Hacker News Reader

Comment by noveltyaccount | Hacker News Reader

Related. I listed something for sale on Craigslist recently and got a bunch of messages right away that asked obvious questions that were in the listing. One suggested that his wife pick it up, and can I take Zelle? Went silent when I said cash only.

But the most interesting scammer said: "for my safety, can I send you a 6-digit number, and you confirm it, so I know the listing is not fake?" I say yes, unsure what the scam was going to be, but sure it was a scam. Moments later I got an SMS from Google Voice asking me to verify my phone number. Mofo tried to steal my number, presumably to use it to scam other people. I was pissed and impressed.

View on HN

They were not trying to steal your number. They were using your number to back a new google voice account, so that they could get another free number from google. It’s a common scam, used on facebook marketplace sellers as well, and actually works best if the victim has never used google voice before.

>> Mofo tried to steal my number, presumably to use it to scam other people.

> They were not trying to steal your number. They were using your number to back a new google voice account

I interpreted "steal my number" as "sign up using my number".

Perhaps the more accurate wording would be "impersonate me".

Either way, thanks for clarifying.

That's a fair clarification, I figured they were trying to move my number to Google voice, but now that you mention it I think that would require more paperwork.

I did cross-post to Facebook Marketplace :)

I don't understand why the 2FA texts don't clearly state what the intent of the code is?

Something on the lines of "you or someone tried to create a new Google voice number. Please enter this code xyz on the form to proceed".

Do you really need a message like that? If you didn’t try to sign in But you get a notification, it’s pretty freaking clear what’s going on. Alternatively if you just signed up a new account you should probably expect a message like that

A common attack is to impersonate a trusted institution and ask for confirmation via an SMS code. The attacker is going through the lost your password recovery flow for 2FA, but pretends it's just for confirmation of identity. If they're smart they can even perform the attack twice and change the 2FA number for your account. If the code was accompanied by an explanation of the intent it would mitigate the attack, that's why.

Clear to whom? Have you ever worked with the average user?

It doesn’t matter how many notifications you give the average user if that’s your argument

Around here all banks that used SMS for 2FA did that. You'd get sms detailing the transaction - whether it's log in, transfer or anything. In case it is a transfer, the text included the amount and destination account.

Everyone mostly went to "authentication apps" now but those still show what are you confirming.

Not sure why it is not a common practice.

Yes, this is called WYSIWYS (what you see is what you sign) and I suffer whenever I receive a confirmation code saying absolutely nothing. However, when _you_ write the code to some trusted web app, there is that context, at least. But reading the code to some random person on the phone? No way!

It's probably a fine line between "brief and readable" and "detailed but people cut to the chase and get burned".

I got a similar scam via instagram DMs recently. They claimed to need me to confirm a code so that they could log in, but actually just triggered my own password reset. Message sent from an actual friend's account (which they had presumably successfully scammed) too.

Certainly made me think about how password reset emails are worded!

Most of those are crypto scams. The IG account starts posting about how they got rich on crypto. This is a very prevalent scam.

I see a lot of these too. They take over regular people's accounts, e.g. people from school I still follow, probably brute forcing passwords, then they post all this content how they are self made off crypto but the person in the videos doing the prostelyzation is in no way shape or form the same person who previously held the account.

Clearly they do this to get a decent follower count initially for their spam bots, but my word is anyone who follows John Doe actually going to believe a scam video that is clearly not John Doe coming from John Doe's account claiming to be him? There has to be more effective angles.

I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts.

It might be instead that your friends re-used a password that was leaked/stolen from somewhere else; anyone with a non-trivial number of online accounts using the same email will be listed in multiple leaks on aggregators like https://haveibeenpwned.com/.

Part of it is they're just looking for the lowest hanging suckers that won't notice, easier victims mean less wasted effort on someone who might bite initially but won't convert into real cash. Also I'm betting it's to legitimize their existing spam accounts with follows from (formerly) authentic users.

A few years ago one of my friends pulled a prank on another friend and made a fake craigslist listing for some truck with his info. I don't think his phone has recovered from the spam to this date. There must be a thousand crawlers combing every single craigslist ad there is looking for information to add to these databases.

So, how many fake 6-digit codes did you give them before they caught on?

My exact reply was "lol fuck you"

500,000 on average

"How about you send a 13-digit number instead"?

How about you just send a freaking RSA key

I've got both those scams. The Zelle person sent me a fake email claiming to be from my bank and that to verify I needed to send them money so they could send me money, right...

2FA scams are common on /r/Scams

Hmm. Makes me wonder about the security of two factor authentication schemes. For scams like these it's pretty obvious that someone is trying to access your account, but I do wonder if there are more secure ways to verify your identity when changing account settings.

It will depend on the authentication strategy. For WebAuthn it isn't a problem, short of sending you their physical authenticator (e.g. their Yubikey, or their iPhone) they can't help you sign in as them even if they wanted to, so this makes it very hard to fool ordinary users into helping crooks.

my wife had the same thing happen. when she said no, the sender cussed her out a bunch. after TFA I can see why he may have been desperate and venting.

well, at least they ended the charade quickly by behaving that way rather than continuing the charade in an attempt to convince.

This just happened to me, yesterday, for the very first time! Watch out!

Reply on news.ycombinator.com