12 ms·

Of the robocalls and text message spam that I tracked back to the originating carrier (OCN), by far the two largest source carriers were: 1. Commio and its sub

Of the robocalls and text message spam that I tracked back to the originating carrier (OCN), by far the two largest source carriers were: 1. Commio and its subsidiaries Teli and thinQ (commio.com and teli.net) 2. Telnyx (telnyx.com) If the FCC reads this comment: look into those two. In particular, both companies do a poor job of policing their resellers/affiliates. Even when a recipient is savvy enough to find the source OCN and report it to them, the spammers just move from one reseller to a different reseller of the same carrier. Both carriers know this and look the other way, since it's cheaper than than investing more resources (content blocking, tighter velocity limits, carrier-verified opt-in) or removing the resellers who repeatably sign up spammers. Twilio was in the top 5, but as a % of their total traffic, nowhere near Commio/Teli and Telnyx. (And if the FCC is reading this, a wish: add a "SPAM" or "ABUSE" SMS keyword that carriers are required to process. Operationally, it would behave similar to "STOP", with a couple differences: it would be entirely processed by the carrier; the carrier would be required to respond with the name and full contact info of both the carrier and their customer; and it would give responsible carriers a way to hear about/act on abuse complaints. Right now, 10DLC spam is so hard for regular people to track that abuse mostly goes unreported.)

kej 4y ago
How does one go about tracking a robocall back to the OCN? I have time and a strong dislike of scammers.
- cgb223 4y ago
  Interested in this as well. Been getting spam texts out the wazoo and have felt powerless to do anything about it beyond delete them
  - lolinder 4y ago
    One thing I do to exert some control is use WHOIS to find out who their domain name and web hosting providers are and forward them the phishing texts. I've gotten multiple domains revoked through this process (though I've also been ghosted plenty). Doesn't help if there are no domains linked, and I'd still love to attack their SMS instead because I suspect that's harder to replace.
    - BenjiWiebe 4y ago
      In a similar vein I've had success surprisingly often when reporting spam email domains to the hosting company and Google safe browsing, which gives a big red warning page when someone tries to access the site (in Firefox and Chrome at least).
      - Dylan16807 4y ago
        Wait, are you reporting those sites to Google safe browsing because of malware or phishing content? If so, great. But if they're just a source of spam I don't think you're supposed to be doing that.
    - Scoundreller 4y ago
      I’ve also had some success getting the SSL cert revoked. Is there any way to send the SSL-encrypted webpage to prove to the SSL provider that the website came from them though? I guess in my case they could open the link, but that may not always work.
      - deleted 4y ago
        [deleted]
  - mikeytown2 4y ago
    I call the spam texts (hi Bob, it's Alice, we met last night type) and it's usually a Google voice number that want you to sign up for their whats app channel. I now text back them that we met last night and they can join my crypto investing WhatsApp group and I've gotten a lot less sms spam as a result. Must be on their black list now
    - jareklupinski 4y ago
      She was trying to scam him using a lonely hearts pull He was trying to scam her with the promises of riches This summer, sparks fly in the romantic comedy of 2023: "Phish into my Heart"
      - dylan604 4y ago
        okay, so this made me smile. just finished exporting a montage scene that could fit right into that script. timing is priceless
      - ethbr0 4y ago
        This makes me feel old. Cinema when I grew up was calling into advice radio shows because someone couldn't sleep on their architect-affordable houseboat in Seattle. None of that exists anymore.
      - Andrex 4y ago
        Or the A24 horror version, "Heartphish."
    - jaxn 4y ago
      I reply to the ones wanting to buy houses that I don’t own. I drag them along for days. I figure I can at least waste their time
- troydavis 4y ago
  (Update: Commenter "homero" mentioned that Twilio's CNAM API response includes the carrier: https://support.twilio.com/hc/en-us/articles/360050891214-Getting-Started-with-the-Twilio-Lookup-API#h_01ECXDQZ8TH86K5S51PDQF4KFC https://support.twilio.com/hc/en-us/articles/360050891214-Ge... . Twilio's docs make it sound like this API does incorporate mobile number portability, which is what you need, but I haven't personally verified. Can anyone from Twitter confirm that the LNP info is at least near-realtime?) You'll need either access to an SS7 routing system or, more likely, an HTTP API that exposes 10-digit number routing info. Google for '10 digit OCN lookup' or 'realtime CNAM lookup API' and you'll be on the right track. You need one that handles mobile number portability. Most APIs charge a small per-query fee because it's not static data. Any one number can be ported at any time and the only way to know is to see where (in SS7) it's actually routed. And be aware that there's a fair number of gotchas. I have a lot of experience in the telco world[1]. The two big gotchas are: 1. Inbound and outbound carriers can be and often are different, and outbound caller ID can be spoofed. The source number on an SMS from a 10-digit number (a "10DLC" SMS) is much, much less likely to be spoofed than the caller ID on a robocall. You can fairly reliably report source numbers on SMSes. To keep it simple, consider starting by reporting SMSes. For robocalls, expect that many robocall CIDs are spoofed, and the most interesting robocalls are the ones that ask the recipient to contact them at the same number. Or, where both the CID and the callback/contact number are DIDs from the same carrier. 2. Number portability means that all the old static databases (LERG and NPA-NXX-Y Number Pooling[2] databases) aren't enough. One phone number might be routed to one carrier and the sequentially-next number might be routed to a completely different carrier, and either of them might change the next day. This is just the start - there are other gotchas and a pretty significant learning curve. Stay polite and professional, assume good intentions, and assume you're wrong about something. [1]: Back in 2010, I made the first free, public REST API for looking up phone data: https://www.slideshare.net/troyd/cloudvox-digits-phone-api-locate-any-number https://www.slideshare.net/troyd/cloudvox-digits-phone-api-l..., https://www.prnewswire.com/news-releases/cloudvox-launches-free-api-bookmarklet-and-web-service-for-finding-the-location-of-any-phone-number-91590254.html https://www.prnewswire.com/news-releases/cloudvox-launches-f... [2]: https://nationalnanpa.com/ https://nationalnanpa.com/ and for thousands-block reports, https://www.nationalpooling.com/ https://www.nationalpooling.com/ -> Reports -> Block Report by Region
- homero 4y ago
  You can actually use twilio to find the carrier on cnam https://support.twilio.com/hc/en-us/articles/360050891214-Getting-Started-with-the-Twilio-Lookup-API https://support.twilio.com/hc/en-us/articles/360050891214-Ge...
- Magicstatic 4y ago
  I use Lookify.io which lets you look up a carrier without creating an account - you can also see if anyone else flags it as spammy but who knows if the reports are anything other than anecdotal
DevX101 4y ago
Can you submit a report to the FCC detailing your findings at https://consumercomplaints.fcc.gov/hc/en-us https://consumercomplaints.fcc.gov/hc/en-us?
- troydavis 4y ago
  I've done this many times. It goes into a Zendesk-powered black hole. Looks like the oldest Zendesk autoresponse I have is from 2014. There's no way to tell whether it's making a difference (is anyone even aggregating reports by volume?), so I stopped.
  - simfree 4y ago
    Commio's shutdown of the Teli platform has been a mess, outbound calling never got STIR/Shaken compliance. The ThinQ side of the house seems to let dialer traffic slide: https://lowendtalk.com/discussion/183904/lowend-sip-trunking#latest https://lowendtalk.com/discussion/183904/lowend-sip-trunking...
andrei_says_ 4y ago
How would abuse of such system be prevented? Require a minimal percentage of spam/abuse responses per number?
- yardstick 4y ago
  Provide personal identification back to the carrier, not just the reseller? Ie Passport/valid driving license. Not fool proof and comes with its own set of problems. But it’ll likely get us most of the way.
- troydavis 4y ago
  Here’s how others address it. For phone calls and texts: - Slowly increase velocity limits on new DIDs/TNs. Often, examine the outbound content before raising limits - is it something anyone would request? where/how? - Require the recipient to have opted-in on the same carrier (ie, no importing lists) - Don’t let the affiliate/reseller sign up customers on their own. Centralize onboarding/KYC. - Verify the end customer’s government-issued ID. For texts: - Block (and flag/escalate) based on message content, like the domain name/URL they’re linking to or a pitch phrase they’ve used.
  - from 4y ago
    > - Verify the end customer’s government-issued ID. This never happens. Lots of PPP or bank fraud investigations go nowhere because the perpetrators used fake IDs all the way down. No company is actually checking the governments database of drivers licenses or state ID cards. Only recently did eCBSV come out which would allow companies to digitally check that an SSN actually exists (mostly to stop synthetic identity fraud) but that still doesn't stop identity theft.
    - troydavis 4y ago
      Some of this is about increasing friction, not collecting flawless info. Is it possible to fool Stripe Identity (https://stripe.com/identity https://stripe.com/identity) repeatedly? Probably. But it’s a pain to make new fake docs (or switch carriers) every time an account is flagged.
onetimeusename 4y ago
Are offshore carriers responsible for spam calls that spoof numbers (based on your data)? Those two carriers are onshore so I think they would have to comply with the SHAKEN/STIR protocol which would make calls originating from their network easier to identify and block. Offshore carriers don't have those restrictions. I am surprised a company is able to operate like this onshore.
kbuck 4y ago
On most (all?) carriers, you can forward spam SMS messages to 7726 ("spam" on the keypad) to report messages as spam. That said, I've got no idea if they actually do anything actionable with this data. It certainly doesn't seem to have reduced my spam volume. Now I just let Android Messages filter the spam out.
- troydavis 4y ago
  I’ve wondered the same thing. I’ve used 7726 to report large, long-lived campaigns (to AT&T Mobile’s 7726) and as far as I could tell, nothing happened. The senders rotate TNs so often that AT&T would either need to track it back to the point of ingress or do content-aware blocking.
  - aendruk 4y ago
    My most recent experience was enduring several weeks of daily spam, all diligently forwarded to 7726 (“Thank you for reporting SPAM. We'll take it from here.”), only to finally get fed up enough to send a complaint to the FCC after which the spam stopped immediately.
- reaperducer 4y ago
  On most (all?) carriers, you can forward spam SMS messages to 7726 ("spam" on the keypad) to report messages as spam. I wonder if that's what the iPhone's "Report Junk" button does with text messages. For some reasons, my iPhones on AT&T always offer the option to report a text message as spam, but my iPhones on Verizon do not. Another curiosity.
  - aendruk 4y ago
    Tell me more about this report button! I’ve long wished for such a feature but thought it didn’t exist. This is something built in to iOS?
    - troydavis 4y ago
      "Report Junk" was originally added for iMessage (with reports going to Apple, I assume). iOS 16 expanded the feature to support reporting SMS/MMS "Depending on your carrier and country or region": https://support.apple.com/guide/iphone/block-filter-and-report-messages-iph203ab0be4/ios https://support.apple.com/guide/iphone/block-filter-and-repo... (scroll to "Report spam or junk messages"). "In the list of messages, touch and hold the spam message, then tap Report Junk. Or, if you’ve opened the message, scroll to the bottom of the message, tap Report Junk, then tap Delete and Report Junk." I've read that "Report Junk" does the equivalent of forwarding to 7726, but I don't have a way to verify that (more: https://www.bandwidth.com/blog/apples-ios-16-update-and-what-it-might-mean-to-the-sms-ecosystem/ https://www.bandwidth.com/blog/apples-ios-16-update-and-what...).
roywashere 4y ago
I’m in Europe and hardly ever receive unsolicited SMS or phone calls. Somehow, at least to me, this seems like a US problem. Why is that? What does EU do that it is not a problem here? Or does it just mean that we have a ‘business opportunity’ here?
- watwut 4y ago
  Afaik, some aspect of it is just not legal. And when someone calls you, you have right to ask to be removed from database and they have to remove you.
  - deleted 4y ago
    [deleted]
- dottedmag 4y ago
  Looks like it depends on the local regulatory agency. I have never had a spam SMS or call in Norway, while on Malta it's a regular occurrence, thought not as bad as described by US folks.
  - codetrotter 4y ago
    I live in Norway. I’ve received both SMS spam and scam phone calls. However, it is still a rare occurrence. Only a few times per year.
- scooke 4y ago
  I was a micro-entrepeneur, or auto-entrepeneur, in France, and unsolicited calls and messages started the very next day I registered. Don't ask me the about the email spam.
- deleted 4y ago
  [deleted]
- reaperducer 4y ago
  I’m in Europe and hardly ever receive unsolicited SMS or phone calls. Somehow, at least to me, this seems like a US problem. Every single time the subject of robocalls or spam texts is brought up on HN, someone claiming to be from Europe shows up to ask why it's a U.S.-only problem. Then people from Germany and France and Greece and the U.K., and elsewhere in Europe show up and say how they have to deal with it, too, and it's not just an American thing. In my RSS feed are several European news sources, and they all talk about robocalls occasionally. Who are these apparently very few people in Europe who allegedly have never dealt with telephonic spam, and why do they always feel the need to talk about their personal situation when it has no bearing on the discussion at hand? You state that you "hardly ever receive unsolicited SMS or phone calls." I'm in America, and I too get unsolicited messages "hardly ever": about one unsolicited SMS per month, and spam phone calls about six times a year on my work phone, and maybe once each year on my personal phone. Don't delude yourself into believing that every phone in the nation is flooded with spam all the time.
tomnipotent 4y ago
I can't imagine even combined these companies are more than a single percentage of Twilio's volume. A quick search shows these two at ~300 employees to Twilio's ~7,900 - if you assume volume is somewhat linear to costs and subsequently revenue, Twilio is an order of magnitude larger. Even a smaller percentage of Twilio being spam is much more volume than a large percentage of these companies.
calibas 4y ago
I looked up the carrier for my most recent spam calls using lookify.io: 1. PEERLESS NETWORK OF OHIO 2. PEERLESS NETWORK OF FLORIDA 3. PEERLESS NETWORK OF CALIFORNIA 4. PEERLESS NETWORK OF CALIFORNIA Nothing from Twilio, but Peerless Network certainly stands out. I see they describe themselves as "A Disruptor and Aggressive Innovator".
- bevenky 4y ago
  Peerless is now owned by Infobip. https://techcrunch.com/2022/07/26/us-and-european-comms-platform-infobip-acquires-voip-provider-peerless-network-for-200m/ https://techcrunch.com/2022/07/26/us-and-european-comms-plat...
giancarlostoro 4y ago
I did a hackathon a few years back a few years in a row and Telnyx was a sponsor the first year. One of the sponsors started asking for legitimate company information in order to keep your account with them. I wonder if this is something the FCC should request from these companies, I also wonder how effective it would be. I dont think all robocalls will die, but a significant number probably will. Once you have an actual company behind the robo calls you can sue. Telecoms providers should be required to be helpful in providing information when abuse is reported or be liable themselves as if they were responsible. It seems like a solvable problem but nobody is actually solving it.
charcircuit 4y ago
>the carrier would be required to respond with the name and full contact info of both the carrier and their customer This would be used for doxxing people. Anyone you text can get all the information they need to swat you.
- troydavis 4y ago
  I was referring to vendors of commercial 10DLC and short code messages, not consumer-facing mobile providers. Consumer-facing mobile providers (where doxxing is a risk) could reply with just the carrier’s abuse contact (ie, abuse@ and/or a phone number). And even if it was only implemented for 10DLC, not consumer-facing mobile, that would be a start.
bevenky 4y ago
Founder & CEO of Plivo - https://www.plivo.com/ https://www.plivo.com/ here. At Plivo we offer similar API services to Twilio for voice calls and SMS. While API offerings have made it easier for developers and tech team to integrate communications into their applications, one of the challenges here is the scale at which spammers and folks using stolen credit cards are always attempting to abuse all of our platforms. Most of us companies, work quite hard to deter these spammers at sign up and later using automated systems to analyze usage patterns including content filtering, but its quite a cat and mouse game. Something that has worked for us has been to restrict signups to only work emails. It does have it's disadvantages but we have been able to limit the random gmail id signups at scale by bot/spammers that abuse the system for use cases like robocalling and more.
dheera 4y ago
For what it's worth, I use Twilio to combat robocalls and telemarketers ...
spamizbad 4y ago
Oh god, Telnyx. We used them for toll-free SMS. Horrible experience. I friend of mine used to work for them in the early days and had some pretty terrible stories about what it was like working there.
deleted 2y ago
[deleted]
timcommio 2y ago
Troy, appreciate the post, and I 100% understand your frustrations. I work at Commio and wanted to respond. Apologies in advance for the long explanation, but I think it will shed some light on the current state of cloud voice. Fraud, abuse, and unwanted calls are unacceptable, and, like the many companies standing between companies placing calls and consumers receiving them, we take all such reports very seriously. We offer a Report a Number link on our website so any unwanted call placed using a number we sold can be investigated, traced, and action taken to shut down the traffic. Commio (thinQ/teli) was a member of the Federal Communications Commission’s task force to combat fraud and robocalling and we are an active member of the working groups resulting from that task force. In addition, we have implemented STIR/SHAKEN protocols to help stop fraudulent calling from spoofed numbers, and are also set to launch one of the first branded calling solutions to enable brands to fully sign and vet their calls, preventing spoofing once and for all. 2025 is going to be one for the record books. Who is Commio: Commio does not make any calls to consumers and generally only provides a network interconnection “bridge” between a calling party’s telecom provider and a called party’s telecom provider. We provide voice interconnection services to other telecom carriers, enterprises, and cloud platforms. We provide service to virtually every major national carrier in the United States. We also provide interconnection services to VoIP providers. We essentially carry phone calls between all of these telecom companies. As part of our service, we also provide telephone numbers to VoIP providers, who then assign these numbers to their end-user subscribers. We provide phone numbers to these VoIP providers because regulatory restrictions limit their ability to obtain their own phone numbers. How We Can Help: Commio does not provide service to individuals and, by law, is prohibited from knowing the identities of our customers’ end users. Because of this, we must forward most abuse reports we receive to the service provider to whom we have assigned the number in question. We will promptly send your report to the appropriate service provider and request they promptly commence an investigation. Please also note that our services are not exclusive, and just because a number comes back to Commio (thinQ/teli), it does not mean we carry all traffic for the originating provider. Our service-provider customers have the option to use other carriers to transport some or all of their calls. When our service-provider customer sends voice traffic to another carrier, the call does not touch our network. In some cases, we can provide you with contact information for our service-provider customer. If that option is available, Commio will send you an email with the service-provider’s contact information so that you can work directly with them to resolve your complaint. Sometimes, our customers will investigate a report and determine that the calling number has been “spoofed.” Caller ID spoofing occurs when the caller inserts a falsified number into the call stream so that your Caller ID shows a phone number that did not make the call. When this occurs, neither we nor our customer will actually know what number or person made the call. Please understand disconnecting a spoofed number will not stop the calls you are receiving because that number did not make the call – it is simply fake Caller ID information sent to your phone. If you need additional information about spoofing or stopping unwanted calls, the Federal Trade Commission (www.ftc.gov) and Federal Communications Commission (www.fcc.gov) have both posted information and tips on their websites to help consumers including information about call blockers, the national Do Not Call Registry (www.donotcall.gov) and how to report numbers associated with scam calls. I would also strongly urge you to contact your local law enforcement agency for assistance if you receive fraudulent, abusive or threatening communications and you are concerned about your safety. Troy, thanks for listening, and feel free to reach out to me anytime: tim (at) commio.com.

kej 4y ago

How does one go about tracking a robocall back to the OCN? I have time and a strong dislike of scammers.

cgb223 4y ago
Interested in this as well. Been getting spam texts out the wazoo and have felt powerless to do anything about it beyond delete them
- lolinder 4y ago
  One thing I do to exert some control is use WHOIS to find out who their domain name and web hosting providers are and forward them the phishing texts. I've gotten multiple domains revoked through this process (though I've also been ghosted plenty). Doesn't help if there are no domains linked, and I'd still love to attack their SMS instead because I suspect that's harder to replace.
  - BenjiWiebe 4y ago
    In a similar vein I've had success surprisingly often when reporting spam email domains to the hosting company and Google safe browsing, which gives a big red warning page when someone tries to access the site (in Firefox and Chrome at least).
    - Dylan16807 4y ago
      Wait, are you reporting those sites to Google safe browsing because of malware or phishing content? If so, great. But if they're just a source of spam I don't think you're supposed to be doing that.
  - Scoundreller 4y ago
    I’ve also had some success getting the SSL cert revoked. Is there any way to send the SSL-encrypted webpage to prove to the SSL provider that the website came from them though? I guess in my case they could open the link, but that may not always work.
    - deleted 4y ago
      [deleted]
- mikeytown2 4y ago
  I call the spam texts (hi Bob, it's Alice, we met last night type) and it's usually a Google voice number that want you to sign up for their whats app channel. I now text back them that we met last night and they can join my crypto investing WhatsApp group and I've gotten a lot less sms spam as a result. Must be on their black list now
  - jareklupinski 4y ago
    She was trying to scam him using a lonely hearts pull He was trying to scam her with the promises of riches This summer, sparks fly in the romantic comedy of 2023: "Phish into my Heart"
    - dylan604 4y ago
      okay, so this made me smile. just finished exporting a montage scene that could fit right into that script. timing is priceless
    - ethbr0 4y ago
      This makes me feel old. Cinema when I grew up was calling into advice radio shows because someone couldn't sleep on their architect-affordable houseboat in Seattle. None of that exists anymore.
    - Andrex 4y ago
      Or the A24 horror version, "Heartphish."
  - jaxn 4y ago
    I reply to the ones wanting to buy houses that I don’t own. I drag them along for days. I figure I can at least waste their time
troydavis 4y ago
(Update: Commenter "homero" mentioned that Twilio's CNAM API response includes the carrier: https://support.twilio.com/hc/en-us/articles/360050891214-Getting-Started-with-the-Twilio-Lookup-API#h_01ECXDQZ8TH86K5S51PDQF4KFC https://support.twilio.com/hc/en-us/articles/360050891214-Ge... . Twilio's docs make it sound like this API does incorporate mobile number portability, which is what you need, but I haven't personally verified. Can anyone from Twitter confirm that the LNP info is at least near-realtime?) You'll need either access to an SS7 routing system or, more likely, an HTTP API that exposes 10-digit number routing info. Google for '10 digit OCN lookup' or 'realtime CNAM lookup API' and you'll be on the right track. You need one that handles mobile number portability. Most APIs charge a small per-query fee because it's not static data. Any one number can be ported at any time and the only way to know is to see where (in SS7) it's actually routed. And be aware that there's a fair number of gotchas. I have a lot of experience in the telco world[1]. The two big gotchas are: 1. Inbound and outbound carriers can be and often are different, and outbound caller ID can be spoofed. The source number on an SMS from a 10-digit number (a "10DLC" SMS) is much, much less likely to be spoofed than the caller ID on a robocall. You can fairly reliably report source numbers on SMSes. To keep it simple, consider starting by reporting SMSes. For robocalls, expect that many robocall CIDs are spoofed, and the most interesting robocalls are the ones that ask the recipient to contact them at the same number. Or, where both the CID and the callback/contact number are DIDs from the same carrier. 2. Number portability means that all the old static databases (LERG and NPA-NXX-Y Number Pooling[2] databases) aren't enough. One phone number might be routed to one carrier and the sequentially-next number might be routed to a completely different carrier, and either of them might change the next day. This is just the start - there are other gotchas and a pretty significant learning curve. Stay polite and professional, assume good intentions, and assume you're wrong about something. [1]: Back in 2010, I made the first free, public REST API for looking up phone data: https://www.slideshare.net/troyd/cloudvox-digits-phone-api-locate-any-number https://www.slideshare.net/troyd/cloudvox-digits-phone-api-l..., https://www.prnewswire.com/news-releases/cloudvox-launches-free-api-bookmarklet-and-web-service-for-finding-the-location-of-any-phone-number-91590254.html https://www.prnewswire.com/news-releases/cloudvox-launches-f... [2]: https://nationalnanpa.com/ https://nationalnanpa.com/ and for thousands-block reports, https://www.nationalpooling.com/ https://www.nationalpooling.com/ -> Reports -> Block Report by Region
homero 4y ago
You can actually use twilio to find the carrier on cnam https://support.twilio.com/hc/en-us/articles/360050891214-Getting-Started-with-the-Twilio-Lookup-API https://support.twilio.com/hc/en-us/articles/360050891214-Ge...
Magicstatic 4y ago
I use Lookify.io which lets you look up a carrier without creating an account - you can also see if anyone else flags it as spammy but who knows if the reports are anything other than anecdotal

DevX101 4y ago

Can you submit a report to the FCC detailing your findings at https://consumercomplaints.fcc.gov/hc/en-us https://consumercomplaints.fcc.gov/hc/en-us?

troydavis 4y ago
I've done this many times. It goes into a Zendesk-powered black hole. Looks like the oldest Zendesk autoresponse I have is from 2014. There's no way to tell whether it's making a difference (is anyone even aggregating reports by volume?), so I stopped.
- simfree 4y ago
  Commio's shutdown of the Teli platform has been a mess, outbound calling never got STIR/Shaken compliance. The ThinQ side of the house seems to let dialer traffic slide: https://lowendtalk.com/discussion/183904/lowend-sip-trunking#latest https://lowendtalk.com/discussion/183904/lowend-sip-trunking...

andrei_says_ 4y ago

How would abuse of such system be prevented? Require a minimal percentage of spam/abuse responses per number?

yardstick 4y ago
Provide personal identification back to the carrier, not just the reseller? Ie Passport/valid driving license. Not fool proof and comes with its own set of problems. But it’ll likely get us most of the way.
troydavis 4y ago
Here’s how others address it. For phone calls and texts: - Slowly increase velocity limits on new DIDs/TNs. Often, examine the outbound content before raising limits - is it something anyone would request? where/how? - Require the recipient to have opted-in on the same carrier (ie, no importing lists) - Don’t let the affiliate/reseller sign up customers on their own. Centralize onboarding/KYC. - Verify the end customer’s government-issued ID. For texts: - Block (and flag/escalate) based on message content, like the domain name/URL they’re linking to or a pitch phrase they’ve used.
- from 4y ago
  > - Verify the end customer’s government-issued ID. This never happens. Lots of PPP or bank fraud investigations go nowhere because the perpetrators used fake IDs all the way down. No company is actually checking the governments database of drivers licenses or state ID cards. Only recently did eCBSV come out which would allow companies to digitally check that an SSN actually exists (mostly to stop synthetic identity fraud) but that still doesn't stop identity theft.
  - troydavis 4y ago
    Some of this is about increasing friction, not collecting flawless info. Is it possible to fool Stripe Identity (https://stripe.com/identity https://stripe.com/identity) repeatedly? Probably. But it’s a pain to make new fake docs (or switch carriers) every time an account is flagged.

onetimeusename 4y ago

Are offshore carriers responsible for spam calls that spoof numbers (based on your data)? Those two carriers are onshore so I think they would have to comply with the SHAKEN/STIR protocol which would make calls originating from their network easier to identify and block. Offshore carriers don't have those restrictions. I am surprised a company is able to operate like this onshore.

kbuck 4y ago

On most (all?) carriers, you can forward spam SMS messages to 7726 ("spam" on the keypad) to report messages as spam. That said, I've got no idea if they actually do anything actionable with this data. It certainly doesn't seem to have reduced my spam volume. Now I just let Android Messages filter the spam out.

troydavis 4y ago
I’ve wondered the same thing. I’ve used 7726 to report large, long-lived campaigns (to AT&T Mobile’s 7726) and as far as I could tell, nothing happened. The senders rotate TNs so often that AT&T would either need to track it back to the point of ingress or do content-aware blocking.
- aendruk 4y ago
  My most recent experience was enduring several weeks of daily spam, all diligently forwarded to 7726 (“Thank you for reporting SPAM. We'll take it from here.”), only to finally get fed up enough to send a complaint to the FCC after which the spam stopped immediately.
reaperducer 4y ago
On most (all?) carriers, you can forward spam SMS messages to 7726 ("spam" on the keypad) to report messages as spam. I wonder if that's what the iPhone's "Report Junk" button does with text messages. For some reasons, my iPhones on AT&T always offer the option to report a text message as spam, but my iPhones on Verizon do not. Another curiosity.
- aendruk 4y ago
  Tell me more about this report button! I’ve long wished for such a feature but thought it didn’t exist. This is something built in to iOS?
  - troydavis 4y ago
    "Report Junk" was originally added for iMessage (with reports going to Apple, I assume). iOS 16 expanded the feature to support reporting SMS/MMS "Depending on your carrier and country or region": https://support.apple.com/guide/iphone/block-filter-and-report-messages-iph203ab0be4/ios https://support.apple.com/guide/iphone/block-filter-and-repo... (scroll to "Report spam or junk messages"). "In the list of messages, touch and hold the spam message, then tap Report Junk. Or, if you’ve opened the message, scroll to the bottom of the message, tap Report Junk, then tap Delete and Report Junk." I've read that "Report Junk" does the equivalent of forwarding to 7726, but I don't have a way to verify that (more: https://www.bandwidth.com/blog/apples-ios-16-update-and-what-it-might-mean-to-the-sms-ecosystem/ https://www.bandwidth.com/blog/apples-ios-16-update-and-what...).

roywashere 4y ago

I’m in Europe and hardly ever receive unsolicited SMS or phone calls. Somehow, at least to me, this seems like a US problem. Why is that? What does EU do that it is not a problem here? Or does it just mean that we have a ‘business opportunity’ here?

watwut 4y ago
Afaik, some aspect of it is just not legal. And when someone calls you, you have right to ask to be removed from database and they have to remove you.
- deleted 4y ago
  [deleted]
dottedmag 4y ago
Looks like it depends on the local regulatory agency. I have never had a spam SMS or call in Norway, while on Malta it's a regular occurrence, thought not as bad as described by US folks.
- codetrotter 4y ago
  I live in Norway. I’ve received both SMS spam and scam phone calls. However, it is still a rare occurrence. Only a few times per year.
scooke 4y ago
I was a micro-entrepeneur, or auto-entrepeneur, in France, and unsolicited calls and messages started the very next day I registered. Don't ask me the about the email spam.
deleted 4y ago
[deleted]
reaperducer 4y ago
I’m in Europe and hardly ever receive unsolicited SMS or phone calls. Somehow, at least to me, this seems like a US problem. Every single time the subject of robocalls or spam texts is brought up on HN, someone claiming to be from Europe shows up to ask why it's a U.S.-only problem. Then people from Germany and France and Greece and the U.K., and elsewhere in Europe show up and say how they have to deal with it, too, and it's not just an American thing. In my RSS feed are several European news sources, and they all talk about robocalls occasionally. Who are these apparently very few people in Europe who allegedly have never dealt with telephonic spam, and why do they always feel the need to talk about their personal situation when it has no bearing on the discussion at hand? You state that you "hardly ever receive unsolicited SMS or phone calls." I'm in America, and I too get unsolicited messages "hardly ever": about one unsolicited SMS per month, and spam phone calls about six times a year on my work phone, and maybe once each year on my personal phone. Don't delude yourself into believing that every phone in the nation is flooded with spam all the time.

tomnipotent 4y ago

I can't imagine even combined these companies are more than a single percentage of Twilio's volume. A quick search shows these two at ~300 employees to Twilio's ~7,900 - if you assume volume is somewhat linear to costs and subsequently revenue, Twilio is an order of magnitude larger. Even a smaller percentage of Twilio being spam is much more volume than a large percentage of these companies.

calibas 4y ago

I looked up the carrier for my most recent spam calls using lookify.io: 1. PEERLESS NETWORK OF OHIO 2. PEERLESS NETWORK OF FLORIDA 3. PEERLESS NETWORK OF CALIFORNIA 4. PEERLESS NETWORK OF CALIFORNIA Nothing from Twilio, but Peerless Network certainly stands out. I see they describe themselves as "A Disruptor and Aggressive Innovator".

bevenky 4y ago
Peerless is now owned by Infobip. https://techcrunch.com/2022/07/26/us-and-european-comms-platform-infobip-acquires-voip-provider-peerless-network-for-200m/ https://techcrunch.com/2022/07/26/us-and-european-comms-plat...

giancarlostoro 4y ago

I did a hackathon a few years back a few years in a row and Telnyx was a sponsor the first year. One of the sponsors started asking for legitimate company information in order to keep your account with them. I wonder if this is something the FCC should request from these companies, I also wonder how effective it would be. I dont think all robocalls will die, but a significant number probably will. Once you have an actual company behind the robo calls you can sue. Telecoms providers should be required to be helpful in providing information when abuse is reported or be liable themselves as if they were responsible. It seems like a solvable problem but nobody is actually solving it.

charcircuit 4y ago

>the carrier would be required to respond with the name and full contact info of both the carrier and their customer This would be used for doxxing people. Anyone you text can get all the information they need to swat you.

troydavis 4y ago
I was referring to vendors of commercial 10DLC and short code messages, not consumer-facing mobile providers. Consumer-facing mobile providers (where doxxing is a risk) could reply with just the carrier’s abuse contact (ie, abuse@ and/or a phone number). And even if it was only implemented for 10DLC, not consumer-facing mobile, that would be a start.

bevenky 4y ago

Founder & CEO of Plivo - https://www.plivo.com/ https://www.plivo.com/ here. At Plivo we offer similar API services to Twilio for voice calls and SMS. While API offerings have made it easier for developers and tech team to integrate communications into their applications, one of the challenges here is the scale at which spammers and folks using stolen credit cards are always attempting to abuse all of our platforms. Most of us companies, work quite hard to deter these spammers at sign up and later using automated systems to analyze usage patterns including content filtering, but its quite a cat and mouse game. Something that has worked for us has been to restrict signups to only work emails. It does have it's disadvantages but we have been able to limit the random gmail id signups at scale by bot/spammers that abuse the system for use cases like robocalling and more.

dheera 4y ago

For what it's worth, I use Twilio to combat robocalls and telemarketers ...

spamizbad 4y ago

Oh god, Telnyx. We used them for toll-free SMS. Horrible experience. I friend of mine used to work for them in the early days and had some pretty terrible stories about what it was like working there.

deleted 2y ago

[deleted]

timcommio 2y ago

Troy, appreciate the post, and I 100% understand your frustrations. I work at Commio and wanted to respond. Apologies in advance for the long explanation, but I think it will shed some light on the current state of cloud voice. Fraud, abuse, and unwanted calls are unacceptable, and, like the many companies standing between companies placing calls and consumers receiving them, we take all such reports very seriously. We offer a Report a Number link on our website so any unwanted call placed using a number we sold can be investigated, traced, and action taken to shut down the traffic. Commio (thinQ/teli) was a member of the Federal Communications Commission’s task force to combat fraud and robocalling and we are an active member of the working groups resulting from that task force. In addition, we have implemented STIR/SHAKEN protocols to help stop fraudulent calling from spoofed numbers, and are also set to launch one of the first branded calling solutions to enable brands to fully sign and vet their calls, preventing spoofing once and for all. 2025 is going to be one for the record books. Who is Commio: Commio does not make any calls to consumers and generally only provides a network interconnection “bridge” between a calling party’s telecom provider and a called party’s telecom provider. We provide voice interconnection services to other telecom carriers, enterprises, and cloud platforms. We provide service to virtually every major national carrier in the United States. We also provide interconnection services to VoIP providers. We essentially carry phone calls between all of these telecom companies. As part of our service, we also provide telephone numbers to VoIP providers, who then assign these numbers to their end-user subscribers. We provide phone numbers to these VoIP providers because regulatory restrictions limit their ability to obtain their own phone numbers. How We Can Help: Commio does not provide service to individuals and, by law, is prohibited from knowing the identities of our customers’ end users. Because of this, we must forward most abuse reports we receive to the service provider to whom we have assigned the number in question. We will promptly send your report to the appropriate service provider and request they promptly commence an investigation. Please also note that our services are not exclusive, and just because a number comes back to Commio (thinQ/teli), it does not mean we carry all traffic for the originating provider. Our service-provider customers have the option to use other carriers to transport some or all of their calls. When our service-provider customer sends voice traffic to another carrier, the call does not touch our network. In some cases, we can provide you with contact information for our service-provider customer. If that option is available, Commio will send you an email with the service-provider’s contact information so that you can work directly with them to resolve your complaint. Sometimes, our customers will investigate a report and determine that the calling number has been “spoofed.” Caller ID spoofing occurs when the caller inserts a falsified number into the call stream so that your Caller ID shows a phone number that did not make the call. When this occurs, neither we nor our customer will actually know what number or person made the call. Please understand disconnecting a spoofed number will not stop the calls you are receiving because that number did not make the call – it is simply fake Caller ID information sent to your phone. If you need additional information about spoofing or stopping unwanted calls, the Federal Trade Commission (www.ftc.gov) and Federal Communications Commission (www.fcc.gov) have both posted information and tips on their websites to help consumers including information about call blockers, the national Do Not Call Registry (www.donotcall.gov) and how to report numbers associated with scam calls. I would also strongly urge you to contact your local law enforcement agency for assistance if you receive fraudulent, abusive or threatening communications and you are concerned about your safety. Troy, thanks for listening, and feel free to reach out to me anytime: tim (at) commio.com.