I Thought Spectrum Was Calling Me. I Got Social Engineered Instead.
By #EnthusiasticTechie | Chasing the Tech Inside
I work around technology. I talk about cybersecurity. I know about scams, phishing and social engineering.
And I still got caught.
That's exactly why I'm sharing this.
On Friday, August 21, I received my upgraded mobile phone from Spectrum. I went to Spectrum's website myself and activated the phone online. Everything seemed normal. New phone activated. Good to go.
At least that's what I thought.
Then "Spectrum" Called Me
The next day, August 22, my phone rang.
Caller ID showed Spectrum.
Think about the timing.
I had literally just received and activated a new Spectrum phone the day before. So when somebody who appeared to be from Spectrum called me about my new phone, there wasn't much reason in that moment for me to think something was wrong.
I answered.
The caller immediately started talking about the phone.
He asked whether I had received it.
I said yes and explained that I had already activated it.
Then he told me that the phone still needed to be registered.
That sounded believable enough.
So we proceeded down that road.
He started asking questions, and because I believed I was speaking with Spectrum, I answered them.
Looking back now, that's where the social engineering really took over.
The attacker didn't need to convince me of some wild story. He stepped into a real situation already happening in my life and made himself appear to be part of it.
The Call Felt Legitimate
This wasn't somebody calling and immediately asking me to send gift cards or cryptocurrency.
The conversation felt like customer service.
The caller knew how to keep things moving. By that point I believed I was dealing with someone from Spectrum who was helping finish the setup of my new phone.
Then he suggested that I should get a cover for my new smartphone.
There were emails involved too, which made everything seem even more legitimate at the time.
I finished the conversation thinking I had simply handled another part of setting up my new phone.
I had no idea what had just happened.
Then I Logged Into My Spectrum Account
On August 23, I logged into my Spectrum account.
That's when I saw something that immediately didn't look right.
There were four mobile phones on my account.
There should have been three.
Hold up.
Where did phone number four come from?
I contacted Spectrum and asked what happened and why there was another mobile device on my account.
That's when this situation turned into a fraud investigation.
Spectrum told me my account appeared to have been compromised, and the matter was sent to its fraud department for investigation.
Now I'm waiting to see what they determine.
They Social Engineered Me to the Max
I'm not going to pretend I saw through it.
I didn't.
They got me.
I was socially engineered to the max.
And I've been around technology long enough to understand what social engineering is.
That's what bothers me—and it's also what makes this experience worth sharing.
Cybersecurity knowledge doesn't make you immune to manipulation.
Attackers don't always attack the computer.
Sometimes they attack your trust.
The timing made this attack especially convincing.
I had just upgraded my phone.
I had just activated it.
The caller ID appeared to say Spectrum.
The caller talked about the exact type of transaction I had just completed.
Everything fit together just well enough for my brain to say:
This makes sense.
And once I accepted that first assumption, everything that followed seemed like part of the same legitimate process.
That's social engineering.
Caller ID Is Not Proof of Identity
This experience changed the way I'm going to treat incoming customer-service calls.
Seeing a company's name on caller ID does not prove the person calling actually works for that company. Caller ID information can be spoofed.
So from now on, if somebody calls claiming to represent my phone company, bank, credit-card company or another important account and starts asking me for information, I'm changing the process.
I'm ending the call.
Then I'm opening the company's official app, visiting the website myself or calling the number printed on my bill or listed on the company's official website.
If the issue is legitimate, the real company will still be there when I contact them through a channel I control.
That's the lesson I'm taking from this.
Don't Let Embarrassment Keep You Quiet
Part of me could have kept this story to myself.
I talk about technology. Getting socially engineered isn't exactly something you want to brag about.
But hiding experiences like this helps scammers.
Somebody reading this might get a similar call tomorrow.
Maybe they just ordered a phone.
Maybe they just opened a bank account.
Maybe they just changed an insurance policy.
Then somebody calls at exactly the right moment and appears to know what's happening.
That's when your guard can come down.
So I'm putting my experience out there.
Not because I handled everything perfectly.
I didn't.
I'm sharing it because somebody else might recognize the setup before they go as far down the road as I did.
My New Rule
If a company unexpectedly calls me and wants information involving my account, identity, device or money, I'm not going to verify myself to the caller.
First, I'm going to verify the caller.
And the easiest way to do that is to end the conversation and contact the company myself using its official channel.
A legitimate representative may understand why.
A scammer just lost control of the conversation.
That's one cybersecurity lesson I won't forget.
Technology can have some incredible security protecting the systems behind it, but humans are still part of that system.
This time, somebody came after the human.
They got me.
Now I'm learning from it, tightening things up and sharing the experience so maybe they don't get the next person.
Stay curious. Stay alert. And never let a familiar name on caller ID make the trust decision for you.
#EnthusiasticTechie #ChasingTheTechInside #Cybersecurity #SocialEngineering #ScamAwareness
No comments:
Post a Comment