Programmer Humor

I know someone who got had by a spearfishing call. They knew all the details about his phone contract, sounded 100% legit. The scammer got thousands of dollars in prepaid SIM cards from his account.

After the police investigation, turned out that the scammer was actually a former employee of the phone company who downloaded a copy of the customer list when he got fired.

Apple ain't using Let's Encrypt

To be fair, I've seen just about everyone use Let's Encrypt, from banks to nsa.gov. The latter has switched their certificate provider though.

So are you saying the original email genuinely was from Apple? If so do you have any idea how the scammers got all that info? And did you ever receive the legitimate call back from Apple?

Imagine when AI is automating the whole process. Including the phone call.

That's frightening

Thanks for sharing your story! It is very important to get these stories as well, someone who has 20 years in tech so close to getting scammed..

You did the correct thing and kept track of the url etc. on an offday you might not have been so vigilant.

They got you because you're not familiar with the Apple ecosystem nor their support system. That's all sus as hell.

You also failed at basic opsec because you allowed them to control the flow of communication.

Was there actual suspicious activity? Did an actual Apple representative ever contact you because it sounds like the whole thing was a phish but you make it sound like they just got the case number and timing when the more likely scenario is that the email was also them.

I send anything that isn't plain text or something I requested straight to security to keep those fucks sharp, I wish they summarized emails I sent them instead of complaining that I keep doing it though.

yeah the only phishing tests that got me were that and an invite to a Teams team because i get added to a new team every week or so lol

The policy is that you don't have privacy and that they sell your data.

I've heard that too. But, super-realistic scams exist, so if that's right it's just splitting the difference between the two that's a bad strategy.

Depends on what the end goal is. Wire fraud? Sure. Typically a Business Email Compromise will try and compromise the account credentials to use it as a location to send other mass phishing attacks to their contacts, gain access to sensitive information the user had, or laterally move between systems and further compromise the organization. In that case, you would want the message to appear as legitimate as possible to gain access to the highest privileged accounts.

Not sure if emails work the same way, but this is how phone scammers work

If you interact with a phone scammer, send them to hell or do anything at all with them, you just get added to a big lost of people that respond to scam calls and so you get more calls

It drives me nuts that I can't turn off the unsubscribe feature entirely. I'll use their unsubscribe button once, and if it doesn't work, then all future emails are getting forwarded back to whoever I gave the email address.

At this point, that's like a default corporate feature.