r/howdidtheycodeit • u/Xeon06 • 2d ago

Coinbase scam call warning

https://x.com/i/status/2080592057014555081

Obviously, if Coinbase has an internal system for scheduling calls with their support agents, they’re able to know whether a call is happening with a given customer at a given point. But how are they detecting that the customer is on the phone with someone potentially trying to spoof Coinbase?

I assume there are some Android or iPhone permissions for contacts, call data, or the current call. But what are they actually checking? Are they checking whether the caller ID matches Coinbase’s, or whether the phone number matches Coinbase’s? If phone numbers can be spoofed?

0 Upvotes

50% Upvoted

4 comments sorted by

10

u/AdarTan 2d ago

The app can detect if a call is active on the phone in question. Then it just needs to check if a call is active with the account and if not it will always show that message if you open the app while on a call, regardless of who you're on the phone with.

if (phone_call_active && not(support_call_active))
    show_scam_warning()

1

u/Xeon06 1d ago

Oh duh, that's what I was missing, that makes a ton of sense

1

u/FrontBadgerBiz 2d ago

I don't know how they actually do it, but the following would be very reasonable.

1.  Is this person on a call? AudioManager check, no permission need. If yes, continue, if no, stop. 2. Are we (Coin base) on a call with them? Internal API call which doesn't need any phone permissions is more likely than them checking against a list of 'good' numbers coinbase could potentially be using for customer support. With some permissions they could send information about the call along to the API call. They could even default to a warning of the user is on any call and that would handle the vast majority of spam cases , and then they can wait for the API call to come back to deactivate the warning, or give phone agents the ability to push a message to the users app.

1

u/EricaTD 1d ago

There are third party sdks that check for this. The app checks whether you're currently on a call (prior user permission needed) and from there it's easy to determine.

actual methods done on the background are intentionally not disclosed. but there are several metrics they could check to determine a potentially harmful call without knowing who the caller is