9 ms·

Your phone company knows the originator info of your calls and texts (or at least enough hops until they reach some even more untrustworthy than normal phone pr

Your phone company knows the originator info of your calls and texts (or at least enough hops until they reach some even more untrustworthy than normal phone provider). They simply don't give you that info and instead show you an unverified caller ID that anyone can basically set to anything by whoever is contacting you. Blame your phone company and the FCC for not solving this (and for not providing you with the data to solve it yourself).

sb057 5y ago
FWIW the FCC nominally levies a fine of up to $10,000 per caller ID spoofing incident: https://www.fcc.gov/spoofing https://www.fcc.gov/spoofing
- encryptluks2 5y ago
  Except, when it comes to prosecuting people they usually make a deal where they pay a $50k fee or whatever, or they just don't have jurisdiction over the spammers and they'd rather sanction Russia than sanction India or other countries that are originating a lot of the SMS and robocall spam.
- spencerf 5y ago
  This is only valid if it’s a US company and many of these are originating outside of the US. Many shady companies outside of the us simply ignore the fines.
  - hedora 5y ago
    Simple solution: The fine is payable, link by link, to the next person in the chain by the party that forwarded the message. So the phone company can pay the subscriber the $10,000, and collect it from whoever they got the text from. I guarantee you spoofing would be solved immediately if this change to the law was scheduled for 12 months from now.
  - mcv 5y ago
    Banning foreign calls/texts that spoof local numbers sounds like a really easy and obvious thing to do.
    - technothrasher 5y ago
      All the big companies that outsource customer support overseas but want an in-country caller ID wouldn't let that happen.
      - somehnacct3757 5y ago
        Solve two problems at once, if you ask me
- MiddleEndian 5y ago
  > FWIW the FCC nominally levies a fine of up to $10,000 per caller ID spoofing incident: But they could just prevent it entirely by giving us the originator info. The process is basically like this: Alice calls Bob. Phone system says "Alice, who do you want to tell Bob you are?" Alice says "Bob!" Phone system says "OK!" and bills Alice because they know who Alice is. Bob gets a call from Alice but displays as Bob because Alice requested to display as Bob. Bob goes "Wtf?" Bob reports it to the FCC but he can only report getting a call/text from his own number. FCC goes "Ooh those naughty caller ID spoofers we'll get them good next time! Too bad there's no way to prevent this..."
  - cptskippy 5y ago
    Does the FCC have the authority to do that or are they beholden to Congress as is so often the case? Part of the conservative push to deregulate is to argue that government agencies are incompetent but the reality is that they've constructed a system where these agencies literally lack the agency to do anything more than write a nasty letter.
    - MiddleEndian 5y ago
      Yeah I'm sure Congress is heavily responsible as well. Some combination for sure.
kurthr 5y ago
It’s interesting to me that the carriers are intentionally devaluing the one protected monopoly they have. Nobody wants to receive phone calls or even SMS any more, because the spam/spoofing is so bad. One has to assume that they plan to simply monetize it until it’s gone. Then, it will be just IP over 5G with a race to the bottom. In the mean time anyone who can’t just whitelist phone numbers loses. Being a business must suck.
- mort96 5y ago
  Who can just whitelist phone numbers? I get calls all the time from numbers I wouldn't have known to whitelist; colleagues, people in other companies who I'm collaborating with on some project, food delivery people, customer support calling me back, etc. I usually ignore calls from abroad at least, but even those I can't block; I'm constantly spam called by different anonymous numbers from the UK, but I also have colleagues in the UK whom I want to be able to accept calls from. I once got an unsolicited call from a French number which I ignored, only to find out that it was the phone number of a food delivery person who was there with my food. Just last week I got a call from an unknown German number; in that case, it was a call from a colleague in Germany. I don't think a whitelist of phone numbers is a workable solution for most people.
  - function_seven 5y ago
    I get maybe 2 calls a month that are both legitimate, and from numbers I don't recognize. Which is frustrating! Because it might seem like that's a low enough frequency to make whitelisting a viable solution. But it's not—for the reasons you outlined. 2 calls a month are important enough to me that I must receive every spam call that comes in. I'm still pretty good at sniffing out most of them. A lot are still matching my area-code and exchange numbers on the spoofed ID—a huge red flag. Many others show rural cities that I'm certain no legit caller would call me from. But then there are the in-betweens: calls I can't make heads or tails of unless I answer. Whenever I do get one of these legit-but-unrecognized calls, I immediately add them to my contacts in some vain attempt to reach whitelist nirvana. But I don't think I'll ever get there.
eyelidlessness 5y ago
I would probably say this is overstated, except today I got a phone call from “Djibouti” with a fake foreign code which was obviously a call spoofing a local area code, matched a very prominent local business, and left a message about… auto warranties.
- deleted 5y ago
  [deleted]
mrjin 5y ago
Well, this issue was actually trickier than it looks. The real problem is the protocols our communication infrastructures built on was designed without almost any authentication & authorization mechanism. It wasn't a big issue when it designed as copper wires were required to make calls but it means basically anyone get those endpoints details can send SMSes, make calls claiming to whoever they want given now almost everything is on IP network. Yes you were right about that those telcoes do know what was the problem and how to fix it but they simply have no incentive to fix it as: 1. it needs overhaul of the current infrastructure, which needs lots of money and effort to proceed. 2. It requires all parties in the network to coordinate. One single exception means the issue remains or you will have to drop interconnection with those are not ready yet. 3. Negative impact to their revenue. So here comes the status quo.
- smordistan 5y ago
  Or just use the originator info.
bmitc 5y ago
> Blame your phone company and the FCC for not solving this I do. They don't care. AT&T doesn't even care that their cell network barely gets above 1 or 2 bars in a major metropolitan area. They mislead consumers by displaying 5Ge as the network (it just means you're on 4G but in an area that might have 5G service). My phone is really not a phone anymore, at least 95% of the time. I do make outgoing calls myself and only answer when I have a definite expected call from a known number. I use video chat apps for both audio/video calls for family.
mrtksn 5y ago
My phone company apparently provides anonymous spamming service. New data protection rules forbid them to share your name and phone number, so they went ahead and created a service where marketers can call people without a phone number. You want to reach females aged 30-35 in a city? Simply call or send an SMS from the API and you will be connected to a random one who matches your criteria. At least, that's what my spammer told me when I insisted on telling me who gave them my phone number. Apparently, I gave the consent to be included in the pool at the time of purchasing some data package or something like that.
- DavidPeiffer 5y ago
  That's ridiculous. Are you comfortable naming and shaming the company? I'd be curious to research other complaints or details on it.
  - mrtksn 5y ago
    Lately I'm not comfortable with naming and shaming, my apologies.
    - vageli 5y ago
      That's a shame, the company surely has no qualms about giving away access to your personal information.
      - Cd00d 5y ago
        I don't think OP indicated the carrier shared personal information - only that they provided a way to connect a 3rd party company to a customer. That transaction doesn't need to include any information beyond the defined demographic.
        mrtksn 5y ago
        That's correct. Apparently they put me in a certain demographics bucket and the spammers can pay the carrier to call or SMS random person from that bucket, sometimes that's me. So they know my gender, approximate age and location(maybe some other stuff?) but they don't know my name.

sb057 5y ago

FWIW the FCC nominally levies a fine of up to $10,000 per caller ID spoofing incident: https://www.fcc.gov/spoofing https://www.fcc.gov/spoofing

encryptluks2 5y ago
Except, when it comes to prosecuting people they usually make a deal where they pay a $50k fee or whatever, or they just don't have jurisdiction over the spammers and they'd rather sanction Russia than sanction India or other countries that are originating a lot of the SMS and robocall spam.
spencerf 5y ago
This is only valid if it’s a US company and many of these are originating outside of the US. Many shady companies outside of the us simply ignore the fines.
- hedora 5y ago
  Simple solution: The fine is payable, link by link, to the next person in the chain by the party that forwarded the message. So the phone company can pay the subscriber the $10,000, and collect it from whoever they got the text from. I guarantee you spoofing would be solved immediately if this change to the law was scheduled for 12 months from now.
- mcv 5y ago
  Banning foreign calls/texts that spoof local numbers sounds like a really easy and obvious thing to do.
  - technothrasher 5y ago
    All the big companies that outsource customer support overseas but want an in-country caller ID wouldn't let that happen.
    - somehnacct3757 5y ago
      Solve two problems at once, if you ask me
MiddleEndian 5y ago
> FWIW the FCC nominally levies a fine of up to $10,000 per caller ID spoofing incident: But they could just prevent it entirely by giving us the originator info. The process is basically like this: Alice calls Bob. Phone system says "Alice, who do you want to tell Bob you are?" Alice says "Bob!" Phone system says "OK!" and bills Alice because they know who Alice is. Bob gets a call from Alice but displays as Bob because Alice requested to display as Bob. Bob goes "Wtf?" Bob reports it to the FCC but he can only report getting a call/text from his own number. FCC goes "Ooh those naughty caller ID spoofers we'll get them good next time! Too bad there's no way to prevent this..."
- cptskippy 5y ago
  Does the FCC have the authority to do that or are they beholden to Congress as is so often the case? Part of the conservative push to deregulate is to argue that government agencies are incompetent but the reality is that they've constructed a system where these agencies literally lack the agency to do anything more than write a nasty letter.
  - MiddleEndian 5y ago
    Yeah I'm sure Congress is heavily responsible as well. Some combination for sure.

kurthr 5y ago

It’s interesting to me that the carriers are intentionally devaluing the one protected monopoly they have. Nobody wants to receive phone calls or even SMS any more, because the spam/spoofing is so bad. One has to assume that they plan to simply monetize it until it’s gone. Then, it will be just IP over 5G with a race to the bottom. In the mean time anyone who can’t just whitelist phone numbers loses. Being a business must suck.

mort96 5y ago
Who can just whitelist phone numbers? I get calls all the time from numbers I wouldn't have known to whitelist; colleagues, people in other companies who I'm collaborating with on some project, food delivery people, customer support calling me back, etc. I usually ignore calls from abroad at least, but even those I can't block; I'm constantly spam called by different anonymous numbers from the UK, but I also have colleagues in the UK whom I want to be able to accept calls from. I once got an unsolicited call from a French number which I ignored, only to find out that it was the phone number of a food delivery person who was there with my food. Just last week I got a call from an unknown German number; in that case, it was a call from a colleague in Germany. I don't think a whitelist of phone numbers is a workable solution for most people.
- function_seven 5y ago
  I get maybe 2 calls a month that are both legitimate, and from numbers I don't recognize. Which is frustrating! Because it might seem like that's a low enough frequency to make whitelisting a viable solution. But it's not—for the reasons you outlined. 2 calls a month are important enough to me that I must receive every spam call that comes in. I'm still pretty good at sniffing out most of them. A lot are still matching my area-code and exchange numbers on the spoofed ID—a huge red flag. Many others show rural cities that I'm certain no legit caller would call me from. But then there are the in-betweens: calls I can't make heads or tails of unless I answer. Whenever I do get one of these legit-but-unrecognized calls, I immediately add them to my contacts in some vain attempt to reach whitelist nirvana. But I don't think I'll ever get there.

eyelidlessness 5y ago

I would probably say this is overstated, except today I got a phone call from “Djibouti” with a fake foreign code which was obviously a call spoofing a local area code, matched a very prominent local business, and left a message about… auto warranties.

deleted 5y ago
[deleted]

mrjin 5y ago

Well, this issue was actually trickier than it looks. The real problem is the protocols our communication infrastructures built on was designed without almost any authentication & authorization mechanism. It wasn't a big issue when it designed as copper wires were required to make calls but it means basically anyone get those endpoints details can send SMSes, make calls claiming to whoever they want given now almost everything is on IP network. Yes you were right about that those telcoes do know what was the problem and how to fix it but they simply have no incentive to fix it as: 1. it needs overhaul of the current infrastructure, which needs lots of money and effort to proceed. 2. It requires all parties in the network to coordinate. One single exception means the issue remains or you will have to drop interconnection with those are not ready yet. 3. Negative impact to their revenue. So here comes the status quo.

smordistan 5y ago
Or just use the originator info.

bmitc 5y ago

> Blame your phone company and the FCC for not solving this I do. They don't care. AT&T doesn't even care that their cell network barely gets above 1 or 2 bars in a major metropolitan area. They mislead consumers by displaying 5Ge as the network (it just means you're on 4G but in an area that might have 5G service). My phone is really not a phone anymore, at least 95% of the time. I do make outgoing calls myself and only answer when I have a definite expected call from a known number. I use video chat apps for both audio/video calls for family.

mrtksn 5y ago

My phone company apparently provides anonymous spamming service. New data protection rules forbid them to share your name and phone number, so they went ahead and created a service where marketers can call people without a phone number. You want to reach females aged 30-35 in a city? Simply call or send an SMS from the API and you will be connected to a random one who matches your criteria. At least, that's what my spammer told me when I insisted on telling me who gave them my phone number. Apparently, I gave the consent to be included in the pool at the time of purchasing some data package or something like that.

DavidPeiffer 5y ago
That's ridiculous. Are you comfortable naming and shaming the company? I'd be curious to research other complaints or details on it.
- mrtksn 5y ago
  Lately I'm not comfortable with naming and shaming, my apologies.
  - vageli 5y ago
    That's a shame, the company surely has no qualms about giving away access to your personal information.
    - Cd00d 5y ago
      I don't think OP indicated the carrier shared personal information - only that they provided a way to connect a 3rd party company to a customer. That transaction doesn't need to include any information beyond the defined demographic.
      - mrtksn 5y ago
        That's correct. Apparently they put me in a certain demographics bucket and the spammers can pay the carrier to call or SMS random person from that bucket, sometimes that's me. So they know my gender, approximate age and location(maybe some other stuff?) but they don't know my name.