0b11011001
Active Member
I really want to drop the subject to not detract from the thread -- but given the confusion, I'll comment again. Just when I think I'm you, you pull me back in.
I think I confused matters by calling it a "scam" (agree most "scams" are elaborate interactive voice and text schemes) -- the correct word is to "hack" into your accounts.
The vulnerability has to do with 2-factor authentication. It doesn't matter if you never conduct business in a public place. It doesn't matter if you don't bank on your phone. It doesn't matter if you don't run apps in public. It doesn't even matter if you keep your phone in your pocket the whole time, because you're likely to pull it out when you hear a text come in. There is nothing whatsoever you can do behaviorally on your phone to prevent it, other than suppressing text previews and popups (which many find a huge inconvenience to disable).
This is how it works: A hacker who knows your email (but not any of your passwords) goes the login page of one of your accounts using the browser on their phone while they are near you in some public place. They know your email address, but they can't get in because they don't know your password. So they click "forgot my password" or "log in with security code" (increasingly common), and then choose "send security code to my phone" instead of send code to your email. This causes the website to send a (typically) 6-digit security code to the phone number registered on your account (your mobile phone) to validate that it is you that is trying to log in. Of course it isn't you trying to log in, it's the hacker, but the hacker will be able to read the code popup on your phone because they control exactly when the text comes in. They can just stand behind you in line and see over your shoulder, or wait until you're distracted talking to somebody, or wait until you put your phone down on the counter while you place your order, etc. As mentioned, you can even have your phone in your pocket, but you hear the text and pull the phone out while they walk behind you and read it. It's not hard to see the code when the hacker controls exactly when it comes in. They enter the code into the website, which allows them to create a new password, and now they can hack away in that account.
Many banks now require usernames rather than emails, so that helps prevent it from being used on bank accounts, but not services like Venmo, Paypal, etc -- but the security codes are not secure the way they are currently sent for most systems.
The scenario you mention, requires that the stars align just right for all those things to take place, at just the right time, that it is almost impossible, but certainly not a mainstay in stealing account info.
And if it does matter if this is happens in a public place, because a stranger is not going to be in my home, and I don’t do financial transactions in public places or on public WiFi, even though all my phones connections go through a VPN.
Our banks have always required a username and password for authentication. But I also have a specific email address for financial transactions. It is not a Gmail, outlook, or yahoo account. It is with my own hosted website.
As I said before, you can turn notifications off, and you can do it for specific apps, you can choose what sort or notifications you get and how much content is displayed in the preview.
But what I want to know is, assuming they have my email address, how did they get my account number to request a password change?
And there is no misunderstanding here. I am aware of what is being discussed here.
