Bank scammers using genuine push notifications to trick their victims | Hacker News Reader

Bank scammers using genuine push notifications to trick their victims

shkspr.mobi

40 pointsedent11 comments

I like their solution, that should be implemented. The best strategy is still to hang up and call the phone number on the bank's website yourself.

That too could be played when people were still using landlines. It is obsolete with cell phones.

If a landline call was hung up at the receiving end but not at the calling end, it took about 30 seconds to time out and disconnect. Probably a feature that allows the callee to hang up and pick up again on a different extension phone.

So the scammer would call; you would rightly hang up and call the 1-800 number printed on your credit card. Only you were "calling" through the scammer's fake telco dialing sequence and... still be online with the scammer.

> So the scammer would call; you would rightly hang up and call the 1-800 number printed on your credit card. Only you were "calling" through the scammer's fake telco dialing sequence and... still be online with the scammer.

Wouldn't the scammer also have to play a dial tone on the line (and eventual ring) to keep the ruse going?

That's what they're referring to by fake telco dialing sequence.

Maybe it's because I'm from a country that is full of 2FA scams exactly like this (particularly for WhatsApp), so I could immediately tell it was a scam, but I didn't find this convincing at all. If the person actively reached out to you on your phone number, it doesn't make sense that they would require you to further authenticate yourself

Financial institutions in the US do this constantly. They call you, and then they ask you for stuff like the last four of your SSN and what loans you might have with them to prove that they're speaking to the right person. They act surprised when you don't want to answer because they called you.

I assume they do this to make sure the number hasn't changed/being answered by someone else?

Yes, the client could be a "sim swap" victim, and in that case you would be talking to an attacker. So the identity validation can be useful in that case.

The real problem with all this is the fact that banks underhire their customer support. There should be laws on wait times for essential services to be less than 5 minutes. The fact that you have to wait for hours at times to talk to your bank or the IRS is bogus.

[dupe]

More discussion: https://news.ycombinator.com/item?id=40242379

Suddenly pigeons don’t seem such a bad idea anymore huh?

Reply on news.ycombinator.com