SoylentNews

Ask SN: Best Way to Report a Major Security Problem at a Cellular Carrier?

posted by janrinok on Sunday July 19 2015, @07:58AM   
from the good-luck-with-that dept.

An Anonymous Coward writes:

I tried to return an item to a nearby carrier-owned store, but they couldn't find my information. They never gave me a printed receipt and couldn't look it up with my phone number or name.

Now here's where it gets fishy: the clerk wanted to log into my e-mail account with the store's computer! When I told him I didn't have a web mail like GMail, etc, he asked another guy, who also said I should just log into it from there and find it.

I'm pretty sure I was giving deer-in-headlights looks while I was there. Flabbergasted is probably the word. Considering their "POS" system is based on Windows and has regular problems, this just seems tailor-made for keylogging, social engineering, or worse. I probably won't use my credit card there again.

So my question: how do I report this? Just calling customer care obviously won't cut it. I have a very hard time believing this is SOP, and that this is probably just this store--and where there's one, there are probably more.

---

Original Submission

• Incompetence, not Malice (Score: 3, Informative) by Sir Finkus on Sunday July 19 2015, @08:17AM

  by Sir Finkus (192) on Sunday July 19 2015, @08:17AM (#210987) Journal

  Lots of smaller businesses (such a cellular resellers) simply don't have the resources or knowledge to have good security practices. Especially in that particular area. I worked briefly at one of those cell phone stores and there was a lot of pressure to just get shit fixed and done.

  If it isn't a corporate store, you could try calling the wireless company itself, or spam executive's email accounts. They're usually pretty easy to find if you can figure out how they format emails. Something like FirstLetterOfFirstName@company.com is usually a safe bet. I personally wouldn't go that route because it is extremely unlikely to cause a company wide change, and rather likely to get the specific employee disciplined or fired.

  I was in a similar situation with a smaller company. I needed to RMA something and I had an extremely helpful email exchange with their customer service person. The return was authorized with no trouble and I just needed to pay for them to ship the new item out to me. I was asked to provide my credit card number over email. I politely explained my reason for not providing my number and was able to arrange an alternate payment method.

  --
  Join our Folding@Home team! [stanford.edu]

  Starting Score:	1		point
  Moderation		+1
  Informative=1, Total=1
  Extra 'Informative' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3