{"id":34897,"date":"2022-02-03T16:10:53","date_gmt":"2022-02-03T21:10:53","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=34897"},"modified":"2022-02-04T16:12:35","modified_gmt":"2022-02-04T21:12:35","slug":"hang-up-and-call-back","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2022\/02\/03\/hang-up-and-call-back\/","title":{"rendered":"Hang Up and Call Back"},"content":{"rendered":"

Brian Krebs<\/a>:<\/p>\n

Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken for more than $10,000 in an elaborate, weeks-long ruse.<\/p><\/blockquote>\n\n

Andrew Abernathy<\/a>:<\/p>\n

\n

A problem here in my experience is legit fraud departments leave callback numbers that don’t match the phone number on the back of the credit card; if you call the number on the card they don’t know what you’re talking about. Fraud depts are training us to trust random ass calls.<\/p>\n<\/blockquote>\n\n

Pieter Gunst<\/a>:<\/p>\n

\n

Once I gave my member number, the attacker used the password reset flow to trigger a text message from the bank.<\/p>\n

They used this to gain access to the account.<\/p>\n

Then read some of my transactions to give the call more credibility<\/p>\n<\/blockquote>\n\n

Patrick McKenzie<\/a>:<\/p>\n

\n

Wish more banks would do what Stripe does here: “Log into your account and use the ‘auth a support rep’ feature. I will read you some digits, you verify they match, then read your digits to me.”<\/p>\n<\/blockquote>\n\n

Chris Messina<\/a>:<\/p>\n

\n

Apple Support now sends push notifications to your devices to verify that it’s you calling.<\/p>\n<\/blockquote>\n\n

Corey Hoffstein<\/a>:<\/p>\n

\n

My bank just called me about something, but couldn’t tell me what it was about unless I answered my security questions.<\/p>\n

Sorry, I’m going to assume it’s fraud and hang up 100% of the time.<\/p>\n

I called the bank myself. Turns out it was legit.<\/p>\n

What a stupid, broken security model.<\/p>\n<\/blockquote>\n\n

Oluseyi Sonaiya<\/a>:<\/p>\n

\n

I just received a phone call<\/em> purporting to be Apple Inc., with a recorded voice telling me my “iCloud account had been breached,” not to perform any actions, and to press “1” to connect with “Apple Support.”<\/p>\n

If you receive this call, it’s a scam.<\/p>\n

[…]<\/p>\n

There is some persistent vulnerability in US phone networks that is allowing spammers to spoof the phone numbers and caller ID information of known brands. It shows up as \"Apple Inc.\" on my phone, too.<\/p>\n<\/blockquote>\n\n

Brian Krebs<\/a>:<\/p>\n

You may have heard that today’s phone fraudsters like to use caller ID spoofing services to make their scam calls seem more believable. But you probably didn’t know that these fraudsters also can use caller ID spoofing to trick your bank into giving up information about recent transactions on your account — data that can then be abused to make their phone scams more believable and expose you to additional forms of identity theft.<\/p><\/blockquote>\n\n

Update (2022-02-04): John Bowdre<\/a>:<\/p>\n

\n

I’ll also add: if you can’t find a company’s support phone number on their website, they don’t want you to call. Use some other contact method. The number you found via search is probably a scam.<\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"

Brian Krebs: Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2022-02-03T21:10:58Z","apple_news_api_id":"41d3f9c5-292f-483b-8fb4-a50d82fb9eec","apple_news_api_modified_at":"2022-02-04T21:12:40Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/AQdP5xSkvSDuPtKUNgvue7A","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[1195,1200,1454,48,2090],"class_list":["post-34897","post","type-post","status-publish","format-standard","hentry","category-technology","tag-financial","tag-phishing","tag-phone-app","tag-security","tag-two-factor-authentication-2fa"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/34897","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=34897"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/34897\/revisions"}],"predecessor-version":[{"id":34918,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/34897\/revisions\/34918"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=34897"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=34897"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=34897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}