I Got Scammed
pluralistic.net
pluralistic.net
Some things I'm surprised weren't in the article, given that the author describes extensive background in security:
1. Suspiciously well timed fraud attempts happen when you are vulnerable, because the attacker is tipped off. Travelling and visiting unfamiliar locations raises a lot of smoke, information wise. Relying on secrets doesn't work, because information is leaked in an uncountable number of ways. You should no longer be thinking "did my card number, phone number, PID, or other secret get stolen?" It should instead be "given that my info was stolen, did anything bad happen and who do I need to securely talk to?"
2. Always blow off incoming calls, you can always get a callback or fix later, and check email, text, or other comms to see if something important is going on. Saying anything is information. As little as a few seconds of your voice being recorded can be used to generate a usable AI voice clone, and at worse it only takes a few minutes. The act of answering a phone call is information, confirming that your phone number is active and belongs to you.
Ironically, the reliance on a local CU also seems to be a miss. IME, big evil banks are more reliable in this area. They get scammed way more often, and as a result are much more resistant to these attacks via pure attrition.
Never respond to anyone calling you if you do not know them personally.
Likely the expert was manipulated by the caller, lulled by the caller pushing all the right buttons, until they said or did something they shouldn't.
Like all the rest of us.
The analogy is more like, "Why would a car mechanic put a part in his car that he didn't choose himself?" or "Why would a doctor take pills some rando on the street gave him?" Most people would look at that car mechanic or doctor and think, "How good a mechanic or doctor are you?"
Yes, the expert was "manipulated", but only in the sense that when his "CU" called him, he didn't heed the initial advice experts give everyone -- hang up and call the number of the CU directly.
That said, I'm not piling on him. His article provides a great lesson about how easy it is to ignore one's own advice and knowledge and what the consequences can be. In this case, he /knew/ the right thing to do, but he also knew so much about how the systems worked that he ignored the base knowledge because he thought he "knew" what was happening. In a way, he manipulated himself.
I would call myself an expert in scams / cons with online activity, however I myself was recently scammed during the holiday season. Physically rather than digitally though with one of those fake gold cons employing a variety of different tactics. They caught me off guard in a variety of ways by being parked off a rural Country highway early in the morning (6 am). I pulled over to see if they needed any help and the guy instantly approached my car where I was even more flustered. Point is, scams all seem ridiculous after the fact, but these people are not fools when it comes to social engineering, applying pressure, and taking advantage of the holes in the swiss cheese.
Many variables would've had me on high alert in my situation, but even being the "expert" I am, I fell victim. It's always easy to look back after the fact, or even after you have a few seconds to breathe. They play on immediacy / urgency often, and intentionally try to paralyze you in a sense.
He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.
Discussion here: https://news.ycombinator.com/item?id=39261875