This is the solution.

Had this happen once, followed those steps, and the CSR was very interested in getting the details of the call. They put a freeze on that account for a bit as well. Nothing was taken.

True for any company asking for anything sensitive.

I've gotten scams from my internet provider asking me if I want to upgrade my plan with a new discount. Caller ID was spoofed and it sounded pretty legit, until they started asking me about my current plan tier and price. I was like "uh, you tell me. You're the one with access to my account info." After they hemmed and hawed about that, I just hung up.

Honestly, you should be suspicious of ANY incoming calls at this point. There are convincing scams that spoof the voices of people you actually know using trained AI. It's actually pretty easy to do now, since you only need a few seconds of audio to use as a training sample. Anyone who's ever posted a video with their voice on social media can potentially have their voice spoofed. I've warned my family about this, since most of us have our voice out there somewhere.

Phone calls are dumb. SMS is dumb. Phone numbers are dumb. Phone line security is basically non-existent. It's wild that phone numbers have become the de facto ID on the internet; almost everything requires SMS auth to register now. PHONE NUMBERS ARE NOT PERSONAL IDS.

They should already have your name too if they're calling you

Any department really, but that's just me.

Told a family member the same when she almost got tricked by a scammer & called me to see if it was legit. They wouldn't try it if it wasn't convincing enough to catch people in the scam to make it worth their time to do this crime instead of some other.

He said someone in the bank's supply chain was compromised, as they knew a lot of details that should have been known only to the bank. Also that the only information he gave away were the last digits of a card number.

I didn’t know that either but I’d also never divulge that info on an inbound phone call.

Adding multiple factors to authentication just adds another step to the scam, it doesn't make it impossible by any means.

Another thing is that I feel like the era of the private phone number has passed. I see the use case for phone numbers for businesses, but people just don't use them very much anymore otherwise.

Like, we don't memorize them. We don't dial them. They're just entries in our contacts.

At this point, we could create an alternative way of contacting private phones. Something based on whitelisting instead of blacklisting. Something that can be easily shared but not easily guessed. Something that would be easy to trace who called you.

All of these phone scams rely on the idea that a stranger can just up and contact you without any effort. It's ridiculous. If we got rid of that, we'd save people from untold billions of dollars of scams almost instantly.

He gave them his CC number over the phone. How would Sweden's BankID protect against that?

I think this is true in most of the EU banks.

Edit: speaking from US banking, I think it’s probably different in other countries with updated banking practices.

Recruitment scams tend to involve the hirer sending you a large check to cover office setup purchases from the hirer’s “trusted vendor” and you keep the excess as your first paycheck. Unfortunately, the check is fake and the vendor is just the hirer behind a fake website. But the check “clears” in a couple of days, so you think you have the money, and you spend that money in the fake website, then your bank lets you know the check was fake and takes all the money back.

I’m sure there are other scenarios but they all involve a fake payment that eventually gets taken back. Glad you weren’t taken in.

I get those about once a week. "Your package cannot be delivered" Come on over here you spammy bastards, i'll deliver a package of my goddamn BOOT up the side of your arse! That's what I say. It helps me feel better, because why not feel better?

Anything that requires any personal info from me needs to come in the form of a physical letter. I do not give out anyone over the phone. Emails are not legally binding.

It's a credit card, they don't typically have pins like debit cards do. They do have a 3 digit CVC code on the back, but 3 digits is pretty easy to get just by brute force guessing.