
In Malaysia, people are unfortunately falling victim to a scam using interactive voice response (IVR) technology. Unfortunately, we at Plum Voice have seen this before. Actually not from a world away in the news but first hand in our own IVR systems. In America.
According to news coming out of the tiny peninsula nation, Malaysians are getting calls from an IVR system telling them they have outstanding credit at their bank and need to make a payment. The system provides a number for them to call, where associates in the scam wait to take their personal and banking information.
Supposedly, if the callers don’t have credit cards, the associates ask them to file a complaint with Bank Negara Malaysia (Malaysia’s Central Bank). The associates conveniently provide a phone number for the bank, where more associates wait to pry whatever personal information they can from the callers.
It’s a pretty elaborate scheme, but it’s based on a fairly simple first step. Using an IVR system, the criminals send out calls with recordings asking people to get in touch with customer service reps at such-and-such number. Then the scam begins.
For years, Plum has offered free demo accounts for potential customers to try out our IVR and survey products before they buy them.
With our demo developer accounts, programmers can write and run voice applications (if they know VoiceXML, the programming language of web-voice apps). We used to provide them with a dedicated local Boston phone number to test it out. They couldn’t make outbound calls with the dedicated number (like the Malaysian scam), but they could call in to see how their apps were working.
That’s where they took advantage. Criminals like the ones in Malaysia set up an IVR app that mimicked (not very well, fortunately) a banking IVR system.
They sent out fishing spam posing as emails from several banks, but instead of giving a URL link, they provided a phone number (the dedicated Boston number) and asked them to call…immediately. When people from the emails called, the phony bank IVR started asking them for personal information. Thankfully, some of the people being scammed caught on and reported the fraud.
After Plum found out about it, we passed the information on to the FBI. Then we put a few things in place so it won’t happen again—
- Rather than a dedicated phone line, free demo accounts now get a generic number that requires an extension (and seems less like a legit business).
- The extension prompt incorporates a message explaining to callers that they’re using a demo system run by Plum Voice and warning them to never enter any personal information.
- Meanwhile, a scanning system watches applications for “hot” word combinations typical of scams. If the scan finds any, it flags the account. Then one of our engineers looks over the app to make sure it’s not trying anything malicious.
It’s been several years since Plum put these safeguards in place on our DIY developer hosting accounts. Since then, we’ve also incorporated them into our Plum Survey and QuickFuse products. So far, we’ve had no additional reports of fraud by others using our systems.
PZK78XKH3NA3
-
-
1