phish by VoIP

Hopefully something good will come of this. It is amazing how much information folks give to complete strangers over the phone.

I recall a few years ago when I got a snail mail message from a credit card company about a newly issued credit card. The message was call us *NOW* at this number. The implication was they were worried about fraud. The person I talked to was very annoyed when I refused to give my "mother's maiden name", ssn, card expiration date etc. "But you called us sir. You know who you called." I pointed out I had no idea who I called. All I knew was the person I called had access to a laser printer and could generate a reasonable-looking letter from a credit card company. Unless they could validate themselves to me I wasn't giving them any private information. They of course threatened to turn off the card and I pointed out that would work as validation. If I noticed that card stopped working I'd call them back. They finally decided that form of validation wasn't in their interest either.

The problem still remains, unless one only calls the credit card company's phone numbers physically printed on the card, one has nothing to validate them by. They really need to fix that.

-wolfgang

If you will share the phone number you called, I can pass it along to the Postal Inspectors who are checking into this sort of thing.

Actually, I do believe it *was* my credit card company. The person did eventually open up a bit and tell me which purchase I had made that sent up a red flag. We both cautiously read some of the digits of the purchase to each other. In this way we both did manage to make sure that each of us was looking at my last bill.

It would be good if there were a more official way for the user and the credit card company to mutually authenticate each other.

Although, come to think of it, there is still the possibility that the scammer uses voip and 3-way calls the real credit card company. This way they can record all the validation information and use it at a later time for some mischief of their own.

-wolfgang

Indeed, tell the card holder to call the number listed on their card and then a specific extension to route them right to the proper call center.

But good point, don't just call someone back because they claim to be from a given organization, check the numbers you've already got FIRST.