Hacker News Reader

Comment by drawkbox | Hacker News Reader

On the flipside, I worked on promotions game systems in the brand promotions space with instant win and giveaways after the user played a game. If they won we had to contact them to verify and get info to send them the prize.

When someone won the prize we had to get the social security number of the person that won for gift tracking as many were over 15k, their contact info and location to send the prize, you'd be surprised at how many people pass that up or think it is a scam and/or never get back. We had to pick the next person if they passed it up or didn't get back and sometimes it would go through dozens of people before they would accept it. Lots of game systems, trips and even motorcycles were passed up.

I myself would have probably done the same thing, hard to believe you won and if you do win it is hard to not think it is a scam due to systems like mentioned in the article.

View on HN

As an individual authenticating callers is difficult.

I recently had someone claiming to be from the ATO (Australian Taxation Office) call and ask me to identify myself. Not surprising, my tax filing is overdue. I advised them as a security policy I do not give out PII to unauthenticated callers, asked for a reference number and a return phone number. The number I was given is not listed on the ATO website so I did not return the call. Found some forum posts claiming the number is for return callers who have a reference number. Still, if I can’t find the number listed on offical media I don’t call back.

I’m trying to think of a way the average person could authenticate a caller. I’m not security or technology expert so my knowledge in this area is limited.

Any ideas?

I think just call back on one of their listed numbers and explain.

It seems so obvious now you've pointed it out. I do like to over complicate things.

This is the advice given by banks and anti-fraud agencies. NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up. A phisher will play a dial tone etc to make it seem realistic. The advice is to either wait 10 minutes (longer?) or preferably call back on another line if you receive a suspicious call.

Or try calling somebody else you know. If you land back on the same caller, you know they're playing you. =)

> NB in some countries landlines can remain on a call for several minutes after the call receiver has hung up.

Source for this? I find it highly suspect from a technical perspective (1-3 seconds, maybe, but not several minutes) and nothing I can find online even remotely seems legitimate / real.

I’ve personally experienced this, probably 30 years ago, in Canada.

I’d call a friend, we’d finish talking, then I’d hang up and as a joke he’d leave his phone off the hook. I couldn’t make another phone call until he hung up or some timeout of unknown length passed.

When I was younger in the US the situation was similar, but I thought it was up to the originator of the call to disconnect. Been too long to be certain of my recollection.

I never determined the timeout, and I haven't had a land line in at least 15 years to experiment with.

You could be right, I can’t remember if the times that happened were when I originated the call or my friend did. I know it didn’t work all the time, and I think it stopped working at some point too.

This was back in the days when you could tell roughly where someone lived by their phone number - 43x—xxxx was south Edmonton (but not Mill Woods or Riverbend), 2xx-xxxx was Calgary, area codes didn’t matter because the whole province was 403, etc. The phone system is a lot different now - you can port a landline to a cell phone (and vice-versa). The original phone number where that happened has been ported to the cable company and now goes through coax (the equipment that handles it is basically a cable modem with a phone jack).

Actually, I’m coming around to your point of view. I think it was the recipient who controlled the “transaction”.

The world was so very different. Waiting for that 0 to finally work its way around the dial, good grief. Especially since as a kid I was perpetually afraid any phone number that included a 0 might lead me to somehow get connected to a phone operator, so I wanted to dial the following number as quickly as possible.

One of the things that radio hosts here joke about is how kids with a zero in their phone number had fewer friends. “Oh, I don’t want to call Bobby, he’s got two zeroes in his phone number, it takes so long to dial”. Between that and risking talking to An Adult and getting In Trouble, I wonder how true that is.

Telecoms + networking software engineer here:

'tis true - the caller has call release control on the PSTN i.e. the call doesn't end until the caller puts down the phone. There's special handling for e.g. 911 calls so that call release control is given to the callee i.e. the PSAP.

This doesn't work for e.g. SIP because the SIP client is not a dumb slave to the network. If I click end call, even if the network doesn't 'want' to end the call, my phone thinks the call has ended.

This used to be true but I really doubt it’s the case anymore.

Most of the “PSTN” nowadays has a bunch of SIP or other digital stuff in the middle, so this breaks down. Not to mention, this was never possible for mobiles to begin with.

It really is the case. VOIP in the middle isn't a problem. MGCs can translate between the callee's phone being on-hook to a SIP re-INVITE with inactive media. In fact, I've worked on projects in the last few years to do just this.

Telcos move slowly.

You're right about mobile networks though - that's a different kettle of fish.

Just wondering, why is that? It seems like a lot of effort instead of just sending a BYE when the phone is hanged up. I don’t see any legitimate reason for this “feature” to exist - if anything it makes scams & eavesdropping by a malicious remote caller easier.

Per one of the articles I found on it, British Telecom apparently set the delay to 3min. The rational (if article is to be trusted) is that customers wanted the ability to hang up one phone and pick up another phone in the same home without disconnecting the call.

It is how the old copper PSTN network worked, and if you are lucky enough to still have an actual copper PSTN phone line it is still true.

My argument was that even if you did have an “actual” copper line it would eventually be terminated at a device that speaks analog phone line on one end and spits out SIP on the other end.

This specific hanging-up behaviour was an artifact of older analog switches and I didn’t think they would emulate it in the software-based SIP switches but according to the comment above it’s still the case.

I definitely knew this was the case back when analog COs were the norm, but didn't realize this was still true. Seems it is very dependent on PSTN provider (I know SWBell didn't do this for normal lines when I worked there) as some do, some don't.

True in the UK; https://security.stackexchange.com/questions/100268/does-han... has a decent description of the history and includes a note that BT changed in 2014 from a several-minute timeout to 10 seconds, because of fraud issues. The link to the BT announcement of that change has bitrotted, but it is at https://www.openreach.co.uk/orpg/home/updates/briefings/down...

I've had my bank call me at work because I forgot to pay my credit card off the day after it was due. No callerid info, just a number. The woman on the phone didn't say who she was, who she was calling from, she just immediately asked me if this was blahblah. My work has been the subject of a bunch of scammers calling about financial services lately so I wasn't too keen on saying who I was. I kept asking her who she was calling from and she just kept asking me who I was. Finally she said she was from my bank. I told her I'd call her back. Called up my bank and had to wait through several people for someone to tell me what was up. Not only does there need to be some etiquette when cold calling someone (like using callerid and stating upfront who you are and who you are calling from!) but callerid need an update so you can't spoof it so we can trust it again.

Funny cause on email this is a solved problem (from a technical standpoint not a social one); encryption and digital signatures are easy. And it would be so useful to those industries too.

Etiquette from a bank is like water from a stone. Consider moving your accounts to a credit union.

Same thing is happening here in Canada, got 2 calls recently. Geez what is going on?

I just had the exact opposite experience! I was discussing scams with my regular painter. He said he got one recently, and showed it to me on his phone. It was an SMS that said, "Dear <FORENAME>, we have been trying to contact you without success. Please ring BlergCo on 99999 about your outstanding ATO debt". I thought, easy enough to check. I went to the ATO website; clicked the link about what we do if you don't pay; clicked the link about which collection agencies they use; checked for green padlocks throughout; and voila - BlergCo, 99999! Since the number on the SMS exactly matched the number on the verified ATO website, I couldn't see how the scam would work. So I told my painter I'd changed my mind, it was probably legitimate, and he should ask his tax agent to follow it up. Which he did. Then paid the overdue provisional tax that he'd completely forgotten about! It made me think, legitimate SMSs (like that one) should probably have extra words to tell the recipient how they can check that it's legitimate. For example, "NOTE: to verify our company name and contact number, please go to the ATO website at xxx.yyy.zzz (and remember to check the green padlock!)", or somesuch.

The whole POTS system is archaic and ripe for abuse (which we see with telemarketers able to spoof their numbers).

IMHO the solution would be a calling system where spoofing is difficult/not allowed.

I was one of the very first developers with an app published on Google Play store, and as a "thank you" for having one of the first apps with 10k+ downloads(which wasn't difficult when number of apps on the store was measured in hundreds), Google wanted to send me the Nexus One phone - which was great, except that the email I got from them looked like scam, it was basically "hey you won a phone, click on this link and fill out this google spreadsheet with your details!" - no official google logo, it was just plain text email and the spreadsheet looked dodgy as hell. So I ignored it, until I read about the giveaway on a reputable site few days later - and yeah, I filled out the sheet and the phone arrived few weeks later. But it was very very easy to ignore it.

This seems like an easy problem to solve.

Make the winner fill out the tax forms and send them directly to the IRS. The IRS informs the promotion they've received the tax forms, and verifies names, addresses, amount match. The promotion releases the prize to the winner.

Might not be so easy -- it is like paying payroll -- you, not only the recipient, need to report the tax ID of the person/entity that you paid.

Right, so you provide that information to the winner to put on their form. No big deal.

Nope, you need to put the payee info on the forms that you submit as well as the recipient.

If you are paying someone more than $600, you need to cut a 1099 form, which tells the category, such as interst, rent, misc, etc. (1099-Int, 1099-Misc, etc.).

On the 1099, you must put the Tax Id of the recipient, which for a person is their SSN, and for another entity is typically their EIN.

You submit your copy of the 1099, and they submit theirs. They need to match or the IRS see a red flag.

So, no, you can't simply say "here's the form, you submit it".

Source: I'm not a Tax Attny, but I live with one, and have co-owned several businesses that needed to cut and/or receive W-2s, 1099,s etc.

1099-MISC form for prize winners

https://www.thebalanceeveryday.com/when-should-i-receive-109...

Why did you even need the SSN?

Not parent but presumably the bit about requiring it for gifts over $15k is a regulatory requirement?

Only if you win a prize larger than a certain amount (I think it's somewhere around $600) the promoter of the sweepstakes must issue an IRS 1099-MISC form as such prizes are taxable income.

As mentioned by others, sweepstakes sponsors are required to report prizes awarded to US residents to the IRS if the value is $600 or more. For tax purposes some also choose report prizes of lower values especially if they are giving away lots of them that equal substantial value businesses expense out.

I thought it was only the 15k prizes above gift tax but it was actually any prize for tax tracking. Lots of people balked when the SSN question came up and understandably so. In a few cases the prizes were motorcycles and ATVs and I felt bad for the people that passed them up.

The promotions systems were brand focused and most of them really did want to give away the prizes but sometimes it was tasking due to the fear of a scam.

The entries were mainly for brand focused games and brand focused gear/prizes mostly marketing focused. The system also only asked for email and the opt-in for the company/brand loot running it was un-selected. Though the brand companies did want to collect emails of people interested in the brand, they had to opt-in for that. We mainly needed emails for contacting if the user won. After winning, names/SSN/location would be asked for but lots of people weren't having it.

Wouldn't it be easier to exempt prizes from income tax and instead have a sweepstakes tax paid by the sponsor instead?

It would be easier but it is law and the IRS wouldn't like that. Part of this process of getting the info allows it to be a gift if the sponsor does include paying the taxes, they still need the info to do that.

Basically any transfer of value is tracked and the company that gives it away needs proof to write off the amount and/or declare it a gift.

The SSN and affidavit are the scary part where people think it is a scam.

Anytime you win prizes this happens even if you are on a gameshow. [1]

[1] https://www.nerdwallet.com/blog/taxes/pay-taxes-game-show-wi...

Well this is solved by asking the SSN to redeem the prize, but not before the draw.

The solution is probably a two-part form where the winner can fill in their SSN and seal it in an envelope, then the contest operator would take that envelope and enclose it with the operator's part of the form, and mail it.

That way the contest operator need not ever see the winner's SSN.

The amusing thing is the apparent widespread assumption that contest operators are shady as f.

"Here is a code. Please go onto the IRS website and enter this code and the relevant information, then tell me the code you get in response."

Sure, if you want to be modern.

What the...the problem is the contest winner not trusting the operator with their information. How does giving the operator an envelope containing their SIN solve this problem?!

Okay I didn't think that through.

As mentioned, this is only asked of winners to collect their prize, after the draw.

If they won they must be contacted to verify and get info to send them the prize.

Since it is a transfer of value, the SSN has to be known for the 1099 form that is required by the IRS after $600 in value being transferred. It is also required if the sponsor gives it as a gift, pays the tax portion and for the sponsor to expense it out on the business' taxes.

Same thing happens on gameshows or any giveaway.

It is probably easier to trust after you were on a physical gameshow though, if you just won a prize online it seemed scammy to many eventhough we took all precautions to make it legit including no opt-in when they entered the email or phone. Only their email/phone was required to enter after they won the minigame or played the ticket. Everything else was asked later if they won the prize.

It is harder than you'd think to give away the actual prize to people that won it due to all the scams out there taking the fun out of things.

Thanks for clarifying

The solution I came up with is to have the winner come into a store location to claim their prize. They can see their brand new motorcycle, be told that to drive this away we need to report the gift to the IRS so they can collect their cut.

I think most people will give up the digits then.

Good solution if local, most of the winners were all over the US.

Lots of people just didn't believe it and thought it to be a scam or maybe denied it due to the taxes, or maybe they were trying to stay on the down low due to collections or something who knows. For whatever reason, they didn't want the prize or didn't believe it.

Since it wasn't a cash prize in most cases, people would have to pay some taxes on it so maybe they didn't think it was worth it. Cash prizes are always easier as the person can just pay the taxes out of the prize, a product like a motorcycle or something fairly big, they would have to sell to pay taxes maybe.

I wonder if it would be worth starting a business brokering access to bricks and mortar for your industry. I'm sure you could find some national chains that have retail traffic that could take delivery of a prize and collect the relevant details.

Then it becomes a problem where you need assurance that the customer is going to actually show up at the store and claim his prize before you go to the trouble of shipping it out. Not a big deal.

To report it to the IRS so the IRS knows where to send the tax bill.

I wonder how many were social security, retirees, or welfare recipients? I think those people will lose their benefits if they declare earnings. And perhaps they just don't think about it before they enter?

Reply on news.ycombinator.com