13 ms·

Ask HN: How can scam callers fake a mobile phone number?

• deleted 5y ago
  [deleted]
• barrad0s 5y ago
  I don't know the answer to your question(s), but if you're curious, you can download an app right through the play store to fake your number. I used to prank my friends all the time.
• gvb 5y ago
  STIR/SHAKEN is supposed to stop the spoofing. For an explanation, see https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN
  • lkbm 5y ago
    > The Federal Communications Commission requires use of the protocols by June 30, 2021 Spoofing still exists, though. Is the issue now that our phones are backwards-compatible with the insecure system?
    • eli 5y ago
      That deadline has been repeatedly extended
  • lvs 5y ago
  • jaywalk 5y ago
    The problem is that carriers (especially smaller ones) have been dragging their feet on implementing it, and nobody can use it to actually block calls until essentially everybody supports it and is interoperating. Until then, phones will just show calls between STIR/SHAKEN carriers as having verified caller ID.
    • skyde 5y ago
      would it be possible to tell my carrier to simply block all call that are not (STIR/SHAKEN)? If all my friend are on carrier that support it, I am not interested in receiving call from people that are not on a carrier that support it.
      • jaywalk 5y ago
        I highly doubt any carrier would offer this, especially with the current adoption being where it's at. You'd be better off using your phone's capabilities to restrict calls to only your contacts.
        • lowlevel 5y ago
          This is what I do, and feel is the only solution now. Phone always on DND/only allow contacts to ring. A whitelist approach if you will.
          • thesis 5y ago
            This is great and all until there’s an emergency and someone is trying to reach you.
            • xp84 5y ago
              Yeah, it's less than ideal, but this is the future that the lazy carriers have brought us to. Hopefully, someone trying to reach me in an emergency would have the brains to send a text.
      • 5y ago
  • encryptluks2 5y ago
    STIR/SHAKEN hasn't worked correctly or stopped robocalls like promised. Congress basically told everyone that this was the answer and would stop robocallers for good, but in reality did barely anything at all. The real solution is to label robocallers as terrorist and sanction countries with large amounts of robocalls for sponsoring terorrism. Before long, everyone will be too scared to even consider working in a robocall center and they will start turning on each other and reporting their bosses. They should even offer monetary rewards and protections for providing intelligence on the people operating these.
    • egberts1 5y ago
      And if they do not comply, to follow through with a Hellfire missile, right? /s
      • busterarm 5y ago
        If someone and the coworkers on their floor are calling and scamming old people out of their retirement money, then there is no sarcasm needed here. That should be perfectly justifiable. I'll paint the targeting laser myself.
      • encryptluks2 5y ago
        I mean, think about how many people scammers are killing prematurely as is. Once these countries that we previously let shit on Americans for a long time have some serious sanctions, I'm sure they'll find ways to deal with the problems themselves.
  • herendin 5y ago
    Isn't it already possible for a phone to display the STIR/SHAKEN Caller ID verification status of each incoming call now? This would be useful in the interim as this system rolls out, and would also encourage adoption by mobile carriers
• PaulHoule 5y ago
  https://en.wikipedia.org/wiki/Caller_ID_spoofing https://en.wikipedia.org/wiki/Caller_ID_spoofing
• pwg 5y ago
  Because the design of the original caller-id system allows the initiator of the call to attach any set of numbers they like as the caller-id value that is shown on your phone.
  • phkahler 5y ago
    Which is hilarious because the phone company used to charge extra to bring you this information as if they were telling you who was calling. That's a service I'd almost be willing to pay for today if it actually worked.
    • pwg 5y ago
      Which is also why it is simply an "initiator settable field". When "the phone company" brought out the service (for a monthly fee) there was only one "phone company" and so they could be assured that they themselves were setting the value to the correct source. Now that the phone network looks more like the internet (many different companies all exchanging "calls" with each other) that decision, way back then, has the unintended side effect of allowing the robocall spammers to set whatever set of ten digits they like on their outgoing calls.
• toast0 5y ago
  > - How can a spam caller call me with a source phone number that does not exist? The same way they make a call with any source number. The two source numbers in a call (ANI and CallerID which don't need to be the same) have historically been not required and not validated. See stir/shaken for a modern effort to change this. Coming soon to a carrier near you; maybe. Being able to set the source number enables many useful things as well as some spam/harassment/fraud uses. It requires a lot or coordination to allow the former and restrict the latter. TLDR: don't trust caller id. Don't call people back unless you know the number/it's an expected call. > - Shouldn't my mobile phone network verify that the caller - which was also inside their network - is a valid subscriber? Otherwise, how can they bill someone for this call? Call billing records don't use caller id in the way you're thinking. If you pay for incoming calls, they're charged regardless of the source number, but it's recorded for informational purposes. For outgoing calls, the call record is made closer to the source and is tied to the line that made the call, not the source number. For intercarrier calls (which almost certainly the case here), the source carrier bills its customer and the interconnecting carriers count minutes on calls and settle up for net difference in flows (calling carrier pays, but interchange fees are going to zero among US carriers) > - How does this kind of scam call work technically? Get a phone account where you can set the caller id and calls are cheap; call a lot of people; successfully scam one or two; take the money and run. Some voip accounts let you set caller id. Traditional primary rate interfaces (T1) usually do too.
  • bombcar 5y ago
    To go further on this, the T1/DID allows you to set various numbers for the outgoing (for example, so that all calls from your company appear as "main company number", or all calls from support people come from the "support number"). The CallerID is very easy to replace with anything, but even the ANI can be replaced, and until recently, nobody verified anything at all. And lots of "back end" things depend on this silliness - for example, some MVNO actually have TWO phone numbers associated with the phone: a VOIP "real number" and a secret "actual cell number" - Republic Wireless had this for sure. The VOIP number is what you'd give everyone, and they'd do routing weirdness to use Wifi whenever possible. The "real" cell number would go direct to the phone but not normally appear anywhere.
• downrightmike 5y ago
  Caller id is just a user settable field. There are two numbers, ANI which is how telcos are supposed to keep track of who to charge. NO one uses it, because users don't like it. And caller id is sent out on the second ring, but again, user can set that to anything. Corps have to adhere to the TCPA, others don't and SIP calls are cheap and globally routable. https://www.fcc.gov/sites/default/files/tcpa-rules.pdf https://www.fcc.gov/sites/default/files/tcpa-rules.pdf
  • bufferoverflow 5y ago
    That's a ridiculous system design.
    • colejohnson66 5y ago
      It’s remnants from a time where security wasn’t a concern. The original intent of the From: field in email was that it’s definitive, but now it’s just a legacy field that many systems ignore because it’s fakeable.
      • achow 5y ago
        Is it because earlier there was no display of numbers (ex in rotary phones)?
        • colejohnson66 5y ago
          Possibly, but I'd wager more that it was due to Bell owning the entire network, so they knew that any "from" numbers were correct. If I'm reading Wikipedia right, SS7, which is still supported today, was created all the way back in 1975![0] Bell wasn't broken up until 1982.[1] [0]: https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7 [1]: https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System
    • downrightmike 5y ago
      Brought to you by Ma Bell
• jaywalk 5y ago
  > Shouldn't my mobile phone network verify that the caller - which was also inside their network - is a valid subscriber? Since the advent of number portability, the area code and prefix no longer signify anything about what carrier a particular number belongs to. You could very easily take your T-Mobile number to Verizon, for example.
  • xp84 5y ago
    The number itself is no longer permanently their network, sure - however, they have instant access to look up* any number and find who presently owns it - which they must use to be able to route calls successfully. It's completely true that say, T-Mobile could today refuse to connect a call when the caller pretends to be calling from a T-Mobile owned number and yet is calling from outside their network. Sure, it would only kill a subset of the spam if they could only do this when they currently control the spoofed number themselves, however it would still do something! * Source: https://teraquant.com/local-number-portability-and-how-to-troubleshoot/ https://teraquant.com/local-number-portability-and-how-to-tr...
• bombcar 5y ago
  This is why I like having my number from where I lived in 2005 (see https://xkcd.com/1129/ https://xkcd.com/1129/ ) - any calls from "my area code" are automatically spam unless it is a particular number I know.
  • nwsm 5y ago
    I have this convenience as well. If I don't have a number from my home area code, I don't need it. Although I basically do not answer any unknown phone numbers at this point unless I'm expecting a call from a company for something.
  • deleted 5y ago
    [deleted]
  • brk 5y ago
    This is the same thing for me. Short version is that I'm from Detroit area, lived in NH for a while, and now reside in Tampa area. My cellphone has a 603 area code (NH). But since I'm not from there, the only 603 numbers I care about are already in my address book, any others are guaranteed to be spam calls. This lets me easily ignore 95% of them (I also occasionally see an 802 (VT) number or a 978 (MA) number). What is interesting is that I have started to receive more 727 (local area code) spam calls, maybe 2-3 per month. I suspect this must be from local friends and contacts leaking my number through sharing address books with various apps. I am at the point now where incoming phone calls are near valueless, other than from a very small set of numbers. Most people text me, or contact me through other apps/methods. Even for business purposes, incoming calls are almost always scheduled and the very very few that are not, and from an unrecognized number, can leave a voicemail. It is somewhat amazing how the telco's have let their core product, voice calls, become nearly worthless by not handling these spam call problems. Now I'm using contact methods and apps that are not provided by telcos and not strictly reliant on their networks.
    • philovivero 5y ago
      I get scam phone calls with area codes from most of the major metro areas all over the USA although since it's a California area code, it seems most are from somewhere in California. Your final paragraph is pretty on-point. > It is somewhat amazing how the telco's have let their core product, voice calls, become nearly worthless by not handling these spam call problems I have more than once thought about just giving up on having a phone number at all. Unfortunate that isn't an option yet.
• smeej 5y ago
  Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example. Make sure you're talking to the people you think you are. Otherwise they can phish all kinds of info out of you.
  • localhost 5y ago
    I remember many years ago getting a random phone call from someone who claimed they were a detective investigating a case. The detective sensed my skepticism right away over the phone and suggested that I look up the phone number for his police department, and to ask for badge number ZZZ when I call. I called back, everything was above board, they came and interviewed me (they wanted to see if I still had something in my possession which I thankfully did), they made a mark on the item to indicate that they had seen it already and I never heard from them again. Though I wonder if they ever caught whoever it was that was using that item ...
    • glenneroo 5y ago
      You can't drop a story like that on us and not tell us what "the item" was ;)
      • sweetbitter 5y ago
        I found a video of the GP: https://youtube.com/watch?v=3VlyZIywY9c https://youtube.com/watch?v=3VlyZIywY9c
    • xwdv 5y ago
      All this could be faked, this could have been an elaborate scam.
      • deleted 5y ago
        [deleted]
• moron4hire 5y ago
  I think a much better question is, why can scammers spoof a phone number? We hear lots of excuses from the carriers about how this is out of their control, this is how the system works, etc. Why don't they feel like they have a fire lit under their asses to fix the issue? My immediate guess is that they must make money off of scam calls somehow. A scam call is still a call.
  • doliveira 5y ago
    Yeah, and the net effect is that they're shooting themselves on the foot: I don't even pick up phone calls anymore. And I don't think I'm alone in this: most families and friends claim only to answer calls of close contacts. Legitimate services nowadays just contact you in WhatsApp instead.
  • heffer 5y ago
    The same principle is applied when you use call forwarding on most SIP providers. They "spoof" the real caller's Caller ID when forwarding the call, so that the forwarded call reaches your phone with the number of the actual caller, not some random number assigned to your account or the provider. If they didn't do this you wouldn't be able to call the original caller back directly from your call log. This would be a legitimate use case for Caller ID spoofing.
    • moron4hire 5y ago
      Yeah, no, not buying it. I mean, not buying that's the only way it could be done.
• jijji 5y ago
  Being able to set outbound Caller ID is something that is common with SIP providers and T1/PRI providers. The most common case today is using SIP. The billing happens at the provider level, and is not based on the user defined Caller ID field. Anyone can setup an Asterisk instance and make the caller ID value on the outgoing calls whatever they want [1]. [1] https://www.voip-info.org/setting-callerid/ https://www.voip-info.org/setting-callerid/
• jollybean 5y ago
  Because carriers are arcane companies that have a monopoly on a swath of infrastructure and have little care or perspective on what products and consumer experience amounts to. They buy and install equipment and sell out the voice/data. They actively oppose, thwart any kind of thoughtful innovation, competition etc. on anything relating to their networks, because they believe they 'own' the network and therefore 'own' everything going on on top of it. Remember the 10-cent 'WAP' pages? Tiny, crappy, useless little mobile web pages? And they wanted 10-cents each? Carriers would originally not sell BlackBerry service. They thought it was stupid to have 'email' on their networks. BlackBerry had to buy data and then sell to the C-suite. Then, BlackBerry literally became the reason that people wanted to buy data. The carriers then said - you can't buy network and resell it, you must sell your products through us. Imagine if some private companies controlled all of the roads. Any and business wanting to put a car on the road had to pay a toll, and the owners could decide which kinds of cars, when, and for what reason and intervene. They tried to provide the ambulance and transport for everyone and keep messing it up. It's also an artefact of human organization, even a fairly enlightened community/government body would have difficulty setting clear and appropriate guidance. The issue becomes problematic when there is a control of a scarce resource. In truth, it's absurd that people should be able to easily fake 'from' numbers, we should have fixed that a decade ago.
• deadcore 5y ago
  The how - depending on the protocol. Signalling System No. 7 - ISDN User Part spec (found here: https://www.itu.int/rec/T-REC-Q.763-199912-I/en https://www.itu.int/rec/T-REC-Q.763-199912-I/en) allows you to specify both a calling party number (3.10) and generic number (3.26) (the UK spec adds an additional presentation number so you have 3). This will typically require the help of an operator which is 'connected' to the network on the PSTN. A real business case can be made; like a generic, non geo support numbers appearing on the persons phone instead of the geographical number of the office which called. Either a bit of social engineering or findings a less scrupulous operator is all you really need to do SIP has FROM and P-Asserted-Identity headers which follow the same process
  • fxtentacle 5y ago
    Thank you for this rabbit hole. Today I learned a lot about modulation, frequencies, and how DSL works :) In the end, the most surprising snippet of knowledge for me was that Erlang (that Amazon S3 is built in) was invented by Ericsson for live patching ISDN phone routing systems without dropping any ongoing call.
    • FigmentEngine 5y ago
      I do not believe S3 is written in Erlang... do you have a source for this?
      • garciasn 5y ago
        SimpleDB is; maybe they confused them.
        • fxtentacle 5y ago
          Sorry, yes. They called it Simple Data Service = SDS in the article and then I incorrectly assumed that it's what we now know as S3.
  • drcongo 5y ago
    Does that addition in the UK spec add any extra protection? I've never had a spam call with a spoofed number in the UK as far as I'm aware, and definitely never seen that thing that happens in the states where a call comes in showing the name or company name of the caller, even if they're not in the receiver's address book.
• ghostpepper 5y ago
  I live in Canada, and I and most people I know receive spam calls from spoofed numbers on a semi-regular basis. Sometimes the number only a few digits off from my number, but other times it has a name like TOLL FREE SERV. A common lure is claiming they are Service Canada or Canada Revenue Agency (or the nonexistent Revenue Canada), and the call will open with nonsensical threats like “A warrant has been placed in your social insurance number”. I have a hunch they often target wealthy international students, as sometimes the messages are entirely in Chinese. Recently I received three calls in one day. It’s been happening for years, and the phone companies don’t appear to be able/willing/motivated to stop it. Most people I know have just resorted to not picking up calls from unknown numbers.
  • cjauvin 5y ago
    I live in Canada too, and these particular calls are rapidly destroying the notion of answering a number that is not in your contact list.
  • mef 5y ago
    on iOS, the "Silence Unknown Callers" feature has completely eliminated this for me.
    • fxtentacle 5y ago
      I was actually waiting on a call back from a parcel company, so the scam caller in this case just had very lucky timing.
    • marckemil 5y ago
      Canadian physician here: yeah, this is hell for us trying to reach patients through the hospital system, which is "unknown" by default. Straight to voicemail and you can't really leave a message. Totally agree though, this problem is very time consuming, if only for the time it takes me to look at my phone and decide not to answer the call - a few seconds of my life each time. My worst day was a few days ago; 7 calls.
      • 5y ago
• notreallyserio 5y ago
  I wish phone calls came with a verified (cryptographically) description of the route a call took to get to me. Then I could use a library/app to filter by source or by bad actor (providers that lie about the route). That would enable services like UBlock Origin, allowing for user-generated blocklists.
  • fxtentacle 5y ago
    Great idea! Local area number but traceroute to a call center in India? Automatically reject. That'll also solve the issue of unusable corporate phone support because they outsourced it to save a few bucks.
• jamal-kumar 5y ago
  Back in the day you used to be able to spoof caller ID using in-band signalling. it was like a few fun sounding handshake tones and some static-sounding data that you would play after the official one, and that was called orange boxing. That was the Bell 202 FSK signal and I remember hearing it on landlines up until a decade ago if the phone was picked up as soon as it started ringing. In Canada caller ID also includes the name along with the number from Nortel equipment, while in the USA it's just number. Nobody I know has a landline anymore except for businesses because if it's just the odd crazy person who still makes a super annoying life-interrupting phone call, more than half of calls are just fraud shit with spoofed caller ID and everything. It's so easy you could get started doing it yourself with freepbx installed on some 5$ VPS within minutes. Honestly we need better telephony systems, but everything is being completely superseded by chat apps anyways. Again only crazy people give me actual phone calls anymore and I have two lines between two countries. Fun things to do to the fraudsters: Talk really quietly and when they are like 'sir i cannot hear you' put yourself on speakerphone and YELL into the phone as hard as you can, and you win the game when you can hear them rip their headset off in ear pain because they turned their volume up to hear you. Either that or ask them what they're wearing until they get mad at you and call you homophobic things.
  • b112 5y ago
    Again only crazy people give me actual phone calls anymore I was going to say "Wait!", but then realised all my calls were from recruiters and HR departments. So I guess you're right.
    • jamal-kumar 5y ago
      For me they always want to set up a zoom call nowadays
• cryptonector 5y ago
  Signalling system 7 has no authentication. That's the bottom line. Adding authentication is pretty obviously not trivial, not just because of protocol upgrade issues, but also because end-to-end authen. won't be easy to add at all, and hop-by-hop authen. w/ something like "egress filtering" won't work in the age of phone number portability. What might work is a TCP-like return routability test. I.e., have the network ask the ostensible device "did you mean to make this call?", though that might have other issues (think of how SYN spoofing can be used for DDoS attacks). I.e., preventing caller ID scams is really hard.
  • bigmattystyles 5y ago
    What about charging a penny or 5cents per call? Nominally cheap for regular users, would put a dent in scammers. And don’t let the phone company keep the money, put it towards the infrastructure.
    • cryptonector 5y ago
      Billing is one of the highest costs for telcos.
  • contingencies 5y ago
    Here in China they aggressively egress filter since ~15 years ago (source: had an E1 on fiber way back then). You can set caller ID to any number you are assigned and nothing else.
    • cryptonector 5y ago
      Yes, this would work. It would have to be implemented in a lot of telcos. It would take time to get it all deployed, but there's no better time for this than today.
• hungryforcodes 5y ago
  Just never answer the phone. If they really want to talk to you -- they'll find another way.
  • ravenstine 5y ago
    Or they'll leave a message. The real answer to the problem is to deprecate the legacy telephone system. It will never be as secure or user-configurable as just about any modern implementation of voice/video over IP.
    • 310260 5y ago
      >deprecate the legacy telephone system The legacy telephone system is being deprecated. All three US mobile operators now have VoLTE (ENUM) interconnection with each other. STIR/SHAKEN call verification is happening between the mobile operators and large consumer VoIP operators like Comcast and Charter. VoIP is far cheaper to operate than POTS and most all operators are using it now and shuttering their legacy networks. The issue has to do with regulations around the phone system. Rural call completion to small operators is a requirement - as it should be - but has loopholes that encourage abuse. This rural call completion regulation also comes with the ability for small operators to charge certain prices for call completion so they can afford to keep their high-cost rural customers serviced. The larger carriers pay these fees to connect their subscribers to those of the rural carrier. However, some smaller operators have also been using these higher rates as a means of profiteering by allowing massive amounts of spam traffic through their networks towards the larger carriers.
      • ravenstine 5y ago
        Thanks for the educational response! I've been long wondering why it seems as if carriers are implicit in the widespread scam.
• awinter-py 5y ago
  seriously, never pick up the phone unless you know the caller. every stranger who calls you is trying to waste your time in some way even 'legit' businesses that call you from random numbers are basically a spam channel / are training you to get phished -- for example health insurance and credit card. every time I call back on their official # to ask what they want, it's 10-20 minutes to figure out what they wanted (if they even know!) we somehow aren't a society that can legislate to prevent spammers from using the phones. at this point let's pivot and punish legit businesses who use the phones to waste my time
• TACIXAT 5y ago
  It is actually incredibly easy! If you are using a voip line, it is just a configurable field in the UI. You can do it with any voip phone app (e.g. [1]) and a voip provider (e.g. [2]). I have an old archived video showing it here [3]. It is not so interesting though, just me poking around in a voip provider's UI. To address the other question about phone providers verifying stuff. SHAKEN/STIR [4] protocols are supposed to address this, but I think the telcos are still in ramp up time. 1. https://www.zoiper.com/ https://www.zoiper.com/ 2. https://voip.ms https://voip.ms 3. https://odysee.com/@cybering:1/spoofing-call-id-using-voip:2?t=70 https://odysee.com/@cybering:1/spoofing-call-id-using-voip:2... 4. https://www.fcc.gov/call-authentication#:~:text=STIR%2FSHAKEN%20digitally%20validates%20the,number%20displayed%20on%20Caller%20ID https://www.fcc.gov/call-authentication#:~:text=STIR%2FSHAKE....
  • sschueller 5y ago
    It's ridiculous that phone companies allow this. Anyone wanting to set caller ID via voip should be forced to provide some sort of verification that the number is theirs and the phone company should not route it if it fails verification. We only have 3 major cell carriers here is Switzerland, it should be trivial for the 3 to verify each other's numbers to see if those customers even exist. Unlike the US each cell provider has his own number prefix. Numbers are portable but only between certain providers.
    • ale42 5y ago
      It's not as easy... For example, it is possible and legal to use your own number to call from a VoIP provider, so the recipient can call you back on your actual phone. On the other hand, it should be possible to detect at least a percentage of spoofed caller IDs and block them (e.g. non-existing numbers).
      • MichaelBurge 5y ago
        The VoIP provider could forward the call to your phone as a middleman, or there could be 3 numbers(1. Who to bill 2. Calling number 3. Reply-to number) and only #3 is user-configurable.
• litgab 5y ago
  I just got a call from the Microsoft Security Team. They informed me my computer was highly infected. I spent 1 hour with them executing all cmd commands they wanted & told them the output. In the end i told them my wifi was broken and the technician should come by soon to fix it. She turned very aggressive and told me to call my brother Internet provider right now, as this is urgent because the hackers are already in my system. I told her to call me again the next day. I might have forgot to mention i am using a mac (and had to google the result of all commands & screens). I wanted to setup a VM and trace them or maybe even let them execute a manipulated cmd.exe to create a reverse shell. But after my attempts to buy some time so i could set everything up, they gave up and never called again. So sad, i am still scared of all the „viruses of very dangerous hackers“…
  • wbobeirne 5y ago
    You'd probably enjoy the content of Jim Browning, a guy who tries to flip the tables on these kinds of tech support scams: https://www.youtube.com/channel/UCBNG0osIBAprVcZZ3ic84vw https://www.youtube.com/channel/UCBNG0osIBAprVcZZ3ic84vw
  • toast0 5y ago
    > I just got a call from the Microsoft Security Team. They used to call be, but they said they were from 'The Windows'. I tried to get them to play Zork, but they weren't very interested, and it took me a little too long to get it started anyway.
• taubek 5y ago
  If you hang up be sure that you have really disconnected the line. https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone-scam-1.5375708 https://bc.ctvnews.ca/beware-of-the-delayed-disconnect-phone...
• icedchai 5y ago
  Caller ID is for "presentation" only, not billing. Anyone with the appropriate access can set their caller ID to whatever they want. Some VOIP providers don't do any validation that you "own" the number you are providing. Years ago, when I had an Asterisk PBX set up using a super cheap SIP provider, you could put anything you wanted in for a caller ID. There are legitimate use cases for this. Imagine if you are a company with 1000's of physical locations. You want them all calls to appear that they are coming from the corporate headquarters.
• TesterVetter 5y ago
• mrozbarry 5y ago
  One thing people don't know is that the phone network is actually a bunch of duct-taped technology that is pretty old. There has been advancements, and if you're in the US, you'll be happy to know that mobile carriers require stir/shaken handshaking, which is _mostly_ equivalent to https on the web (this is a gross simplification). The short/simple answer is carriers don't care, because they make money when a call is placed on their network. There is also a difference between what is a valid number (digits are correct) vs a real number (someone owns a number). It is cheap for a carrier to check validity, but not "realness" - to check a real number, a carrier may have to do some sort of data request to any number of carriers to determine if the number is owned.
• smegsicle 5y ago
  paris hilton knew how to do it back in 2006, checking lindsey lohan's voicemail by pretending to call her from her own phone https://www.infoworld.com/article/2658949/paris-hilton-accused-of-voice-mail-hacking.html https://www.infoworld.com/article/2658949/paris-hilton-accus...
  • JoshGlazebrook 5y ago
    It still seems crazy that even though carriers knew how easy it is to spoof numbers, even back then, they still decided to just skip any voicemail passcode authentication if you were calling your own number from your own number to get to your voicemail. It's like letting someone in your house because they're holding up a paper cutout of someone else's face that you know in front of their actual face and that's good enough.
• arcticbull 5y ago
  Used to take about 5 minutes to configure an Asterisk [1] PBX, obtain a provisioned DID from a VoIP provider and set your outbound caller ID with Set(CALLERID()) [2]. Doing so allows you to configure both your text label and call-back number. [1] https://www.asterisk.org/ https://www.asterisk.org/ [2] https://www.voip-info.org/setting-callerid/ https://www.voip-info.org/setting-callerid/
• zitterbewegung 5y ago
  They are doing ANI spoofing. By using a service they can show you any number you want. The law only states that you can’t do this if you are trying to commit a crime.
• mark-r 5y ago
  I always figured that the ability to set an arbitrary phone number was a feature for the benefit of large corporate PBX systems. Every person at the company gets their own phone number, but the number of physical connections to the phone company is limited. The PBX can set the identity on an outgoing call to match the phone number of the person who initiated the call, no matter which physical line it uses.
  • closeparen 5y ago
    Worked in business telephony, this is correct.
• seba_dos1 5y ago
  Do you know how e-mail lets you set anything you want in 'From' field and only relies on optional stuff like DMARC to, maybe, verify it? It's almost exactly the same with phone calls, that 'From' field is just set at a provider level instead of user level - and there are many providers over the world, including some that allow the user to set this field however they like.
• jdofaz 5y ago
  Since you are on T-Mobile verify you have scam id and scam block enabled: https://www.t-mobile.com/support/plans-features/self-service-short-codes#fourthheading https://www.t-mobile.com/support/plans-features/self-service... > which was also inside their network A phone number isn't like an IP address, the call isn't coming from that number and almost certainly didn't originate on the t-mobile network The FCC recently reduced the amount of time some companies have to implement STIR/SHAKEN to June 30, 2022. https://docs.fcc.gov/public/attachments/DA-21-1593A1.pdf https://docs.fcc.gov/public/attachments/DA-21-1593A1.pdf >The Commission recently shortened the extension for a subset of small voice service providers likely to be the source of illegal robocalls.
• bloodcarter 5y ago
  Try https://assistant.dasha.ai/ https://assistant.dasha.ai/ to block such calls.
• tabtab 5y ago
  This should be an easily solvable problem. All calls should come from a paid account and be trace-able to the payee (by the phone company). I don't get why there is so much phone spam. If we need new standards, let's get on it!
• Terry_Roll 5y ago
  > Ask HN: How can scam callers fake a mobile phone number? International Telephone Standards. VoIP VoIP Companies like https://www.sipgatebasic.co.uk/tour https://www.sipgatebasic.co.uk/tour And if you set up a VoIP number and a pbx like freeswitch or asterisk, they will send the ringing tones down to the caller so if you have the pbx set to record calls you can listen to what the caller is chatting about whilst they are ringing you, hearing the ringing tone at their end waiting for you to pick up. All a bit spooky but thats the technology for you! > - How can a spam caller call me with a source phone number that does not exist? Again they have the VoIP number but when you ring it they can play a dead line tone down to you instead or a ringing tone. With VoIP and Freeswitch/asterisk and probably other PBX's you control all of that. > - Shouldn't my mobile phone network verify that the caller - which was also inside their network - is a valid subscriber? Otherwise, how can they bill someone for this call? Depends on the telecoms standards in the country and/or the telecoms provider. > - How does this kind of scam call work technically? Any member of the public can set up VoIP number and PBX's like freeswitch and asterisk and do this. If its not a VoIP then telecoms companies and the security services in your country, or maybe you mobile phone is hacked and your mobile has logged onto a local fake cell instead which is slightly different to the VoIP setup above but I dont know how much this device can do. https://en.wikipedia.org/wiki/Stingray_phone_tracker#Active_(cell_site_simulator)_capabilities https://en.wikipedia.org/wiki/Stingray_phone_tracker#Active_... and you can do things like this https://www.wired.com/2010/07/intercepting-cell-phone-calls/ https://www.wired.com/2010/07/intercepting-cell-phone-calls/
• winternett 5y ago
  I hate to sound like a conspiracy theorist, but it's pretty easy for a carrier to determine devices that are making spam calls because they log everything, and they could simply create and distribute apps to their customers to enable reporting of spam calls, but somehow for years they've left it up to dodgy 3rd party app providers and the calls keep rolling. I don't think carriers have any incentive to stop spam calls because they gain a lot of money every year in billing minutes for those spam calls (mostly prepaid accounts are affected by the billing unfortunately)... I wouldn't dare go as far to say that the calls are possibly even sponsored or conducted by profiteers in the game... (People who sell prepaid and metered phone services) Just a personal opinion though.
• cookiengineer 5y ago
  The easiest way is to have a SIP gateway that uses a too long number to display. Usually it's around 12-13 digits for the subscriber number depending on the country code, so all digits before that (after in SIP) will be cut out on most phones. I think the relevant spec for that is E.164 which enforces 15 digits overall (1-3 for country code and 12 for subscriber number). There are also lots of SIP gateways that have an ISP license or a phone provider license. They're the same types that allow to fake the numbers for their customers, and usually you can transfer some still in use mobile numbers to them as well. Because apparently law enforcement doesnt do anything against them. And yes, never use 2FA via SMS. Never.
  • Spivak 5y ago
    Saying no to 2FA SMS is a little harsh. It’s strictly better than 1FA password. What you probably mean is don’t use SMS for account recovery.
• Froedlich 5y ago
  Decades ago, an American company called DAK used to sell a box that picked up on an incoming call (land line, pre-cellular era) and played a short message, usually something like "Please enter your extension number" or "enter security code." If the correct code was not entered, it simply hung up. No ring, no answering machine, no hassle. The nice thing was, you could pass your phone number out to everyone, but it would only ring for the people you gave the code to. And it was easy to manage, just give your number as "555-1212 ext.382" or whatever. And if the code got spread too widely, you could just change it and give anyone you wanted to hear from the new code. I keep hoping someone will make an app like that for cellular phones, but most people seem to like saving their spam calls in their voicemail boxes to review them later.