Slashdot Mirror
Voice Phishing Scams Are Getting More Clever (krebsonsecurity.com)
Security researcher Brian Krebs highlights several clever methods scammers are using to obtain your personal information. In one example, someone used a fully-automated voice to try and scam "a cybersecurity professional with more than 30 years of experience" by greeting him with a four-note AT&T jingle, "followed by a recorded voice saying AT&T was calling to prevent his phone service from being suspended for non-payment."
"It then prompted me to enter my security PIN to be connected to a billing department representative," Jon said. "My number was originally an AT&T number (it reports as Cingular Wireless) but I have been on T-Mobile for several years, so clearly a scam if I had any doubt. However, I suspect that the average Joe would fall for it." Krebs reports of another, more sophisticated scam attempted on Matt Haughey, the creator of the community Weblog MetaFilter and a writer at Slack: Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses. Actually, he got three calls from the same number in rapid succession. He ignored the first two, letting them both go to voicemail. But he picked up on the third call, thinking it must be something urgent and important. After all, his credit union had rarely ever called him. Haughey said he was greeted by a female voice who explained that the credit union had blocked two phony-looking charges in Ohio made to his debit/ATM card. She proceeded to then read him the last four digits of the card that was currently in his wallet. It checked out. Haughey told the lady that he would need a replacement card immediately because he was about to travel out of state to California. Without missing a beat, the caller said he could keep his card and that the credit union would simply block any future charges that weren't made in either Oregon or California.
This struck Haughey as a bit off. Why would the bank say they were freezing his card but then say they could keep it open for his upcoming trip? [...] The caller then read his entire home address to double check it was the correct destination to send a new card at the conclusion of his trip. Then the caller said she needed to verify his mother's maiden name. The voice in his head spoke out in protest again, but then banks had asked for this in the past. He provided it. Next she asked him to verify the three digit security code printed on the back of his card. Once more, the voice of caution in his brain was silenced: He'd given this code out previously in the few times he'd used his card to pay for something over the phone. Then she asked him for his current card PIN, just so she could apply that same PIN to the new card being mailed out, she assured him. Ding, ding, ding went the alarm bells in his head. Haughey hesitated, then asked the lady to repeat the question. When she did, he gave her the PIN, and she assured him she'd make sure his existing PIN also served as the PIN for his new card. Haughey said after hanging up he felt fairly certain the entire transaction was legitimate, although the part about her requesting the PIN kept nagging at him. Long story short, two fradulent charges were made on his account totaling $3,400. "People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
"It then prompted me to enter my security PIN to be connected to a billing department representative," Jon said. "My number was originally an AT&T number (it reports as Cingular Wireless) but I have been on T-Mobile for several years, so clearly a scam if I had any doubt. However, I suspect that the average Joe would fall for it." Krebs reports of another, more sophisticated scam attempted on Matt Haughey, the creator of the community Weblog MetaFilter and a writer at Slack: Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses. Actually, he got three calls from the same number in rapid succession. He ignored the first two, letting them both go to voicemail. But he picked up on the third call, thinking it must be something urgent and important. After all, his credit union had rarely ever called him. Haughey said he was greeted by a female voice who explained that the credit union had blocked two phony-looking charges in Ohio made to his debit/ATM card. She proceeded to then read him the last four digits of the card that was currently in his wallet. It checked out. Haughey told the lady that he would need a replacement card immediately because he was about to travel out of state to California. Without missing a beat, the caller said he could keep his card and that the credit union would simply block any future charges that weren't made in either Oregon or California.
This struck Haughey as a bit off. Why would the bank say they were freezing his card but then say they could keep it open for his upcoming trip? [...] The caller then read his entire home address to double check it was the correct destination to send a new card at the conclusion of his trip. Then the caller said she needed to verify his mother's maiden name. The voice in his head spoke out in protest again, but then banks had asked for this in the past. He provided it. Next she asked him to verify the three digit security code printed on the back of his card. Once more, the voice of caution in his brain was silenced: He'd given this code out previously in the few times he'd used his card to pay for something over the phone. Then she asked him for his current card PIN, just so she could apply that same PIN to the new card being mailed out, she assured him. Ding, ding, ding went the alarm bells in his head. Haughey hesitated, then asked the lady to repeat the question. When she did, he gave her the PIN, and she assured him she'd make sure his existing PIN also served as the PIN for his new card. Haughey said after hanging up he felt fairly certain the entire transaction was legitimate, although the part about her requesting the PIN kept nagging at him. Long story short, two fradulent charges were made on his account totaling $3,400. "People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
His "clever" shtick just isn't.
If they're calling you, they don't have any reason to ask you to provide any confidential info to verify you are who they called. If they ask, get a name and extension, and call them back via a published number.
"National Security is the chief cause of national insecurity." - Celine's First Law
Incredible that phone numbers still exist. Eventually, phones will just be replaced by apps.
I never answer the phone. Email, text, or voicemail. Those are your only options brah.
So "alarm bells" went off in his head four times and he kept giving out his information? He should have said he would call his bank branch directly or the 800 number listed on the back of his card and hung up.
The "bank" called him, at his phone number, so he doesn't need to confirm anything - the bank needs to confirm themselves. Both of my banks say they will never ask for personal information if they contact me, not only for my safety but because -- spoiler alert -- they already have my information. (I, however, need to provide my information if I call them to prove that I am me.) In addition, why would they ask him to confirm information that won't be changed?
Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses.
Caller ID can be spoofed. Never trust it.
"People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
No. Just no.
It must have been something you assimilated. . . .
The creepiest voice phish I ever got was the call from my little brother, exactly his voice and intonation pattern, telling us he was in jail in Mexico and needed money. The only way I knew it was a scam, besides the Mexican authorities suddenly accepting payment in Bitcoin, was knowing that he had been sick for years and unable to travel.
Donâ(TM)t call me, I will call you.
If you get a call from ANYBODY claiming whatever, hang up and call that supposed somebody at a known good number. Every time.
In his 30 years of being "a cybersecurity professional" he never learned that caller ID is trivially faked? Standard practice for dealing with something like an incoming call from a bank is to hang up and call them back at a previously established number, such as from the back of your debit card. Next to the number is probably printed something along the lines of "we'll never ask you for secrets over the phone", to help out those who aren't "cybersecurity professionals".
... it's a guaranteed scam. NOTHING legitimate has my cell phone number.
I don't answer.
If they leave a VM I delete it and don't even listen to it.
That's racist. You're telling us you wouldn't take a call from Sitting Bull?
You are welcome on my lawn.
Apps that app other apps are appier than LUDDITE telephones!
Apps!
marks and are forced to move away from the Nigerian prince method (so ridiculous only someone who's not all there in the head would fall for it) and into trying to scam people who have some of their senses left.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I thought everyone knew to call the known 800 number back in situations like that. A cyber security professional? Come on. Im in INFOSEC and I would embarrassed to admit such a thing to Krebs.
As people age they stop remembering details of scams but seem to remember they are smarter than the scammers so they can't be scammed. The result is they get taken. People who worked in security along with retired police and criminal lawyers are easier to scam after they retire than the average person.
You deserve it.
Rule Number F-cking One: Never give out information to anyone who contacts you first.
It's just that simple. You find the number or confirm the number they left is legit, and you initiate the contact.
CSB: Once I was being legitimately audited by the IRS, and the IRS employee/contractor calls me and asks for my SSN. I was 99% sure it was the IRS, and the person threatened me with escalation, and I know you don't eff with the IRS. But I did not give out my SSN because it violated Rule Number F--king One. Ultimately it worked out, I'd done nothing wrong, they dropped my case. But wow.
That's racist. You're telling us you wouldn't take a call from Sitting Bull?
He died in 1890, still waiting for a dialtone. He actually had a candlestick phone, but it had not yet been connected.
Start holding the Telecoms responsible for failing to fix the ability to spoof Caller ID.
They start footing the bills for fraudulent shit like this they'll have that shit fixed in no time.
People need to get more saavy. You don't accept phishing from real human beings, let alone technology. Education, education, education.
This is 90s security advice. And it's still good advice. Better than just about everything the "security" s'kiddies manage to offer. It's not difficult at all, you just have to do it.
That's what that call was. Oh, BTW, when a bank (or credit-whatever) issues a new card, they ALWAYS give out a new PIN!!
You're telling us you wouldn't take a call from Sitting Bull?
I dunno, is he calling to confirm my address and ask for my PIN?
Is voice scam
That's just what he wants you to believe. He's lying in the tall grass, waiting to strike, and cashing them casino checks.
You are welcome on my lawn.
What moron gives out their PIN? idiot
Wow! Some security researcher we have here. Might I recommend a book ? 'Lying on the Couch' by Irving D. Yalom
sounds incredibly professional, you'd fall for it, too," Haughey said.
Errr, no.
The first principle of phone banking is to never give out personal information to anyone who calls you. Never.
If you feel there is an issue that does need information to be passed, hang up and phone them on the public number. Just make sure you have actually hung up, there is a long-standing scam where the thieves actually recommend you call the bank, yourself. They then make the sound of hanging up but stay on the line. When you dial the bank's number, you are still actually talking to the scammers.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Don't EVER give out private information to a cold call. Never, for any reason. If there's a problem, and it's urgent, tell them you'll call them back on a known number. (Not a number they provide./duh) Legitimate callers will agree to this. Non-legitimate callers will try to steer you to a different number or insist that you must take care of this now, on this call. Don't fall for it.
Let me repeat this for the cognitively impared: If they call YOU, do NOT give out private information. If you call THEM on a legitimate number, it's a different story.
Let's be safe out there.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
"you'd fall for it, too"
No, I wouldn't. I might not be very knowledgeable in how banks work, but I know one thing for sure: personal card info is personal. Nobody from the bank will ever ask you for your PIN number or the three digits on the back of your card. Nobody, ever. If they ever do, change the bank because they are not handling your personal data professionally.
I don't know how things are in the USA, but in my country all banks allow you to change your PIN at the card issuer's ATMs, the card is mailed to you in a special envelope which makes it impossible to read the PIN number without compromising the envelope's integrity and you need to activate the card at a bank's ATM before being able to make any purchase. I have never heard of a phone purchase which requires you to give out your PIN or CCV to a human being. They might be a thing in other countries, though. If my bank calls me unexpectedly (only happened twice), they verify my identity through my equivalent of a SSN (here it's called Numeric Personal Code) where they ask me for half of it, then ask me for my first 4 and last 4 digits of my card. Never the whole number. If I express distrust, they tell me I can call them back or e-mail them at the phone number or contact e-mail provided on their main page, with instructions on how to reach that person afterwards (usually it's the department and the person's name), e.g. "I received a call from Jane Doe, private credit cards department".
With that being said, the phone scams here are simpler but very effective. You usually receive a call from an exotic phone number (Mauritius, Vanuatu, Gibraltar, etc). The phone rings once, maybe twice then stops. Most people are curious enough to call back... reaching a special line which costs 10 to 50 dollars per minute, where automated messages play back to you in your national language, telling you about issues with your bank account, guiding you through entering your card number, PIN, etc, all while sucking lots of money through your phone bill anyway. Now, if you actually answer the call, a prerecorded voice is going to tell you that there are issues with your account and instructing you to call back ASAP. Then the call ends. This costs them pennies because they rent entire trunks for cheap. One person calling back for a couple minutes covers a few thousand calls' worth from their side.
I would have fallen for it at first because the nature of my job involves receiving the odd call from a weird country every now and then. Luckily, I don't call back unknown numbers because I'm busy anyway and if there's an emergency I know they will call again and again. Anyway, I developed a habit of quickly answering those calls and letting them play through. Lately, I only receive one a week, or less. I guess they will eventually stop because they would realize they are wasting their pennies on me.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
"It's immoral to let a sucker keep his money."
"Love is a familiar; Love is a devil: there is no evil angel but Love." --William Shakespeare ('Love's Labors Lost')
when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too
No I really wouldn't and I don't think anyone I know or where I work would either, I have been targeted with these before and know many others that have received similar types of calls and not even for a nanosecond would I fall for it. Hell when I have had legitimate calls from my bank I ask for a name/extension and tell them I will call the banks switchboard and ask for them. It isn't rocket science, if they called you DON'T TRUST THEM WITH ANYTHING.
This has happened to me, twice. I get a call from my legitimate bank phone number telling me they're contacting me about fraudulant charges. I tell them that's very worrying and that I'll call my bank immediately and talk to them about it. Both times the conversation went south from there. First time they just hung up on me, second time they told me it wasn't necessary because I was already speaking with them, they'd developed a tactic by that point I think. I ended up hanging up the second time. Both times when I called my bank there had been no strange transactions and all my purchaces / balances checked out. It seems preferable to me to spend a few minutes on hold after dealing with the infuriating automated service to check this kind of thing out..
Sure, it's easy to get scammed. Smart people seem to think they're immune yet it happens a lot to them too. I don't think I'm smart or immune, so much so that I'm maxed out paranoid about being caught out so I take it to the extreme; I have a tactic that works for now, that's all. With that said though: Haughey can damn well speak for himself.
It's easy so say "I wouldn't fall for this", but some scammers are good. The ones that call you are excellent actors, and can be damned convincing. Just look at the number of elderly people who fall for the "grandkid in trouble" scams. Yes, this guy shouldn't have given out his PIN - that was one step too far.
However, the root problem in this particular case remains spoofing. There is absolutely no excuse for spoofing numbers to still be possible, after all these decades of abuse. The phone company (or VoIP service, or whatever) knows what connection is placing the call, and the service should set the calling number accordingly. Since providers themselves are not always trustworthy, it must also be possible for the receiving company to verify the number, or at least to verify that it is legitimately under the control of the originating phone service. Sort of a DNS for phone numbers...
Enjoy life! This is not a dress rehearsal.
but when someone from a trustworthy number calls
Caller ID is not "trustworthy", and any number you get via that is by extension not trustworthy. Anyone who hasn't learned that just from the all the "same exchange" spoofing (all but last four numbers same as yours) these days is a fool.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Whenever your bank calls, you should be able to simply go to something like mybank.com/trust , which should display two numbers: one for you to read, and the other for the person calling to read. If they can't provide the second number, it is a scam.
It would be incredibly simple to implement, and yet I am unaware of ANY bank which does this.
Even when my bank or credit card company calls, I would simply call them back at a known number to verify its really them. Its so easy to input any number into caller ID these days. But I do know of a few people who take everything at face value and don't question anything. They are taken advantage of because they fail to question obvious red flags.
Sorry, but if you want something from me, do it in writing. It's that simple.
If I want something from you, you demand I call your main number and agree/sign things. You have to do the same. Except I have to verify myself to you when I call, so when you call me I expect you to verify yourself to me.
Any automated or inbound call that doesn't give me information I demand ("Okay, can you tell me my last transaction and my account number please?") doesn't get anything from me. Yes, I've actually asked my bank for that. Guess what... they tell me that they can't tell me. Cool, then I can't deal with you. Because if the tables were reversed I'd expect you to not deal with a customer phoning up claiming to be me who also refused to give you the required information.
So now if it's important, you'll send me something on paper. It's really quite easy. Or you'll put a "secure message" inside my online banking account. And I'll go there myself to check (not just click and take your word for it that it'll take me there - same way I don't just follow the guy to the bank when he knocks on my door claiming to be from my bank needing money from me).
Security and verification work both ways. And anything legally-binding will end up on paper, especially if I say - on the call - "Sorry, I don't think you're my bank... could you prove it to me? No? Then I'm afraid I won't deal with you and I suggest you contact me in some more official way that I can verify you". Imagine that recording before a court of law, when the bank say "Oh, but we phoned him to tell him about the outstanding amount".
Sorry, but I don't even conduct such business via phone or email for any of my personal accounts. I don't even have bills dropping on my doorstep. I get literally zero post apart from junk mail (which I can't stop as it's just random minimum-wage people paid to put crap through every door on the street).
As such, an official letter stands out, but I still don't trust it and will verify. But all my "official" communique are sitting inside secured accounts that only those companies can ever post a message inside. Any email, phone call, text or even letter outside those bounds can only ever really say "Please check your account". That's it. Anything else is suspicious.
Its always an indian chimp scammer chimpy indian scammer chimpy indian scammer of chimpy chimpy chimps indian chimps indian chimps indian chimps scammers.
In a correctly designed phone system, it shouldn't be possible to generate DTMF tones on a call you didn't originate yourself without first spelling "DMMF" by a sequence of Morse-code hook flashes.
DMMF = dox me, motherfuckers.
Your address book should have little padlocks beside "verified" numbers, where the name of the organization and the number are known by the smart phone mafia to correspond.
It really ought to be required to originate the call from a verified address book entry in order to access inline DTMF tone generation (in your address book entry—when you enable DTMF tone generation—you would be able to click "I know the risks", and barge through all the shrunken human heads on pointy pikes, just like with broken SSL certificate overrides).
The telcos know the originating company. If it's a company that agrees to not allow spoofed caller id your carrier could pass along the caller id, if not your carrier could set the caller ID to LIKELY FRAUD CALL. If not preventing spoofing, it would certainly discourage it and put the recipient on alert for a likely fraud.
The problem is that the telco have almost no incentive to cut down on fraud calls. They get paid the same for a fraud call as a legit one, so why not carry them all?
Scammers don't want you to know about this one weird trick that defeats their efforts every single time. This works for any kind of scam call: cell phone phishing, bank phishing, and even those annoying scammy sales calls that everyone hates.
Click to the next page to learn about how badly scammers try to prevent you learning how to defeat their scams.
Scammers depend on their targets being uninformed. You and other Kansas residents qualify to learn how to beat them at their own game, every time. They've been fighting our proven program for years, but there's nothing they can do to stop you once you've learned the trick to beating them.
Click to the next page for details about how it works. You don't want to miss it!
Everyone with a cell phone is already equipped with everything they need to beat scammers at their own game. Our easy method is a snap to learn and takes just seconds to respond to a scam call. Whenever a scammer calls, it takes just a single tap on your phone to beat them, and then the magic happens!
Click to the next page to see the magic of our proven method. You're almost a scam-beating warrior!
You're almost there! Enter your email address and phone number below to download the instructions for our proven scam-beating process. Don't worry, it's safe! We promise we won't give away your information. We just need to know where to email you our step-by-step instructions.
***
Congratulations! You've made it! Now you can beat scammers at their own game every time you call. Click _here_ to enter some final information and download our award winning program for a small one-time fee of just $9.99! No, that's not per month. It's just ONE TIME!
***
Beat scammers in just a few easy steps;
1) Whenever someone calls claiming to be from XYZ company, hang up the phone *immediately* after they say the name of the company. It is super important to hang up right after they say the name! Be sure you don't miss the timing!
2) Look up the number for company XYZ - use the company's official website or google maps entry, or if you have an account with the company, get the number from your statement or back of your card.
3) Call the direct number to the company to speak with their customer service, and ask why they were calling. But, make sure you do this within 5 minutes of the scam call! Again, you have to get the timing for this weird trick to work!
Good luck!
I wouldn't fall for it for several reasons:
1. When someone legitimate wants to confirm your address, they have you say your address. They do NOT read your address to you.
2. Banks don't care about or need your CVC code from your card. They simply will not ask for this, EVER.
3. You need to activate your new card and set your PIN at that time. You can choose the same PIN or a new one, but you have to set it.
4. Banks will never ask for your PIN. They simply do not need it, and it's a security violation to request it.
There are other things that I can and would do beyond these things. These are just the flags that tell you it's a scam. It's like being asked for a password for your email or anything else: No one legitimate will ask for it.
Ok, so the request for his PIN number didn't set off the alarms.
Really, this is an example of where you make the caller provide some information, then if ti seems wrong hang up and call in to the number you know.
I'm getting 5-15 calls a month from the 'credit card reconciliation center' or some such BS. I haven't listened past them asking me for my name, which if they are my bank or card company they should already know.
deleting the extra space after periods so i can stay relevant, yeah.
Long story short, two fradulent charges were made on his account totaling $3,400. "People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
Uh, no, really, I wouldn't. If they call me, I give them nothing. I have to call them, on their regular public phone numbers.
Whenever some company you do business with calls you, hang up and call them back using their phone number on your credit card or billing statement. Otherwise you have no idea who you are actually talking with. They have ways to authenticate you when you call them by asking you personal questions. But you do not have any other way to authenticate them unless you initiate the call.
I have gotten legitimate fraud alerts in the past for overseas purchases. They were robocalls requesting me to call back to an automated system that described the date and amount of transaction to the T, then asked to authorize or reject them. No request for address, no request for security code or PIN.
Nothing clever about this voice phishing. The victim forgot the telltale signs of a scam and ignored the bells going off in his head. Scammers are good at psychological skills and they rush the conversation so that you don't have a chance to stop to think. The biggest red flags was that this was an unsolicited call, the caller was requesting address as well as card info, and banks do not "hold the card open" in the event of confirmed stolen card info. Any legitimate bank employee calling you would have the complete info right in front of them and would not ask for that. I stopped giving any out info when I receive an unsolicited phone call.
It is easy to get the last four digits of your cards, they are printed on your statements. Scammers can find your address online, open your statements from your mailbox to copy your bank and card info, then use adhesive to seal the envelope leaving you none the wiser. Or they can scan your computer incognito for statements on PDF or other format. My important mail no longer goes to my mailbox, it goes to a PO Box which is much more secure.
If I got a call like that, I would hang up and go straight to the bank in person. If the bank has no record like the fraud claimed from the caller, I would report a stolen card.
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
Never give personal or credit card information over the phone ever.
Scamming people is illegal.
Caller ID spoofing of this type is illegal under the Truth in Calling Act.
Unfortunately the criminals don't follow the law. That's a concept some people forget often.
This is a great story of stupidity. You've "given out that information before" so you can give it out again?! "Before", you gave it to someone you trusted/called/engaged. This time, they engaged you.
Isn't that already enough to tell you to walk away?
How about the ol' if-it-aint-broke-don't-fix-it? Your card didn't stop working for you. Stop trying to solve a problem that you haven't experienced. Either go to the gas station and try your card for yourself, or use your other card (that's why you should have one) in California.
So some chickiepoo called you with a sweet voice, out of the blue, used normal words (not death threats), and you gave her how many pieces of confidential information? Six?
Forget the "clues". There's never any time to speak any PIN aloud -- just like you never sign your signature just for fun.
And why don't people know that caller-id isn't secure at all? It's actually designed to be spoofable, as a form of free-speech, and protected as such.
Six levels of stupid. Hopefully he got to pay the three grand as a lesson.
No. I would not. I tell them that I am calling the number on my card, and that I need an ID number to get back in touch if I need to talk to this specific individual. Occasionally, it's legit. Most of the time, they immediately hand up and go dark. A few become belligerent, start talking about the police or sheriff or make other legal sounding threats. I hang up on them.
If I owe them fuckers one fucking penny, you can damned well be sure that they'll figure out who I am, where I am, and how to get that money. Quit making excuses for them being cheap. Fraud is profitable.
The most important rule to protect yourself from scammers is never provide information to anyone who calls you. If someone calls you claiming to be from your credit union or bank or credit card company and says you have a problem Do not answer any questions even if the caller ID says the right phone number. Phone numbers are routinely spoofed. Hang up and call them back on a number you have independently verified as being legitimate. When they answer identify who you are and why you called. You can now have confidence and answer any questions they have for you. It's a real shame that the phone system allows people to spoof their number. It could have been a great benefit to security and safety but instead it is an easy method of committing remote fraud.