Posts

Call-Aware Link Fraud Prevention Mechanism [Proposal]

-
  1. Background In many social engineering fraud cases, attackers initiate a phone call and guide the victim to open a malicious link sent through SMS, messaging apps, or other communication channels. The attacker remains on the call to create urgency and instruct the victim to perform actions such as entering credentials, sharing OTPs, or installing malicious applications. Traditional caller identification tools mainly detect spam numbers but do not actively protect users during the real-time interaction phase of a scam . This proposal introduces a Call-Aware Link Protection Framework designed to identify suspicious patterns involving calls, links, and user actions. 2. Key Risk Scenario A typical fraud pattern occurs as follows: The victim receives a call from an unknown or spoofed number. During the call, the attacker sends a link via SMS, WhatsApp, or other messaging platforms. The attacker instructs the victim to open the link immediately. The victim enters sensitive informati...
Post a Comment
Read more

Call-Aware OTP Fraud Prevention Mechanism [ Proposal ]

-
  1. Background OTP-based authentication is widely used for banking, payments, and account verification. However, a significant number of fraud cases occur through social engineering phone calls, where attackers convince victims to reveal the OTP in real time. Attackers typically create urgency and manipulate the victim during the call. In many cases, victims unknowingly share the OTP despite system warnings or security messages. This proposal suggests technical controls to reduce OTP fraud risk, especially in situations where the victim is actively engaged in a call with a potential fraudster. OTP - Key Challenges 2.1 Unknown Call Detection Limitations Flagging OTP activity during unknown calls may help detect suspicious situations, but there are legitimate scenarios where unknown calls are genuine. Examples include: Calls from new contacts or new SIM numbers Calls through mutual or reference contacts Calls from service providers or delivery agents Therefore, relying solely on unk...
Post a Comment
Read more