Hacker News Reader

Comment by kstenerud | Hacker News Reader

Teach them this simple heuristic:

No tech company these days will ever call a customer, especially not Microsoft.

If you do receive a call from a more traditional institution like a bank, don't divulge any information. All banks have strong identity theft protections in place, but you haven't authenticated the caller. Ask for a reference id so that you can call the company back using a phone number that you yourself looked up on their company web page.

If the caller has any reason not to comply (and they will have plenty of reasons why they can't), or they insist you use a number that they provide, hang up and forget about it.

View on HN

'If you do receive a call from a more traditional institution like a bank, don't divulge any information.'

The problem with this, in the UK at least, is that banks do call and ask for personal info such as date of birth, etc. The irony always seems lost on them when you refuse to give it.

Which bank? I've found them mostly understanding when I've asked people if I can call back.

Although they still try to ask for your DOB first, which means you can't have a blanket "If someone calls from your bank and asks for your DOB, they are definitely fraudsters" rule.

Note that fraudsters are doing things like faking caller ID and holding the line open, playing dialling tone on landline calls so that you hang up, think you are dialling again, and actually are still on the original call. The fix there is to use your mobile to call them back, or call someone else first. You can also feed them wrong information and see how they react, but I'd still do the call back thing.

I haven't had them ask for personal info, but I've had NatWest 'advisors' ring from random mobile numbers to confirm I was attending an appointment.

Its quite disconcerting, especially as most corporate VOIP extends to mobiles.

Calling someone else first is a false sense of security: if scammers are faking a dial tone, they will starthaving software to connect the call too, and then resume the scam when you call the bank number.

If it's a landline, call on a mobile.

Hah yes I've had this from NatWest. I always insist that they provide me with a number to phone them back, then check it against their website before dialing.

Not only banks.

My pension provider, Scottish Widows, did this to me a few weeks back, from a private number to boot.

I told them I'd call them back and they were fine. Not sure if it was a scam or not but suspect not as they were pretty ok about the whole thing.

There's a lot of institutional stupidity in banking, given that they need to verify the customer at the same time that the customer needs to verify the bank.

That said, the "call back" test is an easy smell test -- a bad actor will have a huge problem with that, while the bank usually won't think too much of it.

fyi .. Etrade has this stupidity fwiw.

if they call you, it's them who want something from you, right? So they can just bugger off. My bank in Russia used to call me all the time to offer stuff, usually credits. I've ended up just blacklisting them. If there's anything wrong with my account they never call, they block the card and wait for me to call them

That always baffles me with HSBC when they call and ask for personal information like DOB or other to confirm the identity. (The calls were legitimate.) I always tell them I won't provide the information, and then they ask me to call back. But why do they ask for it, when on the other hand they also recommend not to disclose any personal information to unknown parties (the phone number is not good enough verification), escapes me.

The one that drives me bloody insane on HSBC is the text from the bank's 'security department' telling you to call them on a number that is unlisted on any web page.

I've tried to explain to them several times that they are training their customers to fall or scams, but they seem to be unable to comprehend.

// Aside: If this kind of stuff bugs folks enough to want to help change the whole industry, come work with us. Rethink and build better workflows to “do it right” for customers of a global bank.

Yes! First Direct did this to me, and when I asked to call back for security reasons, he was borderline upset. "But sir, I have your mother's maiden name; surely that should be enough validation?" I didn't know whether to laugh or cry.

I know you probably asked yourself this, but could that call also have been a scam?

I mention it because (and this is I think a good contribution to the thread) "getting upset" correlates strongly with "hiding something" and with "axe to grind with the world" and with "not disciplined or patient enough to get a job."

I did wonder, but when I insisted, hung up, and called back, the next CS rep saw the call in their CRM and knew exactly what they wanted to discuss with me. So it's unlikely.

Honestly I think I'd rather had have it be a scam, at that point :/

Ha! Well your current relationship with a bank is probably a scam too, but they're smart enough not to bleed you too quickly!

You can set a password for First Direct to use when calling you. That's worked fine for me, but then I did set up the password like... 20 years ago maybe? Maybe a bit more, I was in this city so that's 20-25 years ago.

It doesn't need to be a very good password, because it's not as though it can be brute forced. It's like the Socialist Millionaire's Protocol situation, a human is in the loop, if you get the answer wrong twice the human is already very annoyed, so you cannot try 100 passwords let alone a billion.

Perhaps last year, when I was trying to resolve some broadband issues with Virgin Media, I had to recite my account password over the phone in order to pass the security check....

Thankfully I don't share passwords across accounts, so only had to update that one!

I've had banks call and ask for personal info. I tell them, "I'm sorry, I don't give that information unless I called you."

They immediately understood, gave me a reference number, and told me to get my credit card and call the number on the back and give the reference number.

When I called back I was able to pick up right where I left off.

On one hand I was impressed that they had this flow, but on the other hand I was disappointed that they were training people that it's ok to give personal information on the phone.

I had another bank do what I thought was the right thing. I got a recorded call that said, "We believe someone used your card to make a gas purchase in Las Vegas. We have locked your card. If this was you, please call the number on the back of your card, press 3, and an operator will be able to unlock your card. Or you can log in with the app and unlock the card yourself."

They did all the right things. They told me unique information that helped identify they weren't a scammer but didn't reveal anything too personal, and then told me how to securely contact them.

That is actually a scam (or can be), where they would play the hang-up sound, play the sound when you dialed the keys and then have a second person continue the call. It worked because land-lines didn't end the call until both parties hanged-up. That means when you picked up the phone again, you were still connected to them.

Don't know if that scam still works, or not, and the same flow is probably used by legitimate senders.

Actually some tech companies do call; at least Dell (well I guess you could argue it’s not a tech company) did cold call me to try to sell overpriced extended warranty on their shitty tower. Probably legit since apparently loads of people get this sort of calls, plus they don’t actually ask for service tag or personal info and you can pay on dell.com so rather pointless as a scam.

But having people mistake sales calls for scams doesn't really do any harm.

Reply on news.ycombinator.com