Hacker News Reader

Comment by grishka | Hacker News Reader

You receive a call on your phone. The caller says they're from your bank. You hang up and call back to the bank yourself. End of story. If the caller objects to you doing that, that by itself is an enormous red flag. You never, EVER take incoming calls from "your bank" seriously.

I myself have an additional rule that I always reject calls from unknown numbers, unless I expect one (delivery, taxi, etc).

View on HN

The other day I got a call from my bank, thought it was probably a scam. I hung up and tried calling back but it was a labyrinth of menu options, I gave up. Turned out that the first call was legit and I spent another day playing phone tag to get back to him.

There needs to be a better way to verify.

Some years ago I had one of these calls and the guy told me to turn over my card and call the phone number printed on it, then as for a specific extension number. I got back through to him in moments. This isn't that hard. However the caller didn't do this until I asked him to prove he was calling from the bank.

The banks (and utilities etc) are training the Boomers that they will call and claim to be from the bank.

I got an security awareness email from my bank yesterday saying they will never SMS or email with links to login or payment, as these are often spoofed by scammers. Directly next to this paragraph was a link to the login for the bank.

I. have. no. words.

You should screenshot that and just edit out any even vaguely personal info that might be there -- sounds amazing to see posted somewhere.

I got a letter from the county treasurer that their payment details have changed, and to send new property tax payments to a different PO box, in the major city 3h away. It mentioned a website with domain like foohost.net.

It was legit.

Something like HTTPS but for phone calls could be great, so when you recieve a call, your phone could show that this is actually from whoever is claiming it's from.

I have no idea about phone systems so this mighy be out of touch

This won't work since Caller ID is too easy to spoof.

https://en.wikipedia.org/wiki/STIR/SHAKEN

> The Federal Communications Commission requires use of the protocols by June 30, 2021

Well, then, looks like the problem was solved nearly three years ago!

It probably needs to be transmitted in parallel, out of band, rather than trying to integrate it into the existing phone system. That's how Google's Verified Calls thing they were touting a few years ago worked to give you context about a call by having the company placing the call relay data through Google and to an Android device's phone app with additional info like the reason for the call.

This is what STIR/SHAKEN is supposed to do. Your phone and carrier in the US probably support it, but it’s not obvious. On iPhones there will be a little check mark under the number for inbound calls on your recent call list. This doesn’t carry over to things like voicemail however - where the check isn’t shown.

This model also doesn’t work for businesses that route all outgoing calls through one number, as that is essentially caller ID spoofing.

I'm neither from the US, nor an iOS user, I don't think I ever saw a checkmark when recieving a call.

The Google dialer does ask me whether unknown callers were businesses and try to ID businesses that enough people report

We use 2FA where we can see rotating numbers which we use to validate our login. That means on the server side they have the ability to get the number at any point of time which will match the number on my phone - if that is correct, then why can't the caller quote the number and if it is matches, it is the bank since only they have the ability to get the number. Of course if your phone is compromised then its game over anyway. And there is the added challenge of technically non-savvy people being able to do all this.

But how does that stop this sort of man in the middle attack, the other scamer on the other call just asks the real bank for the number?

Good point - I think one approach that may work is for banks to have the calling feature within the app - only they can initiate such calls. It bypasses all the issues with regular call spoofing etc but excludes customers who do not use the app (for them, just hang-up and call back, which has its own issues).

My bank's app has a built in messaging system, but they seem to hate using it themselves. When they want to contact me they always call, or they send me paper letters. If I contact them through the app, they don't reply there but call me about it. It's bizarre.

can you make an appointment with them at the branch office?

Reminds me of nana going to the bank (Seinfeld)

https://youtu.be/63zSYqmLuhE?si=w5zSiEog-jxw7VIe&t=47

US banks generally give you a "reference number" you can read back when you call them back, and they'll forward your call to the right person.

I received a call from Capital One recently. Dude was trying to tell me that I had charges made in Georgia, have I been to been to Georgia recently, they think it's fraud. The phone connection was terrible, his Indian accent was THICK, I could hear other people in the call center. I've dealt with CO fraud department before- they didn't sound at all like this. I asked him for the last four of the card number used because I have multiple cards with them. He gives me the first six numbers. I tell him that only tells me that it is a Visa/MC/Amex/Discover and what bank. Stop trying to scam me. He got upset and hung up. I called CO directly and they had no idea what I was talking about. Just another scammer.

You receive a call on your phone. You never answer your phone except for friends and family. It goes to voicemail. If you ever need to talk to the bank you call the number that you have in your contacts list.

And if the bank ever needs to call me, they a) call and get unanswered, b) leave a note in my bank account's message system which c) sends me an email telling me I have an unread note and to log in to read it.

The few times this has happened, the note is simply 'call the bank's 0800 number and quote your account number', their robo menu will then automatically forward me to whoever is trying to reach me as soon as I hit the 'speak your account number' menu point (and if for some reason that fails, it then goes to a human operator who will then forward me to whoever was trying to reach me.

I've never even had a whiff of them being annoyed by this chain of events the 3 or 4 times it's triggered (always due to steam triggering fraud protection)

We agree about official calls, I also call back (independantly sourcing an official number) and advise my father ( ~90 ) to do the same.

> I myself have an additional rule that I always reject calls from unknown numbers

I'm highly skeptical of unknown numbers and they're almost always telemarketers or scam calls but ... my circle includes people who can lose phones, have batteries go flat, ask others to pass on a message, etc - fully whitelisting isn't always an option.

independantly sourcing an official number

Be careful about this. Scammers have bought Google adverts to advertise fake phone numbers for banks, so "ask Google what my bank's phone number is" unfortunately isn't secure against scammers.

I mean, yes, you need to independently source the official number; just make sure that your father knows how to do that and doesn't try to do it in a way which may be compromised.

Cheers.

He has actual paper phone books, several address books, and spent some time as a naval signals officer ..

We're both of generations that have always been skeptical of infomation on computers ... I can't imagine life as someone who'd ask google what my banks number is.

Good good. Just wanted to check since it's a mistake a lot of people have made!

It's not just ads or banks, here's a talk from someone who used fake Google Maps listings to intercept phone calls between law enforcement:

Wiretapping the Secret Service Can Be Easy and Fun | Bryan Seely | TEDxKirkland

https://www.youtube.com/watch?v=5c6AADI7Pb4

> I'm highly skeptical of unknown numbers and they're almost always telemarketers or scam calls bu

This is generally true, but...

In Switzerland calls from banks (and doctors and lawyers) don't submit numbers. That's due to secrecy laws (at least in the case of banks)

That said, in 45 years I never received a call from a bank.

This.

You can avoid 99% of all phone scams by never giving personal information out on an unsolicited call. Regardless of what the caller’s phone number appears as.

A legit caller won’t care if you call back yourself.

I have the rule to not provide my phone number and email address to certain institutions (e.g., banks, the government, insurances). If there's a phone call or email, I know for sure that it's not from them. They mostly don't need to or shouldn't contact me anyways. And if they really need to, they can send a letter.

> I have the rule to not provide my phone number and email address to certain institutions (e.g., banks, the government, insurances).

Where do you live that this is possible? I'm genuinely curious. In most places a phone number is required to open a bank account or use most/any government services.

I occasionally get calls from my bank. They are always from the security department saying there was some charge to my card. Was it me or not? I don't have much problem with those.

Same thing works for email/text alerts that tell you to open a link. I go to the service my self and see if the message is there.

Never answer the phone period. If it's important, they'll leave a message.

I only answers calls from immediate family. If I get called by a friend I'm immediately suspicious of foul play. Except during big events. My friends only use calls to shout at each other that they are lost in a crowd.

This may not be sufficient; some phone systems delay the disconnect, keeping you connected to the scammer on your outgoing call.

Older POTS maybe - and I’m old enough to have experienced that back in the 1980s, but I’m pretty sure that that’s no longer the case today - triply so with mobiles.

Yeah, it would have to be a "real" POTS all the way too. These days you're likely using VoIP under the covers anyway.

That's odd, I've never heard of this. On landlines I used, when the other side hangs up, you hear the busy tone, with no other choice than to hang up too.

It was discussed in https://news.ycombinator.com/item?id=6124056

Okay, so different countries had their phone systems work differently. In Russia, even back when we had electromechanical telephone exchanges, it's always been such that hanging up would instantly disconnect your line from the call, no matter the direction of the call. I just assumed it worked this way all over the world.

Reply on news.ycombinator.com