How do you protect family from email or SMS fraud? | Hacker News Reader

How do you protect family from email or SMS fraud?

16 pointsalphabettsy14 comments

Like I’m sure is the case for many of you I am the de facto tech guy for all of my close friends and family.

The older ones in particular I’m struggling with a good solution for spam and fraud email and texts.

My grandfather in particular I warned about links in suspicious emails, but of course that warning didn’t work well when he got an email that appeared to be from a store he frequents.

They also receive fraud SMS messages claiming all kinds of things from sweepstakes to a package they need to pickup.

I’ve warned them not to give out their phone number or email, but sometimes it’s unavoidable.

What do you use to filter email and SMS?

Any tips on how to prevent it?

They’re using iOS devices, but I’m open to solutions for Android.

View on HN

I haven’t found convenient technology solutions but I do tell them the following (and repeat it again and again until it’s drummed into them):

1. If someone calls you from a company you use, don’t tell them any of your account information. Tell them politely that you’ll phone back on the main number. Look up their number and call back (or just ignore if not interested).

2. Emails - same. Call the company about it rather than reply.

3. Offers that seem too good to be true usually are.

4. Hang up on anyone telling you your computer is broken and call me.

5. Some patterns to look out for: limited time e.g. you must do x right now. Paying them in apple gift cards. Email address incorrect. Inability to confirm your details to you (rather than you to them).

The technology changes over time but the tactics don’t so if you can educate them with some basic knowledge of how to avoid the scammers or make them prove themselves, that may be the best way.

Your point (1) is particularly good and Brian Krebs has a nice mantra that echoes it fairly closely: "Hang up, look up, call back".

One small optimization if you can expect likely inbound communications in advance (either on your own behalf or those of your family members): collect the return contact details in an authentic, physical format from the parties you expect to hear from before they need to reach out to you.

The typical example here is a debit/credit card: turning that over to look for the financial institution's phone number is straightforward, trustworthy and confidence-building.

Sadly because we've allowed shoddy insecure software to become commonplace on smartphones and in browsers (thank you, market incentives), it's becoming -- predictably -- less reasonable to depend upon them when researching and communicating. So, I'd expect, more reliable and less sophisticated devices and environments will increasingly make sense for everyone.

I can't answer for iOS devices, but I do know that on Android, the Google Messages app[1] comes with the ability to filter SMS messages that are spam. I am constantly surprised both with how many spam messages my number receives as well as how I never see them because the filter catches them almost perfectly. My carrier, Verizon, also has a spam reporting service that works in tandem with the filter, so occasionally I go through and report all the ones the filter catches. I also believe, as a side note, that a possible upcoming feature will be categorization of text messages [2] which I certainly look forward to being on my phone as the number of SMS messages I receive daily increases.

As for email, in my personal experience Gmail's spam filter is slipping more (as in allowing spam into my inbox) than in previous year, but I think it remains as good as it's going to get for the average user. I also use Yahoo Mail and its spam filter is a tad over-aggressive, I have to manually check spam once in a while and fish out the emails that are in the clear.

[1] https://messages.google.com/

[2] https://9to5google.com/2021/06/28/google-messages-categories...

I'm curious if this may apply to other sms apps, I have my default set to Signal, and haven't received any spam messages yet - I never noticed much on my previous iPhone. Currently using a Pixel 6, so I'll have to look more into this. Thank you.

The only way I've had any success managing a 74 year old who will give his credit card number to anyone who asked in the past is with a 2 pronged approach. One side is for when they are thinking clearly, and another is to protect them from quick click mistakes, like getting texted a link.

1) you are now their secretary. You must help manage their payments. Getting old is hard and they need help. You have to talk to them and let them know they can rely on you, and shouldn't make any decisions on their own. This has been the best decision I've made. You should not restrict them from making payments but you should strongly encourage them to consult you, and also independently watch out for suspicious transactions on their accounts.

2) android phones can use family share, a service that can restrict app installations and where your browser is allowed to go. I get a notification on my watch when the user wants to go to a new link. Old sites are automatically approved. This will not work on a child because there is a way to opt out on the device.

3) get them a new phone number, and port their old number to google voice. Make the old number go to voicemail without ringing their current phone, and the new number forward voicemails to the old number. Set outbound calls to come from the old number. Many times when scammers identify a senile accessible user they're put on a list and get cold calls and targeting from these groups. You must have break that cycle of communication. New emails new phone numbers. Turn off notifications for the old numbers but give them access. When they go to seek out the information they will most likely be in the right mind.

The key here is to approach them and say I want to help. In my situation I only got involved once all of the money was gone so I was really the only way out. It made it a lot easier to get them to buy in.

If I had gotten involved sooner maybe they would still have something left.

I don't understand how these old people simultaneously are incapable of doing basically anything on their own and so stubborn and full of pride they won't let you help them.

If you can't tell I've been dealing with this for years. I don't wish it on anyone. If I can help at all please reply and I will be happy to set aside some time to meet with you and discuss or elaborate on anything here.

1. This is already partly the case, but I’ve been worried about appearing to take away autonomy.

2. iOS has something similar, but for the reason in #1 I hadn’t used many of the features other than location because misplaced devices have been an issue.

3. That’s probably a good idea. I happened to be in the room once when someone asked for their social security number and they started to give it before I intervened.

Thanks! I appreciate your thoughtful advice and good luck!

Ultimately it's about education, tools are never the entire answer.

That said, I point them to Apple ecosystem, all mail is gmail / gsuite with the web interface as the client, this works quite well for spam and phishing. I have not encountered something for the sms and WhatsApp phishing, there I still have to rely only on education.

This is incorrect. Some users can't learn (dementia, Alzheimer's) and still use a cell phone.

Really? Power of attorney or whatever equivalent is needed is also about education. Just the eduacation of the relatives and not the person it self

I have power of attorney and manage finances directly with strong controls and opsec in place.

I try NOT to use any service that uses SMS OTP. Paypal for example require that you use an SMS OTP which is good for security, but bad generally since SMS one-time-codes can be intercepted. And if your phone number got into the wrong hands, your accounts are trivial to take over.

I advise them, for example I tell them most important dos and don'ts.

What are some of the non-obvious do's and don'ts?

Do not respond to soliciting emails e.g. give me, send me, show me, please forward, click this and that etc.

Do not especially send money if somebody asks you to do it.

Do not click links in emails. Unless you are 100% sure it is from trusted source.

Do not download and open email attachments. Unless you are 100% sure it is from trusted source.

Dos:

Check every time who sent you email.

Check if person's or organization's email address previously sent you some mail.

Compare received mail and email addresses with previously received mail and corresponding email addresses.

Check email title, check email grammar, check similarity between text(structure and wording) of current emails with past emails from the same sender who sent you mail.

If you spot something suspicious search and research it online.

Etc.

There are 99 advices I could give but this are some off the top of my mind. Similar advices apply to SMS fraud.

Tbh most of this stuff can be automated.

Reply on news.ycombinator.com