Chris Hogg wrote:

> I assume the second phone call from the scammer was another attempt to get
> some more details to open the app, having failed the first time.

More likely the first call did allow them to login, maybe harvest details of
some recent transactions to convince you during the second call that they are
genuine, and use the pinsentry again to add a new payee to make a transfer.

> I hope that's the end of it.

Indeed, lucky escape ...

Chris Green wrote:

> John Rumm wrote:
>
>> Barclays also use it in branch - say when making a cash withdrawal
>> over the counter.

For paying in batches of cheques I take them to the counter (the app only allows
a small number per week and a low value per cheque) the auto cheque scanners in
branch are comically inaccurate.

> You mean your card in the reader and enter your PIN? I think I'd
> run a mile!

Paying-in slips no longer seem to exist (nor pens on dangly chains) after you
explain why you refuse to use the cheque scanners, they harrumph and ask you for
your debit card hand it back within their pinsentry for you to enter pin, then
swipe the cheques through the MICR slot on their keyboard.

John Rumm wrote:

> Jeff Layman wrote:
>
>> Out of interest, what online banking can you do with a phone app that you
>> can't do with a computer at home?
>
> There are a number - off the top of my head:

dial up/down the payment limits on the card, and cash machine daily limit.

withdraw "emergency" cash from a machine without your debit card.

Since my Dad's death, I seem to have become the family money-lender, so making
transfers in response to a phone call or text message is "necessary"

Well, the question is, who initiated the discussion. I would never give
anyone the details if they started it, even if it was from an apparently
genuine email.
I have no idea about this system as my card has no pin, its a chip and
signature card which the bank says is better for blind people as many point
of sale pin number pads are now touch screen and cannot be used without
sight, However we now have the learning curve of teaching the retailers that
these are legal cards and they would not have the hassle of going back in
time if they had purchased proper tactile point of sale pin number entry
pads. Words fail me really, not enough forethought given once again.
I'm not going to get a chip and pin card, and let some shop assistant key
it in, now am I?
Brian

--

--:
This newsgroup posting comes to you directly from...
The Sofa of Brian Gaff...
briang1@blueyonder.co.uk
Blind user, so no pictures please
Note this Signature is meaningless.!
"Chris Hogg" <me@privacy.net> wrote in message
news:93dalhdr7g1g52pd2v1rp4pshqkfud1l64@4ax.com...
>I got scammed at the end of last week. All sorted and no harm done,
> but the scammer told me that the normal security checks such as
> mother's maiden name etc was no longer being used, and everything was
> being done via the Pinsentry system. After resistance from me I
> eventually went along with it and gave him all he asked for! :-(
>
> As I said, no harm done because I immediately contacted my bank who
> blocked everything, but be aware that the scammers are now trying to
> use the Pinsentry system to get account details etc from people who
> are unfamiliar with Pinsentry.
>
> Different banks may have different names for the system. It's
> basically a card reader that can confirm a person's identity. It's a
> pity the banks don't have a similar system for confirming who they
> are, so that the private individual can check they're not talking to a
> scammer.
>
> --
>
> Chris

On Mon, 24 Oct 2022 19:25:05 +1100, Brian Gaff <brian1gaff@gmail.com>
wrote:

> Well, the question is, who initiated the discussion. I would never give
> anyone the details if they started it, even if it was from an apparently
> genuine email.
> I have no idea about this system as my card has no pin, its a chip and
> signature card which the bank says is better for blind people as many
> point
> of sale pin number pads are now touch screen and cannot be used without
> sight,

Makes more sense to use apple pay given you have an iphone already.

> However we now have the learning curve of teaching the retailers that
> these are legal cards and they would not have the hassle of going back in
> time if they had purchased proper tactile point of sale pin number entry
> pads. Words fail me really, not enough forethought given once again.
> I'm not going to get a chip and pin card, and let some shop assistant
> key
> it in, now am I?

See above.

On 24/10/2022 09:07, Andy Burns wrote:
> John Rumm wrote:
>
>> Jeff Layman wrote:
>>
>>> Out of interest, what online banking can you do with a phone app that
>>> you can't do with a computer at home?
>>
>> There are a number - off the top of my head:
>
> dial up/down the payment limits on the card, and cash machine daily limit.
>
> withdraw "emergency" cash from a machine without your debit card.
>
> Since my Dad's death, I seem to have become the family money-lender, so
> making transfers in response to a phone call or text message is "necessary"

My eldest son is a student, living away and he runs two debit cards.

One account, for day to day use, only ever has a small sum of money in
it and he transfers money over from his other account as needed.
Compromising of that account would not matter.

The other account may at times have his student loan payment, our
accomodation cost contribution and his pay from his part-time job in it.
He does not use that account for day to day use or online purchases. He
does carry the debit card, but it is disabled from any use. If he
suddenly needed it due to any problem with his day to day account, he
can re-enable it immediately using the phone app ... which also allows
to to be re-enabled for a single use, re-enabled with a pre-set limit,
to only be used with a PIN, to be enabled with a pre-set contactless
limit or to be enabled for an online transaction. He can then disable it
or any one usage type again, as soon as he doesn't need it.

On 24/10/2022 08:41, Chris Hogg wrote:
> On Mon, 24 Oct 2022 01:43:58 +0100, John Rumm
> <see.my.signature@nowhere.null> wrote:
>
>> On 23/10/2022 17:54, Chris Hogg wrote:
>>> On Sun, 23 Oct 2022 17:35:40 +0100, Andy Burns <usenet@andyburns.uk>
>>> wrote:
>>>
>>>> Chris Hogg wrote:
>>>>
>>>>> Perhaps the whole pinsentry thing was just a
>>>>> smoke-screen to make it look as though the scammer was genuine. Unless
>>>>> they could somehow unscramble the number it gave and make use of the
>>>>> pin.
>>>>
>>>> No, they can't get your PIN from the code you gave them.
>>>>
>>>> But they can use it for a one-time logon to your bank, if they know the details
>>>> that e.g. appear on one of your cheques.
>>>>
>>>> What was the purported reason for the cold call?
>>>
>>> He said it was because there was a debit transaction they thought was
>>> suspicious, and they had blocked it temporarily but needed my details
>>> to block it permanently.
>>
>> Indian?
>
> No, English. Slight accent (i.e. not BBC English) but I couldn't tell
> you from where.
>>
>> Did they just want the ID code (i.e. that generated just from your pin
>> and your card)?
>>
> 16 digit card number and the response from the pinsentry.

With the card number, the response code would be enough to login to
online banking. However at that point they would have found out (if they
did not already know) that you did not have it setup. It may have been
enough to try set it up, and possibly then enable the app.

>> With other details it might be enough to login to your account - but
>> would not be enough to make a payment to a new payee.
>>
>> (However one way they try and get round that is to see if you have a
>> payee already setup for a suitable intermediate business. They then pay
>> a lump sum to that business from your account, and then ring that
>> business and claim to be you, and explain that you just realised you
>> made a mistake when making an online payment, and paid them by mistake.
>> Could they refund it - to a different account)
>
> There are DD's to utilities etc, but I've never used BACS or similar.

The payment of a DD will be satisfied via a BACS payment usually - so
although you may not have used one "manually", you will have done
implicitly. So further payments to those utilities could be made without
further checks.

> Yesterday morning the scammer rang me again, claiming to be from
> Barclays security, as before, and asking me to have my card reader
> ready. Different accent.

Yup many of the "better" scams are multiple stage these days - the first
to gain information that can be used later to better effect.

(much like these "you have postage to pay on a parcel" scams that take
you to a lookalike courier or royal mail web site to make a small
payment. It is a way of harvesting enough information from you to make a
call a couple of weeks later from the "security" department of your bank
far more convincing)

> I hung up. Earlier that morning I'd had an
> email welcoming me to the Barclays app. Looked very convincing, with
> all the things I could do with the app. There was a phone number to
> ring if I wanted to cancel the app. It wasn't a standard Barclays
> number, which raised my suspicions. I didn't touch any of it and I've
> double-deleted it (i.e. it's no longer even in my 'deleted' folder).

It is possible it may have been a genuine email, if the fraudster had
managed to setup the app. (although if you have no online capability
setup with the bank then it raises the question as to why it came to
your real email address).

In cases like that I would be tempted to keep a copy of the email for
evidential purposes, and also you could forward it to the barclays
phishing reporting address.

https://www.barclays.co.uk/help/security-fraud/email-details/

> I rang Barclays and they confirmed they had blocked my debit card on
> the Friday when I first contacted them, and that someone had tried to
> register the app, but they had also been blocked. I made sure that
> Barclays had also blocked any on-line banking and telephone banking -
> I don't use them, have never used them and don't need them - I manage
> perfectly well without them. Barclays also confirmed that no money had
> been taken from my account. I assume the second phone call from the
> scammer was another attempt to get some more details to open the app,
> having failed the first time.
>
> I hope that's the end of it.

Possibly - although you are now dealing with a spear phisher rather than
the more common or garden variety. They now have enough information to
target you directly, and may try additional attacks using the phone or
other channels.

You have probably neutralised most threats already, so just a case of
staying vigilant.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 24/10/2022 07:51, Chris Green wrote:
> Andy Burns <usenet@andyburns.uk> wrote:
>>
>> Chris Green wrote:
>>
>>> You should never tell anyone the 'magic number' the card reader gives you.
>>> The only thing you should ever do with it (as far as I am aware) is to enter
>>> it in the right field when logging in to your bank or when confirming
>>> payments and such.
>>
>> The counter staff sometimes ask you to put your PIN into their PINsentry to
>> verify your ID in branches
>
> I don't think I have been to my personal banking bank for decades! :-)
>
> The above wouldn't work for HSBC anyway as their equivalent of
> pinsentry is personalised and doesn't require your bank card.

It is still vulnerable to a social engineering attack though - e.g. a
security department on the phone from your bank getting you to divulge a
code. All it does is change one of the factors in the MFA - the
something you "have" becomes the security key rather than your debit
card. The something you know (i.e. the pin for the device / card)
remains broadly the same.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 24/10/2022 07:55, Chris Green wrote:
> John Rumm <see.my.signature@nowhere.null> wrote:
>> On 23/10/2022 16:39, Chris Green wrote:
>>> Chris Hogg <me@privacy.net> wrote:
>>>> On Sun, 23 Oct 2022 14:32:38 +0100, Martin Brown
>>>> <'''newspam'''@nonad.co.uk> wrote:
>>>>
>>>>> and doing the
>>>>> ID me by PIN and passing him that information
>>>>
>>>> No, I didn't give him my pin, at least not directly, unless he is able
>>>> to deduce it from my pinsentry response. Could that happen, and if so,
>>>> what's the point of pinsentry? Not a sentry at all.
>>>>
>>> I don't really understand this. You should never tell anyone the
>>> 'magic number' the card reader gives you. The only thing you should
>>> ever do with it (as far as I am aware) is to enter it in the right
>>> field when logging in to your bank or when confirming payments and
>>> such.
>>
>> Barclays also use it in branch - say when making a cash withdrawal
>> over the counter.
>>
> You mean your card in the reader and enter your PIN? I think I'd
> run a mile!

No, they have their own card readers. They enter the transaction details
into it and hand it to you to enter your pin. When you do that it
generates a OTP that the staff can use to finish the transaction.

So the bank staff don't learn your pin, and you are giving away no more
information than would be required to get the money from a cash machine.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

John Rumm <see.my.signature@nowhere.null> wrote:
> On 23/10/2022 16:39, Chris Green wrote:
> > Someone asking you what the number is screams 'scam' at me.
>
> Indeed, but that is where the job of a good pretexter comes in. To
> concoct a storey plausible enough to make it seem reasonable enough in
> the this context.

Quite often the people caught are those for whom the pretext matches
something they were expecting anyway.

The classic one is parcel delivery scams: people get parcels all the time
nowadays, so a fake tracking website / excess postage or tax to pay / 'while
you were out' message is plausible enough to hook somebody in.

Everyone laughs at Nigerian prince emails (which are a filter for only the
exceptionally gullible), but somewhere somebody will be expecting an
inheritance or sale of a property, and cast the net wide enough and you
might hook them.

Once they have you hooked, then the pretexting starts.

So we shouldn't be complacent that we won't be taken in, because eventually
we will. The thing to think about is what defences we might use to prevent
the hook turning into actual damage.

Theo

On 23/10/2022 19:20, Andy Burns wrote:
> The Natural Philosopher wrote:
>
>> I dont use a phone app.
>> I use a PIN sentry
>> It wants my membership number, my credit card number and a pin sentry
>> generated code
>
> the phone app incorporates the functionality of a PINsentry, without
> having to carry around a bit of blue plastic.

But it isn't a PIN sentry. It's an app. Insecure as ***k

--
The New Left are the people they warned you about.

On 23/10/2022 21:59, Vir Campestris wrote:
> On 23/10/2022 18:46, charles wrote:
>> when I was called by a scammer on my landline, I rang my bank using my
>> mobile phone.
>
> When my bank called me and wanted to ask me some security questions I
> pointed out that he had a good idea who I was, he'd phoned me, but I had
> no idea who he was.
>
> There was a pause.
>
> "You're right you know, but no-one else has ever said that!".
>
I said the same to my bank once. And got a similar reply. As I mentioned
they said 'call the number on your credit card'. So I did.

> I took his name and department and called him back. Yes, it really was
> my bank. And it's depressing that my comment was either needed or new.
>
yes.

> Andy
>

--
The New Left are the people they warned you about.

On 24/10/2022 07:51, Chris Green wrote:
> Andy Burns <usenet@andyburns.uk> wrote:
>>
>> Chris Green wrote:
>>
>>> You should never tell anyone the 'magic number' the card reader gives you.
>>> The only thing you should ever do with it (as far as I am aware) is to enter
>>> it in the right field when logging in to your bank or when confirming
>>> payments and such.
>>
>> The counter staff sometimes ask you to put your PIN into their PINsentry to
>> verify your ID in branches
>
> I don't think I have been to my personal banking bank for decades! :-)

I have never been inside my bank branch (which for peculiar reasons of
takeovers and mergers was not my nearest branch with bank name on it).
>
> The above wouldn't work for HSBC anyway as their equivalent of
> pinsentry is personalised and doesn't require your bank card.

HSBC and several others have recently closed their branches. The High
Street now quite literally has several "holes in the wall" where bank
machines used to reside. Last men standing are Barclays and Santander.

--
Regards,
Martin Brown

On 23 Oct 2022 at 13:49:48 BST, Chris Hogg <me@privacy.net> wrote:

> I got scammed at the end of last week. All sorted and no harm done,
> but the scammer told me that the normal security checks such as
> mother's maiden name etc was no longer being used, and everything was
> being done via the Pinsentry system. After resistance from me I
> eventually went along with it and gave him all he asked for! :-(

The rules here are:

1) Ignore any texts purporting to be from an organisation such as a bank or
delivery cpy, where the text has a link for you to follow.

2) Examine carefully any emails similar to the texts of (1), above. (When I
created my email client, I added code such that hovering over a purported link
in the email puts up a tip showing the actual web address you'd be going to).

3) Banks make it quite clear they'll never call you asking for password etc
details. Any sales calls or supposed calls from banks, just hang up the phone.
One can of course do that at any time with any phone call.

How we operate any bank accounts we might or might not have, I won't be
sharing with you chaps, sorry.

--
Tim

On 23/10/2022 22:16, Jeff Layman wrote:
> On 23/10/2022 19:20, Andy Burns wrote:
>> The Natural Philosopher wrote:
>>
>>> I dont use a phone app.
>>> I use a PIN sentry
>>> It wants my membership number, my credit card number and a pin sentry
>>> generated
>>> code
>>
>> the phone app incorporates the functionality of a PINsentry, without
>> having to
>> carry around a bit of blue plastic.
>
> I don't use a banking app, but if it has the function of a PINsentry
> wouldn't the OP have got caught in the same way?
>
> Out of interest, what online banking can you do with a phone app that
> you can't do with a computer at home? More to the point, why would you
> need to do it then rather than wait until you got home?
>
The millennial snowflakes cant use a keyboard. They have to do
everything on StupidPhones
--
I would rather have questions that cannot be answered...
...than to have answers that cannot be questioned

Richard Feynman

On 23/10/2022 22:54, Bob Eager wrote:
> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>
>> Out of interest, what online banking can you do with a phone app that
>> you can't do with a computer at home? More to the point, why would you
>> need to do it then rather than wait until you got home?
>
> Pay in a cheque.
>
>
>
cant do that with a phone either. You have to physically get it to a bank.

--
How fortunate for governments that the people they administer don't think.

Adolf Hitler

On 24/10/2022 10:29, Theo wrote:
> John Rumm <see.my.signature@nowhere.null> wrote:
>> On 23/10/2022 16:39, Chris Green wrote:
>>> Someone asking you what the number is screams 'scam' at me.
>>
>> Indeed, but that is where the job of a good pretexter comes in. To
>> concoct a storey plausible enough to make it seem reasonable enough in
>> the this context.
>
> Quite often the people caught are those for whom the pretext matches
> something they were expecting anyway.
>
> The classic one is parcel delivery scams: people get parcels all the time
> nowadays, so a fake tracking website / excess postage or tax to pay / 'while
> you were out' message is plausible enough to hook somebody in.
>
> Everyone laughs at Nigerian prince emails (which are a filter for only the
> exceptionally gullible), but somewhere somebody will be expecting an
> inheritance or sale of a property, and cast the net wide enough and you
> might hook them.
>
> Once they have you hooked, then the pretexting starts.
>
> So we shouldn't be complacent that we won't be taken in, because eventually
> we will. The thing to think about is what defences we might use to prevent
> the hook turning into actual damage.

Indeed, one of the things I try to get across when training people on
this stuff, is that the moment you think "I am too smart to get caught
out like this" you are more rather than less vulnerable. It only takes
the right circumstances to come together, and you can get fooled. As you
say it is the defence in depth that then matters.

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 24/10/2022 07:46, Jeff Layman wrote:
> On 24/10/2022 02:02, John Rumm wrote:
>> On 23/10/2022 22:16, Jeff Layman wrote:
>
>>> Out of interest, what online banking can you do with a phone app that
>>> you can't do with a computer at home?
>>
>> Pay by bonk. (i.e. using the phone for a contactless payment device)
>
> You've convinced me! :-))))
>
I am however, not a prostitute

--
How fortunate for governments that the people they administer don't think.

Adolf Hitler

On 24/10/2022 08:41, Chris Hogg wrote:
> I made sure that
> Barclays had also blocked any on-line banking and telephone banking -
> I don't use them, have never used them and don't need them
then why do you have a pin sentry?

--
It is the folly of too many to mistake the echo of a London coffee-house
for the voice of the kingdom.

Jonathan Swift

On 24 Oct 2022 at 10:17:43 BST, John Rumm <see.my.signature@nowhere.null>
wrote:

> On 24/10/2022 07:55, Chris Green wrote:
>> John Rumm <see.my.signature@nowhere.null> wrote:
>>> On 23/10/2022 16:39, Chris Green wrote:
>>>> Chris Hogg <me@privacy.net> wrote:
>>>>> On Sun, 23 Oct 2022 14:32:38 +0100, Martin Brown
>>>>> <'''newspam'''@nonad.co.uk> wrote:
>>>>>
>>>>>> and doing the
>>>>>> ID me by PIN and passing him that information
>>>>>
>>>>> No, I didn't give him my pin, at least not directly, unless he is able
>>>>> to deduce it from my pinsentry response. Could that happen, and if so,
>>>>> what's the point of pinsentry? Not a sentry at all.
>>>>>
>>>> I don't really understand this. You should never tell anyone the
>>>> 'magic number' the card reader gives you. The only thing you should
>>>> ever do with it (as far as I am aware) is to enter it in the right
>>>> field when logging in to your bank or when confirming payments and
>>>> such.
>>>
>>> Barclays also use it in branch - say when making a cash withdrawal
>>> over the counter.
>>>
>> You mean your card in the reader and enter your PIN? I think I'd
>> run a mile!
>
> No, they have their own card readers. They enter the transaction details
> into it and hand it to you to enter your pin. When you do that it
> generates a OTP that the staff can use to finish the transaction.
>
> So the bank staff don't learn your pin, and you are giving away no more
> information than would be required to get the money from a cash machine.

ISTM that a pinSentry device or similar is reasonably secure as it is not
communicating over any network, just reading your card and interacting with
you. And it comes with any software already built-in.

An app on a phone, would be a lot less secure as it could be buggy, and you
could anyway have been fooled into downloading a fake version. The supposed
extra benefits of using an app don't appear to amount to a hill of beans.

--
Anyone who slaps a 'this page is best viewed with Browser X' label on a Web page appears to be yearning for the bad old days, before the Web, when you had very little chance of reading a document written on another computer, another word processor, or another network.

-- Tim Berners-Lee

On 24 Oct 2022 at 10:29:09 BST, Theo <theom+news@chiark.greenend.org.uk>
wrote:

> John Rumm <see.my.signature@nowhere.null> wrote:
>> On 23/10/2022 16:39, Chris Green wrote:
>>> Someone asking you what the number is screams 'scam' at me.
>>
>> Indeed, but that is where the job of a good pretexter comes in. To
>> concoct a storey plausible enough to make it seem reasonable enough in
>> the this context.
>
> Quite often the people caught are those for whom the pretext matches
> something they were expecting anyway.
>
> The classic one is parcel delivery scams: people get parcels all the time
> nowadays, so a fake tracking website / excess postage or tax to pay / 'while
> you were out' message is plausible enough to hook somebody in.
>
> Everyone laughs at Nigerian prince emails (which are a filter for only the
> exceptionally gullible), but somewhere somebody will be expecting an
> inheritance or sale of a property, and cast the net wide enough and you
> might hook them.
>
> Once they have you hooked, then the pretexting starts.
>
> So we shouldn't be complacent that we won't be taken in, because eventually
> we will. The thing to think about is what defences we might use to prevent
> the hook turning into actual damage.

Anyone seen The Sting?

--
"People don't buy Microsoft for quality, they buy it for compatibility with what Bob in accounting bought last year. Trace it back - they buy Microsoft because the IBM Selectric didn't suck much" - P Seebach, afc

On 24 Oct 2022 at 10:46:59 BST, Martin Brown <'''newspam'''@nonad.co.uk>
wrote:

> On 24/10/2022 07:51, Chris Green wrote:
>> Andy Burns <usenet@andyburns.uk> wrote:
>>>
>>> Chris Green wrote:
>>>
>>>> You should never tell anyone the 'magic number' the card reader gives you.
>>>> The only thing you should ever do with it (as far as I am aware) is to enter
>>>> it in the right field when logging in to your bank or when confirming
>>>> payments and such.
>>>
>>> The counter staff sometimes ask you to put your PIN into their PINsentry to
>>> verify your ID in branches
>>
>> I don't think I have been to my personal banking bank for decades! :-)
>
> I have never been inside my bank branch (which for peculiar reasons of
> takeovers and mergers was not my nearest branch with bank name on it).
>>
>> The above wouldn't work for HSBC anyway as their equivalent of
>> pinsentry is personalised and doesn't require your bank card.
>
> HSBC and several others have recently closed their branches. The High
> Street now quite literally has several "holes in the wall" where bank
> machines used to reside. Last men standing are Barclays and Santander.

Canterbury has those two, also HSBC, NatWest, Lloyds, and the Metro Bank
(whoever they may be).

--
"... you must remember that if you're trying to propagate a creed of poverty, gentleness and tolerance, you need a very rich, powerful, authoritarian organisation to do it." - Vice-Pope Eric

On Mon, 24 Oct 2022 10:55:20 +0100, The Natural Philosopher
<tnp@invalid.invalid> wrote:

>On 24/10/2022 08:41, Chris Hogg wrote:
>> I made sure that
>> Barclays had also blocked any on-line banking and telephone banking -
>> I don't use them, have never used them and don't need them
>then why do you have a pin sentry?

Because two years ago I got the impression it would be essential, so I
went into the bank and asked for one. Was given it, no questions
asked,

--
Chris

Whenever I get a call (unsolicited) and they start conversation with
'I just need to go through security' I tell them, you called me, I
am not giving you any security information.

I'll call my Bank (or whatever) and then they route me to you .......
several hang up at that point, genuine callers agree.

Credit Card companies I find are the most difficult

On 23/10/2022 13:49, Chris Hogg wrote:
> I got scammed at the end of last week. All sorted and no harm done,
> but the scammer told me that the normal security checks such as
> mother's maiden name etc was no longer being used, and everything was
> being done via the Pinsentry system. After resistance from me I
> eventually went along with it and gave him all he asked for! :-(
>
> As I said, no harm done because I immediately contacted my bank who
> blocked everything, but be aware that the scammers are now trying to
> use the Pinsentry system to get account details etc from people who
> are unfamiliar with Pinsentry.
>
> Different banks may have different names for the system. It's
> basically a card reader that can confirm a person's identity. It's a
> pity the banks don't have a similar system for confirming who they
> are, so that the private individual can check they're not talking to a
> scammer.
>

On 24/10/2022 10:51, The Natural Philosopher wrote:
> On 23/10/2022 22:54, Bob Eager wrote:
>> On Sun, 23 Oct 2022 22:16:52 +0100, Jeff Layman wrote:
>>
>>> Out of interest, what online banking can you do with a phone app that
>>> you can't do with a computer at home? More to the point, why would you
>>> need to do it then rather than wait until you got home?
>>
>> Pay in a cheque.
>>
> cant do that with a phone either. You have to physically get it to a bank.

Some banks now allow you to pay cheques in by photographing the original
from their app. The same functionality is not present in web banking.

--
Regards,
Martin Brown