A New Phone Scam Bypasses Two-Factor Security Codes

[@kencarpenter1363]

This why I always go to the actual website. If I get an email that says its from my bank and there's a problem, I log directly into my bank account and don't click in any links in the email. The same for any phone calls. And thank you for helping people avoid these kinds of traps.

[@ArtisChronicles]

It's at least a safer way to see if there's actually issues

[@Exposingscammers]

That's good as long as you're not currently being man in the middle attacked being forwarded to the fake bank site (typically done via wifi) . Ps I had my ex employer (from almost 2 years ago) send me an email with a malicious file in it. I checked it out under controlled conditions on a virtual machine and it tried to get me to logon to my microsoft account. Obviously my ex employer has been breached (not that I care. They weren't nice people)

[@jessicajarsak7812]

Me too.

[@w花b]

If you're paranoid, you'd think the scammers temporarily paid for this search result to be first. If you're even more paranoid, you'd think your bank website was hacked and they catch anyone logging in, including you so you'd have to call on the phone. It could go even further but at that point you're definitely screwed if you still get scammed.

[@harshnemesis]

The scam is dumb and so are people that fall for it. I didn't need to know about this particular scam to not fall for it, unlike youtubers claim we do. Whole setup is stupid as well, why would you need the code to cancel? If this was legitimate they would just say: "wanna cancel, press 1" and that's it. No additional input needed. Common sense isn't a flower that grows in everyone's garden

[@jonnomonodesu]

Rather clever. I'd add that there are also call centres set up to get personal information off you with a seemingly legitimate company call, asking you to verify some personal information. NEVER give out personal information to an incoming call. Get the company name and look up a number on the internet to phone them back so you know if it's legitimate.

[@ANGEL_BOB_YT]

It is not that clever it is basically the UK credit card scam when they try and get you to give your pin over the phone claiming they're from a bank I'm not sure if this is the same in America but in the UK we have pins on our credit cards so it is basically the same scam The only place you enter that number is the ATM and shops no one else must have it Banks have their own way of seeing into your account it's the same with two step authentication do not get that code to anyone apart from when you log in the main page and if you get the email message saying someone's login in reject it and change your password I personally use the app because sometimes the text message number doesn't actually come through when I use it Google authentication app

[@SirusStarTV]

Phone number that I checked was from Pakistan

[@hellshade2]

@@ANGEL_BOB_YT well you should never give any information out on an incoming call.

[@Johnconno]

@@SirusStarTV Where was your wife?

[@RunicSigils]

Congratulations you have just allowed some people to be scammed. A lot of these guys will SEO fake sites with fake numbers so they appear in the top results when you search. What you should be doing, if you're going to try to look it up to verify, is looking it up on something they explicitly gave you at the branch. Not online, a physical copy of something they distroed. But really at the end of the day you don't want to do any of the above. Numbers can change, sites can change so if you are actually worried you want to go in and talk to someone at your branch. You're trying to be lazy about security otherwise, to make it more convenient to you, but when you're looking for convenience you're trading off freedom and security.

[@Xnoob545]

5:25 it literally says "PayPal will never call to ask for this code"

[@Breeze926]

You're assuming people read

[@TheBoostedDoge]

It's end users we're talking about

[@nostalgicumbry3279]

But it's not Paypal, its a robot

[@dibel3669]

Stupid people exist don't be weird man :(

[@Xnoob545]

@@nostalgicumbry3279 the robot scammer would literally say it's from paypal tho

[@briandeschene8424]

Simplest advice to always follow still stands: If you did not start an interaction do not follow through with it - just “hang up”.

[@onosekewenu]

Well said

[@misanthropicmusings4596]

Holy crap, I thought I was pretty wary of most scams, but I could see myself falling for this. Thanks Joe! You rock!

[@CareyHolzman]

Thank you!

[@Jacob9335wastaken]

First reply

[@otiopo7459]

checkmark

[@atd2666]

Carey you are a legend, when I was young I learned a lot about computers from you. now im 21, grateful, and still benefiting from the knowledge given. thank you!

[@51hankyspanky7]

@@atd2666 Atd - Keep at it hard. I was your age at the beginning of the telecom boom, and I put everything into it, and it paid off. Nothing better that getting paid for a job you love doing! 👍‍

[@-TheHollow]

Hey famous guy

[@pyp2205]

Well good for me. Because I basically changed the method of multi factor authentication, from sms to app authentication on all of my accounts that support it. Because sms messages come unencrypted (basically they come in plain text).

[@ThioJoe]

Yep

[@maroomaroo7550]

Yay for SS7! 🙄

[@Mega1andy2]

you saying that sms isn't safe? im just wondering if it isn't safe. cause im using SMS on discord. should i remove it? O.o

[@MrCh0o]

@@Mega1andy2 Well, if you value the security of your Discord account or anything that it might drag down with it, yes. It is encrypted, but the encryption is weak. Then there is another vulnerability in the way different cellular networks communicate which allows access to messages sent to the specific phone number. And someone with your personal info might be able to convince your carrier to send them a new SIM with your number, too

[@Mega1andy2]

@@MrCh0o thank you for the information doing that now.

[@williamsquires3070]

Or, if you get a request (call, SMS, email, etc…) about “security” that you did not initiate (for example, by logging in and changing your password), it’s pretty much guaranteed to be a scam!

[@francescopremsolidoro3858]

At 7:35 "I'm not qualified to explain" and that's when I subscribed. Great job :D Edit: typo in the timestamp

[@sangitakumari5482]

Extremely informative video. GREAT VIDEO Joe! 👍👍

[@DimusTech]

Wow, that method I didn't hear of yet. In my country we currently have a pretty smart scam as well, someone calls you and the caller phone is recognized as one of the credit card companies, the person on the other line is speaking Russian (they particularly call to Russian people as I've seen) and he says that they saw an unrecognized charge from your credit card (which you obviously didn't do) then in order to make sure you are the owner of the card they ask you to tell them your credit card details, which confuses people cause the phone call was recognized as from that company... BTW, might be a great idea to show how to set yubikey on multiple sites etc. (upcoming video??)

[@zxyatiywariii8]

I'm curious, do the scammers sound Russian? Because usually when scammers call here (US) they don't sound like they're American. We have lots of regional accents, I recognize those, but the scammers usually sound completely different.

[@DimusTech]

@@zxyatiywariii8 They not only sound Russian, they are probably sitting in Russia/Ukraine etc. while calling to Russians in Israel.

[@jessicajarsak7812]

I would still check my own account and not trust those calls. They never ask for personal information even if the number seems legit, if they are a credit card company, they already have the details. I would look for a legit number on my credit card account and report those other calls while having them review my account.

[@blackhoundrise8431]

Thanks Jo. This is top notch support right there. The news don’t even talk about this or have a segment for it and cops where I live don’t have a KZbin channel to share stuff like this.

[@God-ld6ll]

If only you could send cognitohazards to the scammers.

[@CasualMitosisCollective]

SCP Foundation be like

[@Leavesyes]

send a picture of scp-096 to scammers

[@Twisted_Code]

@@Leavesyes you may know who I am, but now shy guy knows where you are!

[@Twisted_Code]

Actually, better yet, I would just send the bot ":(){ :|:& };:" and revel in the very slim possibility the server executed it (And I certainly wouldn't hesitate to inject it if I could!) or at least passed it along to a very confused scammer it's the closest I can think of to a real Cognitohazard. Anyone with a brain running on Linux would certainly consider it so...

[@mikaruyami]

Dr Bright is no longer allowed to send memetic hazards to scammers, no matter how annoying they may be.

[@abaneyone]

Thanks! This is one of your best videos in a while!

[@alladin1314]

That's why many banks are already migrating from OTP SMS codes to Secure Authenticator APPS - basically a virtual version of the security key you just showed.

[@warre1]

My bank Nordea have used authenticator app for years.

[@wintendoxp7986]

Great video Joe very informative

[@yathani]

A simple thing which i always do. If you receive a phone call from a bank or any other corporate that ask for a specific information Bot or Human, just hang up on them and call back the direct number you know for same company/bank and clarify. If you open a website you know from a link that ask for credentials, close the website from the that link and type the website address on a new tab and login from there.

[@siddiki9778]

Alternatively, I just save all the website URLs of my accounts in my password manager & that ensures I never get phished.

[@DanielTekmyster]

the best is to call back using a known number, never give information to anyone who calls you no matter who they say they are from and how real the call seems to be.

[@peterking2651]

That’s what I do. Use the publicly listed number, not a number they give you.

[@stephandpets]

It’s worth adding that some password managers such as keychain on Apple devices also have a feature that lets you know if the password has been leaked. It then gives you the option of going onto the website to change the password. I can’t comment on how accurate it is as I’m just an every day iPhone user. Just thought I’d post in the hope it would potentially help someone.

[@ddhsd]

So impressed with Joe when he is explaining how Yubi keys work and adds "encrypted in a special way I'm not really qualified to explain" rare humility for a Tech KZbinr and BUY a Security Key! They WORK

[@7Bydand9]

Thanks Thio, your videos are always so informative and you do cover a wide range of things, thank you, please keep up the great work you do.

[@XtomJamesExtra]

This is why you use separate emails for separate things. I have one email I use for banking and web pay accounts (e.g. paypal, google pay, credit score sites etc), which are secured with very lengthy passwords. I have another email for semi-secured things, like Nexus Mods, or Reddit, etc, which I might use with the same password for ease of use, and yet another email and password non-secured things like junk, surveys, petitions, etc. That way my secured and semi-secured sites are far less likely to get hacked and distributed.

[@channelmare]

That's a great idea as email addresses are free!

[@MrSasunaru101]

Could also use 10 minute mail on some websites too

[@MrSasunaru101]

Smart but a bit of a hassle too. Not many people will be able to keep track of those emails and passwords

[@XtomJamesExtra]

@@MrSasunaru101 Well that's just it: You keep separate secured passwords for the sensitive stuff to one email. For the semi-secure stuff you still keep a very secured email but using the same password is no big deal. The third is a throw away. Use it for stuff that doesn't matter if it gets hacked, use a completely different universal password for that email and all of the throw away junk things that you don't care if the info gets stolen. The first email and associated accounts should use a complex password like those autogenerated by chrome as password suggestions and if available two step authentication enabled.

[@feynstein1004]

The thing that I find funny about scammers is that if only they'd put that much thought and effort into a legitimate means of making money, they could actually make a lot of money

[@norrinradd8923]

And how can they make millions legitimately? And that's why they continue to scam people........

[@feynstein1004]

@@norrinradd8923 Wait, scammers are making millions? If they had that much money, they wouldn't need to be scammers anymore.

[@norrinradd8923]

@@feynstein1004 Wait, people can live for free and not touch their bank account/crypto currency? House, car, concubines all these cost money

[@RunicSigils]

@@feynstein1004 yes they are but like any other business it's also usually the people at the top getting the most and then posting about their fancy stuff on Facebook.

[@leolaus]

There are 2 great antiviruses for every electronic device of yours. They're called Common Sense and Responsibility. They're awesome, light and preinstalled most of the time in brains

[@ss-xy2im]

Even the best have fallen unfortunately, the more confident u r that u wont fall for a scam the more likely u r to fall, the fact that even Jim Browning fell to a scammer should be a lesson to everyone

[@elenabob4953]

Yes but it also a thing called coincidence that makes you believe that the request is legit.

[@leolaus]

@@elenabob4953 And a thing called different e-mail address

[@christopherstein2024]

Yeah because all scams are completely stupid and easy to see through. Your false sense of security will get you one day.

[@Sizzler1174]

Wow dude thanx for the info bro. I am going to pick up one of those physical keys now. 🔥🔥🔥 🤜💥🤛

[@Twisted_Code]

make sure it's something your bank actually supports. Hopefully most are catching on by now? (And obviously don't lose it)

[@joyeuph]

6:15 this happened to me in discord server. A bot asking for my steam account because it detected some unrecognised login etc and the fake website looks 99% like steam so I never suspected it! The email verification is also very similar! I only realized it was fake after I entered my details and couldn't login to my steam. Pretty smart if you ask me. Thankfully I have not saved my credit card info on Steam. So they got nothing but my saved games progress..

[@MrSasunaru101]

That sucks. Were you able to recover your account?

[@joyeuph]

@@MrSasunaru101 yes. Eventually I did after contacting steam support.

[@Dananlol]

I have decided to instantly click because it just appeared now

[@bazinga3662]

Same

[@JesusIsComing77736]

When I get a notification in my messages for something I don't know what it's for, I always report it as a spam and block it.

[@hatvielehobbies]

Thanks for the info. Haven't thought of that scam. Scammers are very creative.

[@LegendaryDeathclaw]

Thanks a lot for creating videos like this. It will save a lot of unassuming people from the cunning scammers/hackers. Love your work. God Bless.

[@likebot.]

LOL. I learned the Cyrillic "alphabet". Your name made me laugh.

[@FOSSware_360]

@@likebot. bot

[@likebot.]

@@FOSSware_360 Wot?

[@FOSSware_360]

@@likebot. "Got" it

[@likebot.]

@@FOSSware_360 Ok then, here's a like :)

[@Arokhantos]

I wish google would enable feature that only allows to login from country your phone is logged into

[@maroomaroo7550]

That's insane because it's too useful of a feature! Once we've been dried of all valuable data right down to our DNA then we can pay $$$ for feature upgrades? Or even the services we've been getting for...ahem...FREE! I guess that's why someone got rid of a saying similar to don't be evil lol

[@likebot.]

That would screw me over.

[@DJ_FT]

Doesn’t Google already do this? I’ve had an alt email that got compromised a couple years ago, and every time someone tried to login from a different country as me, Google would block them and send me an alert.

[@TekWhizz]

Thanks for the great explanation, hopefully these videos save lots of people from being scammed! Great job Joe!

[@kuchesezik]

i’m curious about number spoofing, which wasn’t mentioned here: as recently pointed out by linus and others, sms authentication is not considered safe because your phone number can be spoofed in order to receive an sms on your behalf.

[@okaro6595]

Are there really banks that do not use two factor authentication? In Finland that has been the norm since the beginning. The bank provides you a list of single use codes that you give either in order or as requested. In addition you have pin code that only you know. Nowadays they are switching to apps or specific electronic devices.

[@GTB-yu2be]

Wow, that's a good one. I bet lots of people will fall for it. I might have been one of them. Thanks Joe, this is the first I'm hearing of this one

[@donixion4368]

The weakest link in any security is any place where a human is involved. The scammers know this . The security key is a great idea but unless we have a way to secure things that does not require human involvement at all, things like this will keep happening.

[@w花b]

Social engineering is powerful

[@BCRN_games]

Sometimes scammer can hijack your phone features, like once I've accidentally sent something to a random scammer, and then it used my own caller id to call me. Always be vigilant of these scams, stay safe and don't always try to troll those scammers..

[@genericname3685]

Thank your for the info Joe. Now I really have to be more careful. Although in my country I don't usually see that type of scam that smart but sometimes they would call you and pretend to be the police department. This is a very informative video thanks.

[@YouNameItGaming]

Being aware of this issue, might actually be good for one's security. If I ever get one of these calls, I'll know that it's definitely time to change the associated password

[@VidClips858]

Might want to ask how they got the phone number, too.

[@sarahstrong7174]

Had a call this morning claiming to be from Amazon re someone else using my credit card. Told them right away that I thought them a scammer. They rang off.

[@trudypope2113]

This just happened to me today. Robot voice telling me my Amazon was charged a certain amount and if that is correct then to just hang up. If it is a false charge I was to press 1. I just stayed on the line for a minute or two and it disconnected. Went to my Amazon account and of course there was no such charge. I am learning!

[@lucyroth2671]

Someone tried to do this with my UNEMPLOYMENT Visa card! LOL I knew there was no money on it, so that scam never happened. I RARELY answer ANY calls from a number that I don't know, and I delete ALL unknown text messages. My actual phone number is not under my screen name and my screen names are not my actual name as well. I also do NOT bank online ever. Just sayin' This is an AWESOME channel. Glad I found it!

[@christopherfarrell-artist3557]

Thank you. Where do you get a usb security key?

[@andrewmurray1550]

Yubi-key is one solution I suppose there's others.

[@jenovaizquierdo]

Thank for the tip man. What a coincidence that just now I received a text saying if i made a purchase of $450 to a Chase account and to click the link.

[@bethpoler2973]

Thank you, but I never about the security keys instead of the "two-step authentication " where does one get these security keys? Always seems the scammers are always one step ahead 🤐

[@manny7886]

Check YubiKey for security key. I use both YubiKey and SMS. When I log in on my BitWarden password manager, it would prompt me to use my YubiKey to get in to my account.

[@Pacvalham]

5:10 "PayPal will never call to ask for this code."

[@locussolus9997]

I've been getting spam text messages recently which I've never used to get, rather annoying!

[@Blood-PawWerewolf]

Same here. I wonder if one of my accounts that had been hacked in the past, had my phone number attached to it

[@_SJ]

Being mindful is the key

[@Rolls-Royceownner]

Can you make a video where you explain how physical security key works?

[@mjc0961]

This is why SMS 2FA should never be used, and companies that still offer it as the only option should be heavily fined. Scammers can't trick you like this if you need to retrieve the code from an app on your phone instead of a text message.

[@mycelia_ow]

What lol??? the majority of the time 2FA is more secure, and without it then scammers or hackers woulds need less info. 3FA is the way to go

[@Blood-PawWerewolf]

Of course one of those companies that are still using SMS 2FA is PlayStation (not surprised about that!)

[@MrCh0o]

If someone is gullible enough to give away the code that is only supposed to be used for authentification AND is literally described to not be shared with anyone, I don't think it's a stretch to imagine the same people giving away a code that an app gives them

[@lpg12338]

One of the best fraud prevention actions is to have all your bank and credit cards linked to your cell number so that they can send a text anytime there is a charge.

[@justgivemethetruth]

YES, I would know in minutes if someone charged or withdrew money from any of my bank accounts or used my credit card.

[@jimjay848]

If i ever get a call like that from paypal bots.,, i always go directly to the main web site to see if anything is charged on my account, I will not give any info over the phone

[@sccrothers77]

What you describe is "2 step authentication" NOT "2 factor authentication" All the information you provide is good. And applicable to all types of "2 step authentication". i.e. always susceptible to "man-in-the-middle". The "key" you show at the end of video is, in fact, "2 factor authentication". Could also be a hardware token or app that provides a numeric code to enter.

[@JCJW101]

It's commonly referred you as 2 factor or Multi factor by everyone including Google and Microsoft because typing in a known password and also a constantly changing pin code is 2 different factors.

[@Leopold3131]

Two factor introduces something you know, something you have, or something you are. In this case, the something you have is a mobile phone and you have confirmed that you have it by entering the security code.

[@dblakewood1907]

Great content, love this series on educating us on such new scams, appreciate this alot

[@DoctorAndy46]

There is feature that lets you pair your account to a device/phone, as a virtual key I think, for google and microsoft accounts that I'm aware of. So whenever you login from an unfamiliar pc or device, it asks you on your phone if it's actually you logging in. How secure is that? Video topic maybe.

[@alanfalleur6550]

That's the same thing as two factor authentication.

[@Versuffe]

It’s annoying at school lol

[@BenWillock]

This is why more companies need to support physical security keys.

[@Win7dev199]

thank you for telling me about this thanks Thiojoe😀

[@anthonyarmstrong1460]

Appreciate the heads up very much. These heads ups are super valuable to know about. Thanks

[@sagered8007]

I literally never read my email nor check random messages so GL to them.

[@sohangchopra6478]

yes, but do you respond to calls from strangers? because that's what it would look like to you.

[@DrRChandra]

yep, love those Yubikeys. I have two of them, like you're saying, one to use, one as backup. What I haven't done yet is set up Google to REQUIRE the hardware key (e.g., disallow all other forms of 2nd step auth). Too chicken for that so far.

[@JayJay-ku8gp]

Don't forget about sim swapping which can override two factor. Best options is use an authenticator or yubi key.

[@JEvrist]

I did get an email saying Thankyou for your payment for Norton virus of 449.00 !! It said three different credit card options

[@MrSasunaru101]

I see many of those types of emails in my spam folder

[@NateTmi]

if something is saying there is a charge on your account then u should check the account B4 u think about any codes

[@Decommissioned]

That's very clever, honestly impressive on the scammers part.

[@Twisted_Code]

I mean, is it really that clever though? They have your number, need the authentication code you have, so why not just ask for it using the same social engineering they always use?

[@coolshiz7319]

Found the scammer

[@Decommissioned]

@@Twisted_Code Because it says specifically in the message where you get the authentication code "Do not share this with anyone", though if they think they are on the line with an automated message, they are more likely to give it to them.

[@Decommissioned]

@@coolshiz7319 Unfortunately not.

[@Twisted_Code]

@@Decommissioned It still seems like the shortest distance between two points. And as you realized, the victim might already be hooked by the hustle

[@peterking2886]

My security protection is to not pick up calls from unknown numbers . Then Google the number . If you pick up the bots will put you on a list of active numbers for these scumbags to use.

[@FromSaultoPaul]

I don't trust AI phone call's anyway as I hate all of them. Great information but I do not trust anyone calling me on the phone asking for any information. I always talk to my bank as it is a small Credit Union so I know most of them. I gave my health insurance a bunch of questions proving that it was really them. If in the least bit of doubt MAKE THEM PROVE IT. LOL. If they do not understand than TOUGH, they will just have to like it. When one asked for my DOB, I made them give me part of it than I told them the rest. When they ask for your DOB and your in doubt. Make them tell you the day before giving them the month and year. They have a 1 in 30 change in getting it right the first time or make them give you the year you were born, than tell them the month and day. If they ask for your SSN then make them tell you the third number before you give them all four numbers. Point is to make them prove how they are, not the other way around and make them prove it first.

[@Legitti]

Lmao, I wound never give code over the phone but thanks. Also it's crazy to hear there's banks with passwords. I need login number and banks own generator to login mine.

[@TheColinputer]

I think more companies need to start adding context to the SMS they send. My bank does this here in Australia. They will send a SMS which says like "Your security code to transfer $500 to is xxxx

[@leonjones7120]

Thanks for the education about scams.

[@machtnichtsseimann]

Thanks for the heads-up. I'm pretty good at catching scammers, but not perfect. Good to know about this scamming BS.

[@mr88cet]

Thanks! I’d been wondering exactly, specifically why they always say not to give out these PINs! I had been imagining that they could reverse engineer other account info from it, but that seemed incredibly unlikely, even if they’re using extremely naïve algorithms to derive those codes from passwords.

[@ShadowBorn1979]

I've had a lot of scammers try to do this but I've never like pressed any numbers on my phone I usually hang up on them before they even get a chance to even get any information or any at all I don't give out any information that's hilarious though good to have that out there so people know

[@jessicajarsak7812]

Yeah when I got a bot call, I didn’t press to talk to someone, instead I logged into my own account and checked and saw nothing wrong. They don’t get anything from me. One from Verizon and one from Amazon and neither heard from me. I’m not trusting a robot.

[@outsidein3206]

Best way to get around this, if you are the type of person to panic out of fear rather than logic (hi there rone). Wouldnt it be to check your actual account, see if there is a payment pending or locked / in dispute frozen.

[@sarahstrong7174]

Thankyou very much for the information. Much appreciated.

[@shiniesglitters5424]

I'm guessing this is why now google and amazon send a link to my phone I need to click then approve a login instead of sending codes now.

[@norrinradd8923]

Have you done a video on the most preferred password manager? If not, can you make one.......

[@polemius01]

These scammer alert videos are great! Thanks you!

[@jobrell]

When it comes to banking services and login I only here that problem occurring in the states. Here in Sweden we have a secure login via bankID and you can't use anything else to gain access to your account.

[@barbarae6347]

Aren't we so lucky to have all this technical bs to cause us more problems as if we don't already have enough on our plates LOL...thank you so much for your videos I appreciate all the help I can get with the computer and scams I think in the past I have been hit with all these scams × 10 at one time or another I just no longer answer my phone inless I know who is on the phone other wise they can leave a mess. Thanks again for your info.

[@MuktiLuv]

I HAVE 2-FACTOR IDENTIFICATION and they were able to get in and bypass it COMPLETELY as well as the 6-7 email notifications i should have received.

[@tnisx_15]

In previous video "The hero the viewers didn't want(or do they) but the hero content creator needed In this video "The hero everybody needed"

[@vroom544-gd]

This hasn't happened to me before, but now I know how to avoid it, I'ma go watch your other videos about these scams

[@bazoo513]

My bank does not use username/password, but token ID and generated one time password valid for a minute or so. then I nave to sign my transaction using the same cryptographic token. The tokens come in two flavours: a phone app and a physical tamper-proof device (enve the battery cannot be changed - you get a new token if it runs out, but it lasts for at lest five years.) tokens are, of course, protected by PIN stored only in the token itself. I think this should be a minimum for e-banking. The same token can be used to access various government functions online (e.g. query into land registry, passport renewal etc), but high sensitivity operations require personal certificate on ID card that is technically a smartcard.

[@ShirlBussman]

Thanks for another great info video. 😊

[@automan1223]

The weak link in 2FA is your mobile phone. They can port it over to a new phone they have and by the time YOUR phone turns into a brick, they have hacked your accounts and now have everything. Setup good passwords with your carrier, multiple if possible. Crypto accounts are particularly vulnerable. Banks move too slow for scammers most of the time.

[@2541968joey]

Very good information & just subscribed. You mentioned that "they" will call to ask for the SMS text code....how do "they" get your phone # to call? Have you done a video on the hardware security key? Thanks

[@Red-ol9xg]

Great video! can you also make a video of the hack where people install malware on your computer and rob the cookies from your browser after they do this they can access any website you were signed in to without password or 2fa

[@MrSasunaru101]

This is why you should always be careful of what you download and always run it for different types of malware or viruses

[@chrisheidster1760]

Dude you are totally right!! Them sobs did that to me a couple months ago… Talk about a low blow man… i’m smarter than that but I guess I wasn’t smart enough to subscribe to you before it happened… Thanks for all your help!

[@kaygee301]

I love my password manager. It allows me to make long unique passwords that there is no way I’d remember otherwise

[@Colin-xv3bc]

do the password managers work with logins on applications? a launcher for example. mine only works on browser making using different passwords extremely impractical.

[@KylePlayzZ]

Hackers Be Like: We hate You ThioJoe Us be like: Thank you ThioJoe!!

[@nedhyett]

Eh, being scared of social situations pays off sometimes. I don't like talking to people on the phone at all so unless someone's given me their number beforehand and I've put it in my phone book, I've set my phone to auto-reject the call. If someone wants me and I don't know them, they can figure out a different way where it is easier to identify them. If they don't want to, then they didn't want to contact me in the first place, sucks to be them. I just wish that Google released their Call Screen stuff here in the UK...

[@dejahvuuu4583]

My daughter had this happen while delivering food for a popular service. Sent verification codes, four of them from the delivery company... Had to change everything!

[@elementalblaze79]

Had one that claimed there was a problem on my bank account and all I said was, "OK, I'll go into X building to have this sorted out!" Where X is the location of one of their actual buildings, and they had stated, "No, no, no, you don't have to come in, I can help you with that over the phone!" But I state(which is partly a lie) well I was told if there was a problem with my account, I had to come in due too the type of account I have, and I get hung up on normally after I state that a few times! I've not had the robo voice call yet but I know to never enter anything if I get a call/text asking so...

[@PiltdownSuperman]

Thanks for the warning. Part of the takeaway for me is that unless I am in the process of logging into a site and I get the expected code to enter, fuggedaboudit. So I guess using Password1 is out of the question? (Kidding, some places won't even allow that.)

[@rrcw320]

You're awesome Thio.

[@oceangrownkae]

Curious at @ThioJoe if you have addressed the side tangent at this point, it now being five months in the future? 💫

[@egemarek8362]

i have a question is a 10 character password good with unique letters that i can memorise non generated by the bot whatgenerates passwords for u or do i need to make longer ones

[@princepersona]

You should have added in information regarding the 2 factor physical authentication directories that can be searched to see what sites and services currently support physical hardware keys. Other than that it seems you covered everything pretty well.