Hacker News Reader

Even better would be: ask your rep what his or her favorite animal is. If he or she answers giraffe, then share this code. Otherwise hang up and dial the number on the back of your card.

If the warning not to are is not worded carefully enough then a second message could be sent by an attacker before or after instructing the user to disregard the warning.

Hello, this is Fidelity customer service, and to confirm this, we will send a text message with a code to the phone number you registered with us. For security, please confirm you are our customer by responding with the code.

Narrator: No, it was not Fidelity, but a scammer who needed the code to drain the customer's Fidelity account.

The attacker doesn't control that message. If they did, they would already know the code and wouldn't need you to give it to them.

How will scammer initiate the SMS? Considering online and customer care messages are different enough.