PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER
{ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE MANAGER
{IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS
SUBJECT:  SOCIAL ENGINEERING TECHNIQUES USED TO OBTAIN CALLING CARD
NUMBERS {AUTOMATED SYSTEM SECURITY INCIDENT SUPPORT TEAM {ASSIST}
BULLETIN 93-03}.
1.  THE USE OF SOCIAL ENGINEERING TECHNIQUES TO ACQUIRE CALLING CARD
NUMBERS HAS BECOME WIDESPREAD.  COMPROMISED NUMBERS HAVE BEEN USED TO
STEAL SUBSTANTIAL DOLLAR AMOUNTS OF LONG DISTANCE SERVICES.  DOD
PERSONNEL WHO POSSESS CALLING CARDS SHOULD NOT GIVE THEIR CALLING
CARD OR PIN NUMBERS TO ANYONE, ESPECIALLY OVER THE PHONE.  EXAMPLES
OF TECHNIQUES USED TO ACQUIRE CALLING CARD (AND OTHER NUMBERS) ARE
LISTED BELOW.
2.  A PERSON WORKING OUT OF A METROPOLITAN BUS STATION PAY PHONE HAS
BEEN PLACING COLLECT CALLS TO TERMINATING NUMBERS ALL OVER THE
COUNTRY.  THE PERSON STATES THAT HE WORKS FOR A LONG DISTANCE CARRIER
AND HAD EVIDENCE OF FRAUD ON THEIR CALLING CARD NUMBER AND ASKED FOR
THEIR CALLING CARD NUMBER.  THE PERSON USUALLY CALLED AFTER 10:00 PM
AND 65% OF THE COLLECT CALLS WERE ACCEPTED BY THE TARGETS.
3.  ANOTHER METHOD BEING USED BY PERPETRATORS OF THIS FRAUD IS TO
SELECT NUMBERS FROM THE DIALING DIRECTORY, ONE AFTER THE OTHER.  WHEN
A TARGET ANSWERS, THE CALLER IDENTIFIES HIMSELF AS A PHONE COMPANY
INVESTIGATOR AND GIVES A 'BADGE' NUMBER.  THE PERSON IS AGAIN TOLD
THAT FRAUD HAS BEEN NOTICED AGAINST THEIR CALLING CARD ACCOUNT AND IS
THEN ASKED TO GIVE THE PIN NUMBER SO THE ACCOUNT CAN BE CANCELED.
4.  DOD USERS WITH CALLING CARDS ARE STRONGLY CAUTIONED AGAINST EVER
PROVIDING THE PIN FOR THEIR CALLING CARD TO ANYONE EXCEPT AN OPERATOR
AND ONLY WHEN THE DOD USER INITIATES THE CALL TO THE OPERATOR.  ANY
OCCURANCE OF AN INDIVIDUAL TRYING TO ACQUIRE A DOD CALLING CARD
NUMBER AND PIN SHOULD BE REPORTED AS SOON AS POSSIBLE TO THE ASSIST
OFFICE AND THE APPROPRIATE INVESTIGATIVE AGENCY.
5.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
PETE HAMMES, COMM {703} 696-1924/05 OR DSN 226-1924/05.  ASSIST CAN
BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE {800-
759-7243}, PIN NUMBER 2133937.  WHEN CALLING THE PAGER SERVICE,
FOLLOW THE AUTOMATED VOICE INSTRUCTIONS AND ENTER THE CALL BACK
NUMBER AFTER THE PROMPT.  THE ASSIST DUTY OFFICER WILL CALL YOU BACK
WITHIN 30 MINUTES.  IF FASTER SERVICE IS REQUIRED, PREFIX YOUR
TELEPHONE NUMBER WITH "999", AND THE ASSIST DUTY OFFICER WILL CALL
BACK WITHIN 5 MINUTES.  ASSIST CAN BE REACHED VIA E-MAIL AT "DOD-
CERT{AT-SIGN}DDN-CONUS.DDN.MIL".
BT