Tag Info

New answers tagged

3

Using the real code from the website may increase the ability for automated detection to find and identify the phishing site. If the victim site has some specific text phrase, this could be used in searches across the web to identify potential phishing sites. Crawlers and other bots may also store complete HTML and could match against structural items. With ...


2

OPM has released statements offering credit protection and advice on how to respond. Phishing e-mails were listed as one of their concerns. Their recommendation was to use anti-phishing plugins to your web browser to help identify phishing e-mails and keep your systems patched. For the layman, that's probably the best you can do. I believe it's important to ...


1

00 is the telephone prefix to dial international numbers in many countries, including the UK. The 1 to 3 digits that follow 00 are a country calling code, in this case the code is 800 which is an international toll-free number. As far as I know, 00800 numbers are always toll-free, so this can't be a scam where you are tricked into calling an expensive ...


3

When I get a call from my bank (presumably) and they say there is some problem and they need to verify my identity first before proceeding in the call, I tell them I don't feel comfortable to provide this information because I don't know their identity. That say they understand and I should call the number on the back on my credit card and hang up. There is ...


3

Ditto lots of what others have said. I've been stupid in the past and given out information to people who called me claiming to be from the bank or a charity or whatever. No more. These days, if someone calls claiming to be from a charity and asks to put a donation on my credit card, I say no, send me something in the mail. Then I can verify that any ...


4

As above the best methods of verification include reference numbers/account information. However, I think it would be highly unlikely in most cases that your bank would ever directly ring you, perhaps only in the event of card fraud. In such event I would end the call and dial the bank from another number or at least verify the call had indeed been ...


6

I worked at a call center that handled services for several banks. The person calling was likely following procedure when they didn't tell you your account number. Since phishing scams are common against banks it was a fire able offense to give any account number without the customer verifying who they were. And even though they called you they are still not ...


21

Ask for their extension, then call the bank back with a number you trust. Most office phone systems allow you to get directly to any employee if you know that employee's extension, so hanging up and calling the bank back will not take more than a few seconds. If you have been called on an old style landline you should phone back on a different phone line or ...


7

First of all, never give them any information that isn't available to the public until you are sure that they are real. In fact, if they called you, I would probably never give them any information, since they shouldn't be calling to collect that kind of information. Most legitimate banks will send you a letter and then ask you to come into the branch to ...


93

If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up: Name of the company/service the account is for. What is the nature of the problem? Is there a reference ID (e.g.: ticket #) for the issue? Name and/or ...


7

This does sound like a scam. Given the amount of big data breaches of late scammers have huge datasets they can parse through and create a targeted attack. That being said, mutual authentication is a good action to perform as they will always have the data in their system. In addition I have never experienced a large organization VoIP system that does not ...


0

I use a tool from a vendor that does exactly this. It's basically a set of regex applied the the text of the domain name to permutate over variations. Can it be fooled? Of course. If you only use string manipulation, then one can figure out the manipulation patterns and devise domain names that meet the attack criteria. The trouble for the phishers here ...


0

I'm not sure the answer to your actual question - for example whether it is possible for a tool to distinguish between www.google.com and www.gooogle.com and alert the user of a phishing attempt. The best protection would be a browser based password manager. This will only offer login credentials for matching sites. So if the user goes to www.google.com ...


0

As mentioned by curious_cat in the comments, https connections should help as the identity of the website is then validated. There are several client side tools that attempt to identify the content of the website by using a browser plugin: Phishtank, Web of Trust, Avast! Popular web browsers also come with some sort of mechanism to try to identify phishing ...


2

A common phishing website looks extremely similar to the website it is trying to impersonate, but is still a different website. One could develop a tool which examines any websites the user visits and alerts them when they look exactly identical to one of the websites is set $S$. Unfortunately there is a problem with this: A phishing website only needs to ...


0

For the rest use formula: f(n)=(5*(n-1)) mod 9 For example if you have f(5)=7 the next step is f(x)=(5*7) mod 9 = 35 mod 9 = 8 and so on



Top 50 recent answers are included