Hacker News Reader

I also warn my mother not to think she's clever and talk back to the scammers. "Don't tell them off" I tell her. Just hang up. Say nothing.

> then realizing what was going on then positively jovial at how they'd played the scammers along for almost a full day.

...because once they realize they're talking to an old lady, they may realize the "kidnapping" story may not work, but a call verifying something for a Stimulus check might (for example).

Just hang up. You won't outwit them.

Hang up for another reason. That is less data they have to fake they are you. Say "yes" and any audio tech with a reel to real tape recorder can insert that yes into a different conversion where you are agreeing to whatever scam. (it is easier with modern technology of course) say enough and they can clone your voice inflections and record your voice saying anything they want.

Okay.

Has that ever happened?

Does a fake recording like that make it easier to scam you in any meaningful way?

I don't know if it has. However it is reasonable tactic. If you have a recording of them agreeing to something that is strong evidence in court. You need to figure out how to get payment, but if you have bank information from some other source (not hard) a charity to "help the poor" that spends 5% on the poor and the rest on CEO isn't hard to set up.

I'm not convinced that the scammer going all the way to court is a reasonable tactic.

The point is the scammer has enough that no lawyer will take your case to court.

I love talking to them because it's time they aren't talking to someone else. My goal is to waste their time, not "outwit" them.

I'd like to think that if enough people did this they wouldn't make any money.

I had a conversation with a scammer claiming to be MSFT support, maybe 5-6 years back. It was clearly a cold call, not based on any PII, so I just toyed along for maybe a half hour until I started getting bored. We talked another 10 minutes or so about life in his city, lack of jobs, using fake tech support as a stepping stone, practicing english, siblings, etc. Seemed like the same familiar monotonous daily grind, just trying to find a path and provide. Maybe that was all an act too, but it felt authentic.

There are a few Twitch streamers doing this. I saw one that had a VM set up with all sorts of fuckery built-in to mess with them.

Yeah one guy has sound effects (such as driving for going to the store to buy the gift cards) and voice modification set up.

There was a video that he kept the scammer on the phone for 6+ hrs then at the end when he was giving them the apple cards was "confused" and redeemed $20000 dollars onto "her" "own" account to send them a computer all on a vm where they could watch her putting in the cards codes and go through the checkout but the control software "was broken" so they couldn't interfere.

edit: Youtuber/twitch streamer is mentioned below, Kitboga

Obligatory kitboga mention: https://twitch.tv/kitboga. The dude is a genius at baiting scammers and his stream is family-friendly as far as I know.

Then there is Jim Browning on YouTube.... I’ll just leave this here: https://youtu.be/le71yVPh4uk

Yea, some of those are hilarious to watch actually. I can't sit there for that long. But I would say on average I can easily waste 10 minutes of someone's time while still getting work done on my side.

> I'd like to think that if enough people did this they wouldn't make any money.

The population density and average income disparity between the US and India works strongly in their favor, however.

kitboga does this on Twitch, Jim Browning also has a bunch of YouTube videos of doing this. There's even a community for it on reddit: /r/scambait/

I travel internationally a lot and my parents and grandparents get calls like this on occasion. I send them an annual email reminding them that I will never call asking for money. I also give them a password in the email and let them know that if someone claims to be calling on my behalf about an emergency they will know this word (I give it to my lawyer and girlfriend plus business contacts that might actually have occasion to call in an emergency). My relatives know that if the person doesn't know the word they should hang up immediately.

I established this system because it is possible I will be involved in an accident or something and I do want my relatives to be able to trust someone calling if I am unable to do so. Many scams start with news of an accident so this usually stops them before they get to the asking for money part. I also make it explicitly clear that an emergency call would never be a request for money. I have savings and insurance and there is no occasion where I would need money from relatives, ever.

How will you never ask them for money, I was stuck in Vietnam, had my cards and cash stolen. Visa will not send a replacement to Vietnam. There was no alternative except to get my sister to wire me some money.

Then you go into an Internet cafe or borrow somebody's phone and do a video call to establish it really is you asking.

The countdown timer to when this can be convincingly deepfaked is ticking, but while a pre-recorded video is within realm of possibility (if the scammer can get access to video of the person, which is already hard), being able to fake a live conversation is still a ways off.

Also, I'd tell you to leave a backup card in a separate place from the rest of your belongings, but you've probably learned that the hard way already!

I've been traveling extensively for 10 years, over 60 countries and counting. Still haven't ever been in a situation where I needed relatives to send money. I have multiple banks, cards, credits cards, accounts and lawyers who can handle these types of issues for me.

I've also built up a network over the years so I have friends in virtually every major city on the planet. You could literally spin a roulette wheel of cities and drop me into one anywhere on the planet with nothing in my pockets and I'd be fine. People are far more helpful than you realize and of course knowing people helps.

I was completely broke once in one of the most dangerous cities on the planet (San Pedro Sula, Honduras) due to poor planning and a city wide internet outage that took out all ATMs. I also didn't speak any Spanish at the time. This was before I had multiple banks too.

In the end it wasn't really an issue at all, bus driver let me ride for free to the next town and personally escorted me to a safe ATM. Once you've been through things like that a few times you realize most situations just aren't as big a problem as you might think.

Go into your embassy. They'll help.

What if you get kidnapped and don't have enough money? I highly doubt there is no world in which you would ever need money. When you make blanket statements such as "X cannot ever happen" you're asking to be wrong.

A better approach would be to establish a set of preshared keywords that convey information about what's going on.

That's why they gave their parent's a password that could be used in case they ever actually need money. I remember growing up, my mom told me a password that would be used if an adult I didn't know was trying to pick me up from school or was in some way trying to get me to come with them. I think it was only used once when my mom's coworker picked me up after school because my mom was stuck at work. Nowadays, you need multiple signatures, a letter from your congressman, and a notary to let anyone that isn't the parent pick up a kid from school but this was before all of that.

Parent here: in Massachusetts, you just file a form with the school authorizing specific people to pick up your kid. Those people have to come in to the office and present their driver's license or similar. That's all the bureaucracy.

Which for the situation of "something unexpected comes up and someone else needs to pick up the kids" is just as blocking.

Or can you have that person bring the form and show ID?

No, you can't have someone bring a form with them and show ID. Too easy to abuse.

However, you can list as many people as you like and change it at any time by visiting the school. So we have four or five neighbors listed and my sisters who live in other states.

Kidnapping is a real, albeit unlikely threat in many of the places I end up in. That's why I have lawyers and insurance. There is no scenario in which I want my grandparents or parents involved in a kidnapping situation in any capacity.

These people are in their 70s. Preshared list of words? You are lucky they even accept a password.

The most basic solution. People age 70+ keep paper books of hand written names and phone numbers next to their home POTS phone. Have them write down the "password" next to your name in the book.

I'm not ready for ad networks start using targeted deepfakes of my parents on me to buy skincare products or something.

Just ask them what's wrong with Wolfie.

We'll need 2 factor auth for phone calls at that point

TOFU with digital signatures to verify the originating device would be huge for voice calls.

“oh, sorry mom, I got a new phone for the trip so it would work overseas. don’t worry about that! just send the money quickly so we can pay the hospital.”

> "They didn't send any money but both of them said it was incredibly difficult to keep what I'd told them in mind because "what if it really was you needing help?"

Perhaps a pre-established code phrase is a good way to address this. "If I ever need help, I will mention that [memorable vacation] we spent together. If that vacation isn't mentioned explicitly, it's not me."

Fine as long as your parents aren't beginning to go senile when such instructions will just be confusing and/or completely forgotten.

There might be better protocols - make sure all their cash is in the bank, set a per store per week limit of £200 on their cards, require your/siblings authorisation to make larger purchases?

But then there are things like their pensions, who they move their phone/internet account or other utilities to, so much opportunity for malicious people to commit fraud and deception; companies aren't motivated to help as it often reduces the companies income.

This is exactly what I have done when we leave the country. We leave a binder with emergency info including code words with expected responses to validate that our emergency contact at home is truly speaking with us.

Seemed kind of silly at the time but it truly is a low cost way to mitigate this issue.

A lot of times the victims give these type of information to the scammer. Not saying this is what happened to your parents, but my aunt got a call where a young man was crying and SHE was the one that asked for my name. From there it was quick for the scammer to say "yeah, I am here with so-and-so". Thankfully she got stopped outside the bank branch by a police officer who saw her panicking and was able to talk her out of it.

>what if it really was you needing help

And people think Pascal's wager is a good argument and you lose nothing believing in hell.

Time to start creating honey pots.

I think "trawling" would be more appropriate than "trolling" here.

"trolling" works. It's a method of fishing, just like trawling. It's one of the lesser-used definitions these days but IIRC that is the root for the more well known antagonizing definition.

https://en.wikipedia.org/wiki/Trolling_%28fishing%29

Why's that?

Because trolling makes no sense in that sentence. They were looking for older family members for potential targets.

edit: apparently trolling is fine here:

https://www.merriam-webster.com/dictionary/troll

They're both fishing metaphors and they both make just about as much sense.

https://grammarist.com/usage/trawl-troll/

well, today I learned troll has other verb definitions.

I think "trawling" is a lot more common, "trolling for cock" is the exception where it's always "trolling" and never "trawling".

Probably regional dialect. I spent my teenage years "trolling" for just about every part of the female anatomy, but never heard anyone use the word "trawling" in the same way. That said, trolling is a much more popular fishing method where I'm from.

In fishing isn't it a question of volume? IIUC trolling is moving very slowly/wakeless with a small number of lines, and trawling is a big net that catches everything?

Before 'trolling' became popular, 'trawling' was common and correct use for this case. Same kina use as fishing trawlers. The dictionary has more detail.

But trolling is also a type of fishing - you drag a line and try to catch people/fish on your bait (the phone call from the supposed son). That seems the perfect metaphor for what they were doing? They weren't dragging a big industrial net trying to catch anything at random passively (trawling) because they were trying to get individual people by calling them up one by one trying to get them to bite.

Surely "spear (ph|f)ishing" is the most appropriate fishing analogy here because it targets an individual?