So there is a new scam going around, and I mean, this shouldn't be a surprise.
There's always new scams coming out and going around.
But this one is particularly bad because it specifically targets
a security feature, two factor authentication and tries
to get around it by tricking the user into basically giving up
that two factor authentication code that comes via SMS message.
So I've always talked about the importance
of using two factor authentication, and this doesn't change anything.
Having two factor authentication on your accounts will improve the security.
However, you need to know that just because you have it on there
doesn't mean you have to stop being vigilant.
So how exactly does this scam work, so you can know how to avoid it?
And the good news is, once you do know how it works,
it is relatively easy to avoid.
So the very first thing that happens, which is completely out of your control,
is that your information and your login credentials or whatever,
gets leaked online in some kind of database breach.
And this has probably happened to you more times than you would want to know.
There have been literally billions of login credentials leaked
from hundreds of databases over the years.
If you didn't know this already,
then you should know that you are absolutely in some of these
leaked databases and your passwords are absolutely out online,
which is why you need to use unique passwords on every single website.
Because you might think, "Oh well I don't care if this random website got hacked
and my credentials got leaked on there." "I don't care about that website."
But here's the thing if you used the same password or a similar password
on a website you don't care about, as on your bank website.
Well, they may as well have hacked into your bank website.
They're using the same credentials.
So the first thing the hacker does is looks in these databases
and tries a whole bunch of preexisting passwords
from this database and try it on bank websites, stuff like that
when they get a match, if they are able to log in
and there's no two factor authentication on that account.
Well, I mean if that happens, they're already going to steal your money.
But this scam specifically addresses if you have gone through the extra
good step of adding two factor authentication in some form,
specifically with a text message, then if the hacker gets a hit
and they see that "OK, this password and log in worked,
but they have a text message code that has to confirm before
I can actually break into this account." Well that's where this scam comes in.
So to kind of summarize everything I just said, is your passwords
and login credentials on old websites are already out there on the internet.
Hackers have access to them right now.
So then the hacker
then happens to try one that works and they realize that, "OK, this account,
the correct credentials are there, but I need the two factor
authentication code
that was sent to the user to actually get into it."
So what is a poor scammer to do at this point?
Well, that comes to the main topic of this video, which are these
new services out there for scammers to basically have a bot set up
that will automatically call and pretend to be the website
that they're trying to log into and basically tricks
the user into giving the bot the password, and then that gets passed to the scammer
who then logs in. So let me explain how that works.
So the scammer will use this app, they'll type in your phone number
and then it will dial you and pretend using a robot voice.
Say "This is PayPal security fraud.
We have detected a 58 dollar charge to your account.
If you didn't do this charge, then press one" or something like that.
So then, of course, the person types in one or whatever to say
that they didn't do it.
And then it'll then say, "We just sent you a code,
please type it in so we can confirm and then cancel the order".
And remember, this voice phone call is fake.
It's not actually from PayPal, it's just pretending.
So basically, it's just trying to get the person into scared mode.
Oh no, there's a fake charge on my account.
And then what will happen is as that phone call is going,
the scammer on the other end will log in to the account
with the working credentials, which will automatically trigger
a real two factor authentication code to be sent
to the person, who is at the same time receiving the phone call.
So when the fake voice says "we just sent your code
Type it in to cancel the order", the person is going to do that.
"Oh, OK, I'll type in the code."
"The thing just said they'd send it," they think it's all automatic.
They then type it into the phone with the tones,
and that tone actually gets translated and feed it back to the scammer,
who now has the two factor authentication code to log into the PayPal account.
And this person never even had to interact with them.
All they got was a robot voice.
They didn't even know that this was not automatic.
And then also apparently what will happen
is after you type in the code and the scammer confirms that it works,
the voice will say something like "confirmed canceled,
if you see any charges on your account for the next 24 to 48 hours.
Don't worry, we'll refund you for that." Meanwhile,
those are the charges that the scammer is going to actually make.
There was no fake charge before.
Now the scammer is going to go actually make one
and the person's going to think, "Oh well it said that I don't have to worry
about those".
So again, if it wasn't clear, basically the scammer already has your contact info,
they know that the login works,
and they now need to get your two-factor authentication code.
So they have a fake voice robot thing, call and pretend to be PayPal or whatever.
And the whole point of that call
is to simply to get you to type in the two factor authentication code,
while the scammer is then going to use that to log into your account.
And again, the code that comes through is real.
But the phone call is not.
And actually, this is really clever on the scammers part because usually these
phone text messages will say something like "Never share this with anyone,"
but the victim may think, "Oh, well,
it's a robot on the other end, this isn't a person asking for it.
It's an automatic thing.
I'll just type it in."
They don't realize that they are actually giving it to a person.
So basically the way to avoid this is to simply know about it.
If you know that there's phone calls going around that are trying to get you
to type in two factor authentication codes to get sent your phone,
know that that's probably not from the real website.
That code is not to be
given over the phone or anything that's to be logged into a website,
especially on a phone call that you received unsolicited.
Never give any kind of information to anyone
or any robot that calls you unsolicited.
Now, another thing I need to point out is that just because you have two factor
authentication enabled on your account doesn't mean you can't also get phished
in other ways.
For example,
there are websites out there that know that two factor authentication is a thing.
So the website may set up a fake
login page to PayPal, whatever and have you type in your credentials.
And then it will go and use the credentials you just typed in.
Send it to the website and then ask you on the fake website for the code again,
and then again you just pass it along to the real website.
So just having two factor authentication really just protects you against
purely a scammer logging into your account without you doing anything.
But you can still get phished for it if they trick you into giving it to them.
And that is why I have always suggested getting one of these (or
at least two of them, so you have a backup)
which are security keys.
These are physical security keys, they have some cryptographic stuff
going on,
but basically this is un-phishable So instead of the website asking you
for a code that you type in from your phone, the website will ask you
to simply tap the button on the security key,
and that confirms that you have physical access to the security key,
so therefore the second factor is something you have.
So therefore, the only way a scammer could be able to log into your account
is if they steal your passwords, AND this physical thing.
And it works in such a way that even if there is someone listening
doing a "man in the middle" attack, listening to the information going between
your key and the website to confirm it, they can't use that information
because it's encrypted in a special way that I'm not really qualified to explain.
Now, the important thing to remember is that a lot of websites,
even if you have a security key, they may also have a fallback method
where it'll also allow you to log in with a phone code or something like that.
So you
definitely have to be aware of that, where if you're going to use a security key,
then only use the security key
no matter what other methods it may also have you set up.
But anyway that's kind of a whole side tangent, not super related to the video.
So just know about this scam.
And again to sum it up, just don't give those security codes
to anyone (or anything) that calls you unsolicited
because there could definitely be a person on the other end
that is using it to now log into your account.
Because your credentials again, are already out there.
That is why you need to absolutely use unique passwords on every website.
If you don't want to keep track of them, there are plenty of password managers
out there like LastPass, 1Password, Dashlane.
I forget what a bunch of other ones are, but they're all decent.
You just really need to make sure that you use an exceptionally strong, long
and unique password on the password manager, if you do go that route.
So anyway, just be aware this is a thing and stay safe out there.
So if you enjoyed this video, definitely give it a thumbs up.
And if you want subscribe, be sure to also click the bell to enable notifications.
I only post about twice a week tops, so you don't want those to get lost
in the rest of your subscriptions.
If you guys want to keep watching, I'll put a couple of videos here
for previous videos I made talking about new scams in 2021,
and another one more recently,
it was about a delayed disconnect phone scam, it was really clever.
I'll put those right there.
So thanks so much for watching guys, and I'll see in the next video.