6 ms·

No they can't. The scammers will just hire a random person from indeed/monster/whatever, ship them a SIM box and tell them to fill it with prepaids.

by bbbbb5 4y ago

josephcsible 4y ago
Couldn't this be fixed by restricting international roaming of US SIMs into countries with high rates of call scams?
- bbbbb5 4y ago
  No, the SIM boxes live in the US.
- jeltz 4y ago
  Nothing says that they cannot put the SIM box in e.g. the US or Canada. It does not have to be in India.
mclightning 4y ago
no, not with that mindset. security is about creating obstacles. obstacles create friction and traces, even when they fail.
- bbbbb5 4y ago
  Using SIM boxes is already standard practice, sketchy VOIP providers and SMS spammers have been doing for years because it is cheaper to do this than to pay for legitimate routing. Just put something along the lines of "sim box grey route" into Google and you'll find loads of relevant industry materials. Besides, you're drastically moving the goalposts here. We went from "could put a stop to this" to minor obstacles.
jacquesm 4y ago
You tackle these things one-obstacle-at-the-time. Telco's are borderline complicit in this today, they don't have to be. Note that in some countries these scams are far more prevalent than in others, they'll go for the low hanging fruit first just like any other business. Make it harder and definitely there will be a response and then you aim to tackle that one. Shipping a SIM box would already be much more work than just changing a number in a database. Require that a phone number is used in the country of origin before you allow it to roam is another step in that process and so on. Rome wasn't built in a day and I'm sure that getting rid of this problem is going to be a series of steps. But as long as telcos willingly cooperate and allow remote call centers to basically pick any number in the locality of the recipient even though that number is not currently roaming in India they are making things much worse.
- bbbbb5 4y ago
  > Note that in some countries these scams are far more prevalent than in others, they'll go for the low hanging fruit first just like any other business The reason for this is language barriers, it's not some countries doing things better than others. > Shipping a SIM box would already be much more work than just changing a number in a database They don't even actually need to ship one, there are thousands of them operational already. This is a massive industry. Even if you cracked down hard on SIM boxes, the scammers will just purchase routing from botnets. This won't really impact their costs, and will be essentially impossible to take any meaningful action against.
  - jacquesm 4y ago
    Yes, but that would at least put them at the same level as burner phones with a physical presence required in the target country (or close to it). Anyway, since you are willing to shoot down each and every suggestion in this thread short of rolling over and accepting the damage how would you tackle it?
    - bbbbb5 4y ago
      Can you give a single example of similar fraud being successfully tackled? Not just the scammers being caught, but the entire scam being rendered unprofitable. European authorities haven't managed to do anything about the car selling scams Romanians have been running for decades now. Nobody has managed to do anything about the Nigerian prince scams. BEC with truly shitty phishing pages keeps on growing and growing. The best bet would be for US authorities to force India to crack down on these activities and prevent these scams from operating at an industrial scale. The actions you propose would work well to address lower return activities, such as marketing robocalls. They can not work to address high-return scams.
      - jacquesm 4y ago
        > Can you give a single example of similar fraud being successfully tackled? Plenty of such cases here locally. Your point about the language barrier is on the money though, I never really gave that much thought but the number of Dutch speakers in India is most likely so low and the market so small that it isn't worth a massive campaign to them. Especially not if there are millions of gullible people in markets that are more accessible to them. As for forcing Indian authorities: I've seen up close how corrupt things are there and I have very little hope that that would be a viable avenue to resolution of this problem.
jeltz 4y ago
Yeah, I do not see how stopping the spoofing (which I am all for doing) would be anything but a minor inconvenience for them.
- imglorp 4y ago
  I think the subtext is that given valid caller IDs, then block lists can be made. The US FTC might manage them like it does the do-not-call lists, or the perhaps the US Attorney's office, after some criminal complaints. Ideally, the telco would implement these block lists, but also ideally, they could be traded around like web ad block lists for individuals to load on their phones. I think we all know scam calls are a serious source of revenue for carriers, so they will need to be led to this conclusion by force. None of that happy future would come without true caller id, thus the resistence from carriers to fixing spoofing.
  - jeltz 4y ago
    > I think we all know scam calls are a serious source of revenue for carriers, so they will need to be led to this conclusion by force. Why would they be a major revenue source? The carriers make their money from normal users, not dodgy call centers.
    - imglorp 4y ago
      Logically, there must be enough benefit for them carrying spoofed robocalls to risk regulatory attention AND driving away all their voice revenue. Many people have stopped answering their phones altogether since voice calls became unusable.
      - supertrope 4y ago
        Voice revenue has been replaced by cellphone bills which are mostly broadband.
    - supertrope 4y ago
      Phone companies make money by the minute.
Nextgrid 4y ago
There's no reason consumer SIMs should be able to call more than N distinct numbers in any 24h period. You can implement reasonable rate limits to prevent abuse. However, even if we assume that SIM boxes are a magic solution to carrier interventions, that still raises the cost from the current status-quo. Implement enough of these barriers and the entire scam operation becomes unprofitable and no longer worthwhile.
- bbbbb5 4y ago
  And what do you propose would be such a reasonable rate limit? >However, even if we assume that SIM boxes are a magic solution to carrier interventions, that still raises the cost from the current status-quo. Implement enough of these barriers and the entire scam operation becomes unprofitable and no longer worthwhile. Why do you assume that the call routing is a meaningful cost to these operations? For all we know they spend less than 0.01% of their revenue on call routing.
- ClumsyPilot 4y ago
  > There's no reason consumer SIMs should be able to call more than N distinct numbers in any 24h period. Oh jesus please no, whats next? Ther is no reason a consumer oven should cook more than 5 meals a day. There is no reason a consumer toasteer should toast mpre than 10 times a day. The bread you make tourself is unauthorised in a toaster
  - Nextgrid 4y ago
    The difference between this and cooking/toasting bread is that your bread-making activities have no way to negatively affect someone else - we don't have an epidemic of spammers paying people to bake "underground bread" in their homes. Of course, an override should be provided - the restriction should be relaxed over time once the account is established for a long time without any complaints.
    - from 4y ago
      What you are describing is already done by carriers in countries with high sim box usage. (Basically, it costs ~$0.01/min to make a local call in Nigeria but $0.25/min to make an international call to Nigeria so people there set up SIM boxes and Asterisk to terminate calls locally and profit the difference between these rates. The reason it costs $0.25/min to call the official way is due to many governments taxing incoming international calls because they see it as an easy way to raise revenue at other people's expense). But anyways, because governments don't like this kind of arbitrage, they force carriers to add detection mechanisms. So they check for high ratio of outbound to incoming calls, high amount of distinct phone numbers called, 24/7 usage patterns, etc. Except Africa is still losing a few billion dollars a year to this kind of toll bypass because it is still massively profitable (see https://en.antrax.mobi/request-pricing/ https://en.antrax.mobi/request-pricing/ for example) and these changes just require them to rotate sim cards slightly more often. Essentially what I am saying is that unless you can reduce the fraudsters' margin by a substantial amount you are wasting your time.

No they can't. The scammers will just hire a random person from indeed/monster/whatever, ship them a SIM box and tell them to fill it with prepaids.

by bbbbb5 4y ago

No they can't. The scammers will just hire a random person from indeed/monster/whatever, ship them a SIM box and tell them to fill it with prepaids.

josephcsible 4y ago

Couldn't this be fixed by restricting international roaming of US SIMs into countries with high rates of call scams?

bbbbb5 4y ago
No, the SIM boxes live in the US.
jeltz 4y ago
Nothing says that they cannot put the SIM box in e.g. the US or Canada. It does not have to be in India.

mclightning 4y ago

no, not with that mindset. security is about creating obstacles. obstacles create friction and traces, even when they fail.

bbbbb5 4y ago
Using SIM boxes is already standard practice, sketchy VOIP providers and SMS spammers have been doing for years because it is cheaper to do this than to pay for legitimate routing. Just put something along the lines of "sim box grey route" into Google and you'll find loads of relevant industry materials. Besides, you're drastically moving the goalposts here. We went from "could put a stop to this" to minor obstacles.

jacquesm 4y ago

You tackle these things one-obstacle-at-the-time. Telco's are borderline complicit in this today, they don't have to be. Note that in some countries these scams are far more prevalent than in others, they'll go for the low hanging fruit first just like any other business. Make it harder and definitely there will be a response and then you aim to tackle that one. Shipping a SIM box would already be much more work than just changing a number in a database. Require that a phone number is used in the country of origin before you allow it to roam is another step in that process and so on. Rome wasn't built in a day and I'm sure that getting rid of this problem is going to be a series of steps. But as long as telcos willingly cooperate and allow remote call centers to basically pick any number in the locality of the recipient even though that number is not currently roaming in India they are making things much worse.

bbbbb5 4y ago
> Note that in some countries these scams are far more prevalent than in others, they'll go for the low hanging fruit first just like any other business The reason for this is language barriers, it's not some countries doing things better than others. > Shipping a SIM box would already be much more work than just changing a number in a database They don't even actually need to ship one, there are thousands of them operational already. This is a massive industry. Even if you cracked down hard on SIM boxes, the scammers will just purchase routing from botnets. This won't really impact their costs, and will be essentially impossible to take any meaningful action against.
- jacquesm 4y ago
  Yes, but that would at least put them at the same level as burner phones with a physical presence required in the target country (or close to it). Anyway, since you are willing to shoot down each and every suggestion in this thread short of rolling over and accepting the damage how would you tackle it?
  - bbbbb5 4y ago
    Can you give a single example of similar fraud being successfully tackled? Not just the scammers being caught, but the entire scam being rendered unprofitable. European authorities haven't managed to do anything about the car selling scams Romanians have been running for decades now. Nobody has managed to do anything about the Nigerian prince scams. BEC with truly shitty phishing pages keeps on growing and growing. The best bet would be for US authorities to force India to crack down on these activities and prevent these scams from operating at an industrial scale. The actions you propose would work well to address lower return activities, such as marketing robocalls. They can not work to address high-return scams.
    - jacquesm 4y ago
      > Can you give a single example of similar fraud being successfully tackled? Plenty of such cases here locally. Your point about the language barrier is on the money though, I never really gave that much thought but the number of Dutch speakers in India is most likely so low and the market so small that it isn't worth a massive campaign to them. Especially not if there are millions of gullible people in markets that are more accessible to them. As for forcing Indian authorities: I've seen up close how corrupt things are there and I have very little hope that that would be a viable avenue to resolution of this problem.

jeltz 4y ago

Yeah, I do not see how stopping the spoofing (which I am all for doing) would be anything but a minor inconvenience for them.

imglorp 4y ago
I think the subtext is that given valid caller IDs, then block lists can be made. The US FTC might manage them like it does the do-not-call lists, or the perhaps the US Attorney's office, after some criminal complaints. Ideally, the telco would implement these block lists, but also ideally, they could be traded around like web ad block lists for individuals to load on their phones. I think we all know scam calls are a serious source of revenue for carriers, so they will need to be led to this conclusion by force. None of that happy future would come without true caller id, thus the resistence from carriers to fixing spoofing.
- jeltz 4y ago
  > I think we all know scam calls are a serious source of revenue for carriers, so they will need to be led to this conclusion by force. Why would they be a major revenue source? The carriers make their money from normal users, not dodgy call centers.
  - imglorp 4y ago
    Logically, there must be enough benefit for them carrying spoofed robocalls to risk regulatory attention AND driving away all their voice revenue. Many people have stopped answering their phones altogether since voice calls became unusable.
    - supertrope 4y ago
      Voice revenue has been replaced by cellphone bills which are mostly broadband.
  - supertrope 4y ago
    Phone companies make money by the minute.

Nextgrid 4y ago

There's no reason consumer SIMs should be able to call more than N distinct numbers in any 24h period. You can implement reasonable rate limits to prevent abuse. However, even if we assume that SIM boxes are a magic solution to carrier interventions, that still raises the cost from the current status-quo. Implement enough of these barriers and the entire scam operation becomes unprofitable and no longer worthwhile.

bbbbb5 4y ago
And what do you propose would be such a reasonable rate limit? >However, even if we assume that SIM boxes are a magic solution to carrier interventions, that still raises the cost from the current status-quo. Implement enough of these barriers and the entire scam operation becomes unprofitable and no longer worthwhile. Why do you assume that the call routing is a meaningful cost to these operations? For all we know they spend less than 0.01% of their revenue on call routing.
ClumsyPilot 4y ago
> There's no reason consumer SIMs should be able to call more than N distinct numbers in any 24h period. Oh jesus please no, whats next? Ther is no reason a consumer oven should cook more than 5 meals a day. There is no reason a consumer toasteer should toast mpre than 10 times a day. The bread you make tourself is unauthorised in a toaster
- Nextgrid 4y ago
  The difference between this and cooking/toasting bread is that your bread-making activities have no way to negatively affect someone else - we don't have an epidemic of spammers paying people to bake "underground bread" in their homes. Of course, an override should be provided - the restriction should be relaxed over time once the account is established for a long time without any complaints.
  - from 4y ago
    What you are describing is already done by carriers in countries with high sim box usage. (Basically, it costs ~$0.01/min to make a local call in Nigeria but $0.25/min to make an international call to Nigeria so people there set up SIM boxes and Asterisk to terminate calls locally and profit the difference between these rates. The reason it costs $0.25/min to call the official way is due to many governments taxing incoming international calls because they see it as an easy way to raise revenue at other people's expense). But anyways, because governments don't like this kind of arbitrage, they force carriers to add detection mechanisms. So they check for high ratio of outbound to incoming calls, high amount of distinct phone numbers called, 24/7 usage patterns, etc. Except Africa is still losing a few billion dollars a year to this kind of toll bypass because it is still massively profitable (see https://en.antrax.mobi/request-pricing/ https://en.antrax.mobi/request-pricing/ for example) and these changes just require them to rotate sim cards slightly more often. Essentially what I am saying is that unless you can reduce the fraudsters' margin by a substantial amount you are wasting your time.