Hacker News Reader

Comment by gleenn | Hacker News Reader

So so true. 1Password refusing to auto fill a password has saved me multiple times in the past! Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) and got scammed by someone who stole his brother's SIM card and did some shenanigans. No one is safe, no matter how smart or tech savvy you think you are! For the less tech savvy folks, I understand why they are scared, it's hard to give them even general tips to not lose the farm to fraudsters.

View on HN

The general advice I give is:

Don't trust incoming calls, text messages or emails.

Don't trust caller ID on your phone.

If someone calls you asking for information or to do something, ask for a case id or reference number. Hang up, call back on a number you get from a previous bill, back of your credit card, or by googling the company.

If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it.

> Don't trust incoming calls, text messages or emails.

> Don't trust caller ID on your phone.

And if you're anyone of moderate fame, importance or cryptocurrency holdings, call back using a phone other than the one you received the call from. SS7 attacks remain relatively cheap , and redirecting an outgoing phone call placed to a phone number they know you're likely to call next is within the realm of feasible attacks.

>by googling the company

And remember it's going to be the 4th or 5th link down, not the first.

This is one of many reasons why ad blocking isn't just cosmetic: it's a best practice for security too!

So much this.

I recently saved a friend from getting scammed when she wanted to buy an audiobook, we wanted to avoid Audible because of the DRM and limited device selection.

The first few results she got were some shady services offering really good deals. I looked them up on trustpilot and they weren't outright scams, but they aggressively pushed you into getting an expensive monthly subscription that was basically impossible to cancel.

Yeah the first will be the scammers with a highly targeted ad buy, and who can even tell the difference between ads and search results these days?

All of my search results are search results, because of ad blockers.

Now, many of my search results suck due to SEO and whatnot, but that’s a different story.

> If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it.

This is honestly the #1 piece of advice to give friends and family.

Almost every scam is predicated on urgency.

I have an entirely seperate phone and SIM for any service I think is important which demands a phone number. (prepay, I top it up by €5 every few months. Sadly I can't automate that)

I generally refuse to give any number if I can help it. I can count on one hand the number of unsolicited calls/texts I've gotten.

I really wish phones would change the UI to make it more obvious that caller ID shouldn't be trusted.

I know that "rocket scientist" has been a standin for "smart person" or "genius", but in this case, I would be more surprised if a computer security expert (various job titles) had been scammed, because it's their job to be up on this stuff.

How often does a rocket scientist deal with computer viruses, or phishing emails, etc compared to a security expert? Most of the time, their IT security expert (ideally) stops it before it gets to them..

I may be more qualified then, I work in fraud. I accidentally called a fake airline number to get a refund for a Delta ticket and happily gave the guy my credit card for some such fee. If requiring a credit card fee to get a refund isn't a red flag, I don't know a better one. To be fair, my sister had found the number and three way joined me in because I was helping her buy the ticket. So an extra rule: don't even trust a phone number someone you know found because /they/ might have been the first victim and passing compromised information to you.

Rocket science is surprisingly straightforward, it's rocket engineering that's the tricky one.

Yeah projectile motion is high school physics.

Engineering the thing to not rip itself apart, melt, or explode is the hard part.

> Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT)

One of my friends is a nuclear physicist from TU Delft and they somehow managed to install a fake clone of Chrome haha. Somehow never got their accounts broken into or money stolen.

Physical SIM cards should _always_ have a strong PIN set. It baffles me how many people either don't have a PIN or it's just set to 0000. You're basically handing over your whole digital life away to anyone who gets their hand on your SIM card.

I didn’t even know that existed until now.

Smart people often have blind spots. The confidence you get from knowing one subject really well can leave you vulnerable in other areas.

This is one of the reasons scammers like to target doctors.

Reply on news.ycombinator.com