Hacker News Reader

Comment by ljm | Hacker News Reader

Like many scams, it depends on the victims being polite, perhaps more much than them being naive.

The fraudulent message asks for a yes or no reply but does not care about the answer spefically; only that there was an answer. So the victims are the people who couldn't ignore the message and had to say no. Most likely the people who say yes are still taken into account , because they confirmed there was a person behind the number. They'll get a new scam later on.

But the people saying no are the target.

A lot of people feel bad if they don't answer the phone, or a message, or the doorbell. So you prey on their niceness.

How to fight back? Don't. The way to defeat the scam is to not acknowledge it.

Ignore whatever primal urge you have to get involved, or teach them whippersnappers a lesson, and cast it into the void.

View on HN

I'd be really curious to know how many people actually answer calls they aren't expecting, on their personal phones (e.g., non-work phones where you must answer customers).

I bet that graph is U-shaped of % of people that answer unknown messages vs. age. Kids want to be social, and old people don't know any better. With salty Gen-Xers in the middle.

99.99% of the time I let it go to voicemail. I have since the days of cassette-tape answering machines. The only time I don't is if some just texted and said they are calling. Even when my insurance company hold line asks if I want a callback, I'm too paranoid that a scammer could have infiltrated the callback process.

>I'd be really curious to know how many people actually answer calls they aren't expecting

What do you do when your counterpart won't answer their phone?

I answer calls I'm not expecting when I'm expecting a call. Like from a plumber, a recruiter, a paving company, etc.

If I don't, at best I get to play phone tag, and at worst, the other person gets ticked off and I lose an opportunity. I don't like leaving voice mail, particularly the second or third time.

It would be nice if everyone legit had their main number show up to identify them, and it would be nice if they all answered their phone all day, but they don't.

I'm a Paramedic here in Northern California and we recently went on a welfare check to an apartment - us, fire dept, and law enforcement - for a family that could not get ahold of their grandmother.

Grandma was fine, fortunately, and she simply turned her phone off because it was ringing constantly with scam phone calls. She was sick of the auto warranty spam all the time, so she unplugged entirely.

The elderly are the ones that still have landlines and cell phones too, so they often get hit multiple times. It's harder for them to disconnect the landline due to things like Life Alert requiring a landline.

Medical alert devices that use cellular connections are widely available.

There going to be areas where coverage is poor, but for many people, working out of the home is going to be a considerable improvement.

They are widely available but not as common. We will run on 2-3 lifeline calls a day sometimes and while resetting them, we rarely see a wireless one.

I got a call recently about my student loans.

It was...erm...remarkable in its high production values.

Even compared to the auto warranty ones, which I don't get often, but every now and then.

I also got a "hello...hello...hello" call, and seven hangup/no message calls the same afternoon.

I assume the call I answered was a scammer, but a few months ago, I got one just like that and it turned out it was from my physician's office, and I had some trouble getting ahold of them.

> What do you do when your counterpart won't answer their phone?

I'm not sure what you mean. Like I said, if someone texts me and tells me they are calling then i'll pick up. Or if I get a voicemail saying, "duh, pick up dingus"... then i'll pick up the next buzz.

That never happens because almost no one I care about uses the phone anyway. Exvept that 0.01%.

>almost no one I care about uses the phone anyway

Right, even 80-year-olds can text these days. You're talking about personal friends who almost never call from unknown numbers.

But with professionals? Would you miss an appointment for a root canal or spend an extra day without your car because you won't answer the phone?

Ugh. Can you at least read my posts next time before you start planning your lectures? I already covered this.

I don't live in a big city or even in a super-internet-embracing country like for example South Korea - but even in my neck of the woods, dentists, doctors, vets, barber shops, car mechanics, contractors, etc. all have shifted to messaging instead of calling. Unfortunately most are using WhatsApp because of peer pressure. But I'll even swallow that bitter Zuckerberg pill because it's so much more convenient than doing appointments over the phone.

In my region of the US, people with appointments to come to me will sometimes text that they're on the way, which is nice.

And plenty of people have websites, but on the whole, most local business interactions start with a phone call, and usually it goes to voicemail or a receptionist, so I have to answer when they call me.

Even small time businesses have websites, but they don't do anything usually so it's clear you have to call.

Also, sometimes they try to embrace the Internet, and then they get hacked...

My primary care doctor had a patient data breach by their accountant. A different practice failed to set permissions propertly on the patient information on their portal, and never said anything to me, but silently scrapped it. A plumber that I had over once had all their client information stolen about six months later and vigorously spammed/phished.

Nobody has ever suggested WhatsApp to me. But I gather it's disproportionately popular in some countries.

I think WhatsApp is especially popular in countries where SMS messaging was the number one means to communicate before smartphones. No idea why WhatsApp in particular won the messenger race, I don't like it and think it's a bad piece of software even before Facebook bought it, but it seems to be "fun" enough for non-savvy people to try to get into it. And it's the same here - operating their own website and handling email is too challenging for most small businesses, doctors, or contractors. But for some reason they all manage to operate WhatsApp.

I don't answer a single call unless I'm told to expect it, or I can antipate one coming (e.g. I ordered takeout and the delivery driver is gonna ping me, or I asked a recruiter to call me at X time).

If the call comes out of nowhere, or if it's from a hidden number, then I'll silence it rather than declining (i.e. hit the power button rather than actually acknowledging the call, so it carries on ringing in silence until they give up instead of being told I'm busy). If it's important they'll leave voicemail or send an email.

I just realized I can keep my phone on DND 24/7 and it's wonderful (rings for contacts only).

The bonus of it only ringing for your contacts is that when your phone does ring, you know it's something relatively important.

Completely changed my relationship with my phone.

Me too. I consider it rude to be called on my phone, actually, even by people I know.

It's not about niceness. When you get a text about a potential scam there's an urgency to reply. And you can't just ignore it. All major banks send out official text messages to confirm large transactions. This has happened to me multiple times with Chase, and just recently I blocked a fraudulent ATM withdrawal using exactly the method outlined in the article (someone skimmed my debit card when abroad, I got a text from Chase when they tried to use it, I replied no, got a call from the customer service rep). Only thing missing was reading out the OTP, obviously, which I would not have done.

> Only thing missing was reading out the OTP, obviously, which I would not have done.

This is the real red flag here. No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field.

Last week I had to call Wells Fargo to change my home address. They texted me a code to read it back to them to confirm my identity.

Their standard text messages for auth codes say: Wells Fargo will NEVER call or text you for this code. DON'T share it. Enter code 123456 online to send $1.00.

Their verification text said: Free Msg: Use Wells Fargo verification code 123456 to verify your identity. Reply STOP to stop msgs. Call 1-800-869-3557 if you didn't request this code.

It should explicitly say that the code is intended to be shared with one.

> No workflow that I'm aware of ever has you read a one-time code to a human, it only ever goes into a text field

If I place a large wire with my bank, they text me a code and ask me to read it back to them. Granted, I will only do that if I initiated the call.

When calling banks and even telcos, their sop to verify identity seems to be to request you to read one of these codes

I agree with your point about not acknowledging these scam attempts. Just wanted to point out the "fight back" bit of the story was advice for people who've already been victimized and are being told their bank won't cover the loss.

I don't think the issue is people being polite. It's that these messages look similar to the legitimate fraud alerts that credit card companies and banks send.

What happens if you don't respond to those? Presumably, the transaction will be blocked -- but can you be sure? It would cause me a lot of anxiety not to resolve the issue right away.

In some cases, banks have trained us not to panic instead of taking time to understand what's happening.

A while ago, I scheduled a wire transfer through Chase to go through the next day.

While asleep, I got an automated call from Chase asking me to confirm that the wire transfer was placed by me.

By the time I had woken up, my online banking and my bank cards had been shut off.

This is not consumers fault. Everyone is used to banks not being completely impatient and expecting immediate responses. For some other example, by law, you only have two days after a transaction to respond to fraud, or else you could be looking at $500 lost instead of $50. Not immediately answering the phone could make a difference of $450!

Reply on news.ycombinator.com