Vishing: Dialing for Dollars, Part II
Security Fix received a copy of a new scam e-mail targeting Bank of America customers that is likely to con quite a few folks before it is shut down.
Sure, Bank of America is hit by this sort of thing all the time. It's the fourth most popular target for "phishing" scams that use e-mail to lure people into giving away their data at counterfeit sites, according to stats just released by PhishTank. But this is one of the more convincing voice phishing or "vishing" attacks I've seen yet.
Vishing scams start with an e-mail lure that asks the recipient to call a specific 1-800 number to settle some matter with his or her account. The numbers usually are connected to an automated system that asks the caller to key in data from a credit card -- the 16-digit account number, the expiration date and the three-digit security code on the back.
This new Bank of America scam has the same elements, but its execution is nearly flawless (unlike the majority of previous vishing scams Security Fix has seen, which either bungle the voice mail system or use a lure full of poor spelling and grammar). It informs the recipient that his account has been suspended because it was used to purchase "obscene or certain sexually oriented goods or services." From the e-mail:
"We are hereby notifying you that, after a recent review of your account activity, it has been determined that you are in violation of Bank of America's Acceptable Use Policy. Therefore, your account has been temporarily limited for: hotjasmin.com cam shows. In order to remove the limit please call our TOLL FREE number [omitted]." That domain is registered to a guy in the Netherlands, but it's currently inactive.
I recorded a short snippet of the first 45 seconds or so of the automated phone message used in this attack. If you enter the requested information, the voice then asks for your bank PIN: "Bank of America asks for your PIN in order to verify your identity. This also enables us to assist federal authorities in order to prevent money laundering and other illegal activities."
Generally, it's a good idea not to even dial these bogus 1-800 numbers, as you're essentially giving the scammers your phone number, a key piece of your personal data. It's also a good idea to be very suspicious of e-mails that ask you to call any number. When in doubt, open up a browser Window and find the official Web site of your financial institution, then look up the customer-service number listed there.
By Brian Krebs |
March 8, 2007; 12:26 PM ET
Fraud
, Latest Warnings
, Misc.
, Safety Tips
Previous: Apple Patches QuickTime Holes |
Next: Patch Reprieve for March's Black Tuesday
Posted by: Michael | March 8, 2007 12:51 PM
I get the poorly made fake calls a couple of times every week. A very slow-speaking voice, ennunciating carefully: "Please call . It is VERY IMPORTANT (their emphasis) that you return this call as soon as possible." Never any company name given, and after a couple of months of calls with an authoritative woman's voice, they tried a deep, stern male voice. I was wondering what it might be, but I knew it couldn't be anything good. I deleted it the first time I heard it just because it sounded so specious.
Posted by: tiranda | March 8, 2007 4:53 PM
The world of the internet makes me think about security differently. But this may cause Catch-22 problems when I am called. "This is the Red Cross?" "This is the IRS" "This is Bank of America?" How can I be sure? They want to confirm that it is really me, but how do I confirm that it is really them? The only way is to look up their telephone number in the phone book or on their website and call them, but you'll never get to the same person that has your case or whatever.
Perhaps this would be a welcome end to telemarketing??!?! One can always hope. I did get a legitimate (I think) series of calls (one per day) from a collecting agency about an outstanding parking ticket. Their messages sounded so much like a phishing scam I didn't want to call backm but did after months of these phone calls. Of course, they couldn't do anything without asking me my license plate number, which I shouldn't have told them.
Posted by: terry | March 9, 2007 1:01 PM
I received that email, but it seemed odd so I checked my browser history for the website listed in the e-mail. No website was visited during the time in which the e-mail was received. I then did a search of the telephone number via search engine yahoo.com, but nothing came up. I then searched for the website listed in the e-mail and found this posting which descibed the same situation. I just want to say thanks for having this site and for having this information available.
Posted by: Tom | March 14, 2007 1:51 AM
here in australia - there's an epidemic of emails - purportedly from our leading banks - asking us to click on their ( supposed bank)website to right some wrong or to claim some money in our bank accounts - never a dull moment it seems.
Posted by: neville johnstone | March 15, 2007 3:53 AM
Instead of being lured into giving info away, why dont folks simply respond with "I'm an adult over 21 - what I buy with MY credit cards is MY business" or simplest of all, review your credit card statement online and dispute any charges you didnt make? If folks understood how to use their credit cards etc or how online purchasing works (including disputeing charges and their rights as credit card holders) they would not click links, respond to e-mails, or give personal info away over the phone to anyone with whom they themselves did not initiate true and correct contact!! I get a dozen or so phishing e-mails a month but when "BB&T" says my account is delinquent and I must fix it immediately, I know that I should ignore it because 1. I can go to www.BBandT.com to see my account status myself (so I probably would know about a problem before they had a chance to tell me about it) and 2. I dont even HAVE a BB&T account (and if I did they would know my name and account number, not refer to me as "Daer BBnT accountmember:" OR ask for my account number, OR route their e-mails through Nigeria or Romania)
Posted by: tunatofu | March 19, 2007 1:48 PM
Terry, when I get those calls, I tell them that I dont give out that information over the phone unless -I- called them. I have had a couple provide me with -A- number to call (not necessarily -THE- number though - but most get irrate and hang up. If I want to be sure that it is THEM on the other end of the phone, I dial the number on the back of my credit card, bank statement, or look them up on their ACTUAL web site (usually under "contact us").
Posted by: | March 19, 2007 1:51 PM
The comments to this entry are closed.










One assumes the phone number wasn't a "toll free" one either.
This kind of ruse would be a good way to get incautious users to dial a premium-rate number.
There's a current scandal in the UK over television stations who've been abusing premium-rate dial-in numbers. The BBC, Channel 4, and ITV have all been treating people who've been induced to phone premium lines in unacceptable ways.
For example, they have been accepting calls they don't intend to use--telling people to dial a premium line to vote for a game-show contestant when they've already chosen the winner, and the callers can't possibly affect the result.
http://www.timesonline.co.uk/tol/news/uk/article1488735.ece
If supposedly above-board organizations like TV stations are doing such things, is it plausible that spammers are not? Certainly there's a lot of mobile phone text message spam in the UK that's aimed at getting people to ring premium-rate lines.