Phishing, Have You Been Hooked?

[Huntn]

Not yet…

Living in Houston, Texas, Centerpoint Energy is both the natural gas provider and they control the Electric Grid for all of the electricity providers. There is an arrangement in Texas which is actually good that allows a significant number of electric providers to compete with one another on a common grid so most residents in single family housing can choose the best deal for their electric power.

Yesterday I got a phone call that said it was coming from: Centerpoint Power Out. I’m on a notification list so I answered. There was a recording that said due to non-payment that my power would be cut off and to select 1 to talk to a representative. So I did.

This person told me that my payment had not been received and did I want to make a payment with my credit card. This was curious, because when I think of power out I’m thinking electric, and I don’t pay Centerpoint for electricity, at least not directly. The only paymemt I make to Centerpoint is for my natural gas, and that is on auto pay and I told them that, and this man told me well sometimes they expire or not received , so I told them that I would log into my Centerpoint account and check for any issues, goodbye.

Then I logged into Centerpoint, where it said zero balance owed. I talked to Centerpoint customer service who said this was an ongoing issue. The number showing on my phone with the phishing attempt had been spoofed. I accidentally called it back, and it showed up as Lanai City, Hawaii, but no idea if that is accurate either…

This disgusts me. Con men and women have always been around, but in combination with all that is going on in our politics today, world conflict, degradation of our environment, how we treat one another, mounting National debt, this is just another sign that the human race as a species may not be worthy to suceed. 🤔

 

[Nhwhazup]

So many of these scams out there. 😡

 

[velocityg4]

I got those all the time on my home phone. I finally switched to Ooma and locked it down to only calls from my address book can ring my phone. Everything that's known spam gets a number disconnected message. Regular unknown callers not known for spam get dumped to voicemail. Then if they are legitimate (like doctors office). I add them to my address book.

For some reason my iPhone doesn't get many spam calls anymore and it's a published business number. I guess T-Mobile has a good filter. Unfortunately since it is for business. I can't just limit it to contacts.

I haven't fallen for any spam caller though.

Also, whenever I have to open my home phone temporarily to unknown callers. My first step in answering is to be silent. If I hear a click or silence before sudden background noise, spam. If it just hangs up, spam. If an actual person is calling. There won't be auditory oddities in the first second or two and they'll eventually realize the line is no longer ringing and tentatively say hello.

Beyond that. I do what you do. If they say something is amiss with an account. I'll just check it online.

Sometimes I'll screw with them and use weaponized incompetence. Like for those tech support scams. For some reason their remote access software or even the website just won't work (in Mac OS 9 or System 7.5). Oops, did I forget to mention that? My credit card number won't work? I know I paid my bill. Let me find another card. Sorry, I know it's around here somewhere. Wait don't hang up. I think I remember where it is. Bonus points when they start threatening you and cursing.

 

[Nhwhazup]

I got those all the time on my home phone. I finally switched to Ooma and locked it down to only calls from my address book can ring my phone. Everything that's known spam gets a number disconnected message. Regular unknown callers not known for spam get dumped to voicemail. Then if they are legitimate (like doctors office). I add them to my address book.

For some reason my iPhone doesn't get many spam calls anymore and it's a published business number. I guess T-Mobile has a good filter. Unfortunately since it is for business. I can't just limit it to contacts.

I haven't fallen for any spam caller though.

Also, whenever I have to open my home phone temporarily to unknown callers. My first step in answering is to be silent. If I hear a click or silence before sudden background noise, spam. If it just hangs up, spam. If an actual person is calling. There won't be auditory oddities in the first second or two and they'll eventually realize the line is no longer ringing and tentatively say hello.

Beyond that. I do what you do. If they say something is amiss with an account. I'll just check it online.

Sometimes I'll screw with them and use weaponized incompetence. Like for those tech support scams. For some reason their remote access software or even the website just won't work (in Mac OS 9 or System 7.5). Oops, did I forget to mention that? My credit card number won't work? I know I paid my bill. Let me find another card. Sorry, I know it's around here somewhere. Wait don't hang up. I think I remember where it is. Bonus points when they start threatening you and cursing.

One time I tried to make a guy feel guilty and asked him what if I was out there doing this to his mom? I told him to get a real job. He told me that he had a day job and this was to supplement his income. I told him that he ought to be ashamed of himself. He asked me to pray for him.

 

[circatee]

What timing of your post! Just this morning, I was contemplating creating a new email address. Am so sick and tired of the sheer volume of spam/junk/phishing emails.

The more I think about it, even creating a new email address, unless I simply never handed it out, the likelihood of getting spam/junk/phishing email is still there.

Alas, good that you were thoughtful to log into your account online and check for yourself...

 

[velocityg4]

What timing of your post! Just this morning, I was contemplating creating a new email address. Am so sick and tired of the sheer volume of spam/junk/phishing emails.

The more I think about it, even creating a new email address, unless I simply never handed it out, the likelihood of getting spam/junk/phishing email is still there.

Alas, good that you were thoughtful to log into your account online and check for yourself...

It's best to have multiple addresses. I have the following

Personal: This is just for friends and family only. It gets no spam
Business Public: This is my published e-mail address. Which oddly enough gets very little spam. It's for new customer inquiries.
Business Private: I give this to paying clients and registering for business services. It gets very little spam.
Junk: I use this for registering personal accounts with businesses or websites I frequent. It gets some spam but not as much as you'd think. I've been giving out this address for around fifteen years.
Throwaway: I use these for charitable donations or a job search. These quickly get hammered with spam.

The lesson. Never give an email address you want to keep. When you donate to charity or are looking for a job. Same with anything political.

 

[circatee]

It's best to have multiple addresses. I have the following

Personal: This is just for friends and family only. It gets no spam
Business Public: This is my published e-mail address. Which oddly enough gets very little spam. It's for new customer inquiries.
Business Private: I give this to paying clients and registering for business services. It gets very little spam.
Junk: I use this for registering personal accounts with businesses or websites I frequent. It gets some spam but not as much as you'd think. I've been giving out this address for around fifteen years.
Throwaway: I use these for charitable donations or a job search. These quickly get hammered with spam.

The lesson. Never give an email address you want to keep. When you donate to charity or are looking for a job. Same with anything political.

Touche'. Hard to place the genie back in the bottle. But, I guess I could start a fresh one, for personal/friends/family.
Then again, my ideal username is probably long gone...

 

[velocityg4]

Touche'. Hard to place the genie back in the bottle. But, I guess I could start a fresh one, for personal/friends/family.
Then again, my ideal username is probably long gone...

Make your own domain. Then you can have whatever username you want.

 

[circatee]

Make your own domain. Then you can have whatever username you want.

Touche'. I actually have a personal domain (Microsoft 365), with an email account.
However, I do not use that email address for anything. As I think about it, I may start using it for personal, i.e. friends and family. And then use Gmail and Outlook for purchases and general online accounts.

Honestly, though, the real trick is for me to simply ignore the Junk folder in my Outlook Dot Com account. Microsoft does not give you real control of the Junk folder, like you have with a personal domain (on Microsoft 365)...

 

[eyoungren]

Not yet…

Living in Houston, Texas, Centerpoint Energy is both the natural gas provider and they control the Electric Grid for all of the electricity providers. There is an arrangement in Texas which is actually good that allows a significant number of electric providers to compete with one another on a common grid so most residents in single family housing can choose the best deal for their electric power.

Yesterday I got a phone call that said it was coming from: Centerpoint Power Out. I’m on a notification list so I answered. There was a recording that said due to non-payment that my power would be cut off and to select 1 to talk to a representative. So I did.

This person told me that my payment had not been received and did I want to make a payment with my credit card. This was curious, because when I think of power out I’m thinking electric, and I don’t pay Centerpoint for electricity, at least not directly. The only paymemt I make to Centerpoint is for my natural gas, and that is on auto pay and I told them that, and this man told me well sometimes they expire or not received , so I told them that I would log into my Centerpoint account and check for any issues, goodbye.

Then I logged into Centerpoint, where it said zero balance owed. I talked to Centerpoint customer service who said this was an ongoing issue. The number showing on my phone with the phishing attempt had been spoofed. I accidentally called it back, and it showed up as Lanai City, Hawaii, but no idea if that is accurate either…

This disgusts me. Con men and women have always been around, but in combination with all that is going on in our politics today, world conflict, degradation of our environment, how we treat one another, mounting National debt, this is just another sign that the human race as a species may not be worthy to suceed. 🤔

If you are not in my contact list I do not answer the phone.

My bank does not call me - ever. My utilities do not call me - ever. My cellphone carrier, my subscription services and almost everyone else I use a debit card for online does not call me.

I call THEM. If I need/have to.

So, if someone is calling ME, pretending to be X, right there I know it's fake. That's if they leave a VM because I'm not answering their call.

I am generally in all of my accounts at least once or twice every couple of days. I know when I've paid the bill and how much because I have to keep straight what our current balance is between paychecks. Just this morning I caught one subscription service that charged me twice. It was supposed to be one order, not two. I've emailed them.

Another thing, almost all of the entities I deal with are set up to email me. So if they are calling me, again I know it's fake.

And half the time these people are calling about accounts with banks I don't have and companies I don't use. Right there - fake.

Further, I know which email accounts and phone number(s) I gave the companies/businesses I deal with. I know what I bought and how much I paid, so if I'm being contacted on the wrong email or the wrong phone number - fake.

I'm not paranoid, but I know who I deal with and when I did it and I stay on top of my account balances.

 

[HDFan]

You can reduce, but not stop, these calls by:

1. Signing up for nomorobo, depending on phone and connection method (wired, wireless)

2. Activating any spam protection your carrier provides, either landline or wireless.

3. On a phone install a program such as malwarebytes which allows your to report numbers

4. If you are really ambitious you can report the call to the FCC. This method is really slow, takes years, but it does help. They just ordered some local carriers to stop the billions of auto warranty calls they handled:

You May Get Fewer Car Warranty Scam Calls Soon; Thank the FCC

It's the number-one complaint by consumers, and now your cellphone may actually stop getting so many annoying robocalls.

www.caranddriver.com

5. You can block all callers not in your contacts. This can be risky, however, if an important call comes in from, say, an unknown doctors' private number.

As I wrote this I received a text spam message: "FreeMSG Citi: Your requested temporary access code is ... Never requested this code? Repy NO

In response I:

1. Reported the number to T-Mobile (7726)
2. Reported the number to Malwarebytes. Probably not useful for text messages but what the heck
3. Blocked the phone number on my phone

 

[eyoungren]

You can reduce, but not stop, these calls by:

1. Signing up for nomorobo, depending on phone and connection method (wired, wireless)

2. Activating any spam protection your carrier provides, either landline or wireless.

3. On a phone install a program such as malwarebytes which allows your to report numbers

4. If you are really ambitious you can report the call to the FCC. This method is really slow, takes years, but it does help. They just ordered some local carriers to stop the billions of auto warranty calls they handled:

You May Get Fewer Car Warranty Scam Calls Soon; Thank the FCC

It's the number-one complaint by consumers, and now your cellphone may actually stop getting so many annoying robocalls.

www.caranddriver.com

5. You can block all callers not in your contacts. This can be risky, however, if an important call comes in from, say, an unknown doctors' private number.

As I wrote this I received a text spam message: "FreeMSG Citi: Your requested temporary access code is ... Never requested this code? Repy NO

In response I:

1. Reported the number to T-Mobile (7726)
2. Reported the number to Malwarebytes. Probably not useful for text messages but what the heck
3. Blocked the phone number on my phone

I have a blocked caller contact with a silent ringtone. Back when I was jailbreaking any spam number got put into that contact and it was that contact alone that I used a JB app/tweak to block calls from.

Later on when Apple started offering its own call blocking, I had my Block Caller contact blocked using Apple's system. I just continue to add spam numbers that irritate me to that contact. If they have really irritated me, I block their individual number.

I have T-Mobile's SPAM block on as well and the carrier seems to have added actual call blocking by number on their website lately - so that option is available too (Sprint used to have that).

But as I mentioned above, if you aren't in my contact list I don't answer. Sometimes, like with a doctor you mentioned, it means I miss a call. But I usually just add those to a contact at that point.

Most of these spammers don't seem to like leaving voicemail so after a try or two they usually go away. I also delete their VMs and don't call back, so there's that.

 

[Huntn]

I have a blocked caller contact with a silent ringtone. Back when I was jailbreaking any spam number got put into that contact and it was that contact alone that I used a JB app/tweak to block calls from.

Later on when Apple started offering its own call blocking, I had my Block Caller contact blocked using Apple's system. I just continue to add spam numbers that irritate me to that contact. If they have really irritated me, I block their individual number.

I have T-Mobile's SPAM block on as well and the carrier seems to have added actual call blocking by number on their website lately - so that option is available too (Sprint used to have that).

But as I mentioned above, if you aren't in my contact list I don't answer. Sometimes, like with a doctor you mentioned, it means I miss a call. But I usually just add those to a contact at that point.

Most of these spammer don't seem to like leaving voicemail so after a try or two they usually go away. I also delete their VMs and don't call back, so there's that.

T-Mobile my carrier seems to have a decent spam notification, my guess is when a number is spoofed, the spam system won’t pick it up? I don’t know much about this but I get the feeling that the numbers used for this purpose are perishable, but maybe not. This could be a reason to spoof numbers.

 

[eyoungren]

T-Mobile my carrier seems to have a decent spam notification, my guess is when a number is spoofed, the spam system won’t pick it up? I don’t know much about this but I get the feeling that the numbers used for this purpose are perishable, but maybe not. This could be a reason to spoof numbers.

Yeah, I've got six voice lines on my account and all that SPAM block/protection is added to each line. I don't know much about it either, but I'll take anything offered, even if it turns out to be a threadbare g-string.

I just got into the habit though of adding people to this blocked caller. It's silent and if I actually see it 'ringing' on the lock screen (which has not happened in a long time) I can just ignore it.

With this whole local area code spoofing thing though, I've lately just been silencing calls and ignoring them. If I add every call to the contact list pretty soon nobody in my area code will be able to call me - and I don't really want that.

There was a time a few months ago that I was getting spam calls from Indonesia. Yeah. Not answering. Not only will it be spam, I will be charged for the privilege of answering that spam call. No thanks.

I guess I've just learned how to ignore calls. I've been letting it all go to voicemail since my parents got an answering machine in the late 80s.

 

[unrigestered]

not sure yet, but maybe 15-20 years ago, i got an email from the king of Uganda, a friend of mine (he said)

he told me if i just transferred $20.000 to his bank account, i'd get $40.000 back next month
as nothing happened after four weeks, i sent him $20.000 again, as maybe something went wrong first time

somehow nothing else has happened yet, but i'm still positive that it's still just a misunderstanding and i'll soon be getting lots of money. 💵
He's a friend of mine, after all (he said)

 

[orionquest]

I've never been suckered into one of these scams. Though I have chatted to a few of them, still can't get an answer on where to get good samosas though.

As people have mentioned use your mobile device to shut down these calls. Anything important even unknown callers will leave a message and you can just call them back. The less you answer these calls the more likely they will stop calling. I've basically stopped answering my phone, unless it's a number listed in my contacts. But I see they also will try text messages, either with some refund, deposit scam with a fake link, or pretending to be long lost friend just saying hello again. Don't engage, ignore.

Not sure why networks can't completely ban spoofed calls for clients on their network, we've implemented all this wonderful tech, why not make it work even better for stuff like this 🤷‍♂️

 

[eyoungren]

I've never been suckered into one of these scams. Though I have chatted to a few of them, still can't get an answer on where to get good samosas though.

As people have mentioned use your mobile device to shut down these calls. Anything important even unknown callers will leave a message and you can just call them back. The less you answer these calls the more likely they will stop calling. I've basically stopped answering my phone, unless it's a number listed in my contacts. But I see they also will try text messages, either with some refund, deposit scam with a fake link, or pretending to be long lost friend just saying hello again. Don't engage, ignore.

Not sure why networks can't completely ban spoofed calls for clients on their network, we've implemented all this wonderful tech, why not make it work even better for stuff like this 🤷‍♂️

Yeah, I'm of the opinion that answering just tells them that the number they called is legit (and my number). So I don't answer.

I just delete any spam messages. Some of them I do block. Pretending to be a long lost friend is a non-starter with me as I can count on one hand the number of real friends I've had in my life. Everyone else was just the people you went to school with or worked with and I really have no desire to engage with those people outside of where I first met them.

I guess being a loner is an advantage here.

 

[HDFan]

Not sure why networks can't completely ban spoofed calls for clients on their network,

Because the carriers have to implement technologies to prevent them. Large carriers in the U.S. have, the problem is smaller carriers, especially those who are overseas.

Caller ID authentication is critical for protecting consumers against spoofed robocalls where scammers mask their identity, harass consumers, and seek to defraud vulnerable communities. Caller ID authentication, based on so-called STIR/SHAKEN standards, provides a common information sharing language between networks to verify caller ID information which can be used by robocall blocking tools, FCC investigators, and by consumers trying to judge if an incoming call is likely legitimate or not. On June 30, 2021, the FCC confirmed that all the largest voice service providers had implemented these standards in the IP sections of their networks, in accordance with the FCC’s deadline. While some small carriers were originally afforded an extension of this deadline, Chairwoman Rosenworcel cut in half the time afforded to a subset of small voice service providers based on evidence that they were originating an increasing quantity of illegal robocalls. Thus, small voice service providers that are not facilities-based are now required to have implemented STIR/SHAKEN in the IP portions of their networks as of June 30, 2022.

The FCC's Push to Combat Robocalls & Spoofing

The FCC has made combatting unlawful robocalls and malicious caller ID spoofing a top consumer protection priority. By proposing and implementing impactful policy initiatives and pursuing strong enforcement actions, the FCC takes action to protect and empower consumers.

www.fcc.gov

 

[ucfgrad93]

I keep my phone on silent and have just a few numbers that “emergency bypass on.” Everything else I let go to voicemail, and return the calls I need to.