Would You Have Fallen for This Phone Scam?

Unless it's friends/family calling, of which most calls are likely Facetime or Whatsapp video these days, I don't bother answering and let it go to voicemail and I'd never call back purely based on a number given in a voicemail.

Virtually all call traffic I receive that doesn't fit the above is outright scam attempts, fake IRS / CRA threats, bizarre calls in Mandarin or Cantonese or post-sales "check-ins" to see if I want to spend more money with a service I've already paid for.

So it's unlikely I'd personally fall for this, simply due to a lack of opportunity for the would-be scammers.

That said, with the level of sophistication they're employing I could very easily see how people get trapped by it.

Got a letter in our letterbox the other day. It was purportedly from the real estate company that manages the apartment we live in. It said "Starting next month we would like you to change the bank account that you transfer money to". My wife was just going to do it because the letter looked legitimate and even seemed to have a stamp from the company (in Japan stamps are used instead of signatures). I stopped her and asked her to call the real estate company (using the number we already had on file) for confirmation. I pointed out that the stamp appeared to have been printed on the letter, not actually stamped. Indeed, it turns out to have been fraud. The real estate company had no idea about the letter.

From the article comments:

> Many banks including TD Bank on the East Coast of The US, and throughout Canada are now using voice recognition technology for their telephone banking.

> You can only imagine how easily that is spoofed as well.

That's absolutely hilarious... because the technology that allows a person's voice to be recognized is the exact same technology that allows it to be imitated.

On iPhones you could go to Settings > Phone and turn on Silence Unknown Callers.

Works like a charm. If they have something important they'd leave a voicemail or text message or email anyway.

Moving from Germany to the uk was very easy and there hasn’t been a lot “unexpected” things I couldn’t cope with... Robo, spam and scam calls. I’m still only using my German number which only my family and friends have, who know, only call me in case of emergency.

Banks, insurances, institutes etc will never get my phone number. And my money will never be in a place where I have to worry about it getting scammed. Stolen maybe - but that thief would be very lucky.

And all this fuzz and lack of comfort (simply ordering stuff) [especially during times like these] because I’ve become very paranoid, because of situations like that...

What is the best practice for preventing these man in the middle (MITM) attacks? Brian Krebs seems to suggest the only way of doing so using a phone alone is to put down the phone and ring back, that way the initiation of the connection can be guaranteed to be secure.

I suspect there are better schemes that can be adopted when the user has access to both a phone and another connected device that can foil MITM attacks using SSL but you can't always guarantee that a user has access to a web browser or app.

In this case all phone calls from the bank should proceed like so (and it should be made illegal to act otherwise): "Hi I'm calling from Example Bank fraud department. Please go to your banking details and find the phone number for the fraud department and call the number listed and quote the reference ABC. I will now hang up and await your callback"

How does caller ID spoofing work technically? I mean if the attackers do not have the contents of your SIM card stored, how can they pretend to the network that they are you? Isn't that the purpose of the SIM?

Nope because I don't answer calls from outside of my contacts. So much spam these days. If it's important they will leave a voicemail, and I can just skim the transcript rather than listening.

I strongly recommend getting a phone number from an area where you don't know anyone. Any time I get a phone call from Dallas, I know it's a scammer spoofing my misleading area code.

How about this for a scam idea -- you call someone innocuously, without any purpose but to get them talking to you. Record their voice and then create a deep audio fake of them. Then mass dial the area code spoofing their number and try to get someone else on the phone with you using as your bot the audio fake and record their voice and repeat

There sure must be a bunch of lousy online shopping sites storing CVVs in flagrant opposition to the entire point of CVVs.

"This data, known as “CVVs” in the cybercrime underground, is sold in packages for about $15 to $20 per record"

Would it be terribly complicated to make single use credit cards? Like if you have an app from your bank (which they push on you these days, anyways), you could generate a new virtual credit card for every transaction?

It seems like the greater risk described in this blog is attackers using social engineering against your bank to gain access to it. How do you prevent that?

Another piece of USA infra that is just miles behind most western countries.

Phone numbers cannot be used as sole auth.

This also shows the total flaw in the phone infra. Why can't I rely on the phone number I see?