Hacker News Reader

> The advice from Krebs about phone calls is never talk to "the bank" (etc) when they call you, always you have to call them back. But the bank _will_ really sometimes contact you "out of the blue" to ask you about potential fraud on your account. You just have to hang up and call them back, you can't tell the difference based on "reasons".

Don't forget that you have to call them back by looking up your bank's phone number yourself from a trusted source (perhaps their HTTPS website). Obviously just calling back the number they called you from (or provided to you) is useless.

It baffles me that their fraud alert texts include a callback number. It's like training users to be gullible.

It should say "Call us back at the number on the back of your card", or some such.

I'm sure they're afraid that a lot of users won't figure that out, but it still seems like a weird tradeoff.

Unfortunately not having a phone number on the back of the card saves a ton of money on customer service calls.

My cards all have a toll-free number on the back of the card. When I get a call, text, or email from my CC company that requires a phone call, I call them at that number.

That’s great! Most banks do not have that because it might be toll-free for you, it definitely isn’t free for them.

Hm, in the USA I've never seen a credit or debit card without a customer service phone number on the back.

I doubt that is true in the US. In 20 years, I have never come across a card without a phone number on it for customer service.

You're really saying "most" banks don't have a customer service number on the back of their payment card? Sorry, no, this just isn't true.

I just checked my own debit and credit cards. 27 (twenty-seven) of them have a phone number printed on the card itself, only one doesn't - that's SoFi Money debit card, it says "for assistance please visit the SoFi app or SoFi.com." it's also just one extra step to phone support - I opened the app and clicked "help" and there was "Call Money support" as the first option.

This hasn't happened to me personally, but I've read of security-conscious people receiving legitimate fraud-warning calls from their bank, and then struggling to get back in contact with the right people. Not every bank is set up to deal with security-conscious customers, apparently.

I've dealt with several companies and banks (mortgages) that were very weirded out by me saying "I'll call you back to verify you are the bank"... Even up to their security people.

The critical aspect about this is, "What can I do about it?"

For most hacks, the answer is, more or less, "Nothing." For a social engineering hack like this, you can be aware and avoid falling victim to this.

For me, reading this article, that's the meat of it -- I am trying to figure out how vulnerable I specifically am to this, and what I need to do to stay safe (and what I need to recommend to my family and friends). Sometimes it's "hope the organizations that have your data are secure", but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone."

> but this time it's the same advice I usually give, "Don't ever tell anyone anything, and NEVER give out passwords to anyone."

OK, but if the legit banks are actually *asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that?

Krebs advice to "never give out personal info or 2FA codes when they call you, always call them back at the number on your card" seems like a more useful/actionable appraoch to me than your "never give them personal info or 2FA codes at all".

So, anyway, yeah, krebs advice is "actionable", but... it's not easy. To remember, or to do when you're busy and trying to get on with your day dealing with banks and other bureacracies that routinely "legitimately" ask you to do crazy things.

> OK, but if the legit banks are actually asking you to read back 2FA codes on the phone"... I assume you include a 2FA code as a "password" since that's what we're talking about... you'd just refuse to talk to them when they call you about potential fraud? Find a new bank that doesn't do that?

You find independent corroboration of what they're telling you. If the only evidence you can find in your account that something went wrong is what someone is telling you over the phone, it's almost certainly itself an attempt at fraud.

If you can't, reveal nothing and reach out to them separately (call the bank back) to find out more.

I think I'm going to go with krebs advice which is just call the bank back right away as first step, not as something you do after you on your own try to "find independent corroboration." Just hang up call them back at the number on the back of your card. Only provide personal info when you've called the known number, not when you've received a call, period. (which is actually different advice than "never provide personal information at all", or "only provide personal information after doing your own independent investigation for corroboration")

Okay, that sounds great. I'm going to continue to do things that include but aren't limited to using a phone and human speech to better understand the situation.

I think we'll both be in pretty good shape!

I guess we'll find out only if/when someone tries to use one of those sophisticated phish's on us!

Note in the linked krebs story the person thought they were doing that "corroboration"....

> But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks.

https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...

He "independently corroborated", they were calling him about fraud, and there WAS fraud! The whole thing is the story of a guy who is actually a security professional and thought he was being smart, and got tricked, and is now really embaressed.

I am sure you will reply that you are smarter than him and will never be tricked, you will do the correct corroboration, not corroborate the wrong thing. Everyone who ever gets tricked also thinks that, but you are probably more correct than they.

But that's why I think it's better to make the "rules" as simple as possible, not be like, oh, sure, I'm going to embark on some spur-of-the-moment "independent corroboration" investigations... you start playing games, they're probably better at the games than you. (I mean, not you, I know you are better than anyone else, but the other people who may be reading this and may be mere mortals, like me). And still you (I mean "one", not you of course, I'm speaking of typical people) might get tricked, because the system is not set up in such a way that it's easy to avoid universally.

I have received such a phishing call recently.

The script went something along the lines of:

"Hi, we need to authenticate a recent transaction of $high_value_item, well send you a verification code to prove we are $company_x." <receipt of OTP code via SMS from $company_x> "Can you repeat the verification code to authenticate?" "Of course this isn't a scam, we must be $company_x, how else could I send you the verification code?"

I can definitely see general members of the public falling for this sort of scam - because they are being led to believe it's not a one-time-password that they're relaying at all, and some organisations do use verification codes of that sort, although usually it's to verify ownership of a particular mobile telephone number when setting up an account or pairing an app or similar.

I wouldn't expect non-technically savvy folk to immediately spot the difference between a verification code and a one-time-password.

It might be good if the OTP SMS message had text along the lines of "Do not give this code to anyone under any circumstances, regardless of who they claim to be employed by." - not that I would expect it to help in all cases.

(tbh - I was actually quite impressed, the English skills of the person on the other end of the telephone were significantly better than the average tech support call center person).

That's not the same thing! Here the scammer's app is saying "enter the one-time token generated by your device", then passing that on to the phisher. Your quote is about letting the bank know that the device is in the possesion of the person they are talking to.

From the OP:

> OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”)

What are you saying is the distinction that an ordinary user should be expected to distinguish, between a phone call that says it's from your bank alerting you to fraud and asking you to read back a 2FA code, and... a different kind of phone call that says it's from your bank alerting you to fraud and asking you to enter an OTP code in a different way?

It's a pretty similar thing. In these particular cases, you and I could realize that a bot asking you to use keypad to enter the code is more suspicious than a human asking you to read it. But it's not like humans can't scam you too, as in the other story I linked to from krebs. And it's all a bit subtle and overwhelming for the average user (who of course encounter bot voice systems all the time when dealing with 'legitimate' businesses these days).

Instead of asking me for my 2FA code If the bank told me what the code was and I confirmed it on my device then would I be able to trust them? Is there any reason 2FA can’t be used in “reverse” like that?

Then the bank would give out 2FA codes to un-authenticated people??

It's always the same. Don't click a link, type it yourself, of course your banks address and not the link from the mail. Don't answer a phone call, call them back.

While "call them back" is good practice, you should remember that even outgoing telephone calls aren't authenticated or encrypted. An advanced enough attacker can totally redirect your outbound calls too - it's just a little harder without an insider in your phone network.

So to be safe, I should call them back on a one-time use burner phone? What would you recommend for the call back?

What, and trust that they didn't compromise the hardware manufacturing supply chain? Not today, criminals! I design and construct my own one time burner phone from silicon I personally extracted and refined, it's the only way to be secure!

You have to find the address of the call center, and go there and ring their bell.

But don’t just google the location! The scammers are onto this now and have set up fake call centres and banking branches to trick you.

You need to start from a reasonable root of trust like your local government. Go down to city hall and ask them to pull the business license for the organization, and visit the address on file there and work your way down through the organization to the department you’re trying to contact.

If your threat vector is someone hacking/infiltrating your phone network, you have bigger problems.

> An advanced enough attacker can totally redirect your outbound calls

How?

The attacker rings your phone company up, impersonates you, and gets your phone line added to a company plan where all dialled phone numbers are first passed to a company phone system to allow the mobile phone to act like an internal phone - so for example you can dial "753" to ring the phone in room 753 of your company office. Calls will only go to the external phone network if the internal company one rejects them.

Then the attacker can intercept any outgoing call.

Feasible. Far more work required, and the plan switch should trigger all sorts of red flags (and thus verifications) before you even place a single phone call.

Is this even possible? An external number's calls getting routed around to the internal side of a PBX without explicitly dialing into the PBX?

Possible, you need to convince the phone company, but it is done just often enough for real reasons that it is posisble

Perhaps orders of magnitude more likely than someone getting root on your telecom network is someone simply convincing you that an attacker's VOIP number is the official support number you wanted to call.

You shouldn't be downvoted because you're right, although for a slightly different reason. Scammers definitely have been using this trick: https://security.stackexchange.com/questions/100268/does-han...