was on a different line with them? Wouldn't that mean that the scammers had authorised as him already, in which case the account is already compromised? Also, the bank asking for 2FA over the phone also sounds like training into bad habits, but I appreciate there's different approaches with different banks.

This is a pretty similar sequence of events to one a reasonably intelligent but non-tech friend of mine fell for this week: Got an email saying that the TV licence needed to be renewed. They followed the link on the email, didn't check the URL and filled out their account details to set up a direct debit.

Two days later, gets a call from their "bank", telling them that they filled out a scam direct debit (gets victim flustered to compromise judgement) but they need to authorise them first before they can speak any further... my friend challenged their identity but they used the exact same "fake caller ID" trick - to the correct bank number since they had the sort code from step 1, and that identifies the bank. I knew this (caller ID) was possible in general, but hadn't heard of it being actively used in the UK - only from stories in the US. After "verifying" they asked for the 2FA device code, then (registered a card for ApplePay and) asked them to "confirm" the code they had just been texted, which is the point I walked in and was "WTF are you doing?"

About 10 minutes later while in the waiting queue for the actual bank, the actual bank called them - when we said that we wouldn't trust the call they instantly gave us a reference number to quickly recall the case and advised us to call back quickly. Luckily, the bank reimbursed the amounts taken before they locked it off (apparently some UK agreement from a couple of years ago.)

They were pretty shaken up from the experience, and want to know what to look for in the future. It strikes me that a lot of these cases are hitting otherwise reasonably cautious people who aren't aware that something they think is authentication, really isn't, like caller ID.

The bank was on the phone with Mitch and the attacker at the same time. Mitch thought the “other Mitch” was himself on the other line.

1. If someone who calls you asks you for ANY sensitive personal info, just tell them that your policy is to not give any personal info to those who called you, but you’re happy to call the official number. That stops it right there

2. Use email aliases instead of your actual email when creating accounts with eg Amazon Web Services. An email alias is like [email protected] — this way the attacker can’t get the customer service rep to give them access to your account easily.

3. If you use your phone as a 2FA, be on the lookout for sim porting - that’s when they trick the rep into porting your phone number.

I had the third one happen, luckily I acted fast. The attackers couldn’t get into my G Suite email but they got into godaddy to port the domain and MX records to their servers. So they could receive email sent to me, and send email as me. They also changed my GoDaddy password. I had my phone as the 2FA at the time. Better to not have one at all, or use an authenticator app.

I called in and luckily GoDaddy restored my account. Too bad they had no tool to check what changed so I had to check every domain manually.

The attacker was too slow in that regard. But it was telling that I received an email with the subject “Test”. That’s what tipped me off.

I feel like if we ran a public education campaign about how easy it is to spoof caller ID, a lot of these scams would stop working, but that's probably just me being foolishly optimistic.

The guy claimed that "don't worry it's me". I told the guy that if you call me back to "talk about my account/verify me" you're going to be met with a "go fuck yourself". They do not have any protocols to confirm they are who they claim when they call back.

Basically, the scammer would instruct a suspicious mark to hang up, look up their bank's phone number, and call back, just as Krebs is instructing. As soon as the mark hung up, the scammer would begin playing a dial tone instead of hanging up. When the mark picked up the phone, they would hear the dial tone, so they would begin dialing at which point the scammer would end the dial tone, wait for the dialing to stop, and then play a few ring tones and then pretend to pick up the phone. This was in the 90s so the technology was there to automate it, but it's simple enough it could have been done completely manually by stopping and starting recordings. From the user's perspective, it seemed they had hung up and made a call to the bank, so it seemed impossible that they were connected to someone else.

Cell phones, which don't stay connected when only one party hangs up, are totally immune to this hack. And this hack has probably fallen out of use since the ubiquity of cell phones has deprived scammers of a viable pool of marks.

Another simple trick used by the fraudsters is to ask the called parties to hang up and dial their bank, but after the victim hangs up, the fraudster does not, keeping the line open and remaining connected when the victim picks up the phone to dial.[4] When in doubt, calling a company's telephone number listed on billing statements or other official sources is recommended, as opposed to calling numbers received from messages or callers of dubious authenticity. However, sometimes hanging up and redialing is insufficient: if the caller has not hung up, the victim might still be connected, and the fraudster spoofs a dial tone down the phone line to entice the victim to dial. Then the fraudster's accomplice answers and impersonates whomever the victim is trying to call.[5] This is known as a 'no hang-up' scam.[6] Hence consumers are advised to use a different phone when dialing a company's number to confirm.

When in doubt: hang up, look up, and call back "from a different number".

Funny enough, I never got a call back from canada revenue agency for, being less than polite to them, and the spam calls stopped.

My advice, if you actually get a real person on the line, call them out on their shit and tell them to fuck off. It seems to work.

Whoa, a double-tap attack

Isn't bank cards designed to be non-cloneable (with crypto chips)?

My response is not picking up the phone at all.

When you are starting a new person to person transaction with an unknown party, it seems impossible to verify that an attack like this is not happening. The attacks could get arbitrarily complex and every defense I can think of has repucussions.

Even trying to start a transaction could be replayed to someone to make it look like I was the one that was doing the scamming.

Wow. In the UK as far as i'm aware no bank uses auth codes over txt, we have a physical devices to generate one time codes for identification or transaction signing using chip and pin.

Most people here are aware txt messaging is not secure, it's enough of an issue for email hijacking, I'm very surprised banks are using it in US.

Sometimes a device is an option. Some organizations use a software token app on your phone, or something physical they send you.

Imho, this is where the phone company should be liable. If I let people masquerade as other users in my software, it would be a critical security bug and I'd be in deep trouble. But we just accept this crap from phone companies.

So there's that minor difference. If you decide to do a security upgrade and your software breaks, it probably doesn't mean that an 85-year-old woman dies because her only form of communication, a rotary phone, suddenly stops working and she can't get out of the house.

STIR/SHAKEN[1] is the solution to this problem, but the rollout is scheduled to be completed by June 2021 in the US, and September 2020 in Canada. It's slow, but this is something that you don't want to be rushed. Yes, I get it that Robocalls are terrible: I got 3 calls which I didn't pick up but I assume were robocalls today. But this upgrade is a difficult problem and the stakes are high.

[1] https://en.wikipedia.org/wiki/STIR/SHAKEN

Caller ID and Email are just about the same age.

- governments

- credit card companies

- social media sites

- email providers

- search engines

- long, long list, since basically, any system currently that allows fraud could be prevented if counter measures were invasive enough and were legally required. Problem is no one would agree to such a system and would rather just pay for the fraud either directly or indirectly.

Later on I called back, to verify that it was someone from the bank who had phoned me.

The call-centre person in the bank who answered my call was unable to confirm or deny if someone from the transaction-checking department had actually phoned me, because it was all very confidential.

We need verified identity for phone numbers and email, with consequences attached to bad behaviour.

Page 126 (page 10 of the PDF) from RJA’s Security Engineering being my reference...

https://www.cl.cam.ac.uk/~rja14/Papers/SEv3-ch4-dec18.pdf

If, in retrospect, you feel someone was attempting to scam you, a better option - I hope - might be to contact the bank's fraud line, explain that you are suspicious, and have them look for suspicious activity.

He says that his suspicions were tweaked, near the end of the call, by the scammer giving an old address for him, and apparently his girlfriend was a good deal more suspicious: "Anyway, the whole time my girlfriend is sitting next to me listening to this conversation and she’s like, ‘This sounds like bullshit.'”

Mitch didn’t notice, so the attackers called Mitch pretending to be the bank. They didn’t ask him for any details so no red flags were raised, they just said “we noticed fraudulent charges and rest assured we are fixing it.”

Next day, attackers call the bank and Mitch at the same time. They needed the code the bank would send to the # on the account, so the attacker requested it from the bank, the bank sent it to Mitch, Mitch read it to the attacker, and the attacker repeated it to the bank.

At some point, Mitch got suspicious and called the bank to ask if they were on another call with him. The bank was on a call with the attacker pretending to be Mitch, so they said yes. Mitch thought the other Mitch was himself.

The risk of the scheme not working might be high, but I am not sure that the risk of being caught is much increased.

The victim unfortunately assumed, on verifying that the bank had a second call, supposedly to himself, in progress, that the bank had placed that call and that it was in fact the call he had received on the first phone.

For how often you need that kind of cash readily accessible it's simply not worth the risk for the overwhelming majority of people.

This was a really sophisticated attack and fooled even a security conscious person but defense in depth (not having the big bucks accessible from your general use card and/or following up on unknown transactions) would have stymied it. With a good security protocol breaking one rule (not hanging up and calling back) shouldn't screw you.

But I don't see why having voice conversations over the internet is the issue. The issue is these systems keeping compatibility with old telephone networks which prevents solving these problems. If we dropped that compatibility requirement we could require a certificate authority and be able to verify callers and use end-to-end encryption, just like with https.

Or maybe better would be a compromise where all these systems can still fall back to unencrypted/unsigned connections, but on any modern phone or cell phone it would show a big insecure warning like modern browsers do for http.

This is our password & credentials, now please confirm your identity.

If someone really wants your stuff, they are going to get it.

The cost of getting this guy's money was very high relative to the average scam - but it's important to note that the cost of sophisticated multi-factored scams is dropping.

How is it possible for someone not to check his/her bank account all this time? There were unknown transactions for several weeks and no one noticed?

IMHO not having alerts for your cards/accounts and not noticing strange transactions is a bigger security risk than trusting the telephone number calling you.

I fully agree that we should call back on the official number for any banking issues and don’t blindly trust whoever is pretending to be from the bank.

You and I are the outliers, my friend.

I have had two fraudulent CC charges in 25+ years, and they both were reversed immediately so I'm not worried about that. More worried about my credit union so I keep as little in there as possible. (Interest rates are a joke so it doesn't matter.)