Voice phishing

Voice phishing is the criminal practice of using social engineering over the telephone system to gain access to private personal and financial information from the public for the purpose of financial reward. Sometimes referred to as 'vishing',[1] the word is a combination of "voice" and phishing. Voice phishing exploits the public's trust in landline telephone services, which have traditionally terminated in physical locations known to the telephone company, and associated with a bill-payer. Voice phishing is typically used to steal credit card numbers or other information used in identity theft schemes from individuals.

Some fraudsters use features facilitated by Voice over IP (VoIP). Features such as caller ID spoofing (to display a number of their choosing on the recipients phone line), and automated systems (IVR).

Voice phishing is difficult for legal authorities to monitor or trace. To protect themselves, consumers are advised to be highly suspicious when receiving messages directing them to call and provide credit card or bank numbers — vishers can in some circumstances intercept calls that consumers make when trying to confirm such messages.

Example

  1. The criminal either configures a war dialer to call phone numbers in a given region or list of phone numbers stolen from an institution.
  2. Typically, when the victim answers the call, an automated recording, often generated with a text to speech synthesizer, is played to alert the consumer that their credit card has had fraudulent activity or that their bank account has had unusual activity. The message instructs the consumer to call the following phone number immediately. The same phone number is often shown in the spoofed caller ID and given the same name as the financial company they are pretending to represent.
  3. When the victim calls the number, it is answered by automated instructions to enter their credit card number or bank account number on the key pad.
  4. Once the consumer enters their credit card number or bank account number, the visher has the information necessary to make fraudulent use of the card or to access the account.
  5. The call is often used to harvest additional details such as security PIN, expiration date, date of birth, etc.

Although the use of automated responders and war dialers is preferred by the vishers, there have been reported cases where human operators play an active role in these scams, in an attempt to persuade their victims.

Another simple trick used by the fraudsters is to ask the called party to hang up and dial their bank - when the caller hangs up, the fraudster does not, keeping the line open and remaining connected when the victim picks up the phone to dial.[2] When in doubt, calling a company's telephone number listed on billing statements or other official sources is recommended as opposed to calling numbers received from messages or callers of dubious authenticity. However, sometimes hanging up and redialling is insufficient: if the caller has not hung up, the victim might still be connected and the fraudster spoofs a dial tone down the phone line when the victim dials and a fraudster's accomplice answers and impersonates whoever the victim is trying to call.[3] This is known as a 'no hang-up' scam.[4] Hence consumers are advised to use a different phone when dialling a company's number to confirm.

Modern Solutions

As defined by Song, Kim and Gkelias (2014),[5] voice phishing is the act of a victim disclosing confidential and sensitive information such as personal finances to a scammer through social engineering (p. 865).[5] The decision for someone to carry out such a delicate action is heavily based on the faith that individual holds with their telephone service. Song et al. made an initiative to combat this concern with improved authentication of origin detection through pinpointing masked call numbers with a solution called iVisher. iVisher traces call data back to its source which is a PBX that governs the authentic caller ID pertinent to the name getting displayed for all VoIP calls (p. 868).[5]

To elaborate further on the role of authentication with iVisher as drawn out by Song et al. (2014),[5] masked caller identities can effectively be pinpointed without significantly slowing down the time to set up the call (p. 865).[5] In turn, if suspicious calls arise, a warning message is delivered to the one receiving the call regarding the matter. This is all done to check if IP spoofing occurs. In turn, authentication improves efficiency through informing the caller of whether or not their privacy is being compromised.

See also

References

  1. ↑ LaCour, John. "Vishing campaign steals card data from customers of dozens of banks". PhishLabs. Retrieved 1 June 2014.
  2. ↑ "'Vishing' and courier scam complaints increase". BBC News. Retrieved 26 November 2015.
  3. ↑ "Barclays refunds grandmother's £68k following vishing scam". BBC. Retrieved 4 August 2014.
  4. ↑ Milligan, Brian (6 July 2015). "Banks not liable in most vishing fraud, says Ombudsman". BBC News Online. Retrieved 17 September 2015.
  5. 1 2 3 4 5 "Mason Central Authentication Service". mutex.gmu.edu. Retrieved 2016-05-02.

External links

This article is issued from Wikipedia - version of the Tuesday, May 03, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.