Slashdot Mirror
Voice Phishing Scams Are Getting More Clever (krebsonsecurity.com)
Security researcher Brian Krebs highlights several clever methods scammers are using to obtain your personal information. In one example, someone used a fully-automated voice to try and scam "a cybersecurity professional with more than 30 years of experience" by greeting him with a four-note AT&T jingle, "followed by a recorded voice saying AT&T was calling to prevent his phone service from being suspended for non-payment."
"It then prompted me to enter my security PIN to be connected to a billing department representative," Jon said. "My number was originally an AT&T number (it reports as Cingular Wireless) but I have been on T-Mobile for several years, so clearly a scam if I had any doubt. However, I suspect that the average Joe would fall for it." Krebs reports of another, more sophisticated scam attempted on Matt Haughey, the creator of the community Weblog MetaFilter and a writer at Slack: Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses. Actually, he got three calls from the same number in rapid succession. He ignored the first two, letting them both go to voicemail. But he picked up on the third call, thinking it must be something urgent and important. After all, his credit union had rarely ever called him. Haughey said he was greeted by a female voice who explained that the credit union had blocked two phony-looking charges in Ohio made to his debit/ATM card. She proceeded to then read him the last four digits of the card that was currently in his wallet. It checked out. Haughey told the lady that he would need a replacement card immediately because he was about to travel out of state to California. Without missing a beat, the caller said he could keep his card and that the credit union would simply block any future charges that weren't made in either Oregon or California.
This struck Haughey as a bit off. Why would the bank say they were freezing his card but then say they could keep it open for his upcoming trip? [...] The caller then read his entire home address to double check it was the correct destination to send a new card at the conclusion of his trip. Then the caller said she needed to verify his mother's maiden name. The voice in his head spoke out in protest again, but then banks had asked for this in the past. He provided it. Next she asked him to verify the three digit security code printed on the back of his card. Once more, the voice of caution in his brain was silenced: He'd given this code out previously in the few times he'd used his card to pay for something over the phone. Then she asked him for his current card PIN, just so she could apply that same PIN to the new card being mailed out, she assured him. Ding, ding, ding went the alarm bells in his head. Haughey hesitated, then asked the lady to repeat the question. When she did, he gave her the PIN, and she assured him she'd make sure his existing PIN also served as the PIN for his new card. Haughey said after hanging up he felt fairly certain the entire transaction was legitimate, although the part about her requesting the PIN kept nagging at him. Long story short, two fradulent charges were made on his account totaling $3,400. "People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
"It then prompted me to enter my security PIN to be connected to a billing department representative," Jon said. "My number was originally an AT&T number (it reports as Cingular Wireless) but I have been on T-Mobile for several years, so clearly a scam if I had any doubt. However, I suspect that the average Joe would fall for it." Krebs reports of another, more sophisticated scam attempted on Matt Haughey, the creator of the community Weblog MetaFilter and a writer at Slack: Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses. Actually, he got three calls from the same number in rapid succession. He ignored the first two, letting them both go to voicemail. But he picked up on the third call, thinking it must be something urgent and important. After all, his credit union had rarely ever called him. Haughey said he was greeted by a female voice who explained that the credit union had blocked two phony-looking charges in Ohio made to his debit/ATM card. She proceeded to then read him the last four digits of the card that was currently in his wallet. It checked out. Haughey told the lady that he would need a replacement card immediately because he was about to travel out of state to California. Without missing a beat, the caller said he could keep his card and that the credit union would simply block any future charges that weren't made in either Oregon or California.
This struck Haughey as a bit off. Why would the bank say they were freezing his card but then say they could keep it open for his upcoming trip? [...] The caller then read his entire home address to double check it was the correct destination to send a new card at the conclusion of his trip. Then the caller said she needed to verify his mother's maiden name. The voice in his head spoke out in protest again, but then banks had asked for this in the past. He provided it. Next she asked him to verify the three digit security code printed on the back of his card. Once more, the voice of caution in his brain was silenced: He'd given this code out previously in the few times he'd used his card to pay for something over the phone. Then she asked him for his current card PIN, just so she could apply that same PIN to the new card being mailed out, she assured him. Ding, ding, ding went the alarm bells in his head. Haughey hesitated, then asked the lady to repeat the question. When she did, he gave her the PIN, and she assured him she'd make sure his existing PIN also served as the PIN for his new card. Haughey said after hanging up he felt fairly certain the entire transaction was legitimate, although the part about her requesting the PIN kept nagging at him. Long story short, two fradulent charges were made on his account totaling $3,400. "People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
If they're calling you, they don't have any reason to ask you to provide any confidential info to verify you are who they called. If they ask, get a name and extension, and call them back via a published number.
"National Security is the chief cause of national insecurity." - Celine's First Law
So "alarm bells" went off in his head four times and he kept giving out his information? He should have said he would call his bank branch directly or the 800 number listed on the back of his card and hung up.
The "bank" called him, at his phone number, so he doesn't need to confirm anything - the bank needs to confirm themselves. Both of my banks say they will never ask for personal information if they contact me, not only for my safety but because -- spoiler alert -- they already have my information. (I, however, need to provide my information if I call them to prove that I am me.) In addition, why would they ask him to confirm information that won't be changed?
Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses.
Caller ID can be spoofed. Never trust it.
"People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
No. Just no.
It must have been something you assimilated. . . .
The creepiest voice phish I ever got was the call from my little brother, exactly his voice and intonation pattern, telling us he was in jail in Mexico and needed money. The only way I knew it was a scam, besides the Mexican authorities suddenly accepting payment in Bitcoin, was knowing that he had been sick for years and unable to travel.
Donâ(TM)t call me, I will call you.
If you get a call from ANYBODY claiming whatever, hang up and call that supposed somebody at a known good number. Every time.
In his 30 years of being "a cybersecurity professional" he never learned that caller ID is trivially faked? Standard practice for dealing with something like an incoming call from a bank is to hang up and call them back at a previously established number, such as from the back of your debit card. Next to the number is probably printed something along the lines of "we'll never ask you for secrets over the phone", to help out those who aren't "cybersecurity professionals".
... it's a guaranteed scam. NOTHING legitimate has my cell phone number.
That's racist. You're telling us you wouldn't take a call from Sitting Bull?
You are welcome on my lawn.
marks and are forced to move away from the Nigerian prince method (so ridiculous only someone who's not all there in the head would fall for it) and into trying to scam people who have some of their senses left.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
As people age they stop remembering details of scams but seem to remember they are smarter than the scammers so they can't be scammed. The result is they get taken. People who worked in security along with retired police and criminal lawyers are easier to scam after they retire than the average person.
Rule Number F-cking One: Never give out information to anyone who contacts you first.
It's just that simple. You find the number or confirm the number they left is legit, and you initiate the contact.
CSB: Once I was being legitimately audited by the IRS, and the IRS employee/contractor calls me and asks for my SSN. I was 99% sure it was the IRS, and the person threatened me with escalation, and I know you don't eff with the IRS. But I did not give out my SSN because it violated Rule Number F--king One. Ultimately it worked out, I'd done nothing wrong, they dropped my case. But wow.
That's racist. You're telling us you wouldn't take a call from Sitting Bull?
He died in 1890, still waiting for a dialtone. He actually had a candlestick phone, but it had not yet been connected.
Start holding the Telecoms responsible for failing to fix the ability to spoof Caller ID.
They start footing the bills for fraudulent shit like this they'll have that shit fixed in no time.
You're telling us you wouldn't take a call from Sitting Bull?
I dunno, is he calling to confirm my address and ask for my PIN?
That's what that call was. Oh, BTW, when a bank (or credit-whatever) issues a new card, they ALWAYS give out a new PIN!!
My credit union walks me to an ATM, tells me to enter a pin and turns their back while I do it.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
Wow! Some security researcher we have here. Might I recommend a book ? 'Lying on the Couch' by Irving D. Yalom
sounds incredibly professional, you'd fall for it, too," Haughey said.
Errr, no.
The first principle of phone banking is to never give out personal information to anyone who calls you. Never.
If you feel there is an issue that does need information to be passed, hang up and phone them on the public number. Just make sure you have actually hung up, there is a long-standing scam where the thieves actually recommend you call the bank, yourself. They then make the sound of hanging up but stay on the line. When you dial the bank's number, you are still actually talking to the scammers.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Don't EVER give out private information to a cold call. Never, for any reason. If there's a problem, and it's urgent, tell them you'll call them back on a known number. (Not a number they provide./duh) Legitimate callers will agree to this. Non-legitimate callers will try to steer you to a different number or insist that you must take care of this now, on this call. Don't fall for it.
Let me repeat this for the cognitively impared: If they call YOU, do NOT give out private information. If you call THEM on a legitimate number, it's a different story.
Let's be safe out there.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
"you'd fall for it, too"
No, I wouldn't. I might not be very knowledgeable in how banks work, but I know one thing for sure: personal card info is personal. Nobody from the bank will ever ask you for your PIN number or the three digits on the back of your card. Nobody, ever. If they ever do, change the bank because they are not handling your personal data professionally.
I don't know how things are in the USA, but in my country all banks allow you to change your PIN at the card issuer's ATMs, the card is mailed to you in a special envelope which makes it impossible to read the PIN number without compromising the envelope's integrity and you need to activate the card at a bank's ATM before being able to make any purchase. I have never heard of a phone purchase which requires you to give out your PIN or CCV to a human being. They might be a thing in other countries, though. If my bank calls me unexpectedly (only happened twice), they verify my identity through my equivalent of a SSN (here it's called Numeric Personal Code) where they ask me for half of it, then ask me for my first 4 and last 4 digits of my card. Never the whole number. If I express distrust, they tell me I can call them back or e-mail them at the phone number or contact e-mail provided on their main page, with instructions on how to reach that person afterwards (usually it's the department and the person's name), e.g. "I received a call from Jane Doe, private credit cards department".
With that being said, the phone scams here are simpler but very effective. You usually receive a call from an exotic phone number (Mauritius, Vanuatu, Gibraltar, etc). The phone rings once, maybe twice then stops. Most people are curious enough to call back... reaching a special line which costs 10 to 50 dollars per minute, where automated messages play back to you in your national language, telling you about issues with your bank account, guiding you through entering your card number, PIN, etc, all while sucking lots of money through your phone bill anyway. Now, if you actually answer the call, a prerecorded voice is going to tell you that there are issues with your account and instructing you to call back ASAP. Then the call ends. This costs them pennies because they rent entire trunks for cheap. One person calling back for a couple minutes covers a few thousand calls' worth from their side.
I would have fallen for it at first because the nature of my job involves receiving the odd call from a weird country every now and then. Luckily, I don't call back unknown numbers because I'm busy anyway and if there's an emergency I know they will call again and again. Anyway, I developed a habit of quickly answering those calls and letting them play through. Lately, I only receive one a week, or less. I guess they will eventually stop because they would realize they are wasting their pennies on me.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
"It's immoral to let a sucker keep his money."
"Love is a familiar; Love is a devil: there is no evil angel but Love." --William Shakespeare ('Love's Labors Lost')
when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too
No I really wouldn't and I don't think anyone I know or where I work would either, I have been targeted with these before and know many others that have received similar types of calls and not even for a nanosecond would I fall for it. Hell when I have had legitimate calls from my bank I ask for a name/extension and tell them I will call the banks switchboard and ask for them. It isn't rocket science, if they called you DON'T TRUST THEM WITH ANYTHING.
It's easy so say "I wouldn't fall for this", but some scammers are good. The ones that call you are excellent actors, and can be damned convincing. Just look at the number of elderly people who fall for the "grandkid in trouble" scams. Yes, this guy shouldn't have given out his PIN - that was one step too far.
However, the root problem in this particular case remains spoofing. There is absolutely no excuse for spoofing numbers to still be possible, after all these decades of abuse. The phone company (or VoIP service, or whatever) knows what connection is placing the call, and the service should set the calling number accordingly. Since providers themselves are not always trustworthy, it must also be possible for the receiving company to verify the number, or at least to verify that it is legitimately under the control of the originating phone service. Sort of a DNS for phone numbers...
Enjoy life! This is not a dress rehearsal.
but when someone from a trustworthy number calls
Caller ID is not "trustworthy", and any number you get via that is by extension not trustworthy. Anyone who hasn't learned that just from the all the "same exchange" spoofing (all but last four numbers same as yours) these days is a fool.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Sorry, but if you want something from me, do it in writing. It's that simple.
If I want something from you, you demand I call your main number and agree/sign things. You have to do the same. Except I have to verify myself to you when I call, so when you call me I expect you to verify yourself to me.
Any automated or inbound call that doesn't give me information I demand ("Okay, can you tell me my last transaction and my account number please?") doesn't get anything from me. Yes, I've actually asked my bank for that. Guess what... they tell me that they can't tell me. Cool, then I can't deal with you. Because if the tables were reversed I'd expect you to not deal with a customer phoning up claiming to be me who also refused to give you the required information.
So now if it's important, you'll send me something on paper. It's really quite easy. Or you'll put a "secure message" inside my online banking account. And I'll go there myself to check (not just click and take your word for it that it'll take me there - same way I don't just follow the guy to the bank when he knocks on my door claiming to be from my bank needing money from me).
Security and verification work both ways. And anything legally-binding will end up on paper, especially if I say - on the call - "Sorry, I don't think you're my bank... could you prove it to me? No? Then I'm afraid I won't deal with you and I suggest you contact me in some more official way that I can verify you". Imagine that recording before a court of law, when the bank say "Oh, but we phoned him to tell him about the outstanding amount".
Sorry, but I don't even conduct such business via phone or email for any of my personal accounts. I don't even have bills dropping on my doorstep. I get literally zero post apart from junk mail (which I can't stop as it's just random minimum-wage people paid to put crap through every door on the street).
As such, an official letter stands out, but I still don't trust it and will verify. But all my "official" communique are sitting inside secured accounts that only those companies can ever post a message inside. Any email, phone call, text or even letter outside those bounds can only ever really say "Please check your account". That's it. Anything else is suspicious.
In a correctly designed phone system, it shouldn't be possible to generate DTMF tones on a call you didn't originate yourself without first spelling "DMMF" by a sequence of Morse-code hook flashes.
DMMF = dox me, motherfuckers.
Your address book should have little padlocks beside "verified" numbers, where the name of the organization and the number are known by the smart phone mafia to correspond.
It really ought to be required to originate the call from a verified address book entry in order to access inline DTMF tone generation (in your address book entry—when you enable DTMF tone generation—you would be able to click "I know the risks", and barge through all the shrunken human heads on pointy pikes, just like with broken SSL certificate overrides).
The telcos know the originating company. If it's a company that agrees to not allow spoofed caller id your carrier could pass along the caller id, if not your carrier could set the caller ID to LIKELY FRAUD CALL. If not preventing spoofing, it would certainly discourage it and put the recipient on alert for a likely fraud.
The problem is that the telco have almost no incentive to cut down on fraud calls. They get paid the same for a fraud call as a legit one, so why not carry them all?
Ok, so the request for his PIN number didn't set off the alarms.
Really, this is an example of where you make the caller provide some information, then if ti seems wrong hang up and call in to the number you know.
I'm getting 5-15 calls a month from the 'credit card reconciliation center' or some such BS. I haven't listened past them asking me for my name, which if they are my bank or card company they should already know.
deleting the extra space after periods so i can stay relevant, yeah.
Long story short, two fradulent charges were made on his account totaling $3,400. "People I've talked to about this say there's no way they'd fall for that, but when someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you'd fall for it, too," Haughey said.
Uh, no, really, I wouldn't. If they call me, I give them nothing. I have to call them, on their regular public phone numbers.
I have gotten legitimate fraud alerts in the past for overseas purchases. They were robocalls requesting me to call back to an automated system that described the date and amount of transaction to the T, then asked to authorize or reject them. No request for address, no request for security code or PIN.
Nothing clever about this voice phishing. The victim forgot the telltale signs of a scam and ignored the bells going off in his head. Scammers are good at psychological skills and they rush the conversation so that you don't have a chance to stop to think. The biggest red flags was that this was an unsolicited call, the caller was requesting address as well as card info, and banks do not "hold the card open" in the event of confirmed stolen card info. Any legitimate bank employee calling you would have the complete info right in front of them and would not ask for that. I stopped giving any out info when I receive an unsolicited phone call.
It is easy to get the last four digits of your cards, they are printed on your statements. Scammers can find your address online, open your statements from your mailbox to copy your bank and card info, then use adhesive to seal the envelope leaving you none the wiser. Or they can scan your computer incognito for statements on PDF or other format. My important mail no longer goes to my mailbox, it goes to a PO Box which is much more secure.
If I got a call like that, I would hang up and go straight to the bank in person. If the bank has no record like the fraud claimed from the caller, I would report a stolen card.
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
Scamming people is illegal.
Caller ID spoofing of this type is illegal under the Truth in Calling Act.
Unfortunately the criminals don't follow the law. That's a concept some people forget often.
This is a great story of stupidity. You've "given out that information before" so you can give it out again?! "Before", you gave it to someone you trusted/called/engaged. This time, they engaged you.
Isn't that already enough to tell you to walk away?
How about the ol' if-it-aint-broke-don't-fix-it? Your card didn't stop working for you. Stop trying to solve a problem that you haven't experienced. Either go to the gas station and try your card for yourself, or use your other card (that's why you should have one) in California.
So some chickiepoo called you with a sweet voice, out of the blue, used normal words (not death threats), and you gave her how many pieces of confidential information? Six?
Forget the "clues". There's never any time to speak any PIN aloud -- just like you never sign your signature just for fun.
And why don't people know that caller-id isn't secure at all? It's actually designed to be spoofable, as a form of free-speech, and protected as such.
Six levels of stupid. Hopefully he got to pay the three grand as a lesson.
What exacly are you afraid of? Of breaking down into a jibbering wreck and blurting out all your passwords and PIN numbers?
The most important rule to protect yourself from scammers is never provide information to anyone who calls you. If someone calls you claiming to be from your credit union or bank or credit card company and says you have a problem Do not answer any questions even if the caller ID says the right phone number. Phone numbers are routinely spoofed. Hang up and call them back on a number you have independently verified as being legitimate. When they answer identify who you are and why you called. You can now have confidence and answer any questions they have for you. It's a real shame that the phone system allows people to spoof their number. It could have been a great benefit to security and safety but instead it is an easy method of committing remote fraud.