#its linked here so it should work | Explore Tumblr Posts and Blogs

mostlysignssomeportents · 3 months

Text

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

#pluralistic #social engineering #phishing #ai #swiss cheese security #infosec #finance #fraud #carding

10K notes · View notes

mayrine · 2 months

Text

The Artists for Palestine project does not have an end date

Its going based on artists willingness to participate alone!!

If you are an artist and want to help Palestine and this project you should message @/sitcomabed (https://x.com/sitcomabed?s=20) over on twitter and join the other artists in creating art and generation donations!!

You need to have a twitter account cause Zayna (the person that started this project) doesn't have a tumblr so you can only message her on twitter

here is the link to the original twitter thread where they explain how you can get your commission (https://x.com/sitcomabed/status/1755711698298716487?s=20)

also if you arent an artists you should still go and donate!!!

edit: i've been told that the link to the thread doesn't work for everyone so here are screenshots of the entire thread, the links shown in the screenshots are at the bottom

Care for Gaza: https://www.paypal.com/paypalme/UsmanaliF Pious projects: https://x.com/PiousProjects/status/1751164159658541234?s=20 Donate to Zayna, the person that made the thread and that started this project: https://ko-fi.com/sitcomabed Google form: https://docs.google.com/forms/d/1RStk1YXfg4KJ8X4sO6_DxDIpDlHZIsyZhPAyiCBK6VQ/viewform?edit_requested=true

Thread of the artists that are participating in this project: https://x.com/sitcomabed/status/1756036418869006388?s=20

Also if you want to donate to a different charity/project then the ones mentioned in the tweet, you can!! I asked Zayna and she said its fine as long as you put that down in your description.

If there are any other problems with the links please @ me in a reblog or leave a comment and i'll try to fiz things

#Artists for Palestine #palestine aid #free palestine #free gaza #gaza #gaza aid #palestine #palestine donation #palestine donations

5K notes · View notes

pearwaldorf · 5 months

Text

I hate that you can't see a tweet thread anymore if you're not logged into Twitter (as a gesture of disrespect I refuse to call it by its rebranded name). Here is a copypasta of a thread from Dan Olson, a Canadian documentary filmmaker, expanding upon camera quality, the guilt trips Somerton used to goose his Patreon subscriptions, and how the best tools will never make up for lack of dedication or patience. I have added clarifications in [[double brackets]] where I feel it is necessary.

START OF THREAD

Okay, so, back in April I snapped at James in reply to a tweet that was linking to this video (which James has since delisted but not deleted) and I want to talk about the full context of that but I don't want to make a video, put your beatdown memes away. [[The video has since been deleted. I can see the title of the video is "Maybe the end (not an April Fool's Day thing".]]

The first bit of context is that I initially got keyed into James to fact-check his claims about indie filmmaking in Canada. As a filmmaker the entire Telos venture was immediately obvious as a juvenile fantasy dreamed up by someone with no idea how to make a movie.

Just wild claims about their plans that weren't worth debunking because they bordered Not Even Wrong. But in watching one of these pitch videos I noticed that he had a $4000 current-gen camera in the background as a prop, and that seemed both pretentious and weird.

You don't use your best camera as a prop, you use your second best camera as a prop. So being an obsessive weirdo I needed to know, and I watched his BTS stuff until I spotted his main rig, a $6000 camera with about $1000 in accessories.

Now, these in isolation are unremarkable because his Patreon at the time was bringing in ~$8000 per month, his channel was a full on Business business, and so investing in some professional equipment of that level is maybe a bit indulgent but justifiable.

What was weird is that he doesn't shoot multi-cam, doesn't shoot outdoors, doesn't shoot on location, and in a studio the two cameras kinda really step on each others' toes. Basically if you already have one and don't need a B cam there's no reason to get the other.

Again, on its own, this says nothing, it's just indicative of poor financial decisions, maybe impulsive purchasing, Gear Acquisition Syndrome. Biblical sins, but not crimes.

Paired with the constantly inflating fantasy scope of the Telos films it was clearly an expression of a very, very common bad filmmaker habit of "if I just get the right gear then my movie will basically make itself" Buying stuff because it feels like progress.

At the end of February he tweets "I want to start shooting anamorphic" and then three weeks later in March he posts the worst, out of focus, under-exposed "I just got a new lens!" video I've ever seen, showing off his trash-covered bedroom.

Based on what's available for his cameras and the lead time, that's enough time to get a Laowa Nanomorph or Sirui Saturn from B&H but not enough time to get a Great Joy from the UK or a Vazen from China. And with the flaring blah blah blah, $1300 lens.

Again, [gear acquisition syndrome] is not a crime and these lenses are budget options. Bit of a pointless impulse purchase since he only used it for the Showgirls video. But this is what he was doing just a few weeks before that above video came out: effortlessly impulse purchasing lenses.

James has (had?) a habit of regularly, aggressively driving viewers to Patreon by claiming that videos were getting demonetized. While tacky, it is something a lot of queer YouTubers have dealt with, so there's precedent there. But people were noticing he did it a lot.

Mid-March he humble brags about needing to work so hard to make 6 videos in April because he has over-booked sponsorships.

Then March 29th James posts this whole incel screed on Twitter about how sex work should be "subsidized as a mental health service."

[two image descriptions.

1. "For the majority of people sex (and human contact) can be imperative to a healthy state of mind. A kind and talented sex worker can make someone feel wanted for the first time in their life. I know sex workers who have pulled people back from suicide just by being there for them." 2. "Not only should (sex work) be legal, but it should be subsidized as a mental health service."]

He spends several days getting absolutely *roasted* for this, just dragged across the pavement and read for filth, and doubles down in the replies the whole way.

So this is the context immediately surrounding James waking up on Friday, and posts the above video and the below tweet.

[image description: "We just got the lowest Patreon payout we've gotten in well over a year. Like, a "maybe we need to rethink things" kind of amount... NOT an April Fools Day thing btw. But I don't know if we'll be making videos much longer."]

Now, this unfolds in kinda two directions. The first is that I'm convinced he was just lying about this income shock in the first place.

There's a million theoretical edge cases about what maybe happened and if maybe he just misunderstood the data or saw a glitch and panicked, maybe one of those happened, I don't believe it, I think he just lied because he was salty about getting dragged and felt owed a win.

A big tell to me is that he doesn't blame Patreon. He says he doesn't know what happened, but let's be real, Patreon screws up all the time, they're the first people anyone blames if anything confusing happens, just as a reflex action, even if it's completely not their fault.

The only reason to not blame Patreon is if you already know that it's not their fault and that any investigation on their part might reveal embarrassing details.

Instead he indirectly blames his viewers for not watching enough, not sharing enough, and not turning on auto-renew.

So regardless of the unknowable truth, this segues into the second, far more offensive direction of the messaging itself. "I don't know if we'll be making videos much longer." "Maybe the end" He explicitly framed this as an immediate existential threat to his channel.

In the video he is vague about everything, leaves a ton of hazy room for plausible deniability on how long the channel can keep going, but the messaging is "I need more patrons right this minute or my YouTube channel is over."

He repeatedly evokes all the "fun stuff" they had planned that would never see the light of day if this didn't turn around right away.

And his audience received this message loud and clear. Tons of people making far, far, far less than him left very heartfelt messages about digging a little deeper to subscribe or up their pledge or unsubscribe from other channels to move their pledge to his.

1200 new patrons in one day.

Since I simply don't believe the income shock was real in the first place that would put his post-"Maybe the end" Patreon income at around $10,000 per month. US. Add YouTube income, he's spent the last seven months making around $18,000 per month.

I have seen creators scale back their capabilities to the bone purely to keep making videos for the love of just, like, making stuff even as their funding evaporated and they needed to go back to a desk job to cover their bills.

You'd have to be so outstandingly reckless with your finances as a channel that a one month spook leads immediately to "channel over, sorry about all the fun stuff we won't get to do with you, our patrons, specifically because you, our patrons, aren't giving us enough money"

And not a spook where you then spend a couple weeks crunching numbers. Oh no. A shock so violent where less than two hours later you're weeping on camera about the channel being over.

Three weeks later he brought a brand new Sony FX6v for $8000 CAD to add to his pile of cinema cameras despite the fact that he was, but scant moments earlier, in such a precarious position that a single bad month would kill his channel.

He stole your money, and for that I'm profoundly sad and angry. That's why I snapped at him in April. I'm sorry I couldn't give you the full context then, and I'm sorry if that anger upset you.

END OF THREAD

#james somerton #dan olson #hbomberguy #jesus christ tumblr #it won't let me format things the way i want #because this website is sometimes a piece of shit

6K notes · View notes

cryptotheism · 6 months

Note

The "potion-crafter" archetype of alchemist used in fantasy is often, like, an independent chemist that works off commission or sales to create fireball elixirs or exorcism salves. Is there a grain of truth, there? Did alchemists in any period you studied make a living by synthesizing magical items (like panaceas or DIY-chrysopoeia-kits or somesuch) and selling them on to any willing customer, or was that not really in their domain?

Ha! You know sometimes it can be a bit annoying answering asks like this, because most fantasy media isn t terribly interested in authentically representing history, BUT THIS TIME I can give y'all a specific and direct answer!

The archetype of the potion-crafter you're talking about almost definitely has its roots in an actual pre-paracelcian european medical profession; the Apothecary.

There were three types of doctors in the 1500s. There were diagnosticians, the people who went to school to learn about anatomy, and were allowed to call themselves "doctor." There were surgeons, the low-skilled workers who were in charge of hacking off limbs and draining bedpans. And there were apothecaries, basically the medieval equivalent of a pharmacist.

If you were a wealthy merchant, and you went to a doctor for your runny nose, he would look you over, and give you a prescription that you were supposed to take down to your local apothecary, so you could buy a potion from them.

But these prescriptions weren't exactly strict. A doctor might prescribe you an exact list of ingredients with the amounts, or he might just prescribe you "a healing ungent of cooling and drying herbs." So the apothecaries occasionally had some wiggle room based on supplies and expertise.

The important thing to remember, is that apothecaries were NOT considered magicians or alchemists.

That is, until Paracelsus came along.

See, good ol' Paracelsus was a radical innovator. He was one of the first physicians in history to be all three types of doctor at once. He was a diagnostician, a surgeon, and an apothecary. He argued that all doctors should have knowledge of their entire profession, and that no doctor was above suturing their patients wounds, and mixing their patients medicines.

He was also, crucially, an alchemist and a magician.

Alchemy was the cutting edge of technology for the time, a practice regarded with equal parts awe and suspicion, but it was more the realm of glassblowers and metallurgists than doctors or botanists. Paracelsus disagreed. He argued that if it's part of God's creation, it should be used to heal the human body.

This extended to magic. Paracelsus figured that you had to factor in things like "the movement of the planets and their influence on the earth." And he was known for prescribing patients things like "astral talismans to be worn about the neck." A practice that, even for his time, was often seen as backwards and superstitious. (Although given how harmful medieval medicine was, the astral talismans might have been your best option sometimes.)

Paracelsus was a radical. People fucking hated him, especially when he was alive. But his ideas were extremely influential, and exploded in popularity after his death in 1541. I can confidently say that the fantasy archetype of the Potion Brewer is based on Paracelcian physicians, the doctor/alchemist/apothecary/magicians who followed his theories.

Here I'll link my Patreon if y'all wanna support my research! I have a whole section on Paracelsus.

#occult #alchemy #paracelsus

5K notes · View notes