5 ms·

We all hate robocallers and scammers. We all hate getting called every day by them. But did you know there's something worse? My wife recently discovered a n

We all hate robocallers and scammers. We all hate getting called every day by them. But did you know there's something worse? My wife recently discovered a not so fun side effect of spam calls... Scammers have this popular trick of spoofing the caller ID for a number local to you. People are more likely to pick up the call if it's a number that seems familiar to them (like, the first 6 digits are the same as your phone number). I've known about this trick, but I never really thought about the collateral damage. See ... that number they're faking is a _real_ phone number. And it's someone else's phone number. It's not the scammer's number. Well my wife's phone number got used. You wouldn't believe the number of people who call scammers back! She was getting hundreds of calls a day; non-stop. Most people were calling back trying to figure out who called them. Some were angry. A few threatened her with violence. And there's absolutely nothing you can do about it. You can't stop someone from spoofing your phone number on Caller ID. You can't stop people from mistakenly calling "you" back. You're just stuck in phone hell. The only solution is to change your phone number ... not really a great option. It lasted about a week; we resorted to just keeping her phone on Do Not Disturb. What a nightmare.

softwaredoug 7y ago
I’m totally ignorant here, so I’m sure there’s a good reason: why is secure caller id so hard?
- cobbzilla 7y ago
  The telephone network was designed with total trust for “network operators” who essentially have “root” to do anything. This worked OK when the only operators were the various national phone monopolies (Cap’n Crunch notwithstanding), but today that level of access is much easier to get and abuse, and is difficult to trace. There are efforts to bolt-on security to the telephone network but it’s really hard. I think it’s more likely that (over the next handful of decades) the phone network fades into obscurity as more voice calls are connected over data links which offer much improved security models.
  - bostonpete 7y ago
    > Cap’n Crunch notwithstanding I assume you mean Captain Crunch, not the breakfast cereal... :-)
    - ars 7y ago
      He probably does mean the cereal, since it had the whistle that gave Captain Crunch (AKA John Draper) his name.
- breakingcups 7y ago
  Because there's no financial incentive to fix it.
- antonvs 7y ago
  It's being worked on - there's a standard called STIR/SHAKEN which uses certs to verify calls. I worked on this on my last contract. It's pretty easy to implement as a prototype - I've done it myself - but integrating it into the entire legacy phone network is another matter entirely. Here's an article about it: https://www.howtogeek.com/402141/how-phone-companies-are-finally-verifying-caller-id-numbers/ https://www.howtogeek.com/402141/how-phone-companies-are-fin...
- closeparen 7y ago
  The architecture of business telecom is really flexible. Customer PBXes have wide latitude to make their own routing decisions, and numbers are shared across arbitrarily complex multi-site, multi-provider topologies. What your neighborhood grocery store buys from the phone company is just a pool of voice circuits, probably fewer than its extensions and even its DIDs. There is no simple circuit-number mapping like in residential telecom. Designing federated AuthN/AuthZ for this is not simple; getting it rolled out across all the participating equipment (with many owners and service lifetimes of 15+ years) is basically never gonna happen.
NickBusey 7y ago
Yup. I've had this happen on my Verizon business phone. I called Verizon and was told the only recourse was to change my number, but of course the rep acknowledged the spammers could spoof any new number I received just as easily. So Verizon's only answer was basically "Deal with it."
- diogenescynic 7y ago
  Verizon’s scumbag lawyer was appointed as head of the FCC and promptly rolled regulation on robo-calls.
  - gowld 7y ago
    You got it backwards? https://www.fcc.gov/document/fcc-adopts-rules-help-block-illegal-robocalls https://www.fcc.gov/document/fcc-adopts-rules-help-block-ill...
    - diogenescynic 7y ago
      No, he was against regulation and now that robocalls are the #1 FCC complaint, they’re telling telecoms to fix the problem. For example: https://arstechnica.com/tech-policy/2018/03/ajit-pai-celebrates-after-court-strikes-down-obama-era-robocall-rule/ https://arstechnica.com/tech-policy/2018/03/ajit-pai-celebra...
sucrose 7y ago
> Scammers have this popular trick of spoofing the caller ID for a number local to you. I recently moved to a different state and kept my old phone number. When someone calls using that old area code, it's immediately obvious that it's a robocall. I have no ties to that area code, therefore no reason to answer. I usually Spokeo the suspicious numbers afterwards because I'm curious who it is. A few months back I tracked down the PII of a number that called me, so I texted them back. Here is our short, interesting conversation: https://imgur.com/a/4V2ugw9 https://imgur.com/a/4V2ugw9 (phone numbers and contact list names have been redacted)

softwaredoug 7y ago

I’m totally ignorant here, so I’m sure there’s a good reason: why is secure caller id so hard?

cobbzilla 7y ago
The telephone network was designed with total trust for “network operators” who essentially have “root” to do anything. This worked OK when the only operators were the various national phone monopolies (Cap’n Crunch notwithstanding), but today that level of access is much easier to get and abuse, and is difficult to trace. There are efforts to bolt-on security to the telephone network but it’s really hard. I think it’s more likely that (over the next handful of decades) the phone network fades into obscurity as more voice calls are connected over data links which offer much improved security models.
- bostonpete 7y ago
  > Cap’n Crunch notwithstanding I assume you mean Captain Crunch, not the breakfast cereal... :-)
  - ars 7y ago
    He probably does mean the cereal, since it had the whistle that gave Captain Crunch (AKA John Draper) his name.
breakingcups 7y ago
Because there's no financial incentive to fix it.
antonvs 7y ago
It's being worked on - there's a standard called STIR/SHAKEN which uses certs to verify calls. I worked on this on my last contract. It's pretty easy to implement as a prototype - I've done it myself - but integrating it into the entire legacy phone network is another matter entirely. Here's an article about it: https://www.howtogeek.com/402141/how-phone-companies-are-finally-verifying-caller-id-numbers/ https://www.howtogeek.com/402141/how-phone-companies-are-fin...
closeparen 7y ago
The architecture of business telecom is really flexible. Customer PBXes have wide latitude to make their own routing decisions, and numbers are shared across arbitrarily complex multi-site, multi-provider topologies. What your neighborhood grocery store buys from the phone company is just a pool of voice circuits, probably fewer than its extensions and even its DIDs. There is no simple circuit-number mapping like in residential telecom. Designing federated AuthN/AuthZ for this is not simple; getting it rolled out across all the participating equipment (with many owners and service lifetimes of 15+ years) is basically never gonna happen.

NickBusey 7y ago

Yup. I've had this happen on my Verizon business phone. I called Verizon and was told the only recourse was to change my number, but of course the rep acknowledged the spammers could spoof any new number I received just as easily. So Verizon's only answer was basically "Deal with it."

diogenescynic 7y ago
Verizon’s scumbag lawyer was appointed as head of the FCC and promptly rolled regulation on robo-calls.
- gowld 7y ago
  You got it backwards? https://www.fcc.gov/document/fcc-adopts-rules-help-block-illegal-robocalls https://www.fcc.gov/document/fcc-adopts-rules-help-block-ill...
  - diogenescynic 7y ago
    No, he was against regulation and now that robocalls are the #1 FCC complaint, they’re telling telecoms to fix the problem. For example: https://arstechnica.com/tech-policy/2018/03/ajit-pai-celebrates-after-court-strikes-down-obama-era-robocall-rule/ https://arstechnica.com/tech-policy/2018/03/ajit-pai-celebra...

sucrose 7y ago

> Scammers have this popular trick of spoofing the caller ID for a number local to you. I recently moved to a different state and kept my old phone number. When someone calls using that old area code, it's immediately obvious that it's a robocall. I have no ties to that area code, therefore no reason to answer. I usually Spokeo the suspicious numbers afterwards because I'm curious who it is. A few months back I tracked down the PII of a number that called me, so I texted them back. Here is our short, interesting conversation: https://imgur.com/a/4V2ugw9 https://imgur.com/a/4V2ugw9 (phone numbers and contact list names have been redacted)