Hacker News Reader

Comment by klik99 | Hacker News Reader

There's one easy rule that could have avoided all of this - never give out any info on incoming calls. If I get a call or text about fraudulent transactions, I'll keep them on hold while I log into the bank website. If I get a call about a late payment, I'll thank them for the info and ask them to stay on while I pay online. If I get an inbound call with a more complex request, I'll ask them for their employee info and call back the official service number. It annoys the caller sometimes, despite always treating them professionally, but I keep that a hardline rule no matter how real it feels.

I heard this from a security guy and was under the impression it was one of the sacred laws of security. If it's not, it should be - it's a rule of thumb that would stop 90% of social engineering attacks I hear about.

View on HN

This is good advice, despite it being a pain sometimes! I once got a voicemail from the fraud department at my bank, with a number to call back. I googled the number and all that came up were stories about being scammed. So I was 95% sure it was a scam, but called my bank directly just in case. The person who answered assured me they hadn't contacted me, and it was indeed a scam. I later got a follow-up voicemail from the "fraud department", from the same supposed scam number, which I ignored.

Then, the next time I went to use my card, it was blocked. I called the bank again and spoke to someone new, who informed me that the original calls had been legitimate - they had the same reference number and everything - and the card had been blocked due to lack of response!

Obviously a false positive on the scam detector is less of a problem than a false negative, but was still pretty incredible. No idea what was with all the people talking about being scammed from that number online; I can only assume that they (like the first rep) assumed it was a scam, since if the bank needs to call you, they should tell you to call back using the number on your card, not some random number they give you. But apparently that's exactly what they did.

This has a similarity to the original story here, in that the original sounded like: "They behaved a lot like a scammer would, but I also totally expect my real bank to behave like a scammer would".

Many years ago, I have worked in a call centre for a bank and the process for calling customers was exactly what you’d expect from a scammer.

In the standard/credit card section (not, for example, credit card debt collections), it was rare to have to make outbound calls, but when they were needed, no information could be given out until the customer answered security questions. Some customers questioned this because it was exactly what they’d been told never to do. They were told that of course it was right to be cautious, and they could call back, but that they would need to wait in the queue and likely speak to a different person. This was all before they could even be told what they were being called about.

Perhaps half the people questioned the process upon receiving the call (“you called me, and you want ME to prove who I am?”, but very few hung up and called back.

From memory, this was mostly improved later on - no security questions needed unless some sort of action needed to be taken on the account.

This happened to me with Bank of America’s fraud department. I had a charge that tripped the fraud detector on a relatively new card. I don’t recall the sequence of events, but I believe I was prompted to request a callback from the fraud department. When they called back I had to answer a bunch of PII questions, and then they pushed a 2FA code to me and asked me to read it back over the phone. I told him, the 2FA message literally says to never give this number out to anyone, but they insisted it was necessary to continue. I was shocked that the banks fraud department would be so cavalier.

Many banks today have communications preferences options and I've told all of my banks that do to never call me directly. If I receive any sort of legitimate call from them I immediately follow up with a strongly worded letter that they should not have called me and violated their own security policies.

The only thing we can do about "bank behaviors make it easier for scammers" is to change bank behaviors. It's not an easy process, but unfortunately it is a necessary process.

One of the wonders of the world is how much unnecessary data they collect - just because they can demand it - with nary a thought of how much of a liability that is.

Guess it will take a few years of getting slapped for it to filter down.

He is looking for a definite red flag that it's a scammer. This is a terrible strategy and he should know better. One suspicious act and you should hang up and call the number on the back of the card. Really you should just not take calls from the bank ever and call back on the number on the card.

If you’ve ever tried to get a crypto token listed on an exchange, its just as bad in that arena even though it seems so far behind the scenes.

The process to get listed is the same as a scammer’s process to ensure you get listed.

Some exchanges will say “no we would never handle this with DMs over telegram”

/gets listed by being introduced to someone with a DM over telegram/

I had something similar. One time I got a phone call from a "Scam Likely" and decided to answer it. And it was an automated message from my bank asking if some purchases in another state were real or fraudulent. At this point I began to second guess if it was a scam or not, but had to assume it still was. I ended up logging into my account and seeing the same fraudulent purchases that it listed over the phone. So I called the number on my card and had it all settled. I found it weird that the original call was a false positive though.

Probably because the phone number is calling about a scam (fradulant charge), and then when they hang up, people report the phone number as a scam because they don't understand the difference.

No, it's because caller ID can be easily faked. So both spam calls and real calls come from the same number.

STIR/SHAKEN has been the law in NA (where the GP) is for a year or two, so it should no longer be easy. It's a problem a lot of countries are tackling.

Some scammers are making fraudulent charges, then calling victims as the bank to “fix” them. Skips over a bunch of red flags because the bank has every reason to be calling.

Calling on the official number is a good rule. But my neighbour followed that and was still scammed for tens of thousands.

The critical extra step that they missed was to check that the line was disconnected before calling out. They were using a landline.

The scammers called them, but didn't hang up. Then, when my neighbour called out to their bank, they pretended to be answering that call - going through security, etc.

My neighbour then did whatever the scammers said - because they couldn't possibly be scammers.

For the people who are confused: this is a fairly common thing on landlines in some countries, where the telephone exchange doesn't drop the connection until both ends have hung up, or in some cases when the caller hangs up but not the callee. So it's possible to put your own phone down, but when you pick it up again your phone is still connected to the scammer's telephone. If they play a convincing dial tone, then change to a ring tone when they hear DTMF, you'd be none the wiser.

The workaround to this is to use another phone (e.g. switch to mobile), or if that's not possible, apparently you can wait several minutes until the exchange times out the connection.

https://security.stackexchange.com/questions/100268/does-han...

I accidentally won a radio contest many years ago in this way. I heard "you are caller 2" and then the DJ hung up. I stayed on because I was confused and then a few seconds later he picked up again and said you are "caller 4". So I just stayed on and eventually said I was caller 10 and the 10th caller won the prize. I assume he was switching back and forth between two internal phone lines.

I was confused because I was calling to make a song request and had no idea that this contest was initiated because they had just played a certain song.

I did that too, except I called the wrong number and won Barbara Streisand tickets. Not my jam.

Just FYI, this does not and never applied to mobile phones or any kind of entirely digital (SIP, etc) phone system.

Modern "landlines" when used with DSL or fibre are also no longer "true" landlines, instead the modem/router acts as a SIP client and gives you an FXS port to plug an analog phone into. While it could theoretically emulate this behavior (by keeping the SIP session open for a few more seconds), I don't believe any of them do - in any case it's trivial to test by calling a different phone that you control, hanging up on your "landline" and seeing whether the other phone hangs up immediately (it should) or if the line is held open for some more time.

If this is still a thing (I frankly don't see the purpose of it), it would only apply to real landlines where your phone is directly connected to your phone socket without a modem/router in between.

That's not necessarily true. Most smartphones and SIP clients are designed to kill RTP immediately after sending a BYE, but session teardown doesn't _have_ to happen then. There are many scenarios where a BYE would not constitute destruction of the RTP session, and using a dumb analog phone over FXP could easily be one of them.

Even already knowing about this I'm still mystified that landlines work this way on every occasion that I'm reminded of it. Does anyone know if there is, or at least was, a justification for this mode of operation? Was it at least of any use to anyone back around the 1900s or whenever or is it just another "we do it because that's how we've been doing it" residue that hasn't been cleaned yet?

Back in the day, folks would have more than one phone in their house.

Someone would call and all the phones would ring (or you might turn off the ringers on some of them so only one main phone actually rings). So someone might pick up the phone in the entrance hall and the caller would ask to speak to Becky, and Becky’s mom would yell up the stairs ‘BECKY PHONE’ and then put the receiver back down while Becky runs into her big sister’s room to grab the upstairs phone, and carry the whole phone, trailing on its wire, into her bedroom, slamming the door on the wire for privacy, before she picks up the receiver to answer.

I saw this sort of thing in american sitcoms as a child, and I was always mildly triggered by it. Here in Australia the landline phone system disconnects as soon as either person hangs up.

On the shows they would sometimes hang up the phone, then somebody else picked up a receiver and the call continued?? Phones don't work like that! Go try it on your real phone, and you'll see!

It never occurred to me that US phones worked differently than Aussie phones.

The fact I was so bothered by this probably says an awful lot about what sort of person I was as a child. Its no accident I fell in love with computers.

Just going from memory - but I’m fairly sure that around 25 to 30 years ago, in Australia, it did work the way that is being described. That is, the person receiving the call could not disconnect the call by hanging up. The person making the call needed to hang up, otherwise the line stayed open. I messed around with this a few times because I was amazed it existed.

Editing to add that more detail, since I’m basically contradicting your memory of how it worked:

I’m fairly certain it didn’t work if you dialled out, so you may not have come across the circumstances to test it. Also, the other person would probably also need to be participating in testing it, because otherwise they will hang up as soon as you do.

I’ve just remembered another detail - I think there was something different about the tone you heard. If you received a call, and the other person hung up, you would hear the disconnected beeps. If you made a call, and the recipient hung up, I think you would hear the disconnection, but then just silenced.

By the way - I was also confused by seeing how phones seemed to work in the US - like pushing the hang up sensors (is there a name for these?) once to switch lines for call waiting. I never really connected their strange behaviour with how the phones in Aussie worked.

Actually, is this all related to party lines? I’m fairly sure Aussie had these. NZ did.

Was harassment by exploiting this ever a big problem? Seems like you could call someone and if they pick up, you now control their phone line... indefinitely?

> you now control their phone line... indefinitely?

Some other comments said there was a timeout after which the call was disconnected if the receiver hangs up.

> On the shows they would sometimes hang up the phone, then somebody else picked up a receiver and the call continued?? Phones don't work like that!

Well, a few decades ago (80s-90s), at least, landlines sure did work like that in Australia, if you were the one who received the call. I played around with that a lot as a kid. Maybe you just tried it on calls you initiated?

Real phones did work like that in +61 20-30 years ago :).

I lived through this era and at one point worked at a phone company and never knew about this behavior. I'd hold the receiver until I heard the other person pick up, then hang up.

> and then put the receiver back down while Becky runs into her big sister’s room to grab the upstairs phone

This is dumb though. Just don't put it down until becky picks up.

"BECKY, PICK UP! I'm missing my show!"

As opposed to my sib comment, I could see (theoretically, not saying this is what the original logic was) some justification to deal with intermittent line breaks or connection issues - if one side can keep the call open, then a wind gust breaking the connection for a couple milliseconds somewhere between the two parties won't cause the whole call to end. From a customer point of view, it's more resilient and ends up with fewer dropped calls.

I could also theorize about the different switching actions going on, where up until the other party picks up there's already only one phone on the line, but that's getting into phone system/phreaking stuff that is way out of my depth.

Could this be related to party lines? https://en.m.wikipedia.org/wiki/Party_line_(telephony)

This is similar to the other answer regarding answering a different phone in the same house, but perhaps more necessary if sharing a line with neighbours. Distinctive ringtones may have made this phone line non-disconnection behaviour unnecessary though.

I’ve never experienced a party line - but they sound ridiculous (and fun).

If you're up for an (at least to me) fascinating rabbit hole of technological history in audio form, you might enjoy this narrated audio tour of analog phone switches:

https://www.evan-doorbell.com/production/group1.htm

I can confirm that at least once this happened to my family in Italy about 20 years ago.

The most anecdotal statement ever, but a data point nonetheless.

It even makes the news [0] periodically. Watch the video, especially 2:22-2:36 which reiterates the PSTN behavior.

[0] https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...

Was this common in the US? I spent a bunch of time on the phone in the late 90s at several of my family members houses (I was a social kid) and any time someone hung up I'm pretty sure I'd hear the busy signal if I left the phone unhooked long enough.

What the actual f. I feel like the only commenter here who wasn't aware of this. Thankfully I don't use landlines, but still, that is beyond crazy to me.

Back when I was in high school and landlines were still a thing, we used to prank our friends this way sometimes.

So your neighbor hung up to proceed with a follow up call, which, if they're like most people, consists in just pressing the switch with a finger, while keeping the handset to their ear. But then upon releasing the switch, they just started dialing without waiting for the dial tone? And after they finished dialing and never heard the ringing tone, they didn't find that unusual? Forgive my skepticism, but something's missing from that story.

Edit: Just read up on the disconnect time (10 seconds for some providers) and yes, a sophisticated scammer could indeed emulate the various tonalities.

scammer plays a dial tone after the 'hang up' and while dialing.

Was this in the UK? I think they dropped the timeout to help mitigate this. KNow someone else it happened to

The neighbor hung up, but the scammers didn't, and the call was not disconnected? That's not my experience. Is this what you meant?

Yes, and this is how it works as another responder mentions.

The thinking by phone companies is essentially: guy calling pays for the call, so we can milk each call for a few extra cents each time even if they're shady or a wrong number.

Apparently it is a feature Called Subscriber Held (CSH).

https://security.stackexchange.com/a/100342/143105

TL;DR It was just how analog phone worked, users came to rely on it, digital exchanges reimplemented it (with a timeout)

Your neighbor just dialed the new number without hanging up first?

Unless both sides hang up, there's something like a 10-20 second window where the call is held open. Hanging up, picking up within 10 seconds and dialing, means you're still connected to the original caller. If they're clever, the might even detect the click of you hanging up, and play a dialtone for when you pick back up, and stop playing it when you start to dial.

Citation needed. I don't recall any land line phone I've used behaving in this way.

I could see this working if the other end played a click followed by and dial tone sound.

No dial tone and no ring… Seems a difficult mistake to make but then again, I regularly surprise myself with my errors.

There's nothing technical that prevents the other side from playing dial tone and ring sounds

I guess we need to teach people how to use a phone line??

Your neighbour dialed a new number without hanging up his ongoing call? Is this his first time operating a telephone? The scammers mustn't have believed their luck when they realised that was happening. Did they mimic a "brnnnnggg brnnnggg" sound when he dialed?

> Did they mimic a "brnnnnggg brnnnggg" sound when he dialed?

Yes: https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...

Looks like you would have fallen for it.

The connection isn't always torn down immediately. Different switches behave differently in this regard. I remember a long time ago being trolled by a friend of mine who refused to hang up. I wanted to call someone else, but every time I picked up the handset to dial out, he was still on the line laughing at me.

So if you're served by a switch that operates this way, the scammer just holds the line open, plays dialtone and ringback tones appropriately, and you're none the wiser.

Yes, this is what I do too. I say "Thank you for the information. For security reasons I won't discuss this matter on this incoming call but I will immediately contact your fraud department on the number I have." They've never been annoyed about this. In fact, mostly they've been positively surprised.

Another solution would be to find out who the scammers parents are and write them. Worked for me

https://blog.haschek.at/2016/how-a-scammer-stole-500-dollars...

I am a security guy by profession, the other day my wife singed up for a tesla and they ran her credit. next day we get a random call from wellsfargo regarding an auto application and wanted to verify her information. my wife confused why wellsfargo calling, did what I always ask her to do. tell the individual to provide her with the case number and she will call back and they do not need to provide her the call back number. This is easy to remember for most people and She did just that. It turned out tesla has multiple financier which tesla failed to mention that one is wellsfargo.

Yes, this is scam prevention 101. Anyone who called you is always unverified. It's hard for me to take seriously a "scam prevention expert" who doesn't seem to know or follow this rule, which by itself is enough to protect you from most scams. Normally I try not to victim blame people for getting scammed, but when you've made a declaration like that you forfeit that right.

I'll also point out that the author seems to have some complicated arrangement for their phone number(s), presumably in the name of security, that in fact got in the way of identifying this to be a scam.

Regarding the complex phone arrangement: There's an effect, the name escapes me, that adding security can make threats less frequent but more dangerous. Sounds like he was more complacent because he had trust in his phone system.

And I agree about author - if he had said that he violated an easy rule and owned that I would take his credentials more seriously. Everyone makes mistakes, but he didn't list this simple, well-known rule as a way of preventing this.

I can see a normal person falling for this, but in my opinion this person called themselves a scam expert is a scam in itself. The claim that this has only been praise since 2018 is absurd, even if true being four years behind on current practices is making you a no longer expert.

Agreed. No matter how tired and annoyed I was, I'd have stopped dead at the confirmation code that they asked for. There's absolutely no way I'd have given that to them, even if it meant cancelling my account and using a different bank.

That seems a bit extreme, but if their procedures are so crazy as to require circumventing another system's security procedures, I'm not going to bank with them.

I actually had a bank send me an email asking for information that came from another domain, had a header that looked liked it had been badly scanned in, and had links to domains they don't own. When I ignored it, I eventually got a notice that my car loan was in jeopardy because I hadn't provided that information.

They had no clue why I was so upset about that email.

I paid off my loan immediately and never looked back, even though the interest was less than I make off the stock market.

I think this is a statement easier to conclude in hindsight, especially as you are primed with "this story is describing a scam, definitely". The author describes the thought process and what ended up nudging them toward believing the scammer about the workflow. A code sent like this in a legitimate workflow could be plausible. Maybe it's a requirement to ensure that the customer is indeed acknowledging the operation and the CSR isn't taking actions behind the customer's back, for instance.

The author had a lot of signals pointing toward legitimacy to counteract their natural skepticism, it was a stressful situation and the nature of a phone call puts time pressure into the decision making, increasing the odds of a mistake.

Your example points out that false positives on the "scam or ham" decision do have a cost to the contact recipient too, so "never respond to anything" comes with risks and costs too. It's hard to be perfect.

> In order to do that, I needed to relay a confirmation code that would be texted to me.

Everything up to that point matches exactly what happened when I got a call from my own bank (Charles Schwab) regarding fraudulent charges. However, whenever Schwab sends me a code (or Bank of America, Coinbase, etc) the code comes with a message stating that an employee will never ask you for this code.

The fact that OP is an "expert" yet fell for this shows me that they are in fact not an expert here. Don't get me wrong, the execution by the scammer was slick, but I would expect an "expert" to be familiar with their own bank's policies:

"Wells Fargo will not call or text you requesting an access code. We may ask for an access code when you call Wells Fargo customer service. Always contact us using a trusted number on the back of your card or wellsfargo.com."

1) You don't hear about the stories where the scam is stopped.

2) As you have noticed yourself, legitimate banks do what they can to make their actual requests indistinguishable from scams, and "not falling for that" can have severe consequences.

Banks and health care providers have aggressively trained customers to be ok with giving sensitive info in a received call. It's a real disservice to the community, but kind of a tragedy of the commons.

I also do a callback (verifying the number they give me via a google search) but it seems like almost no one else does. On one of these calls from a bank, I asked the agent whether anyone else asked to do a callback, and they said no one ever did this.

> it seems like almost no one else does

Nope, I do basic stuff like this too. And it's basic stuff. As in, can be defeated by simple wiretaps in infrastructure outside your control.

Excellent, simple advice! I don’t believe anyone who calls me with a problem, ever!

Overdue bill? Okay cool thanks, I’ll call back and ask to speak to someone, hang up.

Compromised card? Okay cool thanks, I’ll call the number on the back of my visa, hang up.

(This one happened to me) Relative in another country is dying of cancer and needs money for some obscure procedure and doesn’t want to tell anyone else about it only me so don’t call anyone about it? Okay cool, I’ll check and get back to you.

I don’t care how important the matter is; your house could be on fire! If you are calling me and need any type of personal info whatsoever, I hang up and call you or someone I know related to you or just Google that thing!

Same with door to door salespeople. No thank you goodbye.

Hi, the government is giving $5000 credits for people to add insulation, blah blah blah. Can we do a free evaluation? No! I would have heard of this free money falling from the sky from someone I know.

No thank you, hang up, give zero info don’t even confirm my name, close the door or hang up. Goodbye, won’t phish me.

> Hi, the government is giving $5000 credits for people to add insulation, blah blah blah.

This is... occasionally a real thing. Drives me nuts that they choose to implement it this way though.

I just don't care. I don't want to risk getting scammed for a few bucks that I was not expecting. Give the $5000 to someone else, I'm fine.

I feel like the author made two mistakes that anyone who goes after scammers should know. First is to never trust the caller. Didn't matter what info they have. Second is never give your 2fa. Who cares if some third party product has some wonky scheme that requires it. Don't do it.

Agreed. It’s easy to play Monday morning quarterback, but the author of this article made some pretty big blunders for an expert.

That's good advice. I'm also wary of providing information over a customer service chat. A recent example that comes to mind was when I was price matching a product on Best Buy's website over a chat session. The rep confirmed the price match was valid and began to initiate it. And then he started asking for all of my personal details including, phone number, address, and credit card. When I politely refused, he thought I didn't want the price match anymore. I confirmed I still did, and he said he needed all of the info to place the order for me. I had assumed I would be sent a personalized link to order the product, or it would just be added to my cart (since I was signed in). But no, he needed personal info which would live in a chat log. I ended up ordering from the other retailer.

Anyways, maybe there was nothing wrong with providing those details. Maybe they were already available to him on his screen. But the act of asking for that info and making it commonplace for people to just provide it is how so many scams are successful. I don't know how we get away from bad security practices being the norm.

My doctor's office has a note in my file about this now.

Every time they call me, they just say, "Hi smeej, it's NAME at Dr. NAME's office. We have an update for you, so go ahead and hang up and call us back."

Works like a charm!

>call back the official service number

I thought that was fairly standard in banking/credit card fraud as well. That's how I was directed to proceed when I got a call from my CC company about fraud: "please call the service number on the back of your card regarding potentially fraudulent transactions"

I have the same rule for online chat support.

Last week, I cancelled my Netflix subscription and been trying to remove my credit card details from my account to prevent surprise reactivation in the future. There wasn't an option to do it online, so I went in their chat support and ask them to remove my CC information from my account. Then they asked me to provide my CC number to validate who I am. I told the rep that I am not comfortable sharing my CC information over the chat and prefers only give out my service code or alternative information. This rep kept ensuring that it is secured and they can't see what I am typing in. I asked them to initiate it and I will decide if it is trustworthy to put it down. I got the prompt and it asked for a full CC number. I declined the prompt and told them that I'm not comfortable doing that. And it didn't help that the rep are unintentionally behaving like a scammer. I shared my concerns about the rep behavior and remarks that scammers can say those things. The rep understand my concerns and asked for other information like the email address that is linked in the account and what are two recent activity on the device I uses. I gave out the information and validated I am the accountholder. Then the rep processed my request and I see my CC information is removed from my Netflix account.

Am I alone in just never answering my phone? Like, ever, for _any_ unknown number. Seems like that alone solves a certain class of problems.

That's what I do. If it's actually important I'll get physical mail or a knock on my door. If I didn't request the communication then the communication is not legit.

You literally can’t set up Xfinity internet service without accepting an inbound call and then clicking on a shortened link they text you.

I asked for a callback number instead. They hung up and made me go through the entire process again, culminating in a new inbound call a day later and a new sms.

I think I read about this rule here on HN and have been following it since a couple of years. The funny thing is, banks do scammer like things so often. I had a yearly subscription that tried to renew and they tried to charge me first for 0, and bank rejected it. 2 hours later I get a call from a weird number from my city (when my bank is in another city and all official numbers are from there) from apparently the fraud department of another bank that now handles fraud prevention from my bank. I refused to give them any info, told them I will call the bank back and just called the number on my card, which is the default support number for my bank and sorted everything out in 5 minutes.

"There's one easy rule that could have avoided all of this - never give out any info on incoming calls."

Also: Just call your official bank/card phone number yourself. This number should be on the back of your debit/credit card.

I don't know, I maintain that policy fairly strictly, but I can imagine falling for this.

I won't as a policy give out information to an incoming call, and I do call back if they want any info from me. But my working memory is not endless. The topic of discussion had changed three times before he was asked for any information, and the information still wasn't PII, it was a confirmation code. The scammer knew enough about him that he wasn't especially on alert. I can well imagine that flag in my mind that I was on an incoming call having been lost before we got to that point. And I suspect that's exactly how the scam was designed.

Or better yet, just don't answer incoming calls that you're not expecting

But I might miss out on a sweet extended warranty deal for my car.

I feel like all banks and other such institutions should give trainings / information at least once a year on how they will contact you in the case of e.g. fraud.

I think that any phone calls from a bank about fraud should only be a notification and them telling you to "go to the website, the Contact page, there you will find a number to call in case of fraud". Without naming a web address. And the search engines should mark bank websites and the like as protected, so neither competitors nor scammers can buy ad space when people search for a bank by name.

"never give out any info on incoming calls". 100% agree. It's such a simple rule that I don't understand why it's not part of everyone's DNA. Should be taught at home and in schools, same as "look both ways before crossing a street".

> There's one easy rule that could have avoided all of this - never give out any info on incoming calls.

When I don't recognize a number, I don't pick up. I tell them to email me/text me and that they provide when they called and with what number. Then I might call them back.

Asking extra effort from unknown people will do a few things:

- Scammers won't do it (not yet anyway)

- Spammers won't do it either

- Anyone lazy won't do it

I go one step further and tell them I don't talk to unauthenticated callers, ask them for a reference number and an published return phone number that I can authentic using the usual methods (website, advertising material), explain to them that unaurhticated / cold calls are unethical, and then end the call.

I find there being little risk to giving a yes/no for "is this charge fraudulent" although maybe that's a higher risk than I anticipate.

what information is actually being asked of people on incoming calls these days? I never seem to get any of these calls, but banks and credit cards etc. by now should be clued in enough to this stuff that when they actually call a customer, they do nothing more than alert that customer to proper channels they should initiate and follow to resolve the issue.

Entire generation of older Americans who will happily read out their credit card number over the telephone.

that was not the point. the point was, the actual banks should at least no longer be asking people for information on initiated phone calls. so that we can in fact tell people, "never give information to anyone that calls you", no need for awkward arguments with legitimate callers, because no legitimate caller would ever do that.

> In order to do that, I needed to relay a confirmation code that would be texted to me.

Yeah, BZZZT! End of conversation. Hang up.

Better rule: NEVER answer the phone.

surprised too, once i read it all started with a phone call from author's bank. your bank will "almost" never ask you for your info on the phone. if they do, you don't have to provide it. you can ask to go to a branch in-person, or log onto the website to provide the required information.

all banks should often remind their customers of this. mine does.

banks and phone carriers should do scam and fraud trainings for customers. or friendly reminders.

Reply on news.ycombinator.com