Hacker News Reader

Comment by PM_me_your_math | Hacker News Reader

No, he fell for a scam because he was ignorant of how things work. That ignorance is exactly what scammers count on.

This is victim-blaming. Companies don't make clear "how things work". I've never once found a web page published by a business that makes clear exactly how they will contact you (e.g. by number xxx-xxx-xxxx for security alerts, from email address foo@company.com for bill payments with a link to company.com/billpay, etc.) so that you can follow that sheet to ensure you're not being defrauded, and that's what's needed.

Perhaps it's time for some regulation - of course, drafted with the extreme care that almost no regulation is written with, but should be...

Funnily I got some emails and phone calls from Amex some time ago that were extremely phishy (like aexp.com), but they happen to have a website listing the domains they use:

https://www.americanexpress.com/us/security-center/phishing-...

No such thing for the phone numbers though, and since they were just regular landlines not recognised by Google and not available through a Google search, I declined to provide them any information.

There absolutely needs to be regulation for that, like there is the "Mentions Legales" or "Imprint" in France and Germany (a website needs to have a page who they are actually, with an address and everyhing).

Oh, this is really interesting, I didn't know that Amex had a page like this! This is useful, maybe I can point my bank toward it and ask them to make a similar page.

As harvey9 says in a sibling comment, "If they publish an outbound number then scammers will spoof it.", so perhaps publishing a phone number isn't useful - but they should actually state that on their web site, as well as providing a protocol that allows the bank/agency/company/utility to authenticate itself to you.

> "Mentions Legales" or "Imprint" in France and Germany (a website needs to have a page who they are actually, with an address and everyhing).

I like this concept - let's extend it to include an authentication protocol, as above.

> As harvey9 says in a sibling comment, "If they publish an outbound number then scammers will spoof it.", so perhaps publishing a phone number isn't useful

Unless telecom operators are forced to take actions to prevent spoofing.

You and your OP both are right. Companies are totally at fault for muddying waters by using the same methods as scammers (or scammers are smart by using surprisingly similar tactics), and Customer too should be aware of situations.

Zelle, Western Union, Venmo, PayPal (family) literally gives you warnings, multiple prompts, to say that it is irreversible, pay it only to known people, dont use it for government payments, make sure to check registered name, and stuff.

We as customers should know that no utility company, gas, power, internet, government offices, their representatives accept or want payments by Zelle. Zelle is great for person to person, or one time cash-like transactions. If one handover wad of cash to a person claiming a utility representative, one would not expect to get that cash back if he was fraud.

Zelle is irreversible by design (unless receiver sends it back). Otherwise what would stop from people using it like credit card chargebacks?. The only time I have heard zelle txn getting reversed is if reciever asks & insists to his bank that this money is not for me, undo this txn. Although there is a variation of fake check scam reverse zelle too. Just liek check, scammers arrange a zelle incoming from victim 1 to victim 2. Then calls victim 2that it was mistake. Please zelle it back to "me". Victim 2 does zelle. Original txn gets recalled because either victim 1 found it or his bank found it. Victim 2 is out of his good money.

I like it when they say 'call the number printed on your bank card'. If they publish an outbound number then scammers will spoof it.

There is no good way to authenticate legit vs scam many times. No amount of being clever will put in place a protocol that doesn't exist.

There is one simple and proven way to authenticate phone scams. You tell them that you will call the company back on the number you already know or have from a bill, or you will pay via the website that you also already know. Until they start commandeering phone numbers or domains you're pretty safe. There is really no reason to answer your phone for numbers you don't know unless you're job hunting or waiting for an important call. I block all numbers not in my contact list. Sure, they can masquerade as a fake number, but even if my caller ID says it's the gas company I'm not going to answer it and if I do I am not giving them any information on that call.

I mean, you're still someone at risk here if someone mails you a nice looking electric bill a few days before with fake info on it, especially in the case the scammer has enough info on you to make it look realistic.

Uh nooo.... You don't call the number that's provided in the format of the outreach - be that a physical piece of mail or an email or an SMS message.

In every case where I've gotten a message / phone call informing me that I need to provide some sensitive information or make a transaction, I determine the organization that they are purportedly representing, navigate to the official website, find the relevant contact info, and call back.

I always assumed everybody did this to prevent these exact types of situations.

Exactly. I have zero concern for my own security when it comes to scams because I know how they work and I hear about all of the latest ones because I am curious about the advances in scamology. I am concerned about my family who are fooled by these things. I'm a cynic by nature so the alerts are firing on communications with uncertified connections. I can't get trusting people to understand that there are people who care primarily about taking advantage of that trust.

No matter how many times I've been late for payments in my life, not ONCE have I ever had a human being call me up and demand payment over the phone. It's always a long series of attempts to collect through the mail.

Let alone calling up and demanding I pay using Zelle...

In the case of utility companies you can always just pick up the phone and call their main customer service number to verify your account status and balance. Text messages and emails should always be treated with suspicion, but intercepting outgoing phone calls is outside the capability of regular scammers.

I've received multiple phone calls from my bank to discuss my mortgage

Every time they call me and ask to "go through verification" - aka I give a random stranger on the phone the personal information they need to identify themselves with my bank - so I tell them I'll call them back instead

Then i call back and get bounced around through multiple teams until inevitably the call drops, I think because my mortgage was bought from another bank so it isn't well understood by customer support

Anyway, I think it is legit calls I get from the bank. I hope it isn't important because i still haven't got through to them to talk about it

Every mortgage holder routinely buys loans from other lenders. If you received bad customer service then it probably wasn't due to that specific cause but rather general incompetence and cost cutting.

This is a frustrating reality, but, out of curiosity, did you ever try asking the name and/or department of the person calling you and using that to try to get back to them when calling back?

It has become increasingly difficult to discern legitimate calls in recent times. Lately, I have been receiving calls from my bank, seemingly related to client relations, originating from a variety of random local numbers. These could potentially be the personal mobile numbers of the bank agents, though I cannot be certain. I usually don't answer these calls as I don't recognize the numbers. The only way for me to verify their legitimacy is through the branch number mentioned at the end of the voicemail messages they leave. However, if I were to actually speak with the caller, it would be challenging for me to determine the call's authenticity.

What utility company is gonna request a payment through Zelle?

How did the scammers even have the correct information?

They probably bought it from some data broker.

They sell our data to scammers to let them be entirely convincing, and then blame people who fall for it.

The data broker market is ~$250B, it's not all personal data, but the market for personal data to target these scams is huge. The worst part is many data brokers get their data from government sources like the state DMVs: https://www.privateinternetaccess.com/blog/dmvs-are-making-a...

Or iTunes Giftcards!

Reply on news.ycombinator.com