Phone Scammer: "Read Letter Out Loud"???

[Vermonster]

I'm pissed at my wife today, because despite our many conversations about "just hang up" she mostly fell for a phone scam today.

Incoming call to her cell phone:
Caller gave name and badge number indicating her SSN had been stolen and used in TX (we are in the northeast US)
Caller had her name, address, DOB and last 4 digits of SSN
Asked her to verify any banks she had accounts at (did not ask for account numbers)
Asked her to verify at least two credit cards he has (did not ask for account numbers)

She stupidly provided this information, which may well be part of a scam to obtain sufficient information to open new accounts or recover her username/password and access existing accounts. Even possible this was going on real time in the background with another scammer concurrently on the phone with her bank, once she gave out this info. See for example: https://krebsonsecurity.com/2020/04/whe ... call-back/

After obtaining this initial information, she was transferred to a "senior agent", who texted her an image of a letter on official looking SSA stationary. He said he needed her to read it out loud in order to make sure she agreed to the steps being taken to secure her SSN and so that she would not be criminally charged. At this point (FINALLY) she started hearing warning bells and refused, at which point the scammer hung up.

Here is the text of the letter, with my wife's name redacted:

Attorney 600 Army Navy Dr, Arlington VA 22202 United States
LEGAL NOTICE
DISTRICT COURT OF Virginia
Social Security Administration, Case No.: DC3575
Plaintiff Vs. NAME REDACTED Defendant
TO: NAME REDACTED
A lawsuit has been commenced against you in the above-entitled Court by the Plaintiff. Plaintiff's claim V your personal information such as your social security number has been used in the state of Texas for activities such as money laundering which is illegal under 18 United States Code, Sections 1956 and 1957. As per the phone recording served in defence of Miss. NAME REDACTED
The court is willing to accept the proposal to safeguard the funds which defendant claims.
So the court could validate the funds and cancel the arrest warrant .The defendant must comply with all the departmental protocols laid by the DEA (Drugs Enforcement Agency) in order to safeguard the finances that belongs to defendant. If the defendants fail to comply with the protocols a default judgment may be entered against you without notice.
Dated January 19th 2021
Attorney

I am unclear on the value of having her read the letter contents verbatim out loud. Was this to kill time? Get her voice saying name and date and record it to use later? Interested in what folks think. Absent the letter she probably would have continued to provide them information.

For any of you that have not had a recent family conversation about phone scams, let this be a warning. These callers were very good: my wife said completely perfect English with no accents, etc. Only the weirdness of reading the letter out loud, and the reference to the DEA after saying this was a social security matter tipped her off. The story linked to above is particularly concerning; many might fall for it. That's why the rule should be NEVER speak to incoming callers. 99.9% of the time they are scammers and if real, they will never be upset that you want to call them back at the number YOU look up on the back of card, statement, etc.

[MarkBarb]

Is it possible that they wanted a sufficient voice sample to get through some of the voice validation stuff?

My policy is to simply never answer the phone when it comes from someone not in my address book. If it is legit, they'll leave a message and I'll call them back.

[mr_brightside]

yes -- her voice was recorded for future use by the scammers

new accounts can now be created and they have her very own voice as authorization

unfortunately you need to take all necessary steps to freeze your credit and double check all your accounts very closely

they also are now ripe for hacking

PLEASE do NOT ever answer calls from these unknown numbers

-----------------------------------------------

[alfaspider]

The "read the letter out loud" sounds like scare attempt to me, though I suppose there could be voice authentication uses. My guess is that if the mark reads the letter, they will be asked to provide even more information and threatened if they do not. Additionally, the letter is very poorly drafted. If you can read it out loud and are still credulous, you can probably be talked into just about anything.

[Vermonster]

PLEASE do NOT ever answer calls from these unknown numbers

-----------------------------------------------

It doesn't matter what the incoming number is, that is incredibly easy to spoof. Even it the caller ID is the number on the back of your card, that can be spoofed. What can't be spoofed is hanging up and calling back the number on your card (not the caller ID).

Just confused why they needed her to read the letter for voice print, since they had her speaking in response to other questions already.

[alfaspider]

My policy is to simply never answer the phone when it comes from someone not in my address book. If it is legit, they'll leave a message and I'll call them back.

100% this. These days, there's very few reasons to answer a phone call from an unknown number. One strategy I have is that my cell number is not in the local area code (it's where I lived nearly 20 years ago when I first got a cell phone). If I get a phone call from the area where my phone number is tied to, it's 100% a scam as scammers and assorted robocallers like to spoof numbers from your area code. If the area code is from where I actually live, it's probably a legit call. If there's ever doubt, let it go to voicemail. If it's a legitimate caller, they will leave one.

[Vermonster]

Additionally, the letter is very poorly drafted. If you can read it out loud and are still credulous, you can probably be talked into just about anything.

I agree that the letter was poorly crafted. I think had they never shown it, my wife may have given additional information. Instead it was the red flag she needed to finally wake up.
That's why I'm wondering why they use the letter in the first place.

[mushripu]

Voice recording can be spliced together to create a coversational intereaction possibly. This is more sophisticated that normal scams.
In past i have encountered ligitimate scenarios where i had to say yes i accept for services and charges on phone call. This is gonna be used for some variation of it.

[supalong52]

Based on her responses, can they stitch together audio for "at vanguard [or other institution], my voice is my password"?

[new2bogle]

...
My policy is to simply never answer the phone when it comes from someone not in my address book. If it is legit, they'll leave a message and I'll call them back.

I take it a step further and just never answer the phone (only partially facetious). anyone that wants to talk to you will leave a VM.

[alfaspider]

Additionally, the letter is very poorly drafted. If you can read it out loud and are still credulous, you can probably be talked into just about anything.

I agree that the letter was poorly crafted. I think had they never shown it, my wife may have given additional information. Instead it was the red flag she needed to finally wake up.
That's why I'm wondering why they use the letter in the first place.

I think their idea was to make it look both official and threatening. Someone may be unwilling to give up personal info on the phone when asked, but might in response to a threatening and official looking letter. I've read that scammers often intentionally use poor drafting in many communications, as it's easier to weed out the folks who will wise up.

[alfaspider]

Voice recording can be spliced together to create a coversational intereaction possibly. This is more sophisticated that normal scams.
In past i have encountered ligitimate scenarios where i had to say yes i accept for services and charges on phone call. This is gonna be used for some variation of it.

With deep fake technology, you can make someone say anything given a sufficient sample of their voice. That stuff is becoming more accessible to individuals. You could literally have someone at a keyboard typing responses in someone else's voice that would sound pretty convincing if you weren't looking for it. There have been actual examples of scammers using deep fake voice technology to steal money:

https://www.forbes.com/sites/jessedamia ... ebaa122416

[TomatoTomahto]

I take it a step further and just never answer the phone (only partially facetious). anyone that wants to talk to you will leave a VM.

I generally do that also, unless I’m expecting a delivery that requires me opening a door (eg, furniture).

Apparently, the people who are so mortified that the warranty on my vehicle might be expiring won’t leave a message

[arcticpineapplecorp.]

time to shut down your credit file with ALL three agencies:
https://www.bogleheads.org/wiki/Credit_freeze

if you do, they shouldn't be able to open up new lines of credit because they'd need the pin either your or the credit bureaus create when you initiate the freeze.

be sure to keep your pins forever or thawing your credit when you need to can be a royal pain.

don't be too mad at her. You're in good company:

In 2019, 14.4 million consumers became victims of identity fraud — that's about 1 in 15 people. Overall, 33 percent of U.S. adults have experienced identity theft, which is more than twice the global average. More than one in four older adults, aged 55 and over, have experienced identity theft.Oct 28, 2020
https://www.google.com/search?client=fi ... i.d.+theft

[FelixTheCat]

This is why I
1) Froze my accounts at the credit agencies
2) Have Silence Unknown Callers on my phone
3) Have RoboKiller on my phone

[hi_there]

Pretty scary stuff. Especially with the coronavirus, financial firms will not be suspicious of customers doing unusual things over the phone. It's also concerning that your private information, like SSN, birthday, address, voice print, will not change or are unlikely to change, meaning that your identity will possibly be compromised for an extended period of time.

[palaheel]

Call your financial firms also. Some friends came too close to being scammed, and said that Fidelity was extremely helpful.

Regarding fake "being called from" numbers, I once received a call from myself. I understand faking that data, but even so, that kinda freaked me out.

[02nz]

Additionally, the letter is very poorly drafted. If you can read it out loud and are still credulous, you can probably be talked into just about anything.

I agree that the letter was poorly crafted. I think had they never shown it, my wife may have given additional information. Instead it was the red flag she needed to finally wake up.
That's why I'm wondering why they use the letter in the first place.

I read that these are actually often intentionally drafted that way (with lots of grammar and spelling errors), to filter out those who aren't going to fall for the scam easily.

[MindBogler]

My policy is to simply never answer the phone when it comes from someone not in my address book. If it is legit, they'll leave a message and I'll call them back.

This is my policy as well. I never answer phone calls from unknown numbers.

[exodusNH]

My policy is to simply never answer the phone when it comes from someone not in my address book. If it is legit, they'll leave a message and I'll call them back.

This is my policy as well. I never answer phone calls from unknown numbers.

My VM on my cell phone, for many years now, is "Hi, this is X. Either I don't recognize your number or I'm not available. Please leave a message."

[Mudpuppy]

I agree that the letter was poorly crafted. I think had they never shown it, my wife may have given additional information. Instead it was the red flag she needed to finally wake up.
That's why I'm wondering why they use the letter in the first place.

You said the letter was texted, correct? There are image vulnerabilities via text on fairly recent Android cell phones that can allow attackers to run code if you download and open the image, or if you have automatic downloading enabled. The one released last summer was just the most recent in a string of similar vulnerabilities with MMS text messages. MMS is an attack vector.

Everyone else is worried about deep fakes and voice authentication, but I'm worried about malware that might now be on the device. I'd recommend checking that the device is up-to-date on patches.

I've personally disabled the automatic downloading of MMS messages on all my Android devices now, even though I'm running a patched version. Only if I know someone is sending a picture, like when my co-worker's baby was born, do I actually download the image.

[Vermonster]

Hadn't considered the image vulnerability angle.
Fully up to date iPhone so we are probably safe.

[Kagord]

I use Google Voice, in the legacy section you can set up to only allow phone calls from people in your Google contacts, everybody else gets "The google subscriber you have called...yadayadayada", then voicemail eventually. I add to contacts as calls come in that I want to ring, medical, business..etc.

To me, this was life changing, our phone doesn't ring ever unless it's someone we know or a business that is vetted. I easily get 5-8 calls a day that get rejected.

[Mitchell777]

Sorry to hear this. I would freeze credit with all five agencies, change all passwords, and call financial institutions to see if they have any ideas that may help. I have not had this experience but have had someone call Verizon and try to have my landline calls transferred to another number. I set up a PIN for that one.

[Carguy85]

Op just take it a little easy on her. What’s done is done. My brother was called at work from the work phone from a scammer pretending to be law enforcement from a county about an hour away regarding something (totally made up technicality but believable) that would have resulted in a warrant for his arrest. The guy was EXTREMELY convincing even “transferring” my bro to the “local pd” and using his occupation against him. I think the numbers were even very convincing (maybe they were burned?). This is something I would have said he would never have fallen for..I certainly will never answer my phone other than if I know who’s calling but am wondering if I woulda fell for it as well. In the end he was a few hours and about $600 out. Of course in this day and age even answering a phone to a recognized number isn’t even 100%.

[SmileyFace]

Hadn't considered the image vulnerability angle.
Fully up to date iPhone so we are probably safe.

Was it definitely an image over text? Or did she click a link to access the image?

[Vermonster]

JPEG (JPG) image.
Submitted to virustotal with no hits (not surprising since I assume anything really nefarious would likely be stripped in the process of sending to her iPhone or forwarding to my GMail).

[Poor Rod]

I've received calls from my bank (Ally) that I was either expecting or otherwise was 99.999% sure were legitimate, but if they need information I tell them that since I didn't initiate the call I won't provide it. They always understand and give me a case number. I then call Ally, give them the case number, and we pick up the conversation again after they confirm my identity. But yeah, it takes a while to get to the always on defense mentality.

I always think that people who have weak passwords are a prime target for scammers. Not because of the weak passwords, but because of the low security awareness they have.