Hacker News Reader

Comment by sReinwald | Hacker News Reader

Tell them you feel uneasy giving out details over the phone to an inbound caller, hang up and call their service line directly.

The only way you can be sure you are talking to your bank is if you are calling them.

View on HN

Wait a couple of minutes or call back from a different phone. In the UK it may still be possible for an attacker to hold the line open after you hang up - and then simulate the dial tone.

I've heard this, but I don't understand it. Doesn't the UI feel completely different when it comes to placing a call versus using the keypad on an existing call? On android at least you have to explicitly show the keypad.

The UI feels exactly the same if you are using a landline.

How? If I explicitly push the red button on my mobile phone, how does the line still stay open?

I can understand this attack via land line, but who seriously has a land line in 2021? Even my 93 year old grandma has a mobile phone. (Albeit we did get her one that looks like a land line phone :D )

My grandmother (80s) and her circle of friends all use landlines to communicate. Technically her's is a VoIP line since about six months ago, but it's designed as a drop in replacement (uses the same phones/numbers) so I wonder if there's a possibility the attack is still open.

I also use a landline fairly often (mostly out of habit), and most companies only have my landline number as I don't want them contacting me while I'm out/busy.

You're right that it's a dwindling number, but it's certainly not at zero yet.

Yeah that works, but it's usually time-consuming to get to the specific department that actually called. I wish these companies could route your call to their fraud dept if their fraud dept had just called you, but sadly this doesn't seem to have caught on yet.

In Singapore, Banks send regular reminders that they will never ask us for our personal information over a phone call. It is slowly becoming "common knowledge" among the non-tech-savvy folk I meet in everyday life.

Then there's an antifraud scenario, when the bank still calls you and asks stuff, now you need precise classification what they can ask you and what you can tell them.

Can you really be sure though?

How hard is it really to redirect outgoing calls?

You'd have to have access to the cell tower your phone is connected to. At that point the attack is pretty sophisticated and very targeted.

Reply on news.ycombinator.com