Slashdot Mirror
Voice Phishing Hits PayPal
Chai Vanilla writes "The latest social engineering phishing attack is now using phones instead of fake web sites. Identity thieves have spammed fake PayPal account compromise warnings to lure users into dialing a phone number and giving up credit card information. Unlike normal phishing e-mails, there is no URL or response address. Instead, the e-mail urges the recipient to call a phone number and verify account details."
Isn't this more traceable than just clicking on some IP in Russia? If I got an email asking me to phone any company, I'd be first looking for a landline. If it was a scam why couldn't I just call the phone company, give them the number and then they'd be able to trace it to an address or person?
There are now plenty of companies (such as StanaPhone) that provide a free DID, all you need to do is register with them. Their business model is that they make money on outgoing calls, but most of them don't require payment until you actually decide to make such a call.
retrorocket.o not found, launch anyway?
I've gotten that phishing mail yesterday, and called the number (1-805-214-4801) immediately. The system's recordings were chopped and barely intellegible, and I was prompted to enter "my 16 digit credit card number" (which was indeed verified to at least follow the basic rules of correctess or be rejected), and its expiry date, but nothing like a name or even the paypal account data.
Where can one complain about such fraudulent 1-8xx numbers to get them shut down? Additionally, how much does calling a 1-805 cost in the US, and is any part of the cost passed to the operator?
There's a small degree of higher risk, but if you get a new disposable cell phone every three days and move around all day you'd be a hard mark to hit.
Too many people are now aware of the "don't click the link" aspect of phishing, but I'm sure there are still pleanty of suckers that assume if they have your phone number you must be legit. I would not be surprised if they find a way to do this through US Mail in a way that hides their identity.
It would be interesting if one day, to get such an online account set up, they make you pass a short test, where they give you ten examples of people asking for your account information in various ways, and you have to answer "give them the information" or "report the incident to phishing.ebay.com". Anyone that answers "give them the information" on any of the questions doesn't get an account.
I wager that alone would eliminate 80% of successful phishes.
I work for the Department of Redundancy Department.
What I find funny about this is that it's spoofs supposedly sent by a company notoriously hard to contact by phone. Anyone who has ever tried to contact Paypal about anything would know this. (Of course, the average user doesn't, which is probably what they count on).
i am a soviet space shuttle
This goes back to decades before the Internet.
[ring, ring]Hello? Hello, is this $TRUSTINGSENIORCITIZEN? I have wonderful news! Congratulations, you have just won a diamond ring in our marketing lottery! There are some shipping and insurance fees, so if you'll just give me your credit card number...".
Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself, which is really the same advice as "don't click on the link" if you think about it.
(202) 224-3004
Ask for Ted.
It goes from God, to Jerry, to me.
I live in Iowa. In the state of Iowa, to get a driver's license, you must pass driver's education.
I would dearly love to have a high-school level course in computer usage, which would be required for anyone to connect to the Internet. Not going to happen, I know...
Maybe just make it a part of the general education requirements?
Most people think I'm a snobbish bastard, like every other Linux user. Which is true, to some extent. But I do believe we have a right to call people stupid when they do things like fall for a PayPal scam, buy from spam, send important (highly confidential!) information over email, refuse to apply patches (or not know how), and so on, and so on.
I mean, we have Sex education, we have Driver's education, I don't think it's unreasonable that we know the computer equivalent of wearing a condom, stopping at red lights, buckling your seatbelt... I don't like driving much, I avoid it, but when I have to drive, I consider it my responsibility to know enough to not be a danger to myself and others, and to not get tickets (which cost money and are a hassle, rough equivalent of getting scammed even if you're not held liable)...
This is the argument I use to explain to my mother why we are so snobbish. She gives the example of my uncle, a chemistry prof at MIT -- even his own wife doesn't need to know what he's doing. And I say, at least she knows what atoms are. At least she has a rough idea of what chemistry is, and what a chemical reaction is. Or take a car, at least you know to put gas in the thing, and you know it runs on an internal combustion engine. Take math, at least you know enough basic math to know whether you're getting ripped off; most people still remember a little algebra, even. These basic concepts do have equivalents in computer science.
I may not ever have the opportunity to use a wrench, or take a wrench to my car. But I know what a wrench is and what it does, and so do most people. Most people don't know what a compiler is, and are offended that they should have to know if they'll never use it.
Do you see the parallel?
This is not just about phishing, this is about life skills. It is as profoundly stupid to fall for a phishing attack as to fire a Roman Candle or a bottle rocket at your face. I'm no chemistry or pyrotechnics expert, but even I know it's a bad idea.
Oh, and the Chinese education system has us beat in so many ways it isn't funny -- they're learninng their second foreign language in 7th grade. All we have left is creativity. If they ever find a way to teach creativity, we're through. If we want to preserve our ideals and our way of life, it's imperitive that we improve our education system.
Don't thank God, thank a doctor!
One guy up here was convicted for "hacking" into the local police squad's voicemail system.
Everyone's password was (and I'm not making this up, and its NOT a Spaceballs reference) "1" "2" "3" "4" "5"
For months he listened into all sorts of messages for the detectives, including from informants, wives and girlfriends (nice to be able to blackmail a cop by threatening to tell his wife about his action on the side), etc.
You KNOW most systems have an easy password (or still have the default password).
Convicted, sentenced ... and caught doing it again - they hadn't changed the passwords a year later!!! Of course, once the story made the news, they HAD to change them (hint: if you remember the story and the police station, try "54321")
Just got mine in the email this morning.
(530) 204-6800 is a land line based in Davis, CA
The registered service provider is 01 Communications**.
Detailed listing information is not available.
I got one yesterday I must say it sounded really compelling. I checked the headers and my initial newbie glance was that none of the URLs were immediately noticeable as faked. Upon second glance I could see some warning messages about mismatching IP addresses.
Regardless of the technicalities, because it didn't have the usual telltale signs it really made me wonder. I then checked into my account the usual way, noticed nothing was wrong and then forwarded the email to spoof@paypal.com, receiving a reply this morning that it was indeed a phishing attempt.
The thing is, on this site we always talk about how clueless people are, and I have participated myself on occasion. But after talking with my wife and in-laws yesterday I realize how *easy* it is to dupe 95% of the computer using population using these tactics. These are people that are educated, smart and generally not clueless in life... but when it comes to computers they are. I had to explain to my sister-in-law why my brother-in-law was receiving Cialis/Viagra emails shortly after posting their clean (well, it was) email address on petfinder.com. My point is, it may seem like there is a low percentage of willing responders to a phone phishing attempt, but I can say from my observation that this new technique should be more successful than ever!
I just wonder isn't it really easy to trace phone numbers?
This post brought to you by your friendly neighborhood MBA.
Fuck dude, you should fix your keyboard: You're missing ALOT of keys there!
The other day I got an atuomated call from a credit card company asking me to call an 800 number to review account details. When I called I was in the voice-mail system that sounded like the company but without any explanation of what I was to do. When I finally managed to get to an operator she wouldn't discuss the matter with me without the last four digits of my social security number, and I wouldn't give her those. So there we were, she didn't know who I was and I didn't know who she was. I got through two levels of supervisor and still never found out what the call was about.
I got one of these. Here is a copy of it:
PayPal
Account Verification
Dear $email_addres
You have received this email because we have strong reason to belive that your
PayPal account had been recently compromised. In order to prevent any fraudulent
activity from occurring we are required to open an investigation into this matter.
If your Credit/Debit Card on file is not updated within the next 48 hours, then will
assume this account is fraudulent and will be suspended. We apologise for this
inconvenience, but the purpose of this verification is to ensure that your PayPal
account has not fraudulently used and to combat fraud attempts.
To speed up the process, you are required to call us ($phone_number) to verify your
PayPal account.
We apologise in advance for any inconvenience this may cause you and we would like
to thank you for cooperation as we review this matter.
Regards,
PayPal Account Verification.
Copyright (c) 1999-2006 PayPal. All rights reserved.
--
Please do not reply to this e-mail. Mail sent to this address cannot be answered.
Ascii artist &