3 Messages
Safe word request
Background:
On Saturday our alarm was tripped by our vacuum for the first time since we got it. My wife got a call from an unknown source, introducing themselves by first name (don't recall if they stated they were from simplisafe), explaining that the alarm was tripped and requested a passcode. This struck odd to us, as we have never had to tell the passcode, which to us meant the pin number we input when disarming the device. The person then requested my wife's name, at which point my wife thought it was too suspicious and hung up.
The person then called me, and we went through the same procedure. Again, I cannot recall if they said they were from simpli safe, not that it matters, as anyone can call and pretend to be. Then they asked for passcode again, and I explained I never had to give out the passcode. They told they needed the password, which can be just word or word and numbers. I knew what they were asking for this time. Issue resolved.
Recommendations:
Recommendation One: SimpliSafe needs to have a password for when calling us so we can identify it is really them. Maybe something that gets texted realtime to us, and changes every call.
In a time of phone number spoofing, we need a way to be able to identify that it is SimpliSafe calling us and asking for information. Here is a simple report on how easy it is to spoof phone numbers and pretend to be someone else: https://www.businessinsider.com/phone-number-spoofing-2016-2. How easy would it be to pretend to be someone and try to gain access to our system? I would argue reasonably comfortable with the current standard.
Recommendation Two: Use proper terminology when asking for something across the board. There is a difference between password, passphrase, and passcode. Keep it standard across.
On Saturday our alarm was tripped by our vacuum for the first time since we got it. My wife got a call from an unknown source, introducing themselves by first name (don't recall if they stated they were from simplisafe), explaining that the alarm was tripped and requested a passcode. This struck odd to us, as we have never had to tell the passcode, which to us meant the pin number we input when disarming the device. The person then requested my wife's name, at which point my wife thought it was too suspicious and hung up.
The person then called me, and we went through the same procedure. Again, I cannot recall if they said they were from simpli safe, not that it matters, as anyone can call and pretend to be. Then they asked for passcode again, and I explained I never had to give out the passcode. They told they needed the password, which can be just word or word and numbers. I knew what they were asking for this time. Issue resolved.
Recommendations:
Recommendation One: SimpliSafe needs to have a password for when calling us so we can identify it is really them. Maybe something that gets texted realtime to us, and changes every call.
In a time of phone number spoofing, we need a way to be able to identify that it is SimpliSafe calling us and asking for information. Here is a simple report on how easy it is to spoof phone numbers and pretend to be someone else: https://www.businessinsider.com/phone-number-spoofing-2016-2. How easy would it be to pretend to be someone and try to gain access to our system? I would argue reasonably comfortable with the current standard.
Recommendation Two: Use proper terminology when asking for something across the board. There is a difference between password, passphrase, and passcode. Keep it standard across.
New to the Community? Get started by reading our Welcome Article and please be sure to review our Community Guidelines before posting.
Related Conversations
0
0
captain11
6.7K Messages
Second, COPS, and the company before them, were always excellent in response and held true to the exact SOP. No issues. I strongly suggest you call Simplisafe, give them the date and time of the alarm condition and calls, and ask for them to investigate and advise you what happened.
Please post your outcome here.
1
0
taggart
35 Messages
I recommend taking glass sensors off instant trigger. The only times I've accidentally triggered them was by breaking glass in the kitchen (to be expected), and by sneezing near one of them (a surprise). When I heard the base unit beeping, I knew the alarm had been triggered and I had time to walk to the keypad and turn it off before an alert was sent to the monitoring service.
1
0
coltmaster1
2.8K Messages
0
0
toastie
175 Messages
Is the word not there for them to see? Or are they typing it in to see if it's the correct word? (I have to assume they themselves have to type it in, since we've been asked to spell it more than once!)
0
0
captain11
6.7K Messages
0
0
sevensiamesecats
2.2K Messages
0
0