<story><title>Voice Phishing Scams Are Getting More Clever</title><url>https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/</url></story><parent_chain><item><author>phkahler</author><text>The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don&amp;#x27;t care what excuse anyone has, don&amp;#x27;t care about your stupid PBX or any of that. Caller ID should be mandatory and reliable.&lt;p&gt;Having said that, always assume someone calling you is a fraud. If your &amp;quot;bank&amp;quot; calls you, tell them you&amp;#x27;ll call back and don&amp;#x27;t call a number they provide over the phone or in caller ID. If you can&amp;#x27;t find a reliable number to the bank, drive over there. The bottom line is that you can&amp;#x27;t trust anyone who calls you.</text></item></parent_chain><comment><author>gerdesj</author><text>&lt;i&gt;The problem here is the ability to spoof caller ID. This should not be possible.&lt;/i&gt;&lt;p&gt;Think of incoming CLID in the same way that you do email From: addresses.  Often and easily faked.  Funnily enough both my office PBX and SMTP daemon check incoming CLID&amp;#x2F;HELO and drop attempts to spoof their own identity.  Its not a particularly sophisticated protection these days but is one of many, many rules.  Actually, now I come to think of it, my firewalls also check for inbound IP spoofing on their own IPs.&lt;p&gt;As the OP stories highlight, your mental firewall must make you bail out when asked for your PIN, regardless of how legitimate things sound.  The only thing that should ever request your PIN is a machine that you have stuffed your card in first.  I&amp;#x27;m pretty certain that CVV requests should also only ever come from vendors that you are buying from, not your bank.</text></comment>
<story><title>Voice Phishing Scams Are Getting More Clever</title><url>https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/</url></story><parent_chain><item><author>phkahler</author><text>The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don&amp;#x27;t care what excuse anyone has, don&amp;#x27;t care about your stupid PBX or any of that. Caller ID should be mandatory and reliable.&lt;p&gt;Having said that, always assume someone calling you is a fraud. If your &amp;quot;bank&amp;quot; calls you, tell them you&amp;#x27;ll call back and don&amp;#x27;t call a number they provide over the phone or in caller ID. If you can&amp;#x27;t find a reliable number to the bank, drive over there. The bottom line is that you can&amp;#x27;t trust anyone who calls you.</text></item></parent_chain><comment><author>walrus01</author><text>There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms like whatsapp, signal, telegram, facebook messenger, and the domestic chinese equivalents (wechat etc).</text></comment>