4 ms·

How about the caller id that's being sent has to match the billing number and company ? The telcom companies know who to bill, why do they have to develop any

How about the caller id that's being sent has to match the billing number and company ? The telcom companies know who to bill, why do they have to develop any method to fight abuse ? Being a suspicious person, I suspect it'll be a new feature to add to the bill. https://en.wikipedia.org/wiki/Caller_ID_spoofing https://en.wikipedia.org/wiki/Caller_ID_spoofing

subway 10y ago
That isn't an easy problem to solve. What do you do when a company has a large set of numbers on a single trunk? Do you maintain a list of authorized CID source numbers? How do you enable 3rd parties to make calls on your behalf?
- ralfd 10y ago
  > How do you enable 3rd parties to make calls on your behalf? Why should that be possible? If anything the disadvantages of nuisance or even scamming obviously far outweigh the benefits.
  - dangrossman 10y ago
    Few companies over a certain size run their own call centers. It's no different from a software startup using AWS or Rackspace instead of building a server room in their rented office space. I think it is both acceptable and desirable for my phone to tell me Comcast is calling me (as they currently do), even though it's technically an outsourced call center that makes/takes calls for several different companies from the same building and same set of phone numbers. Requiring caller ID match the billing address for the phone number would be like requiring Hacker News be hosted on a cloudflare.com subdomain because the IP space we're talking to isn't actually owned by YC.
    - bkruse 10y ago
      You can set the CallerID name to whatever you want. We once had a customer that set their callerID name to "DEAD" to signal that the phone number was no longer in use. People thought they were issuing threads on their outbound calls.
      - deleted 10y ago
        [deleted]
    - jonknee 10y ago
      SPF records are reasonably simple to set up and something similar would solve this issue completely.
      - superuser2 10y ago
        To build SPF for the PSTN you'd first have to build DNS for the PSTN, then convince the manufacturers of carrier-grade switches to implement it, then convince telcos to buy new switches, then convince every single telco on Earth to throw out its last remaining equipment that doesn't enforce "SPF" for caller ID (or spammers would just use those companies).
        toast0 10y ago
        DNS for the PSTN exists, e164.arpa; mostly not public though. It would be a slog to get it implemented, but if spammers are limited to spoofing international numbers or from rural carriers, that's still a win because I can ignore calls from out of the area.
        spc476 10y ago
        More specifically (in case anyone wants to know more---I know it surprised me to learn that caller name information is sent via DNS) NAPTR records.
- viraptor 10y ago
  Not sure what the US situation is here, but in the UK end users (of an ITSP provider I worked at) who could originate non-local numbers had to sign a "we have reasons and we won't abuse this feature, you're free to disconnect us if we do" contract. I see how it's a hard problem to solve in 100% of cases, but I don't see why it's not solved for most of them. Carriers have their own interconnects, pricing, and contracts. I believe 99.99% of call spam can be solved in a few months by major telcos coming up with a definition of spam callers and updating contracts to say: if you route more than N such calls within M days, and don't report who you disconnected because of it, we're disconnecting you instead. Real small telcos would have to drop misbehaving lines immediately. Fake telcos selling services only to spammers could not continue to do business.
superuser2 10y ago
Businesses like to send one outgoing CID number from branch offices in several states, serviced by several local carriers, without having to route those calls through a central location first. Individual telecom companies know who to bill, but "the telecom companies" don't have collective knowledge except by deliberate effort. There's no incentive to expend that effort unless it's "a new feature to add to the bill," and all it takes to make that effort worthless is one carrier who refuses to play along.
bkruse 10y ago
Every call has a CIC code (carrier identification code). If callerID was similar to ssl certs, the world would be a better place
MichaelGG 10y ago
They don't. The company getting the call just knows who they get it from. The reseller chain can be a dozen companies deep. I've ran companies doing 1B+ calls a week. Any time there's some sort of complaint from a customer or vendor, we just kick it down the line and say "please verify caller ID xxx is correct". We block it, everyone moves on. No one cares. I tried a few times to get the end user to file a complaint. Vendors and customers would just get annoyed; nothing happened. Even in cases where an AG gets involved and sends out a subpeona, I've never seen anything happen. Hell, even on DHS investigations (like where callers are pretending to be IRS agents), nothing happens. Until the FCC starts getting serious about it, that'll remain the status quo. (Only time I've seen things actually happen is when the request is incidental to another investigation, like "terrorism" or drugs. Why the hell they fwd us any details about the suspect beats me. All over plaintext, too.)
- advertising 10y ago
  1B+ as in one billion a week??
  - MichaelGG 10y ago
    Yes over 1 billion a week. And we weren't a huge reseller. Granted, a lot of calls were junk and didn't connect. But still have to do routing, setup, check billing, etc. (And did it on simple commodity stuff, including just a $5000 SQL Server box for accounting/recording.)
MertsA 10y ago
Just to chime in on the matter, there are actual legitimate reasons to spoof a caller ID. There's even legitimate reasons to spoof a caller ID that you don't own. Right now I've got a couple phone systems that are set up to spoof the caller id of incoming calls that are transferred to an outside line. As far as the outside party is concerned, the party that originally dialed in is calling them directly even though our phone system is really just conferencing two separate calls together. If we didn't do this then whoever we transferred the call to wouldn't know anything about who is calling them other than that the call was through us.
- spc476 10y ago
  The company I work for also provides a service to spoof the originating number. It's meant for companies that send employees out into the field that might need to make phone calls from a cell phone (think a plumber or a delivery person). If the "field agent" makes a call, the customer gets the company number, not the number of the "field agent."

subway 10y ago

That isn't an easy problem to solve. What do you do when a company has a large set of numbers on a single trunk? Do you maintain a list of authorized CID source numbers? How do you enable 3rd parties to make calls on your behalf?

ralfd 10y ago
> How do you enable 3rd parties to make calls on your behalf? Why should that be possible? If anything the disadvantages of nuisance or even scamming obviously far outweigh the benefits.
- dangrossman 10y ago
  Few companies over a certain size run their own call centers. It's no different from a software startup using AWS or Rackspace instead of building a server room in their rented office space. I think it is both acceptable and desirable for my phone to tell me Comcast is calling me (as they currently do), even though it's technically an outsourced call center that makes/takes calls for several different companies from the same building and same set of phone numbers. Requiring caller ID match the billing address for the phone number would be like requiring Hacker News be hosted on a cloudflare.com subdomain because the IP space we're talking to isn't actually owned by YC.
  - bkruse 10y ago
    You can set the CallerID name to whatever you want. We once had a customer that set their callerID name to "DEAD" to signal that the phone number was no longer in use. People thought they were issuing threads on their outbound calls.
    - deleted 10y ago
      [deleted]
  - jonknee 10y ago
    SPF records are reasonably simple to set up and something similar would solve this issue completely.
    - superuser2 10y ago
      To build SPF for the PSTN you'd first have to build DNS for the PSTN, then convince the manufacturers of carrier-grade switches to implement it, then convince telcos to buy new switches, then convince every single telco on Earth to throw out its last remaining equipment that doesn't enforce "SPF" for caller ID (or spammers would just use those companies).
      - toast0 10y ago
        DNS for the PSTN exists, e164.arpa; mostly not public though. It would be a slog to get it implemented, but if spammers are limited to spoofing international numbers or from rural carriers, that's still a win because I can ignore calls from out of the area.
        spc476 10y ago
        More specifically (in case anyone wants to know more---I know it surprised me to learn that caller name information is sent via DNS) NAPTR records.
viraptor 10y ago
Not sure what the US situation is here, but in the UK end users (of an ITSP provider I worked at) who could originate non-local numbers had to sign a "we have reasons and we won't abuse this feature, you're free to disconnect us if we do" contract. I see how it's a hard problem to solve in 100% of cases, but I don't see why it's not solved for most of them. Carriers have their own interconnects, pricing, and contracts. I believe 99.99% of call spam can be solved in a few months by major telcos coming up with a definition of spam callers and updating contracts to say: if you route more than N such calls within M days, and don't report who you disconnected because of it, we're disconnecting you instead. Real small telcos would have to drop misbehaving lines immediately. Fake telcos selling services only to spammers could not continue to do business.

superuser2 10y ago

Businesses like to send one outgoing CID number from branch offices in several states, serviced by several local carriers, without having to route those calls through a central location first. Individual telecom companies know who to bill, but "the telecom companies" don't have collective knowledge except by deliberate effort. There's no incentive to expend that effort unless it's "a new feature to add to the bill," and all it takes to make that effort worthless is one carrier who refuses to play along.

bkruse 10y ago

Every call has a CIC code (carrier identification code). If callerID was similar to ssl certs, the world would be a better place

MichaelGG 10y ago

They don't. The company getting the call just knows who they get it from. The reseller chain can be a dozen companies deep. I've ran companies doing 1B+ calls a week. Any time there's some sort of complaint from a customer or vendor, we just kick it down the line and say "please verify caller ID xxx is correct". We block it, everyone moves on. No one cares. I tried a few times to get the end user to file a complaint. Vendors and customers would just get annoyed; nothing happened. Even in cases where an AG gets involved and sends out a subpeona, I've never seen anything happen. Hell, even on DHS investigations (like where callers are pretending to be IRS agents), nothing happens. Until the FCC starts getting serious about it, that'll remain the status quo. (Only time I've seen things actually happen is when the request is incidental to another investigation, like "terrorism" or drugs. Why the hell they fwd us any details about the suspect beats me. All over plaintext, too.)

advertising 10y ago
1B+ as in one billion a week??
- MichaelGG 10y ago
  Yes over 1 billion a week. And we weren't a huge reseller. Granted, a lot of calls were junk and didn't connect. But still have to do routing, setup, check billing, etc. (And did it on simple commodity stuff, including just a $5000 SQL Server box for accounting/recording.)

MertsA 10y ago

Just to chime in on the matter, there are actual legitimate reasons to spoof a caller ID. There's even legitimate reasons to spoof a caller ID that you don't own. Right now I've got a couple phone systems that are set up to spoof the caller id of incoming calls that are transferred to an outside line. As far as the outside party is concerned, the party that originally dialed in is calling them directly even though our phone system is really just conferencing two separate calls together. If we didn't do this then whoever we transferred the call to wouldn't know anything about who is calling them other than that the call was through us.

spc476 10y ago
The company I work for also provides a service to spoof the originating number. It's meant for companies that send employees out into the field that might need to make phone calls from a cell phone (think a plumber or a delivery person). If the "field agent" makes a call, the customer gets the company number, not the number of the "field agent."