Hacker News Reader

Comment by mhandley | Hacker News Reader

My simple policy is I never give out any information if I'm cold-called. If they claim they're my bank, I say I'll call them back on the number printed on the card, and ask the caller which department I should be put through to. Legitimate callers have never objected to this approach, and it saves me any stress - same policy, no matter the caller, no exceptions, no need for me to try and figure out if I'm being phished.

View on HN

Good idea - but here in the UK there was a scam where they called you and THEN suggested you call the number on the back of the card.

They then don't hang up, but play a dialling tone down the line until you dial the number. At which time they 'answer'. This only works on home phones, not mobile, but is worth considering, and warning your family/friends about.

Fuck that's clever

But, if I don't hang up the received and the counterparty hangs up, then the line tone is the one of the "busy", not the one of the "free", and I'm unable to dial anyone until I physically hang up to reset the line. Or at least that's how it works back home. Is it different in UK ? I suppose it's something that less attentive people might fall for anyways.

In the scam in question, you (as the victim) - hang up the line. You then pickup the receiver to call your bank, via the number on your card.

The scammer, when they hear you hangup, plays a dial-tone down the line, so when you pickup the receiver, you have the impression that the line is clean.

You start to dial, they stop the 'dial tone', play a fake calling tone, and then 'answer' the call.

This would be incredibly malicious and difficult to detect even for the most skeptical of users.

Wow, this really is something if done right. I don't use a landline now, but if I remember, the caller needs to disconnect for the line to actually be disconnected. So even if the callee tries to disconnect by hanging up, the caller is still actually connected. If the callee picks up the receiver again and hears a dial tone, they'd be none the wiser. But I guess the scammer would also need to detect a key-press tone on the line and stop the fake dial tone, start the ring tone, etc.

Never heard of the systems with this flaw. It was always "if you hang up then it's completely cut".

Perhaps it worked on Strowger exchanges when the call is local? I definitely remember this being "a thing" back in the 1970s but I don't remember ever succeeding in reproducing it. Obviously there must have been some time out because otherwise you could DoS anyone's phone by just calling them then not hanging up.

In the UK, when exchanges moved to digital, they deliberately kept the old behaviour because some people relied on it (eg, hanging up their main phone, then walking to another room and picking up the call on an extension phone), with a timeout of a few minutes.

In 2014 they reduced the timeout to 10 seconds to make this fraud harder to pull off.

https://www.openreach.co.uk/orpg/home/updates/briefings/down...

That's not how it works with digital lines. Disconnect on any side breaks the whole circuit presuming they conform to even ancient PDH, much less SONET or SDH. Oh and this includes even more ancient ISDN. The trunk will immediately tear down the DS0 slot and circuit.

GSM and VoIP also do not allow this behavior without engaging call waiting on subscriber side.

This only happens with old fully analog connections. Not sure which country or public operator still has this kind of PSTN.

For the difference, peruse ITU-T G.175 and Q.522 standards. SE (switching element) will disconnect the routing on your side. It took me a while to find the actual standard number.

I haven't heard of this working since the 80's, with rotary pulse dial phones.

I don't think this works any more. My parents always did this when kids did prank calls. Kept the phone open for hours blocking their line. Did not work last time I tested. Uncertain how long you have to wait before next call though.

Generally with digital phone lines (almost every line out there) this does not work, and teardown on your side is at most few seconds.

This is also impossible to pull off on cellphone lines. (There are other attacks but these require access to your BTS.)

In the UK - it was only the person that calls you who could hold the line open. Looks like BT stopped this happening in 2014/2015

Read more about steps taken to prevent this here: https://www.mirror.co.uk/news/technology-science/technology/...

Have you any idea when this worked in the UK?

It's such an old story that you'd have thought there would be an explanation online by now of exactly which telephone exchanges had this problem and when those telephone exchanges were in use.

For what it's worth, it didn't work when I tried it, probably in the 1980s. Perhaps it worked in the 1970s in some places?

Pretty sure I tried it in the 70's with a TXE4. Didn't work.

On POTS lines, the call doesn't drop until the initiator hangs up so even if you put down the phone the connection is still there, pick up the phone again and you resume the same call. I used to use this to move to the upstairs phone to continue a call (back then we had two wired handsets on the same line). The last time I can personally cite it working that way is the late 90s, but I'm sure it has more recently than that, possible even still now for some lines.

I can't test as I've not had a voice capable land-line for some time. It may not work on newer exchange equipment. It won't work if you have a service whereby calls are directed over a digital connection. It has never worked for mobile phone services. It doesn't work on some (most? all?) office PBX arrangements, either.

As well as allowing this sort of scam to operate, the "feature" can also be used as a DoS attack, blocking calls to and from a line for a time.

Mechanically it's more or less unavoidable that call circuits are opened by the caller and can't close until the caller is disconnected with a Strowger exchange (electro-mechanical, pulse dialled). Once they moved to System X (the first digital exchanges, which introduced tone dialling though they can still interpret pulses) it becomes a matter of software engineering in the face of two conflicting considerations

1. Users do not expect the call to drop if for some reason the connection to the recipient momentarily is interrupted - there doesn't seem to be any obvious reason it should be right? Remember users don't understand how any of this actually works.

2. But, when they hang up, which to you as the exchange looks essentially the same as the connection being interrupted, they expected the call to end.

As an extreme example of (1) suppose you have a rotary telephone and idly while talking on a call you put a finger in the dial and dial a '4'. What do you expect to happen? Nothing right? Maybe it makes some click noises, and you apologise to the person at the other end. But those click noises are the same - for a fraction of a second - as hanging up. So if we just naively code the system to drop calls whenever it thinks anybody has hung up, the call drops. You can bet customers will not be happy.

So the providers would pick a plausible delay. OK, let's say after two minutes with the call recipient showing as closed we'll give up and end the call, the caller can always just call back if that's a mistake anyway.

Well this fraud comes into the picture, adding a third consideration to the balancing act. Most UK providers would go in and choose a new smaller timeout. One second seems to cause false positives. How about five seconds?

So there's going to have been a window, and it will vary depending on where you live. System X was definitely not everywhere in the 1980s. It will also depend how you tested. If you tried waiting 5 minutes and the timer was set for 30 seconds then your test seems fine, but a victim who hangs up, counts to five and then tries their bank will get stung.

This is probably the best security technique in terms of simplicity vs effectiveness, one that everyone and their grandma can use. I wish there was more effort in educating people to use it.

I even remember a thread here in HN were one three-letter agency authenticated themselves to a user with this method, calling his numbers and saying, this is the FBI/NSA/etc but for you to be sure, please hang, look the website for the public number, call, and ask to be put through with $Agent from $Department.

> My simple policy is I never give out any information if I'm cold-called.

That's what I do. When someone calls me and then proceeds to ask me security question to allegedly assert my identity I reply "well, you called me so how do you prove to me who you are first?"

I usually get a "err..." but on one occasion the guy was rather rude and hanged up.

The worst thing is that most of the time these calls are genuine. This means that my bank does think it's fine to do that.

My bank did this once - called me out of the blue and started asking for answers to security questions. I asked them how I could be sure it was definitely them and they said to call the number on my card and ask for a particular department, which I did, and it turned out it was indeed genuine.

The fact that they had an immediate answer to the question obviously means that they were asked this question all the time. I wonder how many people happily handed over the info?

It seems that they now just play a recorded message asking to call, and then automatically hang up.

Makes me wonder, what if a bank just started all phone calls like that with: "Hi this is Bank, we need to get in contact with you, for security reasons could you please hang up and call the number on the back of your card?"

I usually receive soft objections to this. They don't even seem to understand the problem most of the time. In fact, they speak rather like I would expect a scammer to: "but we just need to verify who you are, and you will still have to do this if you call the number on your card, so it's easier if I do it now".

They always ask if I want to pay over the phone. I say nope, I'll mail you a check.

Wrote about this years ago: https://blog.oxplot.com/dont-ask-for-personal-details/

The Twitter thread points out that you need to call from a different phone, else the scammer could leave the line open (even after you hang up!).

Reply on news.ycombinator.com