Hacker News Reader

Comment by pants2 | Hacker News Reader

The other day I got a call from my bank, thought it was probably a scam. I hung up and tried calling back but it was a labyrinth of menu options, I gave up. Turned out that the first call was legit and I spent another day playing phone tag to get back to him.

There needs to be a better way to verify.

View on HN

My bank's app has a built in messaging system, but they seem to hate using it themselves. When they want to contact me they always call, or they send me paper letters. If I contact them through the app, they don't reply there but call me about it. It's bizarre.

can you make an appointment with them at the branch office?

Reminds me of nana going to the bank (Seinfeld)

https://youtu.be/63zSYqmLuhE?si=w5zSiEog-jxw7VIe&t=47

Something like HTTPS but for phone calls could be great, so when you recieve a call, your phone could show that this is actually from whoever is claiming it's from.

I have no idea about phone systems so this mighy be out of touch

This won't work since Caller ID is too easy to spoof.

https://en.wikipedia.org/wiki/STIR/SHAKEN

> The Federal Communications Commission requires use of the protocols by June 30, 2021

Well, then, looks like the problem was solved nearly three years ago!

It probably needs to be transmitted in parallel, out of band, rather than trying to integrate it into the existing phone system. That's how Google's Verified Calls thing they were touting a few years ago worked to give you context about a call by having the company placing the call relay data through Google and to an Android device's phone app with additional info like the reason for the call.

This is what STIR/SHAKEN is supposed to do. Your phone and carrier in the US probably support it, but it’s not obvious. On iPhones there will be a little check mark under the number for inbound calls on your recent call list. This doesn’t carry over to things like voicemail however - where the check isn’t shown.

This model also doesn’t work for businesses that route all outgoing calls through one number, as that is essentially caller ID spoofing.

I'm neither from the US, nor an iOS user, I don't think I ever saw a checkmark when recieving a call.

The Google dialer does ask me whether unknown callers were businesses and try to ID businesses that enough people report

Some years ago I had one of these calls and the guy told me to turn over my card and call the phone number printed on it, then as for a specific extension number. I got back through to him in moments. This isn't that hard. However the caller didn't do this until I asked him to prove he was calling from the bank.

The banks (and utilities etc) are training the Boomers that they will call and claim to be from the bank.

I got an security awareness email from my bank yesterday saying they will never SMS or email with links to login or payment, as these are often spoofed by scammers. Directly next to this paragraph was a link to the login for the bank.

I. have. no. words.

You should screenshot that and just edit out any even vaguely personal info that might be there -- sounds amazing to see posted somewhere.

I got a letter from the county treasurer that their payment details have changed, and to send new property tax payments to a different PO box, in the major city 3h away. It mentioned a website with domain like foohost.net.

It was legit.

We use 2FA where we can see rotating numbers which we use to validate our login. That means on the server side they have the ability to get the number at any point of time which will match the number on my phone - if that is correct, then why can't the caller quote the number and if it is matches, it is the bank since only they have the ability to get the number. Of course if your phone is compromised then its game over anyway. And there is the added challenge of technically non-savvy people being able to do all this.

But how does that stop this sort of man in the middle attack, the other scamer on the other call just asks the real bank for the number?

Good point - I think one approach that may work is for banks to have the calling feature within the app - only they can initiate such calls. It bypasses all the issues with regular call spoofing etc but excludes customers who do not use the app (for them, just hang-up and call back, which has its own issues).

US banks generally give you a "reference number" you can read back when you call them back, and they'll forward your call to the right person.

I received a call from Capital One recently. Dude was trying to tell me that I had charges made in Georgia, have I been to been to Georgia recently, they think it's fraud. The phone connection was terrible, his Indian accent was THICK, I could hear other people in the call center. I've dealt with CO fraud department before- they didn't sound at all like this. I asked him for the last four of the card number used because I have multiple cards with them. He gives me the first six numbers. I tell him that only tells me that it is a Visa/MC/Amex/Discover and what bank. Stop trying to scam me. He got upset and hung up. I called CO directly and they had no idea what I was talking about. Just another scammer.

Reply on news.ycombinator.com