Periodic reminder: EVERYONE. Even very smart people. Even people who work in sec

Comments

1. badsamurai@infosec.exchange@infosec.exchange ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill @wendynather has an incredibly good #BSidesSEA 2025 keynote about this topic.

   Empathy in tech is punk af

   https://youtu.be/HNGdemVgXQc

2. EdTheDev@infosec.exchange ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill Yes. This is such a good reminder.

3. raphaelmorgan@disabled.social ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill I'm pretty sure I've only not gotten scammed yet (to my knowledge) because I have a really hard time paying attention to correspondence. Either I haven't yet seen enough of the scams to fall for one, or I'm not seeing the alerts that I did 🤷 /hj

4. linear@nya.social ⁨1⁩ ⁨day⁩ ago
   @JessTheUnstill@infosec.exchange AT&T sometimes does sign-up bonuses where they send you a visa gift card with $200 on it
   
   and they've clearly got some bad actors in their network who can spoof their call centers (unless the call is coming from inside the house); access personal information on newly-signed-up subscribers including name, address, and account number; and already know your gift card number save the security code.
   
   they try to convince you that they mis-issued it, that it doesn't have money on it, and that they are trying to confirm sending you a replacement.
   
   i fell for them years ago before thinking it through, when they called me while i was still in bed. then i managed to transfer the money off of it before they did
5. cR0w@infosec.exchange ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill but I'm different. and better. maybe even better than the gods

6. lucyruthe@mastodon.social ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill

   I fell for one a few years back that was a text claiming to be the post office when I was already expecting a package and distracted washing dishes. I realized it almost immediately after falling for it and promptly cancelled/updated my card, but feel like the distracted by normal life chores may be a common factor.

7. silver_buttercat@kolektiva.social ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill

   Definitely not too smart to get caught in a scam. 🥴 Fortunately smart enough to bail early and avoid the worst of it. Still got taken for some $$$ but not as much as it could have been.

   Advice: If it seems too good, ask for help; it may save your bank account, identity or reputation. Do NOT be afraid to seek help if something seems off. Better to be safe, than very, very sorry...

8. FritzAdalis@infosec.exchange ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill @badsamurai
   Shoot, I've been phished. It was almost funny looking back at all the things that should have tipped me off. But I been tired, boss. At least I got my money back.

9. geonz@mathstodon.xyz@mathstodon.xyz ⁨1⁩ ⁨day⁩ ago

   @JessTheUnstill Welp, they do target the foolish, but they get a lot of satisfaction from snagging somebody "savvy."

10. boringaccount@mastodon.social ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill this is a good message. i remember the youtube creator jim browning got tricked into deleting his account because someone used some computer tricks to look like they were from google. for those that dont know he was a youtuber known for exposing scammers that took advantage of people and stuff. here is his youtube channel

    link: https://www.youtube.com/@JimBrowning/

11. scottmichaud@mastodon.gamedev.place ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill The biggest enemy to security is complacency. Arrogance is a complacency. (So is greed, fear, etc.)

12. yakkoj@fosstodon.org ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill my "narrowly dodged" thing came in the form of an ESIM added to my mobile phone (fun fact: iPhone just accepts the ESIM and ADDS it and doesn't give a choice to NOT add it.)

    I fortunately wised up and called my mobile provider and deleted the ESIM about 5 minutes after that. Could have been worse.

    Never EVER trust Caller ID; Bell not tying that to ANI before they rolled it out in the 1980s was a BIG mistake.

13. tamarasellman@social.seattle.wa.us@social.seattle.wa.us ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill thank you, it's true, and it's not a one-and-done, either. The scammers change strategies, access points, and now have AI to help them deepfake their way into our private lives. EVERYONE IS A POTENTIAL TARGET.

14. DXMacGuffin@metalhead.club ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill

    Well said. Scamming is a multi-billion dollar industry for a reason - the scammers are smarter and more tech-savvy than the users.

    Keep fighting the good fight, and don't blame the victims.

15. 12thRITS@mstdn.social ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill Too true. Been there.

16. kyhwana@social.furry.nz ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill yeah, this is why we enforce passkeys at work! Its annoying, but not as annoying as having to deal with a users compromised by phishing account!

17. osma@mas.to ⁨1⁩ ⁨day⁩ ago

    I absent mindedly clicked a link in a scam email that followed a pattern i’ve seen before on Tuesday. The message did look like one from a service provider I use, did pass my spam filters, but both the sender address and the link destination were obvious scam - had I paid half a second of attention.
    @JessTheUnstill

18. argv_minus_one@mastodon.sdf.org@mastodon.sdf.org ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill

    So, if I'm constantly worried about being scammed, that makes me highly resistant to scams?

    Rare crippling-anxiety W.

19. masek@infosec.exchange ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill Often it is just a matter of timing.

    A scam you would usually recognize ten miles away can trick you if it arrives at the perfect moment.

20. ayke@blahaj.social ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill yes! I almost fell for one, supposedly coming from the government while I was busy doing tax paperwork. I was so deep into the paperwork that I didn't realize the (in hindsight quite obvious) scam.
    I guess it was the first time I got a scam via SMS, so my defenses were low.

21. ApostateEnglishman@mastodon.world ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill Yep. Any professional magician will tell you that highly intelligent, thoughtful people are actually some of the easiest to fool. Which is why when card cheat Jason Ladanye was interviewed recently, he admitted he'd be unlikely to spot even his own techniques in real-time play. Quite an admission from a man with a planet-sized ego.

    But then you don't get that good without having a deep understanding of the deceptive arts - and that means knowing you too could be scammed.

22. knud@mastodon.social ⁨1⁩ ⁨day⁩ ago

    @JessTheUnstill

    Thank you!

    Just recently had a phonecall from my phone company. Offering me as a long-term customer a better deal on cable.

    I said sure, what's your offer, knowing that maybe, if I'm clever, I can shave 10€/month off our bill. With that mindset I was very close to answering the next question: "I then just need your customer id and date of birth".

    I still don't know if this was legit, but I was sooo close to providing essential data to a cold-calling stranger.

23. edarchis@mamot.fr ⁨21⁩ ⁨hours⁩ ago

    @JessTheUnstill 💯 If Brian Krebs was phished, we can be too. My password manager refusing to autocomplete because the url was wrong already saved me twice but now that they're exploiting OAuth, that won't save me.
    I always tell users that they won't be penalized for falling for a scam but will be if they try to hide it.

24. jplebreton@mastodon.social ⁨21⁩ ⁨hours⁩ ago

    @JessTheUnstill shame should be exclusively narrowly focused on the act of spreading the scam to others around you, eg what we saw with crypto. doubling down is a reflex that should be mediated by social norms incl social pressure. (not really applicable to the huge class of drive-by scams like phishing etc, of course)

25. wanwizard@mastodon.scot ⁨21⁩ ⁨hours⁩ ago

    @JessTheUnstill Some time ago I got woken up by a "Dad, I've got a new number, lost my phone" text, which went on to get me to transfer money to buy a new phone. Still half asleep I nearly did it, until I remembered I should always verify so I replied "Have you asked your sister?" and got the reply "yeah, no money". My son is an only child.

26. jqheywood@mastodon.social ⁨18⁩ ⁨hours⁩ ago

    @JessTheUnstill Yeah, just look at all the folks investing in AI...

27. murdoc@autistics.life ⁨16⁩ ⁨hours⁩ ago

    @JessTheUnstill
    Also, try not to feel bad if you do get scammed. From the Techne program:
    "Don’t let shame prevent learning or reporting. Being deceived is not evidence of stupidity. It is evidence that a technique designed by experienced manipulators worked on a normal human brain — which is what these techniques are designed to do. Shame about being scammed is one of the reasons fraud goes underreported, which allows the same techniques to keep working on other people. Reporting scams to consumer protection agencies, financial regulators, or relevant platforms — even when nothing can be recovered — contributes to collective defence. Community and Cooperation, covered in this level, is relevant here: individual experiences, shared, become community intelligence."
    - Critical Thinking Intermediate, Lesson 6: Scam and Manipulation Defence
    https://techne-system.neocities.org/program/level-2/topic-1/l2t1-iif-ct

    #Techne #CriticalThinking

28. CliftonR@wandering.shop ⁨15⁩ ⁨hours⁩ ago

    @JessTheUnstill

    Yep, I got successfully phished at work a couple weeks ago, via a support email I'd never fall for usually, asking to verify company-owned IT equipment.

    FORTUNATELY in this case, it was a phish training email from the company security team, and took me to a page that explained what they were doing and why.

    It was a good reminder! No matter how good I think I am at spotting the tells, I can miss it if I'm distracted or predisposed to accept something like the apparent topic.

29. niavy@masto.bike ⁨13⁩ ⁨hours⁩ ago

    @JessTheUnstill
    I fell twice.
    2020 on a fraudulent website selling hydroalcoholic solution
    2025, a bank transfer scam on FB marketplace

30. Netzblockierer@tech.lgbt ⁨3⁩ ⁨hours⁩ ago

    @JessTheUnstill I always assume every communication is an attempted scam or phishing unless proven otherwise…

    • Not being paraboid is a "skill issue" in #ITsec…
31. dragonfi@social.jsteuernagel.de ⁨47⁩ ⁨minutes⁩ ago

    @JessTheUnstill I was scammed this year by Tele2. Sales person hinted at fiber, I got coaxial. Customer service said the regret period starts from requesting the service, and not from the day they ship me the equipment. In addition everyone redirected me to the next person who acted just as clueless as the previous one. Stuck with a 2 year contract for a service I don't want or need.