Hacker News Reader

Comment by taf2 | Hacker News Reader

This is why I'm terrible to my bank over the phone... I always ask them to prove to me they are from the bank and when they can't - i hang up. It's kind of annoying except I work above my bank so it's pretty easy to walk downstairs. Maybe someday the bank will implement a kind of certificate to help me identify i'm really talking to the bank...

View on HN

Precisely. I've had the legitimate fraud-prevention department of my bank contact me but be unable/unwilling to authenticate themselves. I told them that until they were willing to authenticate, they would never receive any identifying information from me.

At some point I said that I would accept the account number as authentication and they were unwilling to provide that. I don't know why they--a legitimate fraud-prevention department--expected to be able to cold-call a customer and receive identifying information. They should be actively working to prevent customers from turning over this information to "just anyone who rings them at home."

I ended the call and contacted my bank via their online banking system and via that system they vouched for the original call and provided a number to call back. I lodged my complaint that their own fraud department was calling customers without any ability to self-authenticate. Not sure what happened from there; I've not had to deal with that process again since.

I challenge my bank all the time. The answer I get is "Certainly sir. The best way to validate is to find our free-call phone number in a place you trust - the phone book, or anywhere else you trust - then call it and type in the following number: X X X X X. That will route the call directly back to me".

> "[...] call it and type in the following number: X X X X X. That will route the call directly back to me."

I wish every bank did this as standard practice! Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep.

Better yet, print instructions right on the back of the card: "don't engage any support representative you did not call directly." Training customers to do this (perhaps even through proactive callouts?) would work to significantly reduce this kind of fraud.

> Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep.

Except apparently to prevent this form of fraud you need to hang up, then call from your mobile, so that the "support rep" can't just stay on the line and do what the guys in this story did (fake a dial tone, make it seem like you've called the customer care number).

You're right, I misunderstood the behaviour of UK lines; however, it would still be workable in the US or Canada.

I think Canada's system does this, though it might only be a couple seconds. I recall being able to stay on the line ~10 seconds or more and still retain the call. If you have the person on the other side of the phone holding the card and looking at the phone number, being instructed to call it because of some urgent fraud, they're almost certainly going to hang up, and pick back up within a ~5 second window.

And if they don't, no harm, no foul (to the scammers)

Hang up, dial your friend. If your "bank" answers, offer to sell them a ppppppowerbook.

Wow, that's so simple and clever. It seems so obvious but I wonder if I'd remember to do that if I was shaken up by my "bank" calling to tell me my account had been compromised. I'll write it down for future reference.

Wouldn't have worked in this case of UK landlines.

Yeah, but in the article author's case, you can't even rely on being able to do that (at least with a landline), due to the severe landline security hole regarding ending of phone calls.

I thought this was common sense. I even have done that with the police: They called and started to ask question, I asked for their name, and called back on a well known number.

This though, is where this scam is cunning, they use the fact that people feel safe calling a well-known number. I'd like to think I'd have offered the bank to cut off my cc rather than send it, but who knows...

My bank never calls me. They send a secure message over the banks online system or leave a recorded message on my phone. They don't give a number to call back, so that I have to look up the real one. Not that those measures would have saved me in this scenario.

Some banks I've worked with have configuration so that when they contact you by email, you can set a code word(s) that they will include in the communication. So if the communication doesn't start with "Your Majesty Dark Lord", you know it's fake :) Similar system may work with the phone too.

I rang my bank last week, I rang them, and they asked me for my pin number. What, there is not way I am giving you my pin number. It is not used for identification.

This was the Visa at the RBS bank in Scotland, not sure what they are doing over there.

Are you sure it's the actual card PIN they asked for? There may be a separate, different PIN used for phone banking.

Reply on news.ycombinator.com