Hacker News Reader

Comment by lessnonymous | Hacker News Reader

I challenge my bank all the time. The answer I get is "Certainly sir. The best way to validate is to find our free-call phone number in a place you trust - the phone book, or anywhere else you trust - then call it and type in the following number: X X X X X. That will route the call directly back to me".

View on HN

> "[...] call it and type in the following number: X X X X X. That will route the call directly back to me."

I wish every bank did this as standard practice! Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep.

Better yet, print instructions right on the back of the card: "don't engage any support representative you did not call directly." Training customers to do this (perhaps even through proactive callouts?) would work to significantly reduce this kind of fraud.

> Hang up, dial the customer care number on the back of the card, then dial the digits supplied by the support rep.

Except apparently to prevent this form of fraud you need to hang up, then call from your mobile, so that the "support rep" can't just stay on the line and do what the guys in this story did (fake a dial tone, make it seem like you've called the customer care number).

Hang up, dial your friend. If your "bank" answers, offer to sell them a ppppppowerbook.

Wow, that's so simple and clever. It seems so obvious but I wonder if I'd remember to do that if I was shaken up by my "bank" calling to tell me my account had been compromised. I'll write it down for future reference.

You're right, I misunderstood the behaviour of UK lines; however, it would still be workable in the US or Canada.

I think Canada's system does this, though it might only be a couple seconds. I recall being able to stay on the line ~10 seconds or more and still retain the call. If you have the person on the other side of the phone holding the card and looking at the phone number, being instructed to call it because of some urgent fraud, they're almost certainly going to hang up, and pick back up within a ~5 second window.

And if they don't, no harm, no foul (to the scammers)

Wouldn't have worked in this case of UK landlines.

Yeah, but in the article author's case, you can't even rely on being able to do that (at least with a landline), due to the severe landline security hole regarding ending of phone calls.

I thought this was common sense. I even have done that with the police: They called and started to ask question, I asked for their name, and called back on a well known number.

This though, is where this scam is cunning, they use the fact that people feel safe calling a well-known number. I'd like to think I'd have offered the bank to cut off my cc rather than send it, but who knows...

Reply on news.ycombinator.com