A Different "Spoofing" Victim

I came across this article while doing some research.  Not all the victims of Caller ID spoofing are on the receiving end of the scam.  While this article mentions some legitimate used for the spoofing of a number I would suggest that the "needs of the many outweigh the needs of the few" in this case and that both legislation (which will only punish the bad guys if and when they are caught) and technology need to be adjusted so that the spoofing of numbers can no longer be accomplished.  This is also another reason that calling back the number that comes up is not a good idea since you may end up harassing an innocent party.

http://www.mcall.com/news/local/watchdog/mc-c ... ,7216794.column

Page 1 of 2 May 11, 2014 07:39:09AM MDT
Hijacked phone number disrupts life in Nazareth
The Watchdog 9:33 p.m. EDT
9:33 p.m. EDT mcall.com
Hattie Doto was receiving calls by the dozen, many of them vile.
People were angry because they had received repeated phone calls from her number. Some of those
were robocalls making shady sales pitches for a roofing contractor. Others seemed to be pranks.
But Doto, of Nazareth, wasn't making the calls. Someone had hijacked her phone number, a gimmick
known as "spoofing," which is designed to conceal the true identity of the caller in the hopes you'll pick up the phone.

Spoofing is illegal when used to commit fraud but is allowed otherwise.  Doto and her family hadn't heard of spoofing. They were forced to learn quickly and what they learned wasn't assuring. Doto said she was told that other than changing her phone number, there was nothing she could do.

For several weeks last month, the family endured the calls, as many as 50 a day. "A lot of them were screaming, cursing, were very angry," Doto said. "I couldn't even finish a conversation with someone because more people were calling in," said her daughter, Megan Stoneback. "They're like, 'What do you want? You keep calling here, leave us alone.' Even after you explain it to some people, they still don't get it." Eventually, the family put a recording on its answering machine to explain it.
"Our home phone number has been stolen by criminals trying to scam you. The technical term is called spoofing," the message said. "We can no longer continue to receive harassing voice messages from morning until night. We are the victims here."

The spoofing started in early April. The robocalls for a roofing company said a representative would be in the area and wanted to drop by, which is an offer you never should accept because you know nothing about the company. Other calls seemed to be pranks, with people laughing or hanging up, Stoneback said. Many calls went to people Doto and Stoneback know in the Nazareth area. One even came to the Doto home. Imagine that, hearing your phone ring and seeing on your caller ID that you're calling yourself!

The complaint calls ceased around the end of April. The family initially contacted the Watchdog to get the word out that it wasn't making the calls. With the calls apparently over, they still wanted their story told, so people would understand what spoofing is and how helpless victims are. Technology makes spoofing relatively easy. It can be done using a computer or with cards similar to calling cards. A federal law enacted in 2010 prohibits caller ID spoofing "with the intent to defraud, cause harm, or
wrongfully obtain anything of value."

Not all spoofing is devious, though, which is why Congress hasn't outlawed it. A domestic violence shelter might want to conceal its real number. Professionals such as doctors or lawyers who make after-hours business calls from home might want to have their office number show up on caller ID instead of their home number. But spoofing often is used to commit fraud. I wrote several years ago about a Bucks County tax collector whose number was spoofed in an apparent attempt to trick people into providing credit card information, believing they were paying their taxes.

Doto said she sought help from various law enforcement authorities, her state representative and Verizon. All anyone could suggest was to change her number, which she refused to do.
"Unfortunately, caller ID spoofing is frustrating not only for customers, but for companies like Verizon as well," Verizon spokesman Lee Gierczynski said. "Verizon, or any phone carrier, has no way of determining which numbers are legitimate and which are not." I read similar accounts about other spoofing victims who also found no relief.
Nazareth police are investigating Doto's case but have not received complaints from people who received the spoofed calls, only from Doto, Chief Thomas Trachta said. Upper Nazareth Township police received one complaint from a woman who received a spoofed call from the number. She told police the call seemed to be a scam. "Whatever they were saying to her about roofing, she thought sounded funny," Chief Alan Siegfried said.

While police have no reports of crimes associated with the spoofed calls, the calls clearly were annoying. Otherwise, people wouldn't have been calling back trying to stop them. Doto said people told her they got the calls as early as 5:45 a.m. and as late as 10:15 p.m.

Spoofing is another reason to be cautious when picking up the phone. Never assume you know who is calling, no matter what your caller ID says. If a caller asks for personal or financial information, call back on a number you know is legitimate.


The Watchdog is published Thursdays and Sundays. Contact me at watchdog@mcall.com, 610-841-2364 or The Morning Call, 101 N. Sixth St., Allentown, PA, 18101. I'm on Twitter @mcwatchdog and Facebook at Morning Call Watchdog.

Copyright   (c) 2014 Allentown Morning Call      May 11, 2014 07:39:09AM MDT

If Lone Stranger was still around he would be trying hard not to say he told us so. Half the problem with fraudulent telemarketing is that people don't know how or where to complain, and many are too angry and lazy to find out.

Just as sad as the misdirected outrage from call targets is the utter waste of opportunity to redirect that same outrage straight at the source of the illegal calls. Since the beneficiary of the sales campaign would presumably have been some locally operating gypsy contractor, there must be hundreds of people in that county who could each slap the boss with a TCPA suit, which is quite frankly the only appropriate response after requisite alerts to an attorney general and the FTC. Tele-fraud is hardly a new phenomenon. Police departments, state offices, and phone companies must hear the junk call complaints every week. While I don't expect any of them to work outside their scope, it's really become inexcusable that they are generally incapable of providing basic wayfinding to those resources which *are* equipped to help.

I find it very hard to believe that the telephone companies handling these spoofed calls have no idea from whom they received the messages. They do, after all, have to send the bill for all of those calls to someone.

ANI (automated number identification, the calling number for billing purposes) is not the same as Caller ID (the displayed number). Large corporations with 1-800 or similar toll-free numbers are given access to ANI, as they're paying to receive what is basically a direct-dial collect call. How hard would it be to require that telcos extend the same right to the rest of us?

>>> ANI (automated number identification, the calling number for billing purposes) is not the same as Caller ID (the displayed number). Large corporations with 1-800 or similar toll-free numbers are given access to ANI, as they're paying to receive what is basically a direct-dial collect call. How hard would it be to require that telcos extend the same right to the rest of us? <<<

They do.  If you want one, it is quite easy (and not all that expensive, I might add) to get your own toll-free number.  You do not even have to be a large corporation to have one.  An individual can easily get one and use it as his home phone number.

See, for example, this:
http://www.callcentric.com/dids/toll_free_numbers
and this (for calling out):
http://www.callcentric.com/rate/plans/

Lest it appear that this is an ad for CallCentric, let me go on the record as saying that I have three VoIP providers, so that if one goes down, I have the others to take their place.  And I use a less expensive provider than CallCentric for my toll-free service.  I point to them only as a reliable VoIP service that actually advertises that you will always get to see who is calling, and as one that is relatively inexpensive.

But if you are really demanding ANI, you should know that you are asking for a service originally developed by AT&T for billing purposes, solely within their own network.  Nowadays, the different phone companies just contract with each other to terminate phone calls.  And some originating phone companies charge a flat rate for all calls to the US and Canada no matter how many calls you make or from where you make them.  Then, too, there are other types of calls such as phone card calls and SkypeOut calls that all originate from a single, or perhaps only a handful of, outgoing number(s).  So whether ANI actually even exists today in the form you demand is an open question (at least to me).

To identify a caller, what you really need is either the registration information for the phone or device at the originating end of the call or the GUID (globally unique identifier) for the call you receive.  You won't be able to get the registration information, but you can get the GUID with a service provider that reports them back to you (e.g., voip.ms ), or you can try packet sniffing (if it is legal and possible for you to do).  But if all you have is the GUID, you will have to be prepared to get a lot of subpoenas issued to phone companies to obtain the records associated with the calls.  And, with perhaps some exceptions, you won't be able to get them at all if the callers are overseas.

I always wondered about that since they say you cannot block your number from 800 calls.  What happens if the number is spoofed to begin with though?  Do you receive the correct number when you get your bill for the received calls or will it contain the fraudulent number on it?  And then what happens if you call 911 with a spoofed number?  Do they have a way to ascertain your location anyhow?

>>> I always wondered about that since they say you cannot block your number from 800 calls. What happens if the number is spoofed to begin with though? <<<

Those are interesting questions. It may depend upon how the carrier presents the number in the SIP request to set up a call and how the carrier translates its registrations into the header information.

Often, callers try to block their outgoing caller ID with *67 (which, on many systems, blocks outgoing caller ID on all outbound calls) or *81 (which, on many systems, blocks caller ID on the next outbound call only). All this does on a SIP phone is send along the caller ID along with a flag to the carrier indicating that the caller ID should not be sent to the subscriber receiving the call. There are actually some wholesale service providers that anyone can subscribe to (again, quite inexpensively, so an individual could take advantage of this service) where, with inexpensive equipment (around $50-$150) you could get the calling number displayed to you anyway, even if you only have a regular, non-toll-free number.

But what number will be sent if you dial 911 from a spoofed number? My guess is that the caller would get his own 911 service, if he has signed up for one, or nothing at all. Except for copper lines with POTS (plain old telephone service) 911 calls are sent to a special center for dispatching emergency services or forwarding to a local dispatcher. That's because it's practically impossible to automatically determine the location of a phone that is using a VoIP service.

Most all VoIP service providers operating in the US are required by law to provide 911 service to subscribers. But if you have more than one phone number, they often charge you only once to activate 911 on ALL your lines. If you want a different 911 address on some of your phone numbers, you have to get a separate account.

Thus, my best guess is that the 911 address that is sent to the 911 service is sent as a header field in the SIP setup request generated by your provider, and that this address is tied to your account, not your phone number. Thus, unless you register your phone by providing a user name and password to the service provide or attaching your SIP phone to a unique, static IP address on the Internet (which is unlikely for a home user) that is know by the provider to be yours, your 911 service address is not likely to be sent to the dispatcher, even if the number is spoofed. That's because the scammer isn't likely to be logged into your service provider with your credentials (which may include a static IP address).

Note that I say "is not likely to" a lot. If things work as I think they might, I believe there may be a way to spoof a 911 address, too. But if someone actually did that a significant number of times, they WOULD get noticed, and not in a way they would want to be noticed!

Please forgive the rambling nature of my answer. Perhaps someone more expert than I am can give you a more definitive, concise answer.

Yes it was a bit wordy, but you did a good enough job of explaining things.  At least as far as what i need to know about the subject anyhow.

I just happened across a post on another thread where the person *69'nd the number and got his own phone number read back to him.  That has to be worse than seeing it on the caller ID.  The thread was:

https://800notes.com/forum/ta-5b1b3314a05c286-7/rachel-from-card-services, last page, poster Protos Heis

I guess that really does come very close to the ultimate "dis".

Consumerist.com had a post recently about a Dentist that had their office number used fraudulently.  I love to waste as much of a telemarketers time as possible to try to erase as much profit as possible, but I never call back a telemarketing call.  This is a prime reason why calling back a telemarketer is not a good idea.  Better to take as much of their time as possible, and slowly get as much information about them as you can.

The scammy ones will hang up if you try to get too much info about them too quickly, but if you give them time, act interested, and let them think they might have a sale, they generally will give you everything you need to file a complaint.  Bonus is that they've wasted 10, 20, 30 minutes on you with no chance of a sale.  That impacts their profits, which makes telemarketing a little less profitable.  Take out the profit via a grass roots, crowd sourcing efforts of talking to them, and making telemarketing too inefficient is (IMHO) the only way to stop telemarketing

This is one of their new scam numbers we shut down last one and will do the same if we all help

They are all local calls I checked  AT&T   first to make sure no hidden phone charges  
This is how to stop them  don’t make it easy for them by hanging up
Just keep calling number every chance you get THEY ARE FLIPPING OUT   the longer you keep them on phone will give them less time to mess with people we have successfully shut down many of these numbers by doing this back to them  
the best thing is to keep them on line as long as you can scam them back

This is one of their new scam numbers we shut down last one and will do the same if we all help

They are all local calls I checked  AT&T   first to make sure no hidden phone charges  
This is how to stop them  don’t make it easy for them by hanging up
Just keep calling number every chance you get THEY ARE FLIPPING OUT   the longer you keep them on phone will give them less time to mess with people we have successfully shut down many of these numbers by doing this back to them  
the best thing is to keep them on line as long as you can scam them back

I wonder if I can set up a computer with voip to automatically keep calling these scam numbers and not say anything when they answer...

An interesting project to think on.

... and when you call them back, spoof their CNUM and CNAM so it looks like they are calling themselves.  That should create a little chaos in their call center.

My phone number is being used by someone to make calls out of state, all across the nation.  They never leave a message but people call my 800 number to see who I am and why I called.  It is a problem because one day I received 78 calls that the answering machine missed.  The others that left message so far were calm and the people I called back were understanding.  What I don't understand yet is Why?  So far the calls haven't shown on my phone bill.

Its called call spoofing. And of course they are making illegal calls using your number because they know their call is illegal and they don't want caught so they don't get into trouble with the Government.  Your a victim of this same as the people who are getting the calls.

phone spoofing explanation
http://en.wikipedia.org/wiki/Spoofing_attack
http://www.fcc.gov/guides/caller-id-and-spoofing

The laws have changed recently regarding requiring phone companies to send ALL calls to your number when your number has been called.  I called AT&T and complained about the robo calls, the telemarketers, etc.  I was informed they can set your number to reject these calls.  I had them do it about 2 weeks ago, and my phone has stopped ringing multiple times a day.  It's great.  Contact your phone company about it and get your number set to block these annoyances.