Hacker News Reader

The incoming number was reported as

This will do you no good. They are using a hijacked PBX. There is no way possible they are going to make it that easy to find them.

Here's my story:

I kept getting calls from "credit card services" and every damn time I asked to be removed they would just hang up on me. So, after about the 20th time, I decided to play dumb. I strung them along for 10 minutes. Here's how I did that: the first person you talk with asks if you have more than $3000 in CC debt. The second person basically asks the same thing, but in a little more depth. The third guy is the smooth talker. He asks you to find your statement so he can verify information from it. I played dumb and said I needed to find it. He said "I'll wait" in a very patient voice. I kept him on the like for 10 minutes (while I worked). Then, I just hung up. He called back immediately and said we accidentally got disconnected. I told him "you wouldn't take me off your list, so fuck you."

His revenge was next. The phone rang and someone was yelling at me. He was redirecting all complaints to my phone number. I had to unplug my phone.

I called AT&T (who I had service with) and after about 30 minutes of run around, they said they couldn't do anything. I'd have to contact the fraud department, or some such. I did try, but it was a lot of paperwork and it looked very bureaucratic.

So, I decided to google for "credit card services" (not exactly that, but that's what I started with). I found a TX state lawsuit against a company with this name from the early 2000's. The lawyer that prosecuted them was listed and had a phone number. So, I called it. An elderly gentleman picked up the phone and I told him my story. His first words, "so, they're back at it?" He told me to be very careful, and basically tried to dissuade me from doing anything.

It amazed me that they seem to operate with impunity.

Phones need a "report spam" just like email.

Phone companies or device manufacturers should use those reports to trace bad actors.

Note that email doesn't have a "report spam" functionality designed into it (in the form of RFCs), though email providers often offer their own version to their users (most are far more opaque when it comes to reporting spam against their own systems). Reasons for this are diverse, but effectively, if you're a large email service provider, your users' satisfaction is a concern, spam is a large part of that, and the ability to leverage reports from many users to identify spam (and non-spam) sources is very useful.

Telephony was designed in a far more innocent age, and was largely protected against the abuse which ran rampant in email (and Usenet) on account of the costs associated with network access and in actually making calls. Now that this is rapidly approaching email costs (effectively nil at the margin once you've got the infrastructure set up), this is changing.

One consequence is that voice service is rapidly becoming useless due to abuse. I've rightgraded from a smartphone to a dumbphone for a number of reasons, but one feature I particularly miss from my Android device was the call screening app: deny access to unknown or blocked numbers, and allow priority access only to specifically whitelisted callers. Why should I allow myself to be interrupted by any one of the 7 billion people on this planet, or worse, programmed robots which call me without any regard for what I'm doing?

I'm hoping for features such as this to make it into dumb phones soon.

My other thought is that conventional telephony (both POTS and mobile) is going the way of the dodo -- VOIP over wireless broadband with only very occasional fallback to direct connections.

I wonder if it would actually be legal for a phone company to implement a spam filtering service the way an email company can. Phones services are a much more regulated industry than email is.

Offering tools to put the subscriber in much greater control over their device would (and IMO should) be offered.

My frustration is that at present, I cannot do what I want without, take your pick:

• Using a dumbphone with at best the ability to block (but not whitelist) specific numbers.

• Using a smartphone, with all of the additional privacy invasion concerns involved.

• Utilizing a service such as Google Voice, in which all of my phone traffic is routed through yet another NSA surveillance partner (willing or otherwise is left unspecified).

• Ditching conventional voice comms for an alternative (which I haven't yet even identified) that actually does offer the filtering tools I'd like. This would also have the effect of greatly limiting my general connectivity, though in the present universe this might not be all bad.

My suspicion is that a high-end and/or technical solution which does this will emerge. As either option is selective to generally more attractive and upscale markets, the conventional telephone network (wired and cell) will die: it will be comprised increasingly of down-market subscribers, less attractive to both telcos and others who might be interested in reaching them, and cut off from the NeuPhone network (if it weren't that would itself be a disadvantage of the NeuPhone, though some bridges might in fact persist).

It's a similar dynamic to how first AM, then FM radio have increasingly become wastelands as those with means switched first to cassette CD players, then iPhone adapters, as well as satellite and Internet radio. Or Facebook's overtaking of an established social networking market by offering a more attractive network (the in-crowd of Harvard, Ivies, Stanford, and selective colleges for the first few years of the network). Or of broadcast TV's increasing fall in light of both deferred-viewing options through DVRs and increasingly on-demand video content over the Internet -- why accept QVC when you can watch Netflix, Hulu, Vimeo, or even YouTube, bypassing schedules, advertising, and hours of crap?

"This will do you no good. They are using a hijacked PBX. There is no way possible they are going to make it that easy to find them."

Yup. But more likely the caller is using SIP. Which is easy to manipulate to one needs. Quickly too. PBX's, when hacked (and they are hacked regularly), are being used to sell calls. And most PBX's rely on service from carriers. Carriers usually set the CID info (they'll set it to what you want - but it takes time). But with SIP it's a different story. I could call you sitting in Russia and you'd think I was down the street.

And it gets worse too. Cause most carriers (ATT, Earthlink, Verizaon, Windstream, XO, etc, etc) got lazy and greedy and are now using SIP to host 800 service. And all the carriers are getting hacked DAILY.

So reporting the number is a waste of time. If the carrier traced it (and they won't) they'd probably trace it back to their own service.

So it's buyer beware really. I trust email more than phone calls.

PS: I didn't mean to imply these guys are from Russia. They could be (a lot of shit has it's roots in that country - since its mob rule basically), but PLENTY of Americans are scamming too.

It could well be that those 20 calls were from different companies using the same identity. Or it could be a company feeding the calls to different criminals. The FTC keeps going after the people behind these things, but they are woefully outmatched:

http://www.ftc.gov/news-events/press-releases/2012/11/ftc-le...

The FTC held an all day summit on robocalls in 2012, and ran a contest to find the best proposal to handle the problem. The problem is hard to solve, and the winning proposal does not seem to be spreading much:

http://www.ftc.gov/news-events/events-calendar/2012/10/roboc...

If you google around there are government agencies and websites set up for all types of spamming/scamming. I got some scam phone calls awhile back and reported them; it could be a coincidence, but I stopped getting them.

Here's a place to start: http://www.usa.gov/topics/consumer/scams-fraud/report-fraud....

So I'd say, report, report, report. Scammers and spammers go on for too long because people brush it off. The worst thing you can do to an email spammer is take the time to mark it as spam. The worst thing you can do to a scammer is to report it to the government - some justice department and/or federal and state representatives. Articles like this make it seem like nobody is doing anything, but with a bit of digging you'd find that consumer protection agencies and state and federal legislatures have been passing laws regularly to combat scamming/spamming/predatory loans.

Whenever someone calls me and asks me to confirm something - that is, reveal something - I always intentionally get it wrong the first time. If they carry on as if what I said was correct, I can be sure that it's a scam.

I like that idea. Whenever there is a form that asks for my social security number, and it's not some "under perjury" government statement, I always flip a bit somewhere in my number. With any luck, I have poisoned a lot of databases about me.

It used to be that phishing emails were easily sniffed out due to the poor grammar. It was always immediately clear that they were coming from non-native speakers and, hence, obviously not the product of the major bank, etc. they claimed to represent. And, I always thought, "Good grief, if these guys would only hire native English speakers to write their crap (or simply copy a legit e-mail) and take a couple of other similarly easy steps, they'd be in business in a big way".

It all pointed to the fact that there'd be a day when their increased sophistication, coupled with their boldness, would make it nearly impossible for the average person to sniff them out. And, beyond that, even seasoned tech folks would someday be vulnerable. That day is fast approaching.

The good guys are losing and we need a completely new model for dealing with this stuff. "Protecting" access to information has long been an untenable goal, and any new model must make it such that everyone's personal information could be completely public without that fact exposing them to any risk. It's nuts that we all walk around with just a few bits of info which, if gleaned by a bad guy, could completely destroy us. It's also nuts that we walk around with a couple of numbers that we are routinely encouraged to give out to a myriad of people/systems, but if they ever once fell into the wrong hands, could be a gold mine for a scammer.

We also need more international cooperation combined with super-stiff penalties, as there is currently no downside risk for these guys. The current model is esentially: Try. If it doesn't work or the fraudster is discovered, then try again.

My understanding is that the bad grammar lets them filler out the non gullible earlier in the funnel.

This. The potential few extra victims they might profit from by using impeccable language/appearance probably doesn't compare favourably to the cost of extra time/effort dragging along smarter people for a longer time, that are probably just going to bail later on with high certainty at a stage where appearance is no longer the key factor for believability.

Interesting. Makes sense, though many such emails only attempt to bait the recipient into following a link, whereby malware would be installed via drive-by, or otherwise the user would be prompted to enter sensitive info.

In these cases, it seems that crafting a more professional email to cast the net as wide as possible would be prudent.

The only protection you need is this one: if you did not initiate the conversation (email, phone call, IM, whatever) then it is safe to ignore.

Ooh, honeypot credit cards. If there is any law enforcement officer out there who would like to use me as a honeypot, get in touch. I get a half-dozen calls a week like this.

I used to have a debit card that never had more than about $300 on it that I used for final testing of ecommerce sites. I wish I still had it for giving out to scammers.

I'm wondering if it would stand up in court if one were to get a limited debit card, tell the police that you were keeping it purely for a honeypot card, and then hand over those valid, useable, but limited CC details to any would-be scammer while telling the police to start tracking transactions.

There are some interesting stories out on the internet (google for "419 eater" or "scam baiting".) Unlike this story they are often well documented (and in some cases, funny, like tricking the scammer into providing a c64 carved out of hardwood.)

Be sure to read their guidelines before trying anything similar as scambaiting can be dangerous.

> and in some cases, funny, like tricking the scammer into extorting some innocent person into providing a c64 carved out of hardwood.

Fixed, for what usually happens. If you think about it for a few moments, you'll come to the same conclusion: those "funny" pictures of supposed 419 scammers holding up silly signs with shoe-on-head and all that, no way the actual scammer criminals would let themselves be caught on camera like that.

This one time I read a story about someone catching a 419 scammer on a specific 24/7 street webcam in Amsterdam as the location to hand over cash (all the while the trickster resided in the US, pretending to be a middle aged lady with a dog, that just happened to be visiting relatives in NL that weekend). This was in the early 2000s or so. I always used to think, that at least this time, it was the actual criminals they made a fool of.

However, after reading this story, and about "Jennifer", maybe these guys were innocent victims as well. On the other hand, they did appear both quite big, muscular, leather jackets, not really the type you'd expect on the victim side of extortion. But I try to not make a habit judging people I don't know based on fuzzy 200X webcam photos ;-)

I've been getting phishing attempts to my cell phone in the past few months. They leave message that say, "to collect your $100 AT&T rebate, go to www.phishingwebsite.com", which looks like a standard phishing site.

They always come from different phone numbers and list different variants of the web site. It's odd because I've seen plenty of phishing emails, but this is the first time I've gotten them via phone.

I get the same thing. I knew it was not AT&T but I called anyway asked for a manger then another manager explained it to him and I haven't got one since. I'm sure AT&T can quickly figure out who is sending this stuff.

I also get voicemails from my "Google Specialist" letting me know that my "first page ranking" is ready. I can't get rid of this one.

Getting the same calls lately. Not sure what to do about it - my experience with AT&T shows I'll probably waste about 10x to 100x more time just trying to explain to them what I want that it takes me to hang up. But if somebody knows a way to make AT&T aware of it and do something (provided there's somebody in AT&T that cares and can do something) please share.