Hacker News Reader

Comment by lelanthran | Hacker News Reader

> You don't have to. You just ask the bank when you call them back: did someone just call me a little bit ago? What about?

> If the bank can't answer that question, it's time to find another bank. Any reputable bank will be able to look at your file and see that a call was made to you and what the issue was.

That won't help: all the phisher has to do is make a call at around the same time that the legit employee called you. The person you called back would probably not be able to tell you what the call should be about anyway.

View on HN

The idea is to call the institution back, often customer service, or log in to your account and check for alerts or messages. If customer support knows nothing about the contact attempt, I presume it's not legitimate.

> The idea is to call the institution back, often customer service, or log in to your account and check for alerts or messages. If customer support knows nothing about the contact attempt, I presume it's not legitimate.

And I'm saying that even if the customer support knows about the call, that doesn't mean that the next call you get in 2m from the bank is legitimate.

In all cases, anyone reaching out to you from your bank should be treated as not legitimate. The only way to do this is to call the bank yourself, and get put through to the person who wants to talk to you.

Any other way including the way you said you'd do it is vulnerable to phishing.

You don't call the bank, check whether it's legitimate, then wait for them to call you again. You call, confirm that they were attempting to contact you, then complete the issue on that same call.

> Calling back was also impossible since apparently there was no way to get connecter back to the person with whom I was speaking.

I already responded to this in my original post in this subthread.

You're not wrong about the incoming calls, but I can't figure out who you're replying to. Nobody above you in the thread seems to be suggesting that the bank ever call you. And certainly not call again in a short time.

The post I replied suggested that checking with the bank will indicate whether a call was legitimate or not.

I'm saying that checking with the bank doesn't indicate that a call was legitimate, so there's no point in checking with the bank.

> I'm saying that checking with the bank doesn't indicate that a call was legitimate

If you call the bank, using a customer service number that's already known to you, either they will say there's an issue with your account or they won't. So calling them does tell you, indirectly, whether the previous call (that you hung up on and gave no information to) was legitimate or not. But more importantly, it tells you, regardless of the status of the previous call, whether or not there is an issue with your account, and that's what you care about.

Note that you never have the bank call you back in this scenario. You call them, and that's it. You don't call them and ask them to call you back.

> all the phisher has to do is make a call at around the same time that the legit employee called you

How does the phisher have information about what time the bank is calling?

Also, doesn't this mean you're getting two calls? If you get two calls and the bank says they only called you once, that's kind of a red flag too.

Reply on news.ycombinator.com