I'm a scam prevention expert and I got scammed

They called me back a minute later (now without Amazon recording the conversation) and asked me for my NVR's serial number so they could connect to my NVR. I was shocked they had a backdoor into my NVR but I figured I'd let it play out. A minute later the technician said that he was having trouble connecting because "an internet virus is corrupting my firewall". I was extremely confused and thought it must be a translation problem. Until he kept insisting it was a problem and became belligerent and angry. He said I needed to pay $300 to have an on-site technician troubleshoot the problem. I got angry because he was making some weird excuse for their camera not working, and wanting to charge me rather than just ship me a replacement. I refused and he started mocking me. I demanded his manager and he ignored me. Eventually I hung up and called Amazon back.

The Amazon technician was helpful and shipped me a replacement. I contacted Reolink via email to complain about their technician. They responded that they have no on-site technicians and that it was a scam!

I was blown away that Amazon would transfer me to a scammer. I contacted Amazon again and let them know what had happened. Hopefully they will figure out how their guy got this scammers phone number and teach him how to find a 3rd party phone number...

I heard this from a security guy and was under the impression it was one of the sacred laws of security. If it's not, it should be - it's a rule of thumb that would stop 90% of social engineering attacks I hear about.

Sitting at my desk at work, I get a phone call from my bank on by cell phone. "Mr. Anechoic, there appears to be a security issue with your bank account. We can resolve it for you. For security purposes, can you give your checking account number and the last four of you SSN"?

This is clearly a scam, right? I tell the guy there is no way I'm giving up that info for a random dude that calls me. He stresses again that there is an issue with my bank account, that the account will be frozen, and there is nothing he can do about it without the account and SSN information. I refuse again, and he tells me that I should go to a local bank to get it resolved. I hang up and go back to work. I log into my bank account website, and all seems fine.

After about 20 minutes, something is still bothering me, so I leave work to go to a local branch. I speak to a branch manager about what happened, and she agrees with me that it was clearly an attempted scam and the bank would never call me and ask for that information. But just to be safe, she checks my account on her computer. To our surprise, it turns out there was a security flag on my account!

She calls the bank security desk, they confirm that there was an attempt by someone in another branch a few states to get money from my account and the call I got was legit and logged in their system. We get the account locked out, and then the manager asks to talk to a security supervisor about the messed-up way they reached out to me. The security person basically said "this is how they do things" and didn't see the problem. The bank manager apologized, said it was messed up and she would try to run things up the chain to improve their process.

Damned if you do, damned if you don't.

That's a big red flag there. So I try and find the phone # of the fraud dept of Citi because anyone can send a text message. Turns out can't find it anywhere in the official Citi site. So I finally give up and call the phone # before they could go further they asked me to confirm a 2FA they would text to me. At that point I noped out and decided if it was a realt problem I'd find out about it another way.

The problem is I now know how easy it is to break into any Citi account just send them a text with a # and pretend to be the bank. The worst part is every every every message I get that is actually being secure always says "You will never be asked for this code" and everytime they ask for it.

It is security theater of the worst degree by incompetents and MBAs and I am getting sick of it.

Here's one tip for this expert – if you get a 2FA code over text or email that clearly has the line "we will never contact you for this code over phone or text" right under it, DON'T give it to a "support agent" over the phone.

> this is clearly a two-factor authentication code, meant to be entered directly into an authentication page. Which is normally not something that would be relayed over a phone call to a customer service rep. A concern that I raised to Daniel. However, he said that it was part of Apple's system, which they only had limited access to. An explanation that, as someone who works with computers, data security, and API integration professionally, I completely bought

And after reading multiple paragraphs of this person describing money literally taken out of their account in front of their eyes, you get to this line:

> Putting all of this together, the scales started to tip toward this potentially being a scam call, but I still wasn't certain

I really hope they don't have a lot of clients

There's a red flag right there — I've never found a bank willing to provide any verification of who they are when calling me. They call me and ask me to give them a code or card number without providing me with any proof of their identity. I've tried to get them to give the sum of the last 4 numbers of my account, but they won't do it.

They always tell me to just call back using the number on my card and try to find my way to the right department. Super annoying.

It's also a consequence of solutionism, systematic monotonicity, mother-knows-best and externalising costs such that we:

Only add more security solutions on top of existing ones to fix their holes.

Deny the user any choice or agency in setting their own security terms

Never revoke or remove a feature (that would be admitting defeat)

Push the burden in every process on to the user

Create fear in the user - that any misstep will cause them more inconvenience and trouble.

Make security an authoritarian culture such that user will not question or be sceptical.

All of these are antithetical to civic cyber-security that we need available so educated and empowered users can operate technology under their control.

I've been with Wells for over a decade. They have never called me. Never.

I have had "fraud" alerts hundreds of times. They always happen at certain POS, and it's always a text alert.

Some of the stories I read make me viscerally react with "what in the world are you doing with something as simple as a bank account?"

Also a fundamental default is "no action". If you are even slightly suspicious, do nothing. It isn't somehow so important that you stop thinking and just act or react. Just stop.

But I was pick-pocketed twice in my life. Both failed attempts, but only because of dumb luck. And I thought that would never happen, "because I'm that much present always."

One time I'm wearing a hoodie, and a cheery guy distracts me and sticks his hand into a double-ended pocket and my hand, resting in the other side, instinctively grabs his; a trigger-happy hand-shaking mechanism and a bad choice of pocket. I quickly walk off because his grumpy friend looks like someone who would stab you.

Another time I'm running for the bus, my phone is thrashing forth and back in my pocket, so while running, I quickly grab the phone and stick it in another pocket; two seconds later, a young guy bumps into me, and his hands reach all the way down in the now empty pocket. We land, we stare at each other, and I run for the bus rather than him; I'd have no chance catching him anyways.

So... with some humility: The only way to stay out of trouble is to apply really dumb protocols.

The landline caller ID showed "Madison Police Dept" - the local police. The caller introduced themselves as an investigator working a case with counterfeit bills. "Don't contact your boss/owner because we are not sure if they are in on it." The caller knew details like employees names and the layout of the store. The manager was going through the cash in the back "confirming" serial numbers when the owner got in touch and cleared things up.

I was confused about the end game for the scam, but online I've read a version where they send a courier to pick up the "counterfeit" bills. There's also a version where they convince the employee to purchase moneypak cards to be deposited into an account so that the 6AM audit shows balanced books making up for the counterfeit bills that will be confiscated. [1]

To a person that doesn't know caller ID can be spoofed, getting a call that shows up as coming from the local police department can put you in a mental state that it 100% is the police, and it will take a lot of counter information to realize that it isn't. Between that and the convincing reason to "don't tell your boss", I'm afraid this might be an effective scam until it's more widely known.

[1] https://old.reddit.com/r/Scams/comments/ryp4fg/i_got_scammed...

Standard procedure for everybody in the last 20 years should be: Whenever I get a call about security or fraud from the bank, I thank them for the notification and tell them I will call them back, and hang up. Then I call the number on my credit /bank card, not the number I was called from. Fortunately there is a lost or stolen cards so there is no queue time and tell them I received a fraud alert notification.

you can purchase FULLZ from darkweb marketplaces, these contain name and address and social security number and often come with credit card details too

with that, you can do social engineering like this, you can also remote desktop into any computer nearby to their zipcode (from a different darknet marketplace of compromised computers being rented out) and purchase things online from that, making it less likely to be flagged

the idea that "scammers intentionally do obviously red flag things to weed out discerning people and just target susceptible people" is just one segment of the market. doing smarter more cunning things is entirely available and entirely lucrative

I recently had to speak with the Zelle FPD because it had frozen my ability to send (but not receive) after I had made some small trial transactions. Also, I use a Google Voice number with Zelle, which Zelle seems not to like.

I was shocked at the depth of questions that the Zelle FPD agent asked me. My SSN, DOB, address and recent transactions were expected. But then it went deeper: state where my birth certificate was issued. Fine. Car loans I had. Okay, this is all stuff on my credit report. But then it went past me: where my kids were born and their DOBs; my brother's DOB and age; my wife's DOB and age; my mother-in-law's (!) maiden name. Keep in mind this all after I've authenticated myself to my bank including a phone password I have setup. And, it's for a secondary checking account that I have less than $1000 in.

Real bank FPDs have a crazy amount of information on not just you, but also your family members.

I personally would hang up if any of my financial institutions called me and I'd call them back.

I thought it was really unprofessional of them to operate this way.

> I've never heard of a call center system that can accept touch tones seamlessly while a call is active, and it would take extremely sophisticated audio processing capabilities to be able to do that, since the frequencies used by touch tone keys heavily overlap the frequencies of human speech.

It's actually happening all the time. VoIP systems _do_ extract touch tone (DTMF) from the call and convert them to appropriate out-of-band messages (either on RTP or SIP, there are multiple standards). This might also happen with VoLTE, although I didn't verify it myself.

So, while the request was indeed weird, there's nothing technically strange about typing touch tones at any point in a call. Regarding the fact that those frequencies overlap with human speech, it's expected because they were designed to be transferred over phone lines, which are made for human speech frequencies. Since landlines here in Switzerland have been converted to VoIP several years ago, I often hear DTMF tones appearing from nowhere in the middle of a call and covering the voice of the other person. The reason is easy: some intermediate system detected a tone and sent the corresponding SIP/RTP message, while also filtering the tone out of the audio. On the other end of he line, that out-of-band message triggered the generation of an actual in-band tone, whence the result.

This tactic is actually used by so many scammer, it's weird that a scam prevention expert is saying that kind of things. His sentence prove how effective transferring it to someone else is powerful, how could they transfer us to a supervisor?!

They are working in call centers, they just give their phone to someone else, often time someone with more experience with scams thus better to convince you. In some case I have seen situation where they use that tactic as good cop / bad cop, where the first one is threatening, this bad thing will happens if you don't act quick, etc... and the next one is more on your side, he believe you, but you need to works with him. I even seen some where they say that they have no other choice but to open a police report with your local police, and ask you your local police phone number, act like they talk with them on a second phone (as if they couldn't put you on hold and initiate the call directly on their system) and then say that the police want to talk with you and they will call you directly (I guess using fake caller id again but with the police phone number).

It's all part of their tactic.

The critical difference, though, is that he reported the scammer read off a list of his actual recent transactions.

That part, especially when combined with this second story so soon afterward, makes me think some third-party budgeting tool or something was recently breached and just hasn't announced it yet.

With Vercel, Netlify and many others offering free stating hosting and let's encrypt https certificate there is no excuse to run a site without an SSL certificate.

To me the moral of the story and that you should never ever follow instructions by an alleged bank calling you asking to confirm informations and, even worse, give them codes over the phone. Especially if you are an "expert".

The most unbelievable part is falling for the idea that if you had called back your whole account would be on hold. That was such a smoke bomb that was easily detectable.

If this seemed plausible as your dislike your bank and don't like the service why not take your business elsewhere?

From your own story, if anything, Wells Fargo prevented this from becoming a much bigger problem and acted very promptly to your request.

Hardware authentication factors are, of course, immune to these sorts of attacks because you can't confuse the victim into forwarding their second factor back to you. However, I don't see why you couldn't construct a specific scam setup for those.

That's where (I hope) I would have stopped; if X sends me an authentication code, the only reasonable place to send it back to is X.

Also, I think the real fraud department would be completely OK with me saying "Oh, thanks for spotting it. I'd like to call you back now please - give me your name and the name of your department, and I'll look it up and call you back - what do I do to bypass transfer hell?".

Getting on the blower to Wells Fargo on the other line was smart, but you need to have multiple lines at your disposal.

Pet theory: voice recordings will be the next fingerprints/DNA, at some point it will be trivial to identify the person based on old recordings. At which point we can retroactively convict these people years or decades later, when they thought they were out of the woods.

I know that this scam is relatively sophisticated compared to others, but I have to think if I was a scam prevention expert that I wouldn't tarnish my own name by putting a story with this much raw honesty out there.

They basically violated rule #1 of scam avoidance which is that no legitimate business cold calling you will need you to do anything with urgency.

Either that or it's a way to make potential customers feel better about the obvious mistakes they made.

Some combination of new consumer protection laws, infrastructure improvements, and law enforcement attention is desperately needed. I don't know why this doesn't get more attention. Is it just the historical attitude that each of us are responsible for protecting ourselves? Is the line too blurry between a legit business and an outright scam?

I wasn't tired, but I got a call at 8AM on a Saturday as I was just about to wake up, and I hadn't slept very well. You may be very aware of all the latest security practices, but in the end you are human, a big bag of emotions swirling around. And it only takes a moment where you are vulnerable to scam you successfully.

The lesson here, I think, is: it could happen to you.

I cannot fathom how a tech professional would do this. I mean, I read their justification, but it still doesn't make an ounce of sense to me, other than their brain was shut off for the entire call.

One morning in college I was awakened by a call after staying up all night working on some project. The caller claimed to be from my home country's embassy and was investigating a fraud case I was involved in. He started by confirming my personal information such as DOB and passport number and he had them all correctly. He asked me to physically visit consular office, which I told him was impossible because I was in some program.

At this point I sort of give in, but he asked if I was preparing for piano/music rehearsal - a huge red flag that awakened me from foggy mind. During adolescence I attempted to becoming a pianist and dedicated lots of time to training and competitions, but this is a past that was never mentioned on resume or to friends. There couldn't be legitimate way to relate that experience to me.

I said yes and asked why he knew it. He began talking about my musical experience and what awards I won, without knowing that all these bits sounded to me like a pretentious show of being knowledgeable about my life.

One lesson from this and Op's story is that the scammer can attempt an attack at any moment, including downtime of brain activity.

This is how it is at almost any company I have ever worked for. They always say things like "We prefer that you ask questions if you don't know" or "We would rather get a hundred false reports than miss one valid one." That sort of thing.

And then when you follow through with what they ask for, it's just like the quoted part says.

> results in condescending info-dumps or intimidating interrogations

It's not just a cyber security problem folks. This is pretty much a global problem, because no one ever really wants to be bothered over trivial matters, and no one really wants to believe the boy who cries wolf; even if the wolf is real.

None of this will get better until people in general become both intellectually and morally wiser. So get a drink and some popcorn cause this is gonna be a while.

When I received the call from them, they asked for my date of birth and other information. I explained that I'm not comfortable revealing my details to an incoming call and to give me their extension instead. When I did this with BoA or Chase, they'd immediately understand my concern.

The SFCU person on the line, however, gave me some passive aggressive statement about me causing extra work. This was followed by me calling their official number on their web page and having to wait about 20-30 minutes to get through to the extension number to the same person, which proved that the previous call was legit. However, said person proceeded to mock me for having wasted our time.

I love SFCU but they really need to understand how scammers work.

Well yes, as you're slowly reading this entire case, with the prior knowledge that he is getting scammed, and having all the time in the world to find the mistake or red flag in his actions, sure enough you'll find it. How very smart and vigilant you are.

But as the article already explains, those are not the conditions in which a scam happens. You don't know you're being scammed. The person sounds helpful, exploiting your inner desire to be cooperative. There's a sense of urgency, which disrupts calm and clear thinking. It was a very sophisticated and well prepared scam, which increases trust and makes you glance over or "forgive" small oddities.

Ironically, the fact that some of you chose to criticize somebody showing vulnerability is very emotional behavior, not rational behavior. Perfect candidates to be scammed.

By the way, are Americans still logging into online banking with a username and password? That's it? Please tell me that's a joke.

When I called, I immediately got connected to a live person. Second mistake: you can never get through the voice menu to a live person so easily. Anyway, the guy sounded convincing, and said I could get a special discount on renewal, so after some further conversation, I commented that I should be able to log in online and get this same deal, which was my preferred method. At that point, he finally put me on hold and then the call disconnected.

I've had this attempted scam tried on me twice in last 4 months. You know it's a scam for sure when they try to prevent you from hanging up.

Also, always disconnect. Don't just listen for a "dial tone" after they hang up.

* A call comes in from a number I don't recognize, it goes to voicemail.

* The voicemail message says "This is the fraud prevention department at $BANK, please call us back at $NUMBER"

* I pull out my physical card, call the number on the back (which does not match $NUMBER). I go through the menu tree to get the fraud department and ask if the call was legit.

Interestingly enough, at some point the bank modified the menu system so that when you enter your card and the fraud department has called you they'll bypass the menu completely and transfer the call right to that department. Clearly I'm not the only one that does this and they don't necessarily want to discourage this behaviour.

For this reason, I am extremely stubborn about inbound calls. When my bank/superannuation/etc. call me about something and ask for any personal details, I explain to them why it's really not okay for them to be doing this, request a way to call them back via some telephone number that is published on their official website, and then later follow up with a formal complaint.

Who knows whether it actually does any good. Probably not. :/ EDIT: I mean, it definitely protects me, but I don't know if any of these orgs have changed their practices.

I put the effort on the bank, as the bank has the duty to safeguard my money, not the other way around. The bank's responsibility on suspicion of fraud is to block the transaction and summon the account holder.

I use the bank's channels for communication and this does not include random calls. It communicates with me through the bank's web page and app and it has never sent me any email. This is true for my experience in Poland and Portugal. The Portuguese bank used to have a crappy web-banking system and even this worked properly. When I got contacted by my bank, it was an in-person summon with no ability to discuss through the phone, the end.

Being so "remote" these days that we do not consider it important to go to the bank in person is maybe the issue. It is ridiculous one's ability to handle one's fortune in a phone call. It should be bureaucratic by nature.

I can understand being busy but not a single time the article's writer mentioned he will go and sort things himself in the bank. Are physical banks rare in the United States?

As the people most capable of remediating the vulnerabilities in our telecommunication and banking systems, I think we ought to close ranks and insist that our employers do a better job of protecting the innocent, even if it means breaking a few conveniences.

I'm receiving monthly payments, but once payment bounced back because my local EU bank switched their intermediary bank, something normal client shouldn't care about, but I learned about hard way because WF is not updating their database of intermediary banks and routed my payment through outdated intermediary bank.

I was pretty pissed about my own bank not informing me about changing intermediary bank, so I changed my receiving bank to different one, although in the end it was Wells Fargo problem not keeping their records up to date.

Guess what happens years later after my other bank merger with different bank, Wells Fargo once again ignores new intermediary bank and bounced back the payment.

I dunno if this is standard US international banking experience, but I find it extremely unprofessional and unheard in other countries that payments would be bouncing because bank is too lazy to update their intermediary bank database, not sure what operation they are running in Wells Fargo.

In the end company made exemption for me and they are sending me money directly from their Asian account, because apparently you can't get worse banking experience than with US banks.

After reading all that... I noticed that the "scam prevention expert" isn't serving their site with proper https.

That said, I've had a lot of these calls and fortunately not fallen for them once. The funny thing is that eTrade (I think) has a system where you can ask for a callback but then they'll go right into taking your information. When that happens, I followed the play book: I asked for a phone number that I could find on ETrade that I could add an extension for to get to this person. He gave it to me and everything along with some sort of quick access code I was supposed to use to get whomever I hit to pass me along.

Well, I did the whole thing and the person at the other end in the ETrade system that I dialed said "It's okay, I'll just take care of it, sir". I mean, at this point I just sucked it up and went through with the process since I figured I dialed the number from their website to get there and then the extension so surely it has to be legit, right?

But I just know someone is going to point out a way that I could have been scammed through this mechanism.

Long story short, I could have ended up with a subscription on a set of questions for 20 dollars a week, which was given only after a set of legitimate surveys were given on behalf of Apple. I of course notified Apple of this, but I never got the 20 first dollars back, before cancelling the "subscription" I had apparently signed up for.

I really wanted to track the guys down, but they had been very careful in covering their tracks with proxies and mailbox addresses, so in the end I considered it too much work. But I did spam them. Perhaps I could have even used their mail for even more spam, but I suppose they just use throwaway mails anyway.

Not sure how they got through the cracks of Apple, though. IMHO it's pretty damning for the reputation of Apple to work with guys like that.

I got called twice in my life, both times in response to a ticket I had filed but didn't necessarily need a response to (firstly a complaint about some new hardware authenticator that was worse than the old one (I was hoping enough complaints might make them pick a better replacement next time), secondly about phishing-but-legitimately aka Sofort which they now, two years later, finally semi-blocked).

From the post, since it mentions this being routine and normal, plus the comments here, it sounds like americans are called every month or so. Is that impression correct? Is it because of this credit card system where basically anyone with your account number has withdrawal access identical to what we use 2FA (chip and pin) for? With IBAN it's more of a money destination than a source. Direct debit exists but I have yet to see it abused, not sure how that works exactly, and definitely never got a call to confirm this or that.

I would've filed in small claims court but the filing fee is more than the loss. So I looked up all his family info and addresses, and next time in his neighborhood I'll be knocking on their door for my money.

And, I'll just keep finding creative ways to chase him down, online and off, until the day I die. I'm never letting it go and eventually if I had to "take" the money from him through other means (him losing money), that's what I'll do. I'll be sure to double or triple his losses though if it comes to that.

This part sounds weird to me; surely helpdesk employees don't have access to full employee records?

Further, if the scammer already had this much information, couldn't they have used a name of any helpdesk employee who actually does work there?

With all this info they can call up GoDaddy and redirect your domain (and all your emails) to themselves, or call AT&T and sim swap you. Why even call the actual account holder?

https://www.zdnet.com/finance/blockchain/fbi-warns-sim-swapp...

As for these “confirmation” emails or SMS — they are so dumb !!! Why don’t they just include a full description of the ACTION you are supposed to have taken, that you are expected to be confirming? In big red letters before the confirmation number. That way the scammer won’t be able to trick you. Sheesh, these companies haven’t figured out to include that?

Even if your bank is really calling you they will still understand if you call them back on the number you have.

Personally, I've received such calls before, and the first thing I'd ask for is a case number, and that I would call the support number printed on my credit card, to get back to them. Of course, if someone co-opts that number, then I'm also SOL, but I'd imagine then this would be engineering on a larger scale, rather than a specifically targeted whaling attempt.

This says it all. You may be the best expert and everything you want, but when you are tired you are no longer an expert, and it's something that practically can't be learnt to self-identify.

If you think that X will never happen to you, wait until you are tired and we'll see about that.

The issue is, it was a card that I keep only because it's the oldest card I have, that I don't really ever pull out of my wallet anymore. I'm not familiar with the underground stuff but I suppose stolen CC numbers are typically sold reasonably fast (months, not years) and used while they're still fresh? If that's the case, while two random anecdotal data points don't prove anything, I start to wonder if it's possible that WF was recently compromised.

I was buying a 2 yo Toyota car at an official Toyota salesplace. Before this, I've bought three used cars, looked at tons of videos (eg Chris fix on youtube) on how to check the car itself so I don't buy something that risks needing expensive repairs two years later. I wasn't super prepared against the salesman before though. But he wasn't looking like, and behaving like, a salesguy. He was a bit uncertain in his way to talk, and it felt like I was more sure of the buying process than he was.

I had two main concerns - I didn't want to buy a lemon ("Monday specimen") or a crashed+repaired car. The latter may mean things like bearings being slightly out of alignment and leading to wear quicker. So I voiced those two concerns and asked whether this car had ever been repaired, "No, nope.". I asked about service subscription, the guy whispered "I shouldn't say this, but it's better you get it at the other place which is closer to you" (also an official Toyota place).

Since my daughter has allergies, I asked about smoking or animals, "njet, nada, nopes".

Well, a month later the car was completely registered to me and I got access to the Toyota digital registers and surely enough, it had been smacked along the side by a truck. It also already had a service sub pre-payed on it, so that was him getting out of a 350€ service at their place. A final insult was that, as the chemical perfume smell of the cleaning agent came off, it had a foul pungent smell of wet dog.

I confirmed this with the previous owner too, she'd had a dog in the car. Had to buy a replacement air filter and clean the car internally, but at least my daughter doens't call it the "smelly car" anymore.

Pretty happy with the car, and would likely have bought it even if he was completely truthful, but having been lied to, and fallen for it, makes me pretty angry.

Feels good to share the story :). Don't forget to like and subscribe.

I had called their support line to dispute a charge, spoke to an agent for a bit, and they put me in the dispute queue, and then hung up on me after 20 mins waiting. I call back, repeat the process, wait 20 mins and got hung up on again.

Then an hour later, I received text message telling me that my Citi account was frozen, with a (phishing) link to reactivate it.

I had called Citi using a new phone line (not linked to my existing Citi account), so for the phisher to text this new number means that the call center must have leaked it soon after intentionally hanging up on me.

It’s possible that my number was randomly targeted, but the timing was very very suspicious.

Off topic: The site has a contact form and a login page, but no https?

I think it might be time to change banks...

I think a lot of sysadmins following best practices (not every box or estate on the net are compromised, and this is not to say zero-days don't exist) are getting frustrated with security "experts" like this who simply can't even be bothered to practice what they preach...

There isn't a more polite way of phrasing this really...

"Extremely sophisticated?" The tones are just a sum of two sine waves of known frequencies. That's trivial to detect. What am I missing?

I went to read the comments here to see if Daniel somehow acknowledged this

It can be set by the caller to anything, if they have access to some trunk from an operator that allows this. It's another trust based thing, with no automated verification.

Trusting caller ID was the initial mistake. Never trust caller ID with your money. It's like trusting sender names in your spam folder mean anything.

"[...] Wells Fargo will not contact you by phone or text to request this code."

To be fair, that should be about as large as the title text, and displayed before the code. And the scammer was likely doing a good job of keeping the author distracted enough to miss that.

No bank advertises this from what I can tell.

I think if you're going to be a Scam Prevention Expert, you should at least familiarise yourself with the user experiences of these services so that you can detect when they're potentially being used in a scam.

This was too quickly dismissed. If you know a bank isn't up to your personal standards, don't cave into using them anyway! There are so many alternatives that the decision to keep using them should be seen as the primary or root cause of the problem.

> Lupinia Hosting Is Shutting Down

Original archived here: https://web.archive.org/web/20220331074459/http://www.lupini...

Even if I get a text message flagging a purchase that I initiated I still won’t call the number they text me with I’ll always go to their website via url I type and call the number there. Surprised an expert isn’t doing the same.

NEVER give details over the phone on a call you didn't initiate EVER.

Uhhh, when I see any SE I assume it happened because the user / customer is making use of a giant beuracratic system and nobody knows how it works and what is supposed to be private data and what data needs to be sent where, along with government pointing gun at you to send 5 pieces of ID all over the place ASAP without you ever understanding which ones are needed for what purpose. The very reason these broken, impossible to understand systems exist everywhere is because "the user is too dumb, stop being elitist".

Imagine if you logged into runescape and instead of entering user / pass, it said you need to have your IP address authorized, then you need to get a runescape license, then they need a picture of your iris. But you also sent your iris to some pizza shop to "prove" you own your house, and you have no idea what steps that pizza shop took to secure your iris photo (none). Then to get your IP "authorized", runescape tells you to login to some weird website you've never heard of before, and send it two pieces of photo ID (which you also sent to a paint shop to order paint), and then that website says "please give us your phone number so you can open our secure phone app", and then you open the "secure phone app" and you have no idea what it just did or what data was sent where or what data about you it just assumed you're now supposed to keep secret. I don't know, is this concept like not obvious to internet people? It's called ungroundedness.

The reason I'm writing all this without burning my eyes on this stupid color theme, is because whatever typical bullshit narratives HN will prop up as usual in response to this article here are completely invalid. This classic "boo, hoo, you're an elitist" talking point is irrelevant nonsense because in most cases the user hasn't been tricked; he hasn't been provided with a system that allows him to use it properly. But oh wait I just wrote about this last week as the cliche was made again then. I actually WANT a system that makes "elitists" secure and doesn't care about unqualified people (and I know lots of people who also want this, it's what UN*X users like to think of themselves as): https://news.ycombinator.com/item?id=30780519

That’s because you have a debit card instead of a credit card. Get rid of the debit card. There are Zero consumer protections.

lol

Edit: looks like accessing it over HTTPS just gives you a broken looking site saying "Lupinia Hosting Is Shutting Down".

I think you could argue that this guy gives us this long (and somewhat implausible) story in order to:

a/ support the line of business he is in and

b/ to justify all the privacy intrusions and obstructions that banks are undertaking

Different bank, but they had all the basic information, but then started asking for information that I know they don't need (secret questions and answers) and when I told them it was sus they hung up.

You should never give out ANY information on the receiving end of a phone call. Period. Ask what their name is, what department they are in, hang up, call the number you were provided prior, and ask for the same department/person and describe the details of the call.

If the bank calls you, hangup and call the bank number listed on their website.

A. Fraudulent charges are YOUR BANK's problem, not yours. There is no reason to take any risk or share any information. You can agree that charges are fraudulent, but that's the endpoint of your responsibility.

B. Don't give out any information to an inbound caller. None. (except to acknowledge fraudulent charges)

C. Don't try to figure things out. You don't need to reason through it. This author spends SO MUCH time trying to reason out whether this is or is not a scam call. WHY??? Just hang up and move on. If it makes you feel better, you can always call you bank back.

"Putting all of this together, the scales started to tip toward this potentially being a scam call, but I still wasn't certain. It was all circumstantial and conjecture, and a lot of it seemed very legit, plus the difficulty of accurately putting together the information needed to make an attack like this against me without also including strategic disinformation that would tip me off about where they got their data. I needed more information. It was time to push back on this." >>WHAT??? Why do you need to push back? What's the point? Hang up!

"So, I was immediately suspicious, and started asking technical questions; " >> NOW you're suspicious? Again, why ask technical questions here. Who cares? Move on!

This author spends FAR FAR too much time trying to outsmart the scammer - and in the process gets outsmarted himself.

Edit: Nevertheless, I give the author a WHOLE LOT OF CREDIT for being willing to post this. I'm sure he was a bit embarrassed, but sucked it up for the greater good and education of all of us. Thanks!

No legitimate bank would do this. They say "call the number on your card, and mention reference # NNNNN"

Wells Fargo is a criminal organization: https://en.wikipedia.org/wiki/Wells_Fargo_account_fraud_scan... so there's no reason to assume an impostor would be worse.

LOLOLOL OP