Hacker News Reader

Comment by vunderba | Hacker News Reader

I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com, etc.) and look up the phone number there.

A little less convenient for a LOT more security.

View on HN

For some reason I can't seem to find my local Google branch's phone number on their website...

This was so much funnier than I wish it was… ugh. Contacting Google. Good luck.

Wonder why I've never had that problem.

Are you saying you can find Google’s phone number?

Yes.

You’re probably worth a lot of money rn. I would start an entire business just selling people Google’s number. Heck, I would start an entire Google support company rn, publish a phone number and proxy calls to Google. I’d screen calls then also sell Google my services. You’re welcome. Build this in 2 months. I want 30% ownership.

Duh.

EDIT: also thank you, but and 0.0% is fine.

I make them hundreds of thousands a year even with their commission from my app sales. Still don't have a contact there (same with Apple).

They're happy collecting their commissions and avoiding you. The only good thing is that (for the most part) the payment method is just a password/faceid/touchid away.

It’s not (248) 434-5508 ?

I have the fun of making outbound calls to offer people a public service and collect payment if people desire it. Most people gladly hand over their credit card details. A few years ago, someone wisely asked why they should trust me. (It only happened once in a decade!) I said they don't have to. They could look up our phone number at an easily verifiable government website, then call back; they could call any facility operated by the department; or they could visit any facility. Said individual provided their credit card details right then and there. Virtually noone cares about security.

I don’t trust anyone calling me who isn’t already in my contacts.

Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.

Now try and convince your family to do the same (especially parents who are prime targets).

The trouble is, you have to place the outbound call to those contacts to trust them. People could spoof an incoming call from numbers in your contacts and it will look as legitimate to you as a receiver as if the real number was calling you. With voice spoofing, it's now possible to call someone as [grandchild] with [grandchild]'s voice with a pretty horrible story about what's going to happen if some Bitcoin or Google Play gift cards are not purchased and handed over immediately.

I'll give you an example. When the Bank calls me about something important, I tell them to give me their department / extension and I'll call them back. I then look up the bank's phone number on their website (it's actually in my phone already, and on my bank cards) and call them back.

This process doesn't care about them calling from a spoofed number. We've had big problems with spoofed number scams and the CRA (Canadian version of the IRS) recently.

So in other words, you don't trust any incoming calls, even if they appear to be from a number saved in your contacts?

No. If it's someone I know, and I can tell that's who they are from their voice, and they aren't suddenly trying to pry a bunch of financial information from me, then I trust them. I also don't even accept calls from unknown numbers by default, unless I explicitly turn that off temporarily because I'm expecting a call from someone not in my contacts. There are plenty of other ways to get ahold of me.

AI speech still has some noticeable quirks (I cloned my voice earlier this year to produce some tutorials). Once those are ironed out, I may increase my paranoia a bit. It's going to be hard for an AI faking a relative to get my bank password, if that even happens. There are far more lucrative targets with that level of investment.

I think just being on guard and not trusting potential anonymous sources is "good enough" for now.

> Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.

Not to justify their behaviour, but: most businesses are not set up to allow for callbacks or they're set up to actively discourage them. For example: they may be contracting out to call centers or employee performance may depend upon making a sale. My situation is unique since all calls our handled internally and my performance is not based upon making a sale.

That's said, the current situation pretty much dictates that a secure option should be offered to clients.

I suspect far more people question the moon landing than the authenticity of caller!

I've not once had a legitimate company not say "good for you in taking the extra security precaution of calling us back".

No kidding!? I have never had someone take this in stride. Responses have ranged from surprise to defensive condescension. It rarely even works at all, and the two worst offenders were both banks. One UK, one USA. I almost had the check for my rent bounce after three days of this rigmarole and ended up having to just go with it.

Where do you bank? I'm looking for recommendations.

Even better, once I had a financial institution tell me I needed to read them a one time code someone would text me. They were actually surprised I had a problem with it when it’s the scam playbook.

Isn't that just 2fa? It's not limited to web.

In a way, but this was also on an incoming call, and the text came from yet another number, there were a lot of red flags despite being legitimate.

To be fair I give just about anyone and their dog my CC number. Chargebacks work and my life is that little bit easier for it.

Playing Jason Bourne with your credit card number is not worth the effort if you ask me.

I would even say this is a net positive for the economy: the cost of fraud is outweighed by the lower barrier to payment. I'm sure you'd have made fewer sales had people been more worried about security. Net positive then, right?

Depending on which country you're in and which bank you're with, chargebacks are nothing like as straightforward as they used to be. I just completed yet another one, which involved 2 separate phone calls totalling over an hour (so probably not worth it on a $/hour basis), accepting the risk that if Visa rejects the claim I'm liable for a further $50 charge (this is new), and generally 3 months of hassle until I got most of the money back (less the international transaction fee, as the merchant had fraudulently claimed to be in the same country as me, but charged me from the UK).

For the record what kind of chargeback are you initiating, and why does it have to go through visa rather than the bank who issued you the card? Unauthorized card-not-present transaction initiated by a third party? Some cbs are harder than others to get ruled in your favor, but the one where a criminal takes your card and uses it without your knowledge is by far the easiest one to get awarded. It involves one call to your bank and you get a new card, all fraudulent charges reversed.

If your bank doesn’t want to honor the request yes you’ll have to contact the payment network (visa/mastercard) and I’m sure there’s someone in this thread who has experienced that for an unauthorized transaction chargeback but it’s exceedingly rare.

Merchant error chargebacks , on the other hand… very different situation.

The US makes chargebacks exceptionally easy. Non-Americans have a much less useful credit card system, which is why debit cards are more common in most of Europe.

Merchant fraud this time. Done through the (soon-to-be-ex) bank but they brought up the charge from Visa.

It’s possible that my current bank is particularly bad at this, as they are bad at everything else. I have had the runaround with merchant error and stolen card number chargebacks with other banks though.

In the rare case something worms it's way to collections I just ask for the certified letter. Now in ten years that only happened once. I even called the hospital asking where my bill was and they said I didn't owe anything. Three months later collections!

The great thing about credit cards (as opposed to obvious scams for suckers like cryptocurrency) is that consumers don't have to care about security. They can dispute fraudulent charges and never be out any money.

“I have the fun of making outbound calls to offer people a public service and collect payment if people desire it.”

Oh so you’re a telemarketer.

Nope. I only sell services that people previously requested, though it is often months earlier. (As I suggested, it's a government job.) Sales is just one of the things tacked onto my job description over the years.

And to further crush that cynicism: most people are overjoyed when I call them.

Oh so you’re a telemarketer.

Not everyone who makes outbound calls is a telemarketer.

The healthcare company I work for has a whole department of very nice people who make outbound calls to offer free health and nutrition classes to poor people.

Yes, they're free. As an employee I am also required to take one of the classes each year, so I know what they entail. Yes, they cost our company money. No, they're not sponsored by some corporation or ad company, and no we don't sell people's information on (HIPAA and all that).

The real world isn't a tech bubble cage fight.

There are a lot of contact numbers for e.g. banks and often it’s not obvious how to re-contact the department you are talking to. So, I’m happy to take a number, but I have to be able to find it on the conpany site somewhere (will also accept generic e.g. “call the bank fraud line and supply this reference number”)

I simply don't answer my phone for anyone not already in my contacts, unless I'm expecting a call from a contractor or local service.

I assume if I have a problem with any of my accounts, I'll eventually find out and self serve to go and fix it, as much as possible.

But this is google, who don’t have a phone number to call them.

Just to add on, never say "yes" when you get a call from an unknown number (or maybe from all numbers, just be careful).

"This is he(or she)", or "who are you trying to contact" handle most situations.

Just don't let scammers get you saying something in the affirmative.

What happens if you say "yes"?

They have you acknowledging something at that point. Doesn't really matter what it is when they can take it out of context.

Edit: Many of them are scammers, they don't play by the rules.

How does that help them? It's not gonna pass any legal scrutiny. If they were going to lie, it doesn't matter whether you said yes or not at any point in the call.

> It's not gonna pass any legal scrutiny

Probably going to cost a lot to get to that point, probably more than they will scam you for. They're after the quick hit that gets them something right away while also believing that you won't take it that far.

It's like knowing how to pick a lock vs just throwing a rock through the window that's next to the door to gain access. They both get you there.

Scenario 1: You don't say yes and they lie you acknowledged something. You sue or you don't.

Scenario 2: You say yes and they lie what you acknowledged. You sue or you don't.

The math on your end doesn't change, no matter what you said.

I usually ask for the phone number, find it on the corporate site, then call the branch office.

Alternatively, ask for their license number, check the license, then call the number it lists. (Kills two birds with one stone for licensed professionals.)

Yes, why would you accept the phone number given to you by this stranger calling you as legit?

You don't, but large organizations can have a lot of entry points (or none... but that's a different topic), so you let the caller pick the inbound number that will actually reach them or their department, but then you still independently verify that the number belongs to the organization before trusting it.

Reply on news.ycombinator.com