Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Voice Phishing Hits PayPal

Posted by CowboyNeal on Sat Jul 08, 2006 11:26 AM
from the eight-six-seven-five-three-zero-nine dept.
Security IT
Chai Vanilla writes "The latest social engineering phishing attack is now using phones instead of fake web sites. Identity thieves have spammed fake PayPal account compromise warnings to lure users into dialing a phone number and giving up credit card information. Unlike normal phishing e-mails, there is no URL or response address. Instead, the e-mail urges the recipient to call a phone number and verify account details."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Voice Phishing Hits PayPal 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Tracability? (Score:5, Insightful)

    by celardore (844933) <celardore@gmail.com> on Saturday July 08 2006, @11:30AM (#15683482) Homepage
    Isn't this more traceable than just clicking on some IP in Russia? If I got an email asking me to phone any company, I'd be first looking for a landline. If it was a scam why couldn't I just call the phone company, give them the number and then they'd be able to trace it to an address or person?

    • Not in the VoIP era (Score:4, Interesting)

      by Andy Dodd (701) <atd7&cornell,edu> on Saturday July 08 2006, @11:37AM (#15683510) Homepage
      There are now plenty of companies (such as StanaPhone) that provide a free DID, all you need to do is register with them. Their business model is that they make money on outgoing calls, but most of them don't require payment until you actually decide to make such a call.
      • The numbers these companies provide will cause calls to be sent via VoIP to a computer or analog telephone adapter anywhere in the world. In this case, the number could be in California but you might in the end be connecting to a machine running Asterisk in Russia.

    • Re:Tracability? (Score:5, Informative)

      by this great guy (922511) on Saturday July 08 2006, @11:46AM (#15683551)

      Haha ! Welcome to the world of Phreaking [wikipedia.org]... You might not know it but the telephone network is as easily hackable, vulnerable and exploitable as the Internet is today. Good luck tracing the bad guy who impersonated your credit card company you supposedly called on 1-800-XXX-YYYY, when he might have penetrated voicemail systems, set up temporary forwarding, hacked telephone switches, etc...

      • Re:Tracability? (Score:5, Informative)

        by Keruo (771880) on Saturday July 08 2006, @12:05PM (#15683636)
        err.. 1980s called? Analogic phone networks are history in most places today. In order to hack the digital circuit switched phone networks used today, you'd need little more than a whistle and a tape recorder. Digital networks use physically separated medium for call control and signalling, and you won't get access to that medium without crowbar and selected location to crack at. And those locations are usually monitored 24/7.
        • Well the thing is :) usually Id theft phreaking in this day and age rely on simple 'human error' like misconfigured voicemails etc, to enable 'harder to trace' routing. but with the technology that's available, it takes about 10 minutes from the time a number is identified as a 'phishing' scam to the time it takes to completely secure any assets stolen.

          I know there have been articles about peer based communities who harvest all these scam mails by posing as idiots on the internet, and allow authorities to q

        • Re:Tracability? (Score:4, Informative)

          by FireFury03 (653718) <slashdot@@@nexusuk...org> on Saturday July 08 2006, @12:29PM (#15683722) Homepage
          Digital networks use physically separated medium for call control and signalling, and you won't get access to that medium without crowbar and selected location to crack at. And those locations are usually monitored 24/7.

          The SS7 network is certainly not built with security in mind - once you've gained access to a system connected to the SS7 net you've got a pretty free reign. Pretty much any large VoIP gateway will have an SS7 connection on one side and an internet connection on the other so crack one of them and you're sorted. Not to mention all the SIGTRAN enabled equipment that some moron has decided to plug into an unfirewalled internet connection.

          That said, I suspect the worst you'd be able to do is spoof a few calls, send a few SMS messages and add a few records to the billing systems.

          Besides, there are much easier ways of getting an anonymous DDI - just use one of the many PSTN-%gt;SIP gateways.
    • cause they could get sued for invasion of privacy by the scammer.

      So in the end it's a win win for the scammer :P
    • Sure it's tracable, right back to the voice mail they hacked because it had a default password, which rerouted it to some numbered account in some country where the officials are all too hapy to allow a few transactions slip past.

      fortunately, the time of trace to the time of shutting down those accounts is limited only by the proactive reporting of such fraud by end users. so usually, it should only take a few minutes to shut down the assets of such an account. a scammer would need ungogly luck to keep an
      • correction, sorry, you need luck far greater than luck herself can provide, with various community oriented projects to harvest, examine, and report fraudulent e-mail spam to the 'correct' authorities using peer to peer software :)

        It's awesome technology, and it's the reason why phishing and identity theft accounts are frozen and almost 99% of all stolen funds are recovered.

      • One guy up here was convicted for "hacking" into the local police squad's voicemail system.

        Everyone's password was (and I'm not making this up, and its NOT a Spaceballs reference) "1" "2" "3" "4" "5"

        For months he listened into all sorts of messages for the detectives, including from informants, wives and girlfriends (nice to be able to blackmail a cop by threatening to tell his wife about his action on the side), etc.

        You KNOW most systems have an easy password (or still have the default password).

        C

    • If it was a scam why couldn't I just call the phone company, give them the number and then they'd be able to trace it to an address or person?

      You think the phone company would just tell you who a line belonged to if you called them up?
      Nope. Even if the other party is calling you and harrassing you repeatedly you would have to file a police report and get the information sopenaed. The telco doesn't want to be named in any lawsuit if someone goes vigilante after getting the info.

      You can use reverse di

      • Re:Tracability? (Score:4, Insightful)

        by vux984 (928602) on Saturday July 08 2006, @01:15PM (#15683918)
        You think the phone company would just tell you who a line belonged to if you called them up?

        You've got to admit it *seems* reasonable. After all they handed over the information on every call made in the country to the government without even blinking. Why not tell a customer about one little number? ;)
      • Internet crime gets a lot of press, but receives little attention from crime prevention teams? Interesting. Do you have anything to support that claim?

        • Internet crime gets a lot of press, but receives little attention from crime prevention teams? Interesting. Do you have anything to support that claim?

          How many 419 and other scams do you get in the mail EVERY DAY? I get more con mails every month than ALL the scam artists who have ever been jailed over phishing since the birth of the Internet.

          • You're confusing number with proportion.

            • You're confusing number with proportion. How many people EVER go to jail for phishing? Try reporting it to your local cop shop - you'll get the "we don't handle that here" bit. Then you're told to post your complaint to such-and-such a web site ... and nothing happens, because they're after the easy-to-bust ones - they guys running boiler-rooms going "You've just won a vacation, just send us the money for the taxes and duties."

              They HAVE the tools to deal with that, so that's what they do. They DON'T hav

      • I hate clicking on the "Make a Donation" button of some sites, and then seeing the PayPal login appear within a frame of the original site. That prevents me from making a donation

        Just shift-click or ctrl-click the link and it'll appear in a new window or tab. Failing that in FireFox you can right click -> this frame -> view frame info to see the URL. But yes, it's pretty dumb putting this stuff in a frame so you can't see the URL. Also if the framed page was encrypted with SSL, you wouldn't see the

  • Wouldnt having a phone to trace be more effective in catching them then a 'blind' and easily hidden behind webpage??

  • Got that yesterday... (Score:5, Interesting)

    by canavan (14778) on Saturday July 08 2006, @11:37AM (#15683511)
    I've gotten that phishing mail yesterday, and called the number (1-805-214-4801) immediately. The system's recordings were chopped and barely intellegible, and I was prompted to enter "my 16 digit credit card number" (which was indeed verified to at least follow the basic rules of correctess or be rejected), and its expiry date, but nothing like a name or even the paypal account data.

    Where can one complain about such fraudulent 1-8xx numbers to get them shut down? Additionally, how much does calling a 1-805 cost in the US, and is any part of the cost passed to the operator?

    • Re:Got that yesterday... (Score:4, Informative)

      by Anonymous Coward on Saturday July 08 2006, @11:46AM (#15683553)
      805 is Bakersfield, California, USA. You're charged whatever your long distance carrier feels like. If you go to the FBI website, you'll find that there's a link to file an Internet crime complaint. The link is here: http://www.ic3.gov/ [ic3.gov]
    • I don't believe that 805 is a toll-free number. IIRC, inbound WATTS lines are 800, 888, 877, and 866.

      From 411.com reverse lookup:

      (805) 214-4801 is a land line based in Newbury Park, CA
      The registered service provider is Pacific Bell**.
      Detailed listing information is not available.

      **Due to number portability, some numbers have been transferred to a new service provider
    • Lets be honest here, you were scammed but why? What was it in the e-mail that immidialtly send you to the telephone ready to hand over your credit card number. Why did you not check the paypal site for any confirmation or even just to check the number in question.

      Did you check the email headers, were they faked?

      You now know that you been had and that it was stupid, you are, judging from your ID, a fairly recent slashdot user but the mere fact that you are here probably means you have heard about phishing

      • He didn't say he was scammed, just that he called the number to see what was going on because he was curious. At least, that's how I read it.

        Besides, paranoia is not required, 24/7 or otherwise. It's very simple ... if someone or something contacts you asking for private information ... DON'T GIVE IT. PERIOD! Legitimate organizations just simply don't DO things like this, so any contact you receive that claims to be from such an organization is almost certainly fraudulent. I've had banks and credit cards

      • Lets be honest here, you were scammed but why? What was it in the e-mail that immidialtly send you to the telephone ready to hand over your credit card number.

        No, I wasn't scammed. Which part of my posting misled you into believing that I could possibly have entered my real credit card number?

        You now know that you been had and that it was stupid, you are, judging from your ID, a fairly recent slashdot user but the mere fact that you are here probably means you have heard about phishing scams before especial

    • "The number you have dialed has been disconnected, or is no longer in service." It's gone. Skype seems to be saying Pooh Bear after the call ends though.

  • not surprising (Score:5, Interesting)

    by v1 (525388) on Saturday July 08 2006, @11:40AM (#15683522) Homepage Journal

    There's a small degree of higher risk, but if you get a new disposable cell phone every three days and move around all day you'd be a hard mark to hit.

    Too many people are now aware of the "don't click the link" aspect of phishing, but I'm sure there are still pleanty of suckers that assume if they have your phone number you must be legit. I would not be surprised if they find a way to do this through US Mail in a way that hides their identity.

    It would be interesting if one day, to get such an online account set up, they make you pass a short test, where they give you ten examples of people asking for your account information in various ways, and you have to answer "give them the information" or "report the incident to phishing.ebay.com". Anyone that answers "give them the information" on any of the questions doesn't get an account.

    I wager that alone would eliminate 80% of successful phishes.
    • I live in Iowa. In the state of Iowa, to get a driver's license, you must pass driver's education.

      I would dearly love to have a high-school level course in computer usage, which would be required for anyone to connect to the Internet. Not going to happen, I know...

      Maybe just make it a part of the general education requirements?

      Most people think I'm a snobbish bastard, like every other Linux user. Which is true, to some extent. But I do believe we have a right to call people stupid when they do things li
      • But I do believe we have a right to call people stupid when they do things like fall for a PayPal scam, buy from spam, send important (highly confidential!) information over email, refuse to apply patches (or not know how), and so on, and so on.

        Did you know that 85% of dead televisions just have a blown fuse? Did you know the $120 transmission fluid replacement at Jiffy Lube is a twelve dollar bottle of green grease, and the opening and closing of one valve? Did you know that almost everything a plumber ever actually does is run a drain snake and a plunger?

        I mean, we have Sex education, we have Driver's education, I don't think it's unreasonable that we know the computer equivalent of wearing a condom, stopping at red lights, buckling your seatbelt...

        Here's the difference: one costs people their lives, the other costs them an hour at the local computer shop. I don't think it's unreasonable that we know how to maintain appliances; nonetheless, nobody requires it, because that's batshit retarded.

        Most people think I'm a snobbish bastard, like every other Linux user.

        It's got nothing to do with your being a Linux user. It's because you're condescending and because you can't fathom that some people don't have the time or the desire to learn to maintain their computers. Believe it or not, some people have better things to do with their lives.

        Next time you pull into a jiffy lube, call a repair person, go to a barber shop, buy art tools, purchase clothes or engage in any service activity whatsoever, please remember that that's something you could learn to do and then spend your life doing, just like a seventy year old woman could spend a year reading tech sites and manuals and getting up to speed on jargon.

        Guess what? You don't want to either. You're just too dense to tell the difference.
    • It's not to hard to avoid this. Don't give them any information, hang up, got to the dern intarnet or your phone book and look up their customer service number and call that number back. If they say, "we don't know what you are talking about" then it is a scam. I recently spent 20 minutes on a phone call from a recruiter who was looking to fill a contract position for a major bank. That means they want background and credit checks. He wanted a SS number. I recognized his firm's name and I told him send
    • "I wager that alone would eliminate 80% of successful phishes."


      And, not so incidentally, 80% of PayPal's customers.
    • It would be interesting if one day, to get such an online account set up, they make you pass a short test, where they give you ten examples of people asking for your account information in various ways, and you have to answer "give them the information" or "report the incident to phishing.ebay.com". Anyone that answers "give them the information" on any of the questions doesn't get an account.

      Why should ebay care? They don't bear the cost of phising, you do.
  • I haven't heard of any sting operations for hitting the phishers... Considering the anonymous and random nature of the phishing scams and ease with which you can attract a phishing email, you could send an email from a newly created email account back to the phisher without them realizing this wasn't one of the addresses they phished, and could arrange for a carefully monitored and traceable transaction to take place, to track down the phisher. ("follow the money" principle) Why don't we see more of this

  • Paypal -- reachable by phone? Ha. (Score:4, Informative)

    by Buran (150348) on Saturday July 08 2006, @11:49AM (#15683565)
    What I find funny about this is that it's spoofs supposedly sent by a company notoriously hard to contact by phone. Anyone who has ever tried to contact Paypal about anything would know this. (Of course, the average user doesn't, which is probably what they count on).
  • Paypal is just one of many. Do you really need the hassle if they're being targeted?

    Perhaps losing customers might encourage companies to start signing official emails.

     
    • Perhaps losing customers might encourage companies to start signing official emails.

      AFAIK PayPal say they will never send you an email, so I'm not sure how signing the non-existant emails is going to help. Do you really think the average victim of a phishing scam is going to check the signature?
    • Would it make a difference, really? I don't think Paypal sends any official emails anymore, and I don't think the average user knows how to check signatures. I agree, companies should sign official emails, but unless you've got a suggestion of someone who does, I don't see the harm in sticking with PayPal.

  • "Latest" attack? (Score:5, Informative)

    by Beryllium Sphere(tm) (193358) on Saturday July 08 2006, @11:51AM (#15683576) Homepage Journal
    This goes back to decades before the Internet.

    [ring, ring]Hello? Hello, is this $TRUSTINGSENIORCITIZEN? I have wonderful news! Congratulations, you have just won a diamond ring in our marketing lottery! There are some shipping and insurance fees, so if you'll just give me your credit card number...".

    Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself, which is really the same advice as "don't click on the link" if you think about it.
    • Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself

      Unfortunately many companies assume that people will ignore this advice anyway - I have been phoned before now by my cellphone provider who ask me to authenticate myself by giving them my passphrase and date of birth when I pick up the call. Of course I refuse since there's no way for me to authenticate them first - and that leaves them a bit stumped.
      • I've had my (now ex)-bank's anti-fraud system automatically call me. "This is an automated telephone call from Lloyds TSB for Mr xxxxxx. To confirm you are the card holder, please enter in your 16 digit card number." Needless to say, I hung up and called the number printed on the back of my card. I asked the person what it was about and then asked if they would have entered their number onto an automated system that randomly called them - nope(!)
  • Hw long before eBay (who own paypal) strt a rumur that Google Checkout is behind this?

  • Woah, timely! (Score:4, Interesting)

    by Kid Zero (4866) on Saturday July 08 2006, @12:59PM (#15683852) Homepage Journal
    Just got mine in the email this morning.

    (530) 204-6800 is a land line based in Davis, CA
    The registered service provider is 01 Communications**.
    Detailed listing information is not available.

  • I got one yesterday... (Score:3, Informative)

    by fprintf (82740) on Saturday July 08 2006, @01:34PM (#15684003) Journal
    I got one yesterday I must say it sounded really compelling. I checked the headers and my initial newbie glance was that none of the URLs were immediately noticeable as faked. Upon second glance I could see some warning messages about mismatching IP addresses.

    Regardless of the technicalities, because it didn't have the usual telltale signs it really made me wonder. I then checked into my account the usual way, noticed nothing was wrong and then forwarded the email to spoof@paypal.com, receiving a reply this morning that it was indeed a phishing attempt.

    The thing is, on this site we always talk about how clueless people are, and I have participated myself on occasion. But after talking with my wife and in-laws yesterday I realize how *easy* it is to dupe 95% of the computer using population using these tactics. These are people that are educated, smart and generally not clueless in life... but when it comes to computers they are. I had to explain to my sister-in-law why my brother-in-law was receiving Cialis/Viagra emails shortly after posting their clean (well, it was) email address on petfinder.com. My point is, it may seem like there is a low percentage of willing responders to a phone phishing attempt, but I can say from my observation that this new technique should be more successful than ever!

    I just wonder isn't it really easy to trace phone numbers?

  • Sample (Score:4, Informative)

    by Faux_Pseudo (141152) <Faux_PseudoNO@SPAMyahoo.com> on Saturday July 08 2006, @07:33PM (#15685174) Homepage
    I got one of these. Here is a copy of it:
                                                                                  PayPal
    Account Verification
    Dear $email_addres
    You have received this email because we have strong reason to belive that your
    PayPal account had been recently compromised. In order to prevent any fraudulent
    activity from occurring we are required to open an investigation into this matter.

    If your Credit/Debit Card on file is not updated within the next 48 hours, then will
    assume this account is fraudulent and will be suspended. We apologise for this
    inconvenience, but the purpose of this verification is to ensure that your PayPal
    account has not fraudulently used and to combat fraud attempts.

    To speed up the process, you are required to call us ($phone_number) to verify your
    PayPal account.

    We apologise in advance for any inconvenience this may cause you and we would like
    to thank you for cooperation as we review this matter.

    Regards,
    PayPal Account Verification.
    Copyright (c) 1999-2006 PayPal. All rights reserved.
    --
    Please do not reply to this e-mail. Mail sent to this address cannot be answered.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.