#What about the people who have no credit card | Explore Tumblr Posts and Blogs

foldingfittedsheets · 2 months

Text

Since everyone seems to love my sex shop stories, here’s another one.

Phone calls were literally a game for us. Not all phone calls, but there was a specific brand of call where guys would creep on us. 90% of the workforce at the sex shops was women. So we’d get dudes calling jacking off or trying to get their jollies from us.

The game: make them hang up. We could have hung up. On a few occasions I did, but for the most part we made a sport out of getting creeps to go flaccid. It really depended on a caller.

You couldn’t just go in for belittling them straight off- some guys wanted that. You had to tailor your strategy to the perv. Overall it was pretty fun and it turned an aspect of the job that could’ve become a major bummer into a fun sport. We’d get excited when the phones rang.

So one day the phone rings. I pick up and it was very clearly a young teen who was putting on a deep voice. I was utterly delighted, I’d never had a crank call before. He said, “I have a dildo emergency! Can you deliver 5 boxes of dildos to my home?!”

It took everything in me not to crack in that moment. It was so funny. It was like three kids had walked through the door in a trench coat and the phrase “dildo emergency” was one of the funniest things I’d ever heard.

But I kept it together. In smooth customer service tones I replied, “Oh, I’m sorry to hear you’re having an emergency, but due to the nature of our product we do require people to come pick it up themselves.”

The caller audibly deflated. Some of the deep voice he was putting on bled away when he said plaintively, “But it’s an emergency…”

“I’m sorry, sir, rules are rules.”

He hung up. I burst out laughing and told my coworker what had happened. She said, “I will buy you lunch if you call back and pretend you can deliver something.”

This sounded like an all around win for me, and the kid hadn’t used anything to block his number. So I called back.

“Hello!” This was before caller ID was common for home phones and so he picked up in his totally normal voice, several octaves higher than before.

“Hello, I’m calling regarding your dildo emergency?”

“Oh! Hem hem,” he coughed, getting his voice back into character for me. “Yes! The emergency!”

“Well I’ve spoken to my manager and it’s your lucky day. We’ll be able to make a delivery after all. Five boxes you said? We can swing it by later, we’ll just need your name, address, and credit card number.”

He was thrown by needing to provide info and was silent for a moment then said, “Well how much is it for five boxes?”

“About five hundred dollars, sir.”

He slipped out of his character voice to exclaim, “Five hundred dollars?! What kind of dildos are they?!”

“Just standard six inches with balls, sir.”

This was his breaking point. He started wheezing with laughter trying to repeat the phrase “six inches with balls” incoherently.

“So your address and card info?”

He hung up and I broke down laughing too. We both got a kick out of it, and I won the game twice in one day.

#ramblies #ffs foibles #sex shop #retail #story #funny story #storytime #writing

14K notes · View notes

pinolitas · 23 days

Text

i hate being my parents' parent

#its why i moved out to dorm first chance i got but unfortunately i had no chance of transferring to engineering there #they cant make payments online #i teach them and they dont learn #my dad tells me he tries to pay his credit card himself before coming to me and he always gets lost on the first step #i dont even do it for him i just sit next to him and tell him what to click and why #and then when its something thats frustrating for me i know itd be even worse for them #last month comed changed the account numbers and fucked up their online system i couldnt pay at all #this month the flood insurance they bought recently has its first payment due and i couldnt pay any method online at all #and so i called and the robot tells me its paid off but i have no evidence of that anywhere #oh my god and yesterday i had to write my cousin's jury excuse letter because she doesnt understand english #but better me than her 6 year old kid who will only grow up to have the same issues as me if she puts him to translate for her #i hate doing things for people and i feel so much guilt because its what im supposed to do but oh my goddddddd #oh my god i hate it i hate it i hate it #whenever i have evil thoughts its always about the same shit #that post about a gun that just puts you out for a few hours #please

1 note · View note

pokilicious · 4 months

Text

Can we as a society stop infantilizing short people? I'm 161cm tall with a babyface and people don't take me seriously and treat me like a child. I'm in my early twenties, I go to college and have bills to pay, don't treat me like I'm your little sister or whatever, I'm a grown ass adult and you should treat me as such

#I have a 14-year-old brother and people still asks us who is the younger one #what kind of child worries about credit card bills??#and people ask why short people are so angry all the time #my dentist calls me niece of course I'm angry all the time

0 notes

mostlysignssomeportents · 3 months

Text

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

#pluralistic #social engineering #phishing #ai #swiss cheese security #infosec #finance #fraud #carding

10K notes · View notes

heart-bones · 1 year

Text

man every time I think I could not feel Worse, I am proven wrong ⚰️

#I legitimately want to die #just kind of feeling.#pointless? scraping by even with the new credit card #my 'market adjustment raise' was FIFTY. CENTS.#how do they think 17.29$ is a market adjustment???#(when the cost of their product is going up by more than 20% ????)#(RECORD PROFITS GUYS.)#and also on the non job side like #my boss and i were cracking jokes about dating apps #but im genuinely bummed by the lackluster things happening there too #just so many people who are into enm or poly or just looking for flings while they travel #or its people i have absolutely zero attraction to #like i tend to fall for people i develop good friendships with first im not immediately sexually attracted to anyone #but i know what i think is Pretty to me you know? and like. fuck.#im also doing that thing again where i doubt anyone i could ever find pretty & want to be with would FIND ME PRETTY & want to be with ME #like it happened ONCE #ONCE IN 30 YEARS #am i going to be 60 before it happens again?#i just feel lonely and everything feels so . . ... . ????

0 notes

ew-selfish-art · 9 months

Text

Dp x Dc AU: It’s not the usual suspects trying to summon the undead this time, and it’s proving to be a massive headache for John Constantine. They seem...Competent.

When John sniffed out a new plot to summon a ghost, he kind of laughed it off. Ghosts were not more than shades of the people/creatures they used to be, without all the right resources and enough buy in from the greater spirits of the Infinite Realms, most entities that came thought might scare some kids at a slumber party but that was at most. Plus, kids were scary resilient these days thanks to the internet, so really, John’s not worried.

Then he hears about the gathering of artifacts and he has to care a little more. He learns that one Jasmine Fenton is involved and he’s... Surprised. She’s got a public record of dismissing her parent’s inventions and causing stirs at supernatural conventions (not to mention a great reputation as a research focused psychologist). Jasmine’s credit cards report a great deal of cash (refunded to her account by an unknown off-shore account) being taken out and her location is right next to the last place anyone could find a shard of the Crown.

Yeah, that Crown. The Infinite, ancient blessed and deity cursed one. John had meant to get around to investigating if the shard of obsidian (fire forged) was legit, so he begins to set his sights on Jasmine for a ‘chat’.

Then Sam Manson, a scary ass Heiress, pulls up in a limousine and all but kidnaps him and dumps him outside city limits. She tells him that he’s been cursed for the next 48 hours to stay out of their city- If he comes close, any plant will identify him in a heartbeat and come to life to kill him. (Fun fact: there are a goddamn lot of plants surrounding this stupid town, even the dandelions are forging knives to kill him.)

THEN worse, Red Robin gets on his ass about cybersecurity of all things. Turns out another player, identified by the moniker TooFineTooFurious has been tracking John’s phone and has been rummaging around official JLD documents- How was John supposed to know that keeping his passwords on the notes app could be hackable? Red Robin declares him incompetent and John can only sigh, crush his phone and move on.

That all leads him to the summoning portal in front of him in this weird ghost themed high school gymnasium. It’s far too competent. It gives him goosebumps even before he can read out that they’re summoning the King of the Infinite Realms himself. John clicks the panic alarm on his JL communicator before engaging with the Trio before him.

They’re not wearing any capes, no candles are lit, but this is the scariest cult he’s ever seen. Jasmine Fenton, ghost denier, Sam Manson, Heiress and Plant Witch (?), Some other dude with a beret and fucking DRONES (he considers this might be the man who hacked him). John pleads with them, they don’t know what they’re trying to do. Pariah Dark will kill them all, eat their entire planet for breakfast!! Everyone rolls their eyerolls at him, and he’s taken aback by their nonchalance.

Plant guards grab him and a drone has a laser sight on his forehead. He fights but is subdued- They’re almost done chanting when Superman, Green Lantern, Red Robin and Cyborg all appear. Despite their disruption- the chanting ends with the green illumination of the circle. Despair fills the air.

And then- Poof- a groaning young man appears.

“Dudes you have no idea how unhelpful the Infi-map is sometimes. I was lost for like weeks and CW was being such a bitch ab- What. Wait, who are all- Holy shit did you guys summon the Justice League?” The Ghost King in full Regalia stared back at them in questioning concern. The three summoners start bitching at the monarch and John... isn’t sure if this is going to be an interdimensional incident yet.

#dpxdc #dcxdp #dc x dp #dp x dc #dc crossover #dp crossover #danny phantom #red robin #cult summoning but it's just your homies #jazz fenton #john constantine #justice league dark

4K notes · View notes