FBI rings warnings over VoIP phishing cons

attack vector

Next attack vector: phony bank statements and forged telephone books.

Phone Number Validation

We're doomed, doomed I tell you. Given the general level of idiocy of the population (*any* population), no matter what warnings you sound or safeguards you set up, the idiots *will* fall for vishing calls, just as today they fall for phishing emails.

Trying to stop this inevitable stupidity is akin to King Canute telling the tide to turn back. (At least Canute knew he had no such power.)

Perhaps the law should be changed so chickens come home to roost: if you reveal your banking information to a third party, the resultant losses are strictly your business. Let the banks off the hook. There'll be a great weeping and wailing and gnashing of the teeth by the bleeding hearts, but good Lord! if your bank sends you a printed warning "DO NOT DO THIS" and you ignore it, surely you have to take some personal responsibility, no?

In fact, we might even encourage the 419 scammers: the more folks they take for a ride, the sooner word will get around that responding to such nonsense is Not A Good Idea.

I want to bear Paris's babies, but will settle for "Outlook not so good" as, indeed, the outlook is not good today.

@RW

almost good. The second (missing part) is to make ID fraud a crime. As it is now, there is nothing victim (at least the one in UK) can do put the thief where he belongs. So, if sheep are about to regret their stupidity, there must be some option for them to do next. Like call the authorities and provide all the help needed to catch the criminal. And, possibly in the future, try to recover money in civil case.

Word Ban

I hereby request that the word "vishing" be stricken from the record and never written again. It is a silly word.

Authentication is a two-way street

Steve Dommett said: My personal experience of trying to get my bank to tell me something a 3rd party wouldn't know before I divulged the password they sought involved the bank's operative becoming very uncooperative: "I'll just put a note you've refused to speak to us." "You misunderstand me. I'm quite happy to talk to you once you have proven you really are calling from my bank." "<click>"

You've hit the nail on the head! I could not agree with you more. I've had exactly the same response (almost verging on hostile) when seeking to verify the authenticity of UNSOLICITED business call that is being made to me.

One of the worst offenders used to be BT. They would call me up of an evening (uninvited, I might add) and then they'd promptly dive into a bunch of questions about my ID with barely a "Hello" to start the conversation. This would be bad enough were it not for the fact that their called ID would come up as "Number Withheld" (not even as "Number Unavailable"). I'd then get into a big barney with them about the fact that if BT themselves can't even be bothered to assign themselves a caller ID number, then I'm not going to take the risk of divulging any personal information (especially I had not asked them to contact me). Anyone can 141 their number and then start asking a bunch of questions for "verification purposes". Presumably BT could assign any number they wish, so they could even display numbers like "150" etc.

I found that BT would not even answer the most innocuous of questions - (e.g. the amount of pence stated on the balance of my last bill.)

BT have since fixed their caller ID (although they display 0800 numbers rather than special operator style numbers like 150 etc.) but on principle I will not engage with any business that calls me (unprompted) unless they are prepared to verify who they are. I just explain my reasons to them and then I hang up. If the call would be of any benefit to me then I'll just call them back on their main switchboard number (although in most cases, these unsolicited calls are just about bugging you into signing up for some new costly services).

My bank was entirely happy when...

... I asked them to prove who they were when they called me unexpectedly, on a couple of occasions. They said phone back on the usual number, they'll do the usual security game, you then ask to talk to department (whatever) and off we go, no problem.

So it can be done right (this bank has UK only call centres, which might or might not be relevant).

Two-way authentication...

...is useless in the face of people so hopelessly ignorant about security, they do not even know how to recognize the padlock icon indicating a secure connection in a Web browser.

Two-way authentication is only valuable to folks already cognizant enough about security that phishing and vishing attacks are unlikely to succeed against them anyway.