Comment by bhauer | Hacker News Reader

Comment by bhauer | Hacker News Reader

Parent Full thread

Precisely. I've had the legitimate fraud-prevention department of my bank contact me but be unable/unwilling to authenticate themselves. I told them that until they were willing to authenticate, they would never receive any identifying information from me.

At some point I said that I would accept the account number as authentication and they were unwilling to provide that. I don't know why they--a legitimate fraud-prevention department--expected to be able to cold-call a customer and receive identifying information. They should be actively working to prevent customers from turning over this information to "just anyone who rings them at home."

I ended the call and contacted my bank via their online banking system and via that system they vouched for the original call and provided a number to call back. I lodged my complaint that their own fraud department was calling customers without any ability to self-authenticate. Not sure what happened from there; I've not had to deal with that process again since.

I challenge my bank all the time. The answer I get is "Certainly sir. The best way to validate is to find our free-call phone number in a place you trust - the phone book, or anywhere else you trust - then call it and type in the following number: X X X X X. That will route the call directly back to me".

> "[...] call it and type in the following number: X X X X X. That will route the call directly back to me."

I wish every bank did this as standard practice! Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep.

Better yet, print instructions right on the back of the card: "don't engage any support representative you did not call directly." Training customers to do this (perhaps even through proactive callouts?) would work to significantly reduce this kind of fraud.

> Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep.

Except apparently to prevent this form of fraud you need to hang up, then call from your mobile, so that the "support rep" can't just stay on the line and do what the guys in this story did (fake a dial tone, make it seem like you've called the customer care number).

You're right, I misunderstood the behaviour of UK lines; however, it would still be workable in the US or Canada.

I think Canada's system does this, though it might only be a couple seconds. I recall being able to stay on the line ~10 seconds or more and still retain the call. If you have the person on the other side of the phone holding the card and looking at the phone number, being instructed to call it because of some urgent fraud, they're almost certainly going to hang up, and pick back up within a ~5 second window.

And if they don't, no harm, no foul (to the scammers)

Hang up, dial your friend. If your "bank" answers, offer to sell them a ppppppowerbook.

Wow, that's so simple and clever. It seems so obvious but I wonder if I'd remember to do that if I was shaken up by my "bank" calling to tell me my account had been compromised. I'll write it down for future reference.

Wouldn't have worked in this case of UK landlines.

Yeah, but in the article author's case, you can't even rely on being able to do that (at least with a landline), due to the severe landline security hole regarding ending of phone calls.

I thought this was common sense. I even have done that with the police: They called and started to ask question, I asked for their name, and called back on a well known number.

This though, is where this scam is cunning, they use the fact that people feel safe calling a well-known number. I'd like to think I'd have offered the bank to cut off my cc rather than send it, but who knows...

Reply on news.ycombinator.com