Tag: identity

  • “Hello can you hear me”: Social engineering or part of the call?

    “Hello can you hear me”: Social engineering or part of the call?

    Have you ever received a phone call where the caller’s first question is, “Can you hear me?”

    A lot of talk on the internet since around 2017 with people saying they were encouraged to say “Yes!” only to later have their voice used to pay for services.

    Disclaimer: I am not a lawyer, and I do not play one on television. I am however familiar with social engineering. I can tell you, in my professional opinion, of all the things that never happened, this never happened the most. đŸ˜‰

    But… really? Is this for real? Or is it fear mongering, which is quite common on the internet? With a simple one word answer, can someone really steal my identity, or obligate me to a purchase?

    Can I be obligated with a single word?

    Yes...No...Maybe

    The answer is: Probably not. Realize, you likely have dozens of video clips with you and your friends on YouTube, or Instagram, or TikTok, or Facebook. And can a single word be used to identify you? So the perpetrators of this likely hoax are saying that a bad actor can order stuff on the internet, be on a call with whoever sales person for however long they need to be on, and then at the crux of the call they will change their voice completely and insert your voice with a single word response “Yes”?

    Does that even sound reasonable? Of course it doesn’t sound reasonable. But it makes for good click bait, and fear mongering creates a lot of interest. The problem is, it also distracts you from real adversaries. Distractions are sometimes fun, but distractions are usually not very good use of your time.

    Why the “Hello can you hear me” then? What are more reasonable thoughts on why these calls come in with that odd question?

    Confirming you are a real person

    Robocall

    The reason for the can you hear me is most likely a robocall where the calling company doesn’t want to waste the time of a real agent. Robo companies are operating on volume – the more the calls the better, because some percentage of people will actually buy what they are selling.

    If an answering machine answers, there is no reason to waste the time of a real agent. When the “just say yes or no” happens, it is because the robocall recognized a voice, but thinks it has an answering machine.

    Buying time for the operator

    A second reason is that the robocaller just transferred the call to a real agent, who is trying to buy themselves time in the awkwardness of having the phone answered. You may have said “Hello” or something else, and they don’t know what you said, so in order to trick you into thinking they were having phone issues they ask you to basically repeat yourself with the cue “Hello? Hello? Can you hear me?”

    Final thoughts

    There are many reasons that a caller would ask whether the called party can hear them, including

    • A delay tactic, while being transferred to a live agent.
    • A simple way to start a conversation and to get the other person to respond.
    • Allows the scammer to test the audio quality of the call and to make sure that they are able to understand the other person.
    • A way to gauge the other person’s interest in the scam. If the other person responds positively to the “Can you hear me?” question, the scammer is more likely to continue with the scam.
    • A way to confuse or startle the other person, making them more likely to fall for the upcoming scam in confusion.
    • A basic tactic for sales, get the potential buyer to get used to saying “yes” in the conversation.

    Now that said, these are my professional opinions. And remember, just because you are paranoid doesn’t mean they aren’t out to get you, so hanging up the phone is the right thing to do.

    From: Your local computer security friend.

  • Coronavirus special report: Separating your Work and Personal identities

    Coronavirus special report: Separating your Work and Personal identities

    The Coronavirus quarantining and social distancing has resulted in tight quarters.  More of us have combined working and living in the same physical spaces now, working remotely or working in other unusual spaces.  There is not the same “clean separation” between Work and Personal space where you leave your home and drive to your work.  However, separating your “Work Identity” and “Personal Identity” remains very important, both for your protection and for the security of your company.

    What you need to know 

    The Internet Villains want to “own” your identity. The more online pieces of identity you leave for them the easier their jobs will be.  And remember, regardless of where you are “physically” located, your company is monitoring everything that you do on your business laptop, on your business cell phone, and on your business email.  This is necessary to protect the company if something goes wrong, for example if your “Work Identity” is stolen.  

    What you need to do

    LinkedIn is a personal social media site. Use your  personal email address for personal sites

    LinkedIn is a personal social media site. Use your  personal email address for personal sites

    When you create online accounts, consider whether the account is something that you wish to retain if you separate from your company, or whether the company needs to retain the account information.  Also consider whether you want your company to monitor everything about the account.  

    • For example, a B2B supplier would likely be a “Work Identity” account.  For those accounts, use your Business email.  
    • On the other hand, a LinkedIn account, Facebook account, or account at your child’s school are “Personal Identity”.  For those accounts, use your Personal email.

    Take away

    Personal identity and Work identity need to remain separated, for both your personal security and the security of your company.  Only use your Work email address when representing the company and when necessary for company business. Use your Personal email address for your personal online identity.

    #cybersecurity #security #infosec #itsecurity #cybersec #cybersec #cybercrime #infosecurity #cyber#privacy #digitalsecurity #informationsecurity #datasecurity #information #identity #cybersecurityawareness #cybersecuritytraining #cybersecuritynews #securityawareness #databreach #dataprotection #securitymanagement #identity #identityprotection

  • Data Breaches Unmasked: The Devastating Reality of Identity Theft

    Data Breaches Unmasked: The Devastating Reality of Identity Theft

    No matter where you live, you’ve probably heard about the many breaches of data that have occurred over the last few years. It is even worse than what you read: identity theft is on the rise. Just to name a few (and no, I’m not singling out any particular companies):

    (more…)