<story><title>When MFA isn&apos;t MFA, or how we got phished</title><url>https://retool.com/blog/mfa-isnt-mfa/</url></story><parent_chain><item><author>dataflow</author><text>&amp;gt; this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information.&lt;p&gt;The trouble is, calling the number on the back of your card requires actually taking out your card, dialing it, wading through a million menus, and waiting who-knows-how-long for someone to pick up, and hoping you&amp;#x27;re not reaching a number that&amp;#x27;ll make you go through fifteen transfers to get to the right agent. People have stuff to do, they don&amp;#x27;t want to wait around with one hand occupied waiting for a phone call to get picked up for fifteen minutes. When the alternative is just telling your information on the phone... it&amp;#x27;s only natural that people do it.&lt;p&gt;Of course it&amp;#x27;s horrible for security, I&amp;#x27;m not saying anyone should just give information on the phone. But the reality is that people will do it anyway, because the cost of the alternative isn&amp;#x27;t necessarily negligible.</text></item><item><author>macNchz</author><text>Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you &lt;i&gt;receive&lt;/i&gt; a phone call (or other message) and someone starts asking for information. It&amp;#x27;s always okay to say, &amp;quot;actually, let me get back to you in a minute&amp;quot; and hang up, calling back on a known phone number from the employee directory, or communicate on different channel altogether.&lt;p&gt;Organizationally, everyone should be prepared for and encourage that kind of response as well, such that employees are never scared to say it because they&amp;#x27;re worried about a snarky&amp;#x2F;angry&amp;#x2F;aggressive response.&lt;p&gt;This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card.</text></item></parent_chain><comment><author>strken</author><text>I say &amp;quot;If this is a scam call please hang up now, otherwise give me an invoice or ticket number or name and department and I&amp;#x27;ll get back to you,&amp;quot; and they usually &lt;i&gt;do&lt;/i&gt; hang up. The case where you need to actually call your bank is really rare.&lt;p&gt;Note that it&amp;#x27;s very important not to let them give you an actual phone number to call on. This sounds obvious but I know someone who hung up but called back &lt;i&gt;on a number given by the scammers&lt;/i&gt;, which was of course controlled by them and not the bank.</text></comment>
<story><title>When MFA isn&apos;t MFA, or how we got phished</title><url>https://retool.com/blog/mfa-isnt-mfa/</url></story><parent_chain><item><author>dataflow</author><text>&amp;gt; this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information.&lt;p&gt;The trouble is, calling the number on the back of your card requires actually taking out your card, dialing it, wading through a million menus, and waiting who-knows-how-long for someone to pick up, and hoping you&amp;#x27;re not reaching a number that&amp;#x27;ll make you go through fifteen transfers to get to the right agent. People have stuff to do, they don&amp;#x27;t want to wait around with one hand occupied waiting for a phone call to get picked up for fifteen minutes. When the alternative is just telling your information on the phone... it&amp;#x27;s only natural that people do it.&lt;p&gt;Of course it&amp;#x27;s horrible for security, I&amp;#x27;m not saying anyone should just give information on the phone. But the reality is that people will do it anyway, because the cost of the alternative isn&amp;#x27;t necessarily negligible.</text></item><item><author>macNchz</author><text>Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you &lt;i&gt;receive&lt;/i&gt; a phone call (or other message) and someone starts asking for information. It&amp;#x27;s always okay to say, &amp;quot;actually, let me get back to you in a minute&amp;quot; and hang up, calling back on a known phone number from the employee directory, or communicate on different channel altogether.&lt;p&gt;Organizationally, everyone should be prepared for and encourage that kind of response as well, such that employees are never scared to say it because they&amp;#x27;re worried about a snarky&amp;#x2F;angry&amp;#x2F;aggressive response.&lt;p&gt;This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card.</text></item></parent_chain><comment><author>macNchz</author><text>I don&amp;#x27;t think most people who get scammed this way pause to say &amp;quot;oh, this might be someone stealing my credit card number&amp;quot;, then disregard that thought because it&amp;#x27;s too much of a pain to call back on an official line. Instead I think they don&amp;#x27;t question the situation at all, or the scammer has enough information to sound sufficiently authoritative. Most non-technical people I&amp;#x27;ve talked to about this are pretty scared of getting scammed, but tell me the thought never crossed their mind they could call back on a trusted number.&lt;p&gt;I like the &amp;quot;hang up, call back&amp;quot; approach because it takes individual judgment out of the equation: you&amp;#x27;re not trying to evaluate in real time whether the call is legit, or whether whatever you&amp;#x27;re being asked to share is actually sensitive. That&amp;#x27;s the vulnerable area in our brains that scammers exploit.</text></comment>