The First Call: Andrea Lopez

Andrea Lopez answered the phone at the video rental store where she worked, and in a moment was smiling: It's always a pleasure when a customer takes the trouble to say he's happy about the service. This caller said he had had a very good experience dealing with the store, and he wanted to send the manager a letter about it.

 

He asked for the manager's name and the mailing address, and she told him it was Tommy Allison, and gave him the address. As he was about to hang up, he had another idea and said, "I might want to write to your company headquarters, too. What's your store number?" She gave him that information, as well. He said thanks, added something pleasant about how helpful she had been, and said goodbye.

 

"A call like that," she thought, "always seems to make the shift go by faster. How nice it would be if people did that more often."

 

The Second Call: Ginny

"Thanks for calling Studio Video. This is Ginny, how can I help you?"

"Hi, Ginny," the caller said enthusiastically, sounding as if he talked to Ginny every week or so. "It's Tommy Allison, manager at Forest Park, Store 863. We have a customer in here who wants to rent Rocky 5 and we're all out of copies. Can you check on what you've got?"

She came back on the line after a few moments and said, "Yeah, we've got three copies."

"Okay, I'll see if he wants to drive over there. Listen, thanks. If you ever need any help from our store, just call and ask for Tommy. I'll be glad to do whatever I can for you."

 

Three or four times over the next couple of weeks, Ginny got calls from Tommy for help with one thing or another. They were seemingly legitimate requests, and he was always very friendly without sounding like he was trying to come on to her. He was a little chatty along the way, as well - "Did you hear about the big fire in Oak Park? Bunch of streets closed over there," and the like. The calls were a little break from the routine of the day, and Ginny was always glad to hear from him.

 

One day Tommy called sounding stressed. He asked, "Have

you guys been having trouble with your computers?"

 

"No," Ginny answered. "Why?"

"Some guy crashed his car into a telephone pole, and the phone company repairman says a whole part of the city will lose their phones and Internet connection till they get this fixed."

"Oh, no. Was the man hurt?"

"They took him away in an ambulance. Anyway, I could use a little help. I've got a customer of yours here who wants to rent Godfather II and doesn't have his card with him. Could you verify his information for me?"

"Yeah, sure."
                                                                                    
Tommy gave the customer's name and address, and Ginny
found him in the computer. She gave Tommy the
account number.

"Any late returns or balance owed?" Tommy asked.

"Nothing showing."

"Okay, great. I'll sign him up by hand for an account here and put it in our database later on when the computers come back up again. And he wants to put this charge on the Visa card he uses at your store, and he doesn't have it with him. What's the card number and expiration date?"

 

She gave it to him, along with the expiration date. Tommy said, "Hey, thanks for the help. Talk to you soon," and hung up.

 

Doyle Lonnegan's Story

Lonnegan is not a young man you would want to find waiting when you open your front door. A one-time collection man for bad gambling debts, he still does an occasional favor, if it doesn't put him out very much. In this case, he was offered a sizable bundle of cash for little more than making

 

some phone calls to a video store. Sounds easy enough. It's just that none of his "customers" knew how to run this con; they needed somebody with Lonnegan's talent and know-how.

People don't write checks to cover their bets when they're unlucky or stupid

at the poker table. Everybody knows that. Why did these friends of
mine keep on playing with a cheat that didn't have green out on the table?
Don't ask. Maybe they're a little light in the IQ department. But they're
friends of mine--what can you do?
This guy didn't have the money, so they took a check. I ask you! Should
of drove him to an ATM machine, is what they should of done. But no,
a check. For $3,230.
Naturally, it bounced. What would you expect? So then they call me;
can I help? I don't close doors on people's knuckles any more. Besides,
there are better ways nowadays. I told them, 30 percent commission, I'd
see what I could do. So they give me his name and address, and I go up
on the computer to see what's the closest video store to him.
I wasn't in a big hurry. Four phone calls to cozy up to the store manager,
and then, bingo, I've got the cheat's Visa card number.
Another friend of mine owns a topless bar. For fifty bucks, he put the
guy's poker money through as a Visa charge from the bar. Let the cheat
explain that to his wife. You think he might try to tell Visa it's not his
charge? Think again. He knows we know who he is. And if we could get
his Visa number, he'll figure we could get a lot more besides. No worries
on that score.

 

Analyzing the Con

Tommy's initial calls to Ginny were simply to build up trust. When time came for the actual attack, she let her guard down and accepted Tommy for who he claimed to be, the manager at another store in the chain.

And why wouldn'tshe accept him--she already knew him. She'd only met him over the telephone, of course, but they had established a business friendship that is the basis for trust. Once she had accepted him as an authority figure, a manager in the same company, the trust had been established and the rest was a walk in the park.

 

MITNICK MESSAGE

The sting technique of building trust is one of the most effective social engineering tactics. You have to think whether you really know the person you're talking to. In some rare instances, the person might not be who he claims to be. Accordingly, we all have to learn to observe, think, and question authority.