Hacker News Reader

Comment by bombolo | Hacker News Reader

There is no good way to authenticate legit vs scam many times. No amount of being clever will put in place a protocol that doesn't exist.

View on HN

There is one simple and proven way to authenticate phone scams. You tell them that you will call the company back on the number you already know or have from a bill, or you will pay via the website that you also already know. Until they start commandeering phone numbers or domains you're pretty safe. There is really no reason to answer your phone for numbers you don't know unless you're job hunting or waiting for an important call. I block all numbers not in my contact list. Sure, they can masquerade as a fake number, but even if my caller ID says it's the gas company I'm not going to answer it and if I do I am not giving them any information on that call.

I mean, you're still someone at risk here if someone mails you a nice looking electric bill a few days before with fake info on it, especially in the case the scammer has enough info on you to make it look realistic.

Uh nooo.... You don't call the number that's provided in the format of the outreach - be that a physical piece of mail or an email or an SMS message.

In every case where I've gotten a message / phone call informing me that I need to provide some sensitive information or make a transaction, I determine the organization that they are purportedly representing, navigate to the official website, find the relevant contact info, and call back.

I always assumed everybody did this to prevent these exact types of situations.

Exactly. I have zero concern for my own security when it comes to scams because I know how they work and I hear about all of the latest ones because I am curious about the advances in scamology. I am concerned about my family who are fooled by these things. I'm a cynic by nature so the alerts are firing on communications with uncertified connections. I can't get trusting people to understand that there are people who care primarily about taking advantage of that trust.

No matter how many times I've been late for payments in my life, not ONCE have I ever had a human being call me up and demand payment over the phone. It's always a long series of attempts to collect through the mail.

Let alone calling up and demanding I pay using Zelle...

In the case of utility companies you can always just pick up the phone and call their main customer service number to verify your account status and balance. Text messages and emails should always be treated with suspicion, but intercepting outgoing phone calls is outside the capability of regular scammers.

I've received multiple phone calls from my bank to discuss my mortgage

Every time they call me and ask to "go through verification" - aka I give a random stranger on the phone the personal information they need to identify themselves with my bank - so I tell them I'll call them back instead

Then i call back and get bounced around through multiple teams until inevitably the call drops, I think because my mortgage was bought from another bank so it isn't well understood by customer support

Anyway, I think it is legit calls I get from the bank. I hope it isn't important because i still haven't got through to them to talk about it

This is a frustrating reality, but, out of curiosity, did you ever try asking the name and/or department of the person calling you and using that to try to get back to them when calling back?

Every mortgage holder routinely buys loans from other lenders. If you received bad customer service then it probably wasn't due to that specific cause but rather general incompetence and cost cutting.

It has become increasingly difficult to discern legitimate calls in recent times. Lately, I have been receiving calls from my bank, seemingly related to client relations, originating from a variety of random local numbers. These could potentially be the personal mobile numbers of the bank agents, though I cannot be certain. I usually don't answer these calls as I don't recognize the numbers. The only way for me to verify their legitimacy is through the branch number mentioned at the end of the voicemail messages they leave. However, if I were to actually speak with the caller, it would be challenging for me to determine the call's authenticity.

What utility company is gonna request a payment through Zelle?

Or iTunes Giftcards!

How did the scammers even have the correct information?

They probably bought it from some data broker.

They sell our data to scammers to let them be entirely convincing, and then blame people who fall for it.

The data broker market is ~$250B, it's not all personal data, but the market for personal data to target these scams is huge. The worst part is many data brokers get their data from government sources like the state DMVs: https://www.privateinternetaccess.com/blog/dmvs-are-making-a...

Reply on news.ycombinator.com