republican-creole
Search:  

 
 
   News
newer
story category Comcast Easily Duped Into Handing Out Customer Info
Quick example of phone rep social engineering...
(old news - 04:03PM Thursday Apr 12 2007)
tags: cable · security · trouble
The Consumerist links to an audio file from CMD Radio that shows how easy it is to socially engineer Comcast phone support (at least this particular employee) into doling out a customer's account information. A caller simply poses as a Comcast tech, offers a bunk tech contact ID, and gets the poorly trained phone rep to hand over an account number that should be protected.

Related:
  1. Comcast Contractors Arrested for Animal Cruelty
  2. Cable Companies and Modem Vendors Fight Patent Troll
  3. The Growing Impact of Website Crashes
  4. ICANN Domains Hijacked
  5. DNS Fix Knocks Zone Alarm Users Offline
  6. Major DNS Flaw Finally Publicized
  7. DNS Flaw Even Worse Than Predicted
  8. Thursday Evening Links
Forums » Comcast Easily Duped Into Handing Out Customer Info
view: topics flat text 
Post a:
onegoodsoul

join:2006-12-17
Fredericksburg, VA

+1

Total U.S. un-employed workers + 1

RR Conductor
'Boarrrd
Premium
join:2002-04-02
Redwood Valley, CA

Re: +1

The sad thing too is he was probably poorly trained, which is Comcast's fault, not his.
onegoodsoul

join:2006-12-17
Fredericksburg, VA

Re: +1

Agreed.
LeftOfSanity

join:2005-11-06
Felton, DE

said by RR Conductor See Profile :

The sad thing too is he was probably poorly trained, which is Comcast's fault, not his.
how much training do you need to verify account information?

isn't it almost common sense to not give out info to anyone?

Duhhh....

Phattieg

join:2001-04-29
Jacksonville, FL
·Verizon Wireless B..
·Sprint Mobile Broa..


edit:
April 12th, @10:32PM

I've been with Comcast for 5 years, and I can't count how many times I've been reminded to verify the last 4 of the SS# before giving out info, doing password resets, verifying address/phone number, or discussing balances. I even get occasional e-mail reminders too. No last four, then verify the account number, or visit the front counter, present ID, and setup a PIN while you're there so we'll have a way to verify and discuss account info. This guy just A) didn't care enough about his job, peoples info, or morals, or B) was a complete idiot. The company sensors the ss# (except the last four digits) for everyone except supervisors. In all actuality, it's up to the rep to pay attention, and verify the account. You can train someone till you're blue in the face, but when it's all said and done, the rep has to follow directions to make it work. FYI, it IS covered in training. It even has its own section called "Protecting customer information". I just wish criminal charges would get filed for some of these dim-wits who don't care enough about protecting the private info of others.

EDIT: After finally listening to it, I have concluded... The guy was just a class A idiot. No work order??? C'mon, right then I would have said "Dude, call your dispatcher." If you would have tried the "Well I don't have their number" or anything else, you would have gotten the "stone wall" effect of "contact your dispatcher please". All who agree, this guy (the rep) was just plain dumb once he noticed no work order, acknowledged it, but gave the info anyway. The only thing the company did wrong was NOT FIRE THIS GUY SOONER!

sivran
God Save The Suite
Premium
join:2003-09-15
Arlington, TX
clubs:
·RoadRunner Cable
·Comcast

Hell he may not have even had a way to verify the ID anyway. I sure didn't when I was doing Verizon tech support. Procedure was if someone called claiming to be Verizon tech, get their v-number, name, and location and just put it in the notes.
--
Think outside the fox...Seamonkey

Phattieg

join:2001-04-29
Jacksonville, FL
·Verizon Wireless B..
·Sprint Mobile Broa..

Re: +1

said by sivran See Profile :

Hell he may not have even had a way to verify the ID anyway. I sure didn't when I was doing Verizon tech support. Procedure was if someone called claiming to be Verizon tech, get their v-number, name, and location and just put it in the notes.
Umm, there is plenty of ways. As a matter of fact, the tech number tells us if it's a Comcast tech, a contractor, maintenance, or a liar... The thing is, the tech shouldn't call customer service for assistance, PERIOD... I have had a few "tech" calls come thru my line. I tell them they should know better than to call me, and as long as they have a job number, and the job is open, and they give me a valid tech number, I will modify THAT JOB ONLY... I will not do a change of service, or anything else, nor will I open another work order... I am here for the CUSTOMER, not the technician. Their dispatcher gets paid to talk to them, and they get paid to talk to their dispatchers... That keeps things more "secure"...
--
SIPPhone/Gizmo # 17476200648 / PIMPNET Chatline / Ran by Asterisk & Slackware 10.1.

xdeadhead
220, 221, Whatever It Takes.
Premium
join:2000-11-08
Pangea
·Comcast

Re: +1

don't you and the tech both work for the same company? isn't the common goal to achieve happy customers? so what i hear you saying is, that if a tech calls you for help, if he provided a valid i.d., you will help him for that one job only. why would any tech try to get anything done on any order/ticket other than the one he is dispatched on? company policies like this suck. it should be, that if a tech calls anyone for assistance, that whomever is called take it upon themselves to assist in any way possible, the technician to leave behind a satisfied customer. that way, you can both take extra pride in knowing you've made at least one more customer want to continue to use your service. but i live in reality and know that is not likely to happen with any degree of regularity at any company involved in providing services such as these. that's just my opinion. thanks for reading this far if you did. no offense meant or intended to the op this is just a small rant about big business in general.
--
I am not herbert.

Maxo
Your tax dollars at work.
Premium,VIP
join:2002-11-04
Tallahassee, FL
clubs:
·Embarq

I've seen it

I've seen it happen twice. I was the lucky manager for dealing with the customer.
The first time the guy didn't even work directly under me. After that I made a big point about following the established protocol before giving sensitive information out to anyone (internal or external.)
Despite all that, the second time was one of my employees. One of my best employees.
Not fun days...

Phil
Rojo Sol
Premium
join:2001-06-11
Camarillo, CA

Wow?

Is this supposed to be impressive or troublesome in any way? So he got the account number, big deal.
--
Correcting one "looser" at a time.

RR Conductor
'Boarrrd
Premium
join:2002-04-02
Redwood Valley, CA

Scary

I hope this gets Comcast to review with ALL of their reps proper procedure.

thender
Glamour Profession
Premium
join:2004-05-16
Staten Island, NY
·Verizon FIOS


edit:
April 12th, @04:59PM

Re: Scary

And I'm sure they care, because working tech support/sales for an ISP is such a fun job with a fair wage.

They'd probably ignore everything they heard at the meeting, like any normal 20 year old with the idea that this is "just a temporary job"

I'm not saying it's right to give out personal info, but good luck getting these people to follow procedure all the time/care about their job.

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA

said by RR Conductor See Profile :

I hope this gets Comcast to review with ALL of their reps proper procedure.
The problem isn't necessarily one of procedure. You can train procedure all you want but when it comes to a CSR being bullied by someone they perceive as a superior it's going to come down to that persons personality and self confidence, and the only part of the equation you can change is the self confidence part which is a major problem when you just got done training them not to use their brain but depend entirely on scripts.
--
Revolution!!!... or some such nonsense.

DaSneaky1D
Tell me, where is your father?
Premium,MVM
join:2001-03-29
The Lou
·Charter Pipeline

Pretexting can happen at any level

»en.wikipedia.org/wiki/Hewlett-Pa···_scandal

This isn't limited to Comcast or consumers.
--
:: my trivial ramblings ::

David
Last man standing
Premium,VIP
join:2002-05-30
Granite City, IL
clubs:
·AT&T Midwest

Re: Pretexting can happen at any level

said by DaSneaky1D See Profile :

»en.wikipedia.org/wiki/Hewlett-Pa···_scandal

This isn't limited to Comcast or consumers.
No joke, The corporate people here warn us every year about "Social engineering" and what to look for in an informative brochure and PDF. It covers just about everything and even runs you through audio scenarios. Employees can even report social engineering that they hear right to the security office on the form. I only had to use it once, but they were very quick in calling me. I mean from the time I hit "submit" to my phone ringing couldn't have been greater than 5 minutes. On the test I was very impressed I got 5/5 correct. Some other people got fooled by one that just about got me. The person on the phone gave a id that was a company id but it was for a female, not a male. That one screwed up a few people.
--
If you have a topic in the direct forum please reply to it or a post of mine, I get a notification when you do this.
Koetting Ford, Granite City, illinois... YOU'RE FIRED!!
swindmill

join:2002-07-12
Clinton Township, MI

video clip on front page?

Since when have video clips been posted directly on the front page?

Vathral
Premium
join:2002-08-26
New York, NY
clubs:
·Earthlink Cable Mo..

Re: video clip on front page?

said by swindmill See Profile :

Since when have video clips been posted directly on the front page?
It feels so wrong for some reason.
--
F@H

aaron8301
I can't get myself to go away.

join:2005-01-03
Clarkston, WA
Karl has since removed it.
CMoore2004
i r teh smarts
Premium
join:2003-02-06
Jonesville, MI
·Sprint Mobile Broa..
·HughesNet Satellit..

How many tries?

Funny thing is that when you connect the cable modem to their network, it brings up a page where you can download the software. It asks for account information to register the modem, and says if you don't know the account number you can look it up by going to another page if you don't have it.

There's no reason a technician should have called to get the account number. The software has means to do it all by itself.

My question is: how many tries did it take? I've done some social engineering, and it's not usually a first try success.
--
Sprint Mobile Broadband PX-500 | Windows XP MCE SP2 | Mobile AMD Athlon 64 4000+ | 1.5GB RAM | ATI Mobile Radeon X600 128MB | 120GB HDD

jamez818
please hold during the silence

join:2000-09-18
Sunland, CA

It doesn't suprise me

Whether it be a technician, tech support, or service rep, all Comcast employees I have dealt with seem to have poor training. Oh well.
--
just whiners and complainers...
Nickker22

join:2003-08-16
Portland, OR

Re: It doesn't suprise me

Whenever one needs to change anything on the account, he/she would need to have the social security number to go with the account.

So what can one do with an account number?

aaron8301
I can't get myself to go away.

join:2005-01-03
Clarkston, WA

Re: It doesn't suprise me

Of the many different service locations I have had Comcast, Comcast has NEVER had my social security number.

Phattieg

join:2001-04-29
Jacksonville, FL
·Verizon Wireless B..
·Sprint Mobile Broa..

Re: It doesn't suprise me

Thats fine, it just means you'll have less security with account changes or info if someone calls acting like they are you. The field tech's are SUPPOSED to check ID in a change of service, especially if there is no social security number listed. You may be in an area that doesn't do credit checks, or you are grandfathered from a system that didn't do checks... May I recommend you put a password on your account to avoid a situation like this??? Having your ss# listed doesn't mean anyone can see it, only the last 4 digits. I don't think I've heard of anyone getting their identity stolen from Comcast. Now if you lived in Canada and had Rogers cable, then I'd worry about personal info.
Nickker22

join:2003-08-16
Portland, OR
For all my services ( comcast, tmobile, and even banking) they all ask for my SSN before conducting anything regarding my account.

Loker
Premium
join:2004-07-11
Constantine, MI
clubs:


edit:
April 12th, @04:44PM

said by jamez818 See Profile :

Whether it be a technician, tech support, or service rep, all Comcast employees I have dealt with seem to have poor training. Oh well.
not all do.

and this is not something limited to Comcast...I bet if you tried something similar with various other companies more than 90% would be more than willing to share...
--
"While preceding your entrance with a grenade is a good tactic in
Quake, it can lead to problems if attempted at work." -- C Hacking
battleop

join:2005-09-28
00000

Re: It doesn't suprise me

Another byproduct of cheap broadband. They pay these people crap and treat them like it too. Many of them care about the customer about as much as their employeer cares about them.
JSRoman
Premium
join:2005-03-10
Callahan, FL


edit:
April 12th, @04:46PM

They got nothing.

I'm going to make sure everyone I work with hears this just in case but they got absolutely nothing of any use. There is nothing they can do to this account with just the account number. To make any changes to the account they would still have to provide some information off the account and from this recording I didn't hear the rep. making any changes to account because of these idiots calling in.

This does not deserve to be on front page.
--
www.seabee.org

Chuckles
Premium
join:2006-03-04
Saint Paul, MN
·Comcast


edit:
April 12th, @05:00PM

Cant please everyone.

Many of the customers I speak with get irate when I ask them to verify some information. They feel I'm wasting their time or toying with them. So no matter what if you work in a call center youre *(&^ed. =)
--
If you want a picture of the future, imagine a boot stamping on a human face— forever.

MisterMarcus

join:2001-11-10
San Diego, CA
·RoadRunner Cable

Re: Cant please everyone.

said by Chuckles See Profile :

Many of the customers I speak with get irate when I ask them to verify some information. They feel I'm wasting their time or toying with them. So no matter what if you work in a call center youre *(&^ed. =)
Wrong. I've worked in Customer Service for over 8 years and never had an issue with customers verifying their information. Your problem is the delivery of the questions.

Reps who do this (vis a vis, the "interrogation" method:

"What's your SSN? What's your DOB? What's your name? What's your address? What's your phone number?"

Are going to get rebuttal a LOT more than reps (like me) who do this (vis a vis, the "care" method:

"And who am I speaking with? For security reasons can you verify your SSN and DOB? And to make sure we have the most current information on file, can you verify your home address and telephone number?"

I say more words, but ask for the same information, in a way that's comfortable to the customer. It's a sales technique which quite frankly, a lot of people in customer service jobs need to learn. I hate calling companies for customer service because they do the interrogation method ALL the time and it's irritating. T-mobile is the only one that doesn't.
DSL Oberst

join:2001-11-29

Re: Cant please everyone.

said by MisterMarcus See Profile :

"And who am I speaking with? For security reasons can you verify your SSN and DOB? And to make sure we have the most current information on file, can you verify your home address and telephone number?"
Having worked in the industry for 10 years and having always used that format (along with sir and ma'am), I can verify that yes, people will go insane ballistic asking that exact question with those exact words. The answers, 10-30% of the time, will be:

YOU DON'T NEED THAT INFORMATION! HOW DARE YOU TRY TO STEAL MY IDENTITY! I WILL HAVE YOUR JOB, CRETIN! GET ME A SUPERVISOR NOW! THE CUSTOMER IS ALWAYS RIGHT! F*&#$ING C*(^SUCKER!

If you don't believe me, I will point you to half a dozen places where you can hear actual recordings of this stuff - the insane customers and the reps who are required to take it and not hang up while following procedure.

David
Last man standing
Premium,VIP
join:2002-05-30
Granite City, IL
clubs:

Re: Cant please everyone.

post the links, the shills don't believe it otherwise.

MisterMarcus

join:2001-11-10
San Diego, CA
·RoadRunner Cable

Then there's something wrong with your delivery. I've worked in varying customer service positions in different industries and I have never gotten rebuttal when asked the way I posted. I'll get people who ask if I really have to verify their address/phone, but I just respond with:

"Updating your contact information is definitely optional, however if the information we have on file is outdated or incorrect, it may affect our ability to provide you with any critical updates and/or changes for your account". They're fine then.

Again, it's all about how to deliver the message.

David
Last man standing
Premium,VIP
join:2002-05-30
Granite City, IL
clubs:
·AT&T Midwest

said by Chuckles See Profile :

Many of the customers I speak with get irate when I ask them to verify some information. They feel I'm wasting their time or toying with them. So no matter what if you work in a call center youre *(&^ed. =)
Damn, congrats from one call center rep to another.. kudos.
--
If you have a topic in the direct forum please reply to it or a post of mine, I get a notification when you do this.
Koetting Ford, Granite City, illinois... YOU'RE FIRED!!

Cheese
Premium
join:2003-10-26
Naples, FL
clubs:

Ummmm...

Thanks for the confidence Comcast! I wished you would have stayed the fuck away from my area and left RoadRunner in place!

See 7 replies to this post

Rick
Premium,MVM
join:2001-02-06
Waterbury, CT
clubs:

The problem doesn't really appear to be a poorly

trained phone rep. but rather no system in place for them to verify that the tech number the bogus tech provided was even legitimate. The phone rep clearly asks the caller "for security purposes" provide your tech #.
The caller does and that appears to be it.

The phone rep also appears to be very hesitant about giving out this information even after being provided that bogus tech #.

Perhaps the rep. could or should have questioned this unusual request more, but at some point even your best security measures might fail if you have someone persistent enough to try to obtain some information.

Here you have a caller who's intent is to deceive to obtain this information. They're providing a name..address..phone #..bogus tech # when asked..and using the right words (ie: i need to provision this modem) to obtain an account number.
The phone rep is questioning them, sounding hesitant..asking for verification..

At what point is this the callers fault, and not comcasts?

Perhaps there could be a better system where the rep could see that a work order exists but then again..do you want to allow all comcast reps total access to all things like that? An insider with too much access could probably cause much more widespread problems if they're of the mind to than an individual incident ever would.

Tough call, but at some point, it's the "thief's fault"..and not Comcasts.
And clearly, this caller was out to deceive.
--
The Coyote captured the RR! Roadrunner Rick is now Comcastic!

See 8 replies to this post

hmmwth

@mindspring.com

hhmm!

Well this most be luckiest prank caller. at 3:28 a beep for no reason you can't tell much about it but i figure the tech ask him the name in the account "prank caller- ***** Franklyn" the tech "john- well i see a Barbara Franklyn", Yeah make me wonder wtf how did he guess the account holder last name did he know the person or he using his own account trying to see if Comcast would give his info away.
canuck999999

join:2004-04-19
·MTS

Re: hhmm!

Finding the name wouldn't have been too hard if they didn't already know it, all they would have had to do is wait for the mail person to drop off some mail and then check the name that way.
Now as a tech support worker I have to say that this is seriously messed, if I pulled a stunt like that and got caught I probably would have got fired, no excuses.

Qumahlin
Never Enough Time
Premium,MVM
join:2001-10-05
West Chester, PA

Why is Comcast singled out?

My question is this...why is this news? I could call pretty much any business in the US that has a large amount of support reps and trick someone into giving me account info...

Especially if you have any inside knowledge of a companies procedures it would make it quite easy to trick support reps into giving up info.
--
Forum Posts:7500
Forums » Comcast Easily Duped Into Handing Out Customer Info


Friday, 05-Sep 19:11:12 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 9 years online! © 1999-2008 dslreports.com.