Hacker News Reader

Hacker News

Comment by ramblerman | Hacker News Reader

Parent Full thread

ramblerman

I think you are seriously underestimating the difference.

Imagine getting a call from your wife. Do you doubt right now if it’s her or something that just sounds similar.

This man could have know the ceo quite well.

View on HN

I wouldn’t wire my wife $250k based solely on a phone conversation.

It's just a matter of scale. For some companies $250K is pocket lint.

Would you tell your wife your credit card number if she called you and told you her card is blocked for some reason and she needs to refill the gas tank or buy something?

A while ago a friend who I hadn't seen since 2011 messaged me on Facebook asking if I could take a look at his account on a guitar forum we both used to frequent, because he thought his account was stolen, but couldn't check it for activity without making a new one(and probably also having enough posts to be considered "in").

So I asked who sold him that Music Man Petrucci 7-string in 2009(or so) and after he answered correctly, I followed through with his request.

My point being: it helps to have such a question prepared for everyone - or alternatively - a question concerning some fact about you that only people who know you could answer.

Funnily, companies for whom $250k is pocket lint since they're big enough to have processes for payments and it's often incredibly difficult to circumvent those processes.

That's because this is not a usual request. It could be for the CEO - only they know how likely that was to happen.

One thing is caller id spoofing (would it be possible to spoof my wife caller id), another thing is how reasonable my "wife's" request is.

1. Yes, the ease with which attackers can take over a phone number is a big security issue in general 2. You might question your wife's request but people are far less likely to question their CEO in the same way, it might be seen as insubordination

It's dead easy to spoof caller IDs. Any kid could do it.

Somehow looks it's not so easy to do in EU. Especially with mobile phone numbers. Or i'm just bad at googling.

I just have to assume that they got a good impersonator which sounds a lot more doable than having an AI.

but the deepfake thing is a good story.

Reply on news.ycombinator.com