0

You will often get contact numbers for banks online or through other people, even on the back of your cards. How can one verify whether a number is genuine?

For it seems to me that it should be easy to send specific emails/voice messages saying call back on this number, but once you are on the call, there is really no verification of the dialed number, only the person calling.

What system could be devised to verify the receiving party is genuine as well, as they can easily fake a verification system for your responses, and testing them by telling incorrect information seems like shooting yourself in the foot, as it might get you locked out of your own account?

I know the current method of ensuring correct numbers is dialing the number at the back of your card, or from your statement, or from bank's website, but I am sure all that information can be modified in some way or other.

To add a bit to the discussion -

  • Over the phone, all you hear is a person talking, and they can be persuasive, regardless of if they are genuine or not, that's why most scams work on the telephone, as there no other indicators of authenticity.

  • Whereas online, you can see the SSL symbol, verify the domain name, and see their branding ...etc (admittedly this all can be duplicated as well, but is not at the same level of ease as duplicating a call script and a person).

  • At a branch - again you have the branding, and public visibility, professional staff (more than one, in a decent branch). These are legally protected as well from duplication.

Sophisticated phishing attacks have successfully used a combination of these to trick end-users. Usually incoming calls are the chief suspect, but outbound calls could also be tricked is my guess. The reason i posted this question, was I got a similar incoming call from the fraud department and asked to verify with PIN, and I wasn't sure even after calling the legitimate number.

Improve this question
7
  • 3
    Are you suggesting that someone sneaks into your house and changes the numbers on the back of your cards? – Chenmunka Oct 16 '17 at 13:14
  • 1
    No, I'm suggesting you could swap a credit card with your desired numbers at the back of the card. I would think most people don't pay enough attention to the card to see any flaws. Not necessarily at home, at an office, restaurant, someone pretending to help you – Vijay Oct 16 '17 at 13:17
  • 3
    Not sure why this question is getting down-voted. It does seem worth while to think about the possibility of calls to banks 800 numbers getting hijacked and redirected to an attacker. It is not a bad idea in 2017 to not assume the number you dialed is who you are talking to. SIP man-in-the-middle attacks are possible. – Thomas Carlisle Oct 16 '17 at 13:28
  • 2
    It seems like your propose one threat in the question, but your comments, and your recent edits, propose a completely different threat. Do you want to know if a number is legitimate, or if the person you connected with is legitimate? Those are two very different threats with two very different answers. – schroeder♦ Oct 19 '17 at 6:48
  • 1
    to confirm the person you are connecting with is legitimate, then a 2-way challenge seems simple and easy: they ask you what a certain transaction was, and you ask them the same for another transaction ... – schroeder♦ Oct 19 '17 at 6:51
4

If you cannot trust the phone company to route your phone call, do not use a phone.

If you are concerned about the number being legit, just ask for it in person at the bank, use official papers, cross-reference with a phone book and the website. Use your personal account space online to get the contact information.

If the bank is decent enough and the persons here well trained, they wouldn't share, confirm or denying personal information about yourself.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.