Hacker News Reader

Comment by dvtrn | Hacker News Reader

Recruiting farms like Cyber Recruiters (yuck) will do everything in their power to waste your time

Or share your data.

I made a throwaway, but not obnoxious email on my domain just for recruiters a few years ago, so I could try tracking who I was talking to.

Via three consecutive third-party recruiters I started getting cold calls and e-mails from recruiters I’d never contacted, never met, or never before engaged with from agencies that weren’t the ones I spoke to or sent a CV to. Soon I started getting other completely irrelevant email. Then the robocalls came. I later found that email address among five different data leak sources.

Just so happened to be a different popular recruiting company that has “Cyber” in the name.

View on HN

Same experience.

It seems like an old flea market where most people don't buy anything but the vendors all buy and sell old stuff from each other to supplement.

I highly recommend using a Google Voice number for recruiters for just such a reason.

I keep all my interviewing data isolated from my private data.

These days I just never answer the actual phone for anyone. I don’t even bother to look who is calling.

A scenario I hadn't thought about, that you might want to be aware of: I had to call 911 recently. I talked to the dispatcher, and hung up. A few minutes later they called me back to give me instructions. The call showed up as a regular Los Angeles 323 area code number. In fact, it was flagged by my phone as spam.

It made me wonder whether reverse 911[1] calls, which are used to warn about hazmat situations, fire evacuations, and other public safety issues, show up similarly.

1. https://en.wikipedia.org/wiki/Reverse_9-1-1

I quite honestly think that general direct-dial telephony is only a few years from catastrophic collapse, not for technical reasons, but because people will simply defect from the system.

There are too many nuisance calls, there are too many people (and businesses) falling for scams, and there seems to be nothing telcos or governments are willing to do about it.

It's pretty much the same thing that's happened to Usenet and Email (and is now happening to the Web as well). John Gilmore's lament about crackdowns on open email relays is heartfelt, but ultimately naive. If I'm remembering correctly (and I'm probably not), it ran something like: We created a way for anyone anywhere in the world to talk to anyone else, and it wasn't an accident. The problem is of course, bad actors, and lowering costs means enabling vastly more bad actors.

Figuring out how to impose highly asymmetric costs --- and not necessarily financial ones --- on unwanted communication attempts, will win this.

The technical problem is reasonably straightforward. Generating widespread adoption is the real challenge, IMO.

I haven't received any robocall, cold sales attempt or spam SMS in years. I'm also EU based, maybe it's another side effect of non-existant privacy laws in US?

It's probably a number of factors:

- The US remains relatively high income / high wealth. Especially among the more vulnerable senior population.

- The regulatory environment in the US hasn't been successful, or much interested from appearances, in taking on spam.

- Uniform language. Virtually the entire country speaks a single language, English. That's roughly 300 million targets (minor children generally wouldn't count). The largest single European nationality would be Germany, with a total population of 84 million. It's not even possible to necessarily presume an entire country speaks one language, as with Switzerland. And though computer-generated calls are increasing in prevalence, most still use human speakers.

Effectively, it's opportunity, mechanism, and logistics.

But as costs fall and voice-processing (both comprehension and realtime generation) improve, I'd suggest increasing your vigilence around telephone hygiene.

My understanding, from the last time I looked into this, is that the US does have decently aggressive laws against spamming people without offering them ways to opt out and some prior relationship, but a bunch of the spam originates in places outside the US and its immediate allies, so shutting it down becomes nontrivial.

I have, in fact, gotten periodic spam calls, though only once or twice an SMS - usually trying to solicit me about my car's insurance policy having issues (I do not own a car).

I sort of wish I could convince my Android phone to treat all calls to my direct number from anyone but GV as spam, because I have never given that number to anyone.

I’m also in the EU and received a spam SMS not even five minutes ago. I get maybe one a year, so your point stands. Cold sales attempts used to be more frequent, but after blocking a handful of numbers they stopped.

I hadn't really thought about this before, but your comment made me realize the costs that used to be associated with spam calls in the past.

Monetary or social costs were both asymmetrically in favor of the receiver because a long-distance call was expensive and a local spam call would eventually incur a high social cost (either in the innocent case of teenage prank calls being figured out by parents or the less innocent cases where the police or phone company might need to trace the source).

Additionally, if a neighbor is having an emergency they (emergency services) might call you to see if you are home and able to help.

I don’t know anyone that isn’t my parents age that has a landline anymore so this scenario already wouldn’t work with my friends, family or neighbours. My phone isn’t directly tied to my address in any way that might be useful for emergency services.

A true landline, very few people. But setting up a cheap VOIP line is not very expensive on a month-to-month basis, and it's useful to have a phone number that you can give to any person or business that can't bother you at work. We have poor cell service at my house, so the VOIP line is my preference for most calls at home.

Depends on where you live. In Sweden your cell phone is typically tied to yourself and yourself to your primary place of stay.

Sure, that's why I said that mine isn't. I know that's not the case for everyone, but it is for me and many people I know, at least. Its obviously not the case for everyone, many people will have a phone tied to an address, but many people also don't. My phone is tied to me, but whether or not the provider has an address depends on if I have a bill phone or not (many people here do not).

I also wonder EU countries, including Sweden, would actually allow telecom providers to share that information with other parties such as emergency services or whether that would be against data protection laws.

Besides, prior to the pandemic, there was also a high likelihood that I wouldn't be at home, if you called me on a random day at a random time, so even if my phone were tied to my address, it wouldn't be a good idea for emergency services to rely on that.

The one time my neighbors called for help (their car wouldn't start and they needed to go to urgent care), they txt'ed first, then called. Though I would have picked up when they called (and it would have gotten through my do not disturb settings) because their number is in my contacts.

Not saying that your neighbor would call you, but that the emergency services would call you on your neighbours behalf (and it will not be from a number you recognize).

I've never heard of that happening, but yeah, if the neighbor calls 911, and then EMS calls me for some reason, I'm not going to answer since 99% of the time it's a spammer.

If they leave a voicemail, I'll get a transcript.

I have lost track of how many times I have told people: just because you hear a phone ringing on your end, doesn't mean it's ringing on my end. (Verizon US, and yes, you as a caller will hear ringing while my phone sits silent.) Leave a voicemail. It can be short, it can be almost devoid of meaning, but if you send it, I will at least know that you called. If you don't? No record at all. I was out of range, you left nothing to be tracked by...

They likely do. I've seen similar with numbers that are used by medical organizations.

Yeah, me too. I have my 3 best friends and my mom whitelisted; everyone else can leave a message or SMS.

When I set up a contact, I change the ringtone for them. Then, I ignore calls from non-contacts, which are currently dominated by offers of help with my non-existent student loans (it used to be the warranty on my 20 year old car).

I have set my phone to silently reject all calls from numbers that aren't in my address book. Two years, worked fine for me.

Why not? Do you get too many scam calls or robo calls?

99% of the phone calls I get from unknown numbers are some combination of scam/robo/or just immediate hang up. The only exceptions tend to be businesses responding to my initial contact (eg, trying to get a plumber out to my house), in which case I will answer unknown numbers for a day or two until we connect. Otherwise nope.

This is a US mobile number that I've ported from carrier to carrier since the mid-00s. Haven't been particularly careful about where I use the number, which is probably how it got this bad.

I think they're just enumerating the entire address space, rather than buying your phone number from somewhere. But I guess I have no evidence to prove this; I have given my phone number to companies, and I get a ton of spam calls.

I think they're just enumerating the entire address space

Even when you consider most calls now for SIP/VoIP platforms (which is where a lot of these scammers get their DID/phone numbers from) are charging fractions of a cent for outbound calls, enumerating and then dialing entire NPA spaces gets prohibitively expensive after even five minutes of dialing waiting for someone to pick up, even for the most dedicated of scam call centers.

Doesn't mean they aren't dialing randomly to see who picks up, just I doubt they're dialing entire phone number spaces wholesale.

What can be observed going on is these scammers quite literally trade lists of leaked phone numbers and email addresses and they actively keep track of who responds, and who falls for their scam before sharing the list with others.

Jim Browning (a popular youtube scambaiter and infosec pro) has videos where you can watch it happening with your own eyes.

My partner and I have adjacent phone numbers (x and x+1). /Occasionally/ we get sequential spam calls, where my phone goes off immediately after she hangs up. But not super often. Though one can shuffle before calling everything, just as easily.

It’s like a war games dialer 40 years later.

Anyone who knows me will message through any other app.

I have a nice collection of "throwaway" phone numbers for all kinds of reasons, while one of them is dedicated to job hunting, I don't think merely having it would have stopped this agency from sharing my CV across to whomever they shared it with, or stopped whatever leak occurred for said email address to end up in so many collections of leaked data.

That was the reason: to understand where my data was leaking from, not to duck recruiter calls.

I always ask where do they have this number from.

One time the guy told me that the person who referred me "preferred to remain anonymous".

I asked him if he realised that this is a violation of GDPR and that a typical candidate would recognize it as such?

No coherent answer.

I've more than once asked a cold-call recruiter how they got my number where the answer has been a rather candid, "there are markets for such information".

Kinda makes me regret the few years my LinkedIn profile had my phone number public, but I do wonder how successful these questionable personal data marketplaces are. I certainly haven't had a conversation get beyond "this is spam".

Check out http://intelx.io, depending on your risk tolerances, putting your email and phone number in yet another search bar may not be in the cards. If you can swallow it though, depending if (1) anything you care about has been leaked at all and (2) anything you care about being leaked has been indexed by this site...the results may be illuminating. Or nothing at all.

Interesting resource nonetheless that supplements my day-to-day line of Devsecops.

This site and a few other OSINT tools was how I discovered who 'sold out' my CV to some of the questionable 'recruiting agencies'.

How do you put a phone number in? It rejects mine.

Using E.164 international phone number formatting works. E.g. +14155551212.

I legally changed my name two years ago and I still get recruiting emails addressed to my old name. It hasn't been on LinkedIn for equally as long, so I can only anticipate that my data was sold and my old name is cached in some database.

Even non-recruiter HR will share your data without concern these days.

Reply on news.ycombinator.com