That really rubs me the wrong way... someone doubts the random phone call telling them they are being robbed and he acts like it was their fault for doubting?
I often spent huge chunks of my workday on the phone doing these notifications, and some were harder to track down just by Googling a name than others. I never faulted companies for reacting angrily or suspiciously to my calls; it's too bad that's the conclusion you come to from reading what I wrote. If I was ever bitter about anything related to these calls, it was that I rarely ever received so much as a thank you from the victim or their bank.
I generally welcomed the calls from police departments and FBI agents because in many cases it was an opportunity to educate them about a prolific and often hugely damaging form of fraud that they simply weren't aware of at the time. Some of these companies actually went out of business as a result of these attacks, and I did everything I could to minimize that outcome.
Anyway, I almost always found that the law enforcement person on the other end of the line genuinely appreciated my explaining my methods and how these schemes work.
Thank you!
There's nothing wrong with skepticism on the part of the victims but we're not talking about an anonymous tip off from a phone booth. He goes out of the way to share his own personal information and means of reaching him. It's not his fault that some victims decide to lash out on him emotionally. The fact that he continued to play the good Samaritan is more to his credit.
Happens often. Someone brings bad news and the recipient wants to take out their emotions on the deliverer. And, sometimes emotion can overwhelm logic.
What rubs me the wrong way is that they'd doubt the call. It'd take seconds to process "how can the attacker benefit from this" and come up empty.
After all it's not like he was calling them and offering to fix the issue, he was literally giving them a heads up, the worst that could happen is a wasted call to the bank.
Well, no. The worst (and probably very likely) thing that would happen is they would call the bank, the bank would block withdrawals from their payroll processor, and they would miss payroll for that period. This could also have severe financial consequences for the company's employees, given how many people live paycheck to paycheck.
Small businesses are constantly inundated with all varieties of scam calls, so it's not at all unreasonable to be suspicious of someone who calls you out of the blue and says, "Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately." The odds of ever getting a call from a good samaritan like Brian Krebs are vanishingly small, while you're probably getting called by scammers every day.
He says right there, the fraudulent payroll payments were many times the normal amount and not part of the normal cycle.
In fact, from what he described, even the bank would have picked up on the fraudulent transactions upon human review.
Small businesses are not going to confuse out-of-cycle payroll payments with normal ones, cash flow is way too tight for mistakes like that. -
I'm also not saying it's unreasonable to be suspicious of the call, but after that initial suspicion, it's unreasonable not to hang up immediately on the scammer... then make a "sanity call" to bank/payroll processor/both
The other comment is arguing you could accidentally cancel payroll, which tells me they've never had to worry about payroll before.
This one is claiming I'm advocating making a "security decision based on...".
-
It's making a sanity check based on a few seconds of conversation.
If you didn't know, confirming a withdrawal for many times your normal payroll from your payroll account to an unknown account at the wrong time is fraudulent takes very little effort past a phone call.
That effort is easily worth it based on an off-the-cuff risk assessment.
When arguing from an armchair on the internet, somehow people forget what actual uncertainty under stress is like.