Slashdot Mirror


Has My Cell Number Been Cloned?

2bepissedoff asks: "According to my T-mobile phone bill, I have been receiving incoming calls from a 'NBR unavailable', since February, with talk time ranging from 1 minute to an hour. The strangest thing is, I have never received these calls (my phone doesn't ring and I haven't talked to the caller). I only started noticing them when my phone bill was charged over $40 more than my regular bill. Of course, I have a family plan (2 people only, 2 lines) and I talked to my partner. The answer: he too had not received any of these calls, especially over 300 minutes per month of them. We called up T-mobile twice and claim the possibility of phone cloning. Both representatives hung up on me, thinking I was trying to con them or something. Any advice to what this could be?" I did a little investigation and I've noticed that some of the NBR minutes overlap with calls I actually make. For example:

'2/22 at 3:28 pm "NBR unavailable" 17mins usage.
2/22 at 3:44 pm "-(# I made)---" 3mins usage.

So if you add up the time 3:28pm + 17 mins = 3:45 pm. The time when I made my call was at 3:44 pm. This reoccurs several times. I still do not think this is enough evidence to convince T-mobile of Phone Cloning. So I am thinking of switching either my number or my service provider. "

20 of 561 comments (clear)

  1. switching the number won't work by Incongruity · · Score: 4, Informative
    without changing your SIM card, changing the # won't make a difference, I believe.

    Get a new account -- new SIM's for both you and your partner and do it sooner rather than later, for your sake =)

    1. Re:switching the number won't work by Bob535 · · Score: 4, Informative

      I agree, working for a Cellular Company, the easiest way to fix this would be to call in and ask for them to replace your SIM card. No need for a new account, just ask them to send you out new SIMs. If this doesnt fix the problem, ask for a ticket to be filed and an engineer to call you back with the explaination. The agents dont know anything anyways.

    2. Re:switching the number won't work by SenseiLeNoir · · Score: 5, Informative

      If its a GSM phone, I very much doubt any cloning has occured for the following reasons.

      BTW, I used to work for Logica, in the telecoms division, and have a LOT of knowledge of GSM systems, and how they work. I am also a T-Mobile (UK) customer.

      Remember these facts:

      - A GSM phone has a unique IMEI number.
      - Each GSM phone has a unique SIM card with a unique SIM number. This SIM number is attacted on a central computer to your account.
      - Although the SIM card does contain your number, it is many for informative, and not operational purposes.

      When you switch on your phone and it logs onto your network, it sends its IMEI number, and its SIM number to the network. The network then looks up the SIM number and associates it with a number. As it stands, only one SIM number can ever be associated with a phone number. When i tried getting a new SIM to replace my aging SIM, the old one was disconnected before the new SIM was issued, as it is simply not possible to associate a number with two SIMs. You can associate a SIM with two or more numbers, but not the other way round.

      If someone HAS cloned your SIM, and both phones are attached at the same time, the network would register a fault, as a SINGLE sim number is assiciated at two different locations. It woudl create a fault in the system which would prevent both yours and the clone SIM from working. This is actually one of the main reasons why Cellphones are not usable on Planes (even if it is prooven to be safe to the electronics). The phone woudl try to log onto multiple cells at the same time, causing a lot of strain on the network, or even malfunction.

      A SIM can only be "effectively" cloned if the original was never used afterwards. If both the Original SIM and the Clone was used at the same time, the network will try and continuesly switch between the two cells its registered to, unless both are on the same cell. if both are on the same cell, further issues would happen.

      I am not sayign that cloning is impossible, its just extremely unlikely.

      I woudl think the most likely causes of this situation are:
      - Are you *sure* your partner is not recieving the calls? Really sure?
      - Maybe, if you visited another country (or performed roaming) there might be some residual temporary numbers assigned to your phone.

      However, the way the records are kept, you shoudl find that its pretty easy for the phone company to determine what happend. Who made the phone call, what handset was in use, where the call was recieved.

      Finally I do not know the laws of the US, but here in the UK, the first point of call if you think your phone has been cloned or if your believe that a crime has been committed regarding your phone is the POLICE.

      In UK, if we recieve am abusive call, calling the phone company will not be any help. They will rightly ask you to contact the police first, and they will work with the police to resolve the matter.

      --
      Have a nice day!
    3. Re:switching the number won't work by wfberg · · Score: 4, Informative

      BTW, I used to work for Logica, in the telecoms division, and have a LOT of knowledge of GSM systems, and how they work.

      That's not really a good advertisement for Logica then.

      The IMEI has next to nothing to do with any sort of security function of GSM. It only identifies your handset, and some countries have a registry that they'll put your stolen phone's IMEI on so networks can prevent the handset's further use in that particular country among the operators that signed up to the registry, but IMEI is not checked against your subscription. In fact, that's one of the primary design tenets of GSM; subscription data is contained in the Subscriber Identity Module; the SIM.

      is simply not possible to associate a number with two SIMs. You can associate a SIM with two or more numbers, but not the other way round.
      This is false. Many operators offer dual SIM cards; both cards contain the same subscription data, and usually the last one activated is logged on to the network succesfully to receive incoming calls. Both can make outbound calls.

      If someone HAS cloned your SIM, and both phones are attached at the same time, the network would register a fault
      No, it works, though you will notice only one handset receiving calls. It's not registered as a fault (though it is registered).

      A SIM can only be "effectively" cloned if the original was never used afterwards. If both the Original SIM and the Clone was used at the same time, the network will try and continuesly switch between the two cells its registered to, unless both are on the same cell. if both are on the same cell, further issues would happen.
      Again, not true.

      In fact, if certain algorithms are used (IIRC, COMP-128) it's even possible to reconstruct the SIM's KI and clone it using information eavesdropped over-the-air (be afraid!).

      - Maybe, if you visited another country (or performed roaming) there might be some residual temporary numbers assigned to your phone.
      Which numbers would those be? The connection between your MSISDN and most-likely (or actual) away-network is always looked up via the home registry; the away-registry doesn't associate any temporary MSISDNs to your SIM, it doesn't need to. And if it did, and someone misdialed such a random number, how would they be supposed to get through to you? Their home registry simply won't accept entries for SIMs from your network.

      However, the way the records are kept, you shoudl find that its pretty easy for the phone company to determine what happend. Who made the phone call, what handset was in use, where the call was recieved.
      Spoken as some one who's never tried to get a phone company to look up something in their records. Good luck trying that. Yes, it's technically feasible, but that doesn't mean phone companies are organizationally capable of doing this.

      Finally I do not know the laws of the US, but here in the UK, the first point of call if you think your phone has been cloned or if your believe that a crime has been committed regarding your phone is the POLICE.
      No, first call the phone company to report fraud, so they can put restrictions in place (e.g. no international calls, no premium toll numbers) to prevent ongoing abuse and rising phone bills, and report and investigate at leisure.

      In UK, if we recieve am abusive call, calling the phone company will not be any help. They will rightly ask you to contact the police first, and they will work with the police to resolve the matter.
      Again, no; "British Telecom has its own unit, which deals with nuisance calls. If you have not already reported it to BT then contact them on 150. They will investigate first and if they can trace the calls, you will then be advised to make a formal police report to your local police station. Cable & Wireless and mobile phone companies require that it be reported to police before they will deal with it. Attend your

      --
      SCO employee? Check out the bounty
    4. Re:switching the number won't work by DM9290 · · Score: 4, Informative

      I also work at a telecom company (I will not identify which), and am involved with the development of logic for real time processing of phone calls. You put far too much faith in telecom systems checking for what may or may not be a nonsensical situations. It is far easier to simply process and complete a phone call, than to speculate on an infinite number of potentially contradictory situations which may arrise which might suggest foul-play.

      There is nothing implicitly wrong with completing 2 phone calls at the same time. And while there may be cases where it makes no sense, there are so many cases where it makes sense that generaly speaking it is easier to allow it than to presume there is a problem. A call appearing on a bill for a persons cell phone may not even involve a CELL call or a cloned SIM card at all. It could be a land line which the telco wrongly associated with the cell customers phone bill. There may be nothing wrong with the CELL network at all, but a mere data entry error in the billing system.

      We are first and foremost concerned with insuring that our customers (or any party which even appears to be a customer) are able to completing their phone calls. Failing to complete a good call is considered a much more serious error than erroneously ALLOWING the completion of a fraudulent call. The rule of thumb is.. when in doubt : complete the call. In fact, I would say that while our systems are 99.999% reliable, their ability to stop fraudulent phone calls is NOT 99.999%. Or at least I can say our testing and so forth in that regard has not been enough to make such a claim.

      So... does my code care if you complete 65 phone calls at the same time? no. For all I know you have a service which allows you to complete 65 phone calls at the same time. And if such a service doesn't exist right today, for all I know someone will dream it up next week. It is not for me to speculate.

      As a hypothetical:
      If the same phone line initiated a call from 2 seperate switches simultaneously, there would be no information passed between the 2 switches to detect such an impossible situation. The difficulty of trying to insure such a check was functioning in real time exceeds the benefit.

      In fact... even if we could detect such situations in real time, I would be loath to presume that it was in fact wrong. What if those 2 switches are load sharing? What if Switch A, initiated Call #1, and then experienced a problem causing calls to be routed to Switch B? I would need to think of every possible situation to insure I didn't accidentally break functionality that ought to work.

      We design telephone systems to work when there are serious failures all over the network. We don't want to be the one responsible to not completing that phone call that results in someone dying or whatever.

      You can pretty much assume telephone networks (to the extent that they would BLOCK a phone call which looks funny) are not bullet proof.

      If some technician tells you they are, that technician doesn't know what he's talking about.

      I would be amazed that a customer support person actually hung up on a customer who wanted to know about the possibility of cloning a SIM card.

      --
      No one has a right to their *own* opinion. They have a right to the TRUTH.
  2. Do Not Put Up With That by eldavojohn · · Score: 5, Informative
    Both representatives hung up on me, thinking I was trying to con them or something. Any advice to what this could be?
    Here's some advice: Don't take that shit.

    You're a human being. But more importantly, you're a paying customer. Call them up, get the guy's name. Inform him that if he hangs up, you'll contact his supervisor. Then ask him what zip code these calls were made from, they should be able to figure that out. Verify that it's something reasonable.

    If they won't believe you and you can convince them you're not making the calls, try calling the number and letting your phone ring. See if anyone picks up.

    If that doesn't work, simply demand they change your number for you.

    If they refuse to do that, be sure to inform them where you're taking your business.

    Personally, I'd be pretty damned pissed if anyone ever hung up on me when I was simply inquiring as to why they were charging me money. In fact, I know right where I'd file that complaint.

    If I had a credit card associated with the account, I'd call my credit card company and dispute the charge. You explain to the credit card company that they hung up on you twice. What the operator will do is put you on hold while they contact T-Mobile. The operator should introduce you to the T-Mobile rep and try to resolve the issue. If T-Mobile has a call from a credit card company, I'm certain they'll be a bit more understanding when they're looking at the possibility of having to chase down a stopped payment.
    --
    My work here is dung.
    1. Re:Do Not Put Up With That by barzok · · Score: 5, Informative

      Don't bother with the BBB. Your time is better spent moving up the T-Mobile chain of command. The BBB has no teeth and won't help your case against them.

      I filed a claim with the BBB a couple years ago and all I did was fill out paperwork (well, web forms). I was never interviewed by the BBB, never called by the BBB, and they never (to my knowledge) contacted the company I filed the claim against to work with them as my advocate. I have no evidence that they did anything at all.

      The hours I spent documenting & compiling everything for the BBB, everything I sent them, may as well have been pitched into a black hole.

    2. Re:Do Not Put Up With That by mutterc · · Score: 4, Informative
      Not very many people know quite what the BBB's powers are:
      • Stats collection, as others have noticed. Anyone can get a report on a company and find out how many complaints (and, more importantly, unresolved complaints) have been filed.
      • If the company is a BBB member, then all complaints must get resolved (note that this doesn't mean resolved in the customer's favor), or the company's membership gets dropped. BBB provides arbitration to facilitate this.
      That's pretty much it.

      A selection of things they can't do:

      • Force any company to do anything. They can terminate a member's membership (and keep them from using the BBB logo, etc.) but that's it. They have no authority at all over non-members.
      • Know about every company. (E.g. I can go into business without notifying anybody except licensing boards and taxing authorities; I certainly don't need the BBB's permission).
      • Tell you some company is legit, non-legit, a scam or not, etc. You have to make up your own mind after reading the report. (Think of the slander lawsuits, even from scamsters!) There are exceptions for blantantly illegal things like foreign lotteries, fake cashier's check scams, etc.
      • Give customers legal advice (the legal industry would rather they didn't, and BBB CSR's would rather not be liable for practicing law without a license). They'll certainly refer you to the AG, postal inspectors, etc. if you want help putting the legal smackdown on a scamster. If you just want to know whether something a company did was legal, gotta ask a real lawyer.
  3. I've had this problem also.. by GonzoTech · · Score: 5, Informative
    .. With Verizon Wireless. They wouldn't help me resolve the issue over tech support forums, or through phone call tech support. Know how I got it fixed?

    I showed up at a Verizon Wireless sales center, yelling and complaining (trust me, I can throw quite the tantrum,) until a manager finally got in touch with someone to fix the issue.

    I got three months of free service for the trouble.. and since I've had perfect phone bills.

    Never underestimate the power of being an ass when you're not treated fairly..

    --
    "Snatching defeat from the mouth of victory on a daily basis."
  4. Why make things difficult? by gellenburg · · Score: 4, Informative

    Why make it more complicated than it needs to be?

    Just dispute those calls with T-Mobile and let them figure it out.

    If your bill was over by $40 go back and tell them you didn't receive this call, you didn't receive that call, didn't make that call, etc.

    They have the data to know when and where the calls were received based on the cell towers that the phone was received from.

    Keep escalating the issue dude.

    Call back and immediately ask to speak with a supervisor.

    Get names.

    Record the dates and time you called and who you spoke with.

    Keep escalating up the chain of command if you have to.

    If that doesn't work, file a formal complaint with the FCC and your State's Public Service Commission. That'll definitely get their attention.

    Good luck!

  5. Get in T-Mobile's Face by rizzo · · Score: 3, Informative

    Did you really need to "Ask Slashdot" about this? If T-Mobile's CSRs hung up on you, then you march down to the nearest store and let loose on the first salesperson you see. You *should* have gotten the names of those CSRs (I always make a point of writing down the person's name when I call any kind of support) to give to whoever it is that finally *does* take your complaint. Either they or their manager should be fired.

    And, once you get this issue resolved, leave T-Mobile.

    --

    "More organs means more human." - Zim

  6. Overlap by RomulusNR · · Score: 4, Informative

    Most GSM phones can handle two calls at once (a la call waiting/etc.), so overlapping times doesn't prove cloning.

    The only theoretical way I am aware of to clone a GSM phone is to copy the SIM or have a SIM with the same subscriber number.

    A simple fix would be to get a new SIM card. You can get your existing number transferred over to the new card. If its a card clone, then a new card will solve the problem.

    Dunno why the customer service kept hanging up on you (was it really a hangup or a dropped call?), considering they supposedly have the best customer service in the business.

    --
    Terrorists can attack freedom, but only Congress can destroy it.
  7. Re:I'm skeptical - T-Mobile service is great by Johnboi+Waltune · · Score: 3, Informative

    I've had very bad experiences with T-Mobile. Last week I called to INQUIRE about their prepaid plan, and a couple days later, I found they had switched me over to it without my permission. After three calls, I managed to get them to switch back to my old plan. However, my mobile email no longer works, and the CSR I spoke to told me I never had mobile email for the past 2 years. She actually claimed I had imagined sending and receiving all those emails from my phone. Another CSR believed me, and claimed he could fix the problem, but he was unable to.

    So... after 5 years with T-Mobile, I am ditching them due to the morons I spoke to. The only other GSM game in town seems to be Cingular. They have mobile email, but it's only MSN, Yahoo, AOL, etc.

    --
    "The advanced societies of the future will be driven by competing systems of psychopathology." -JG Ballard
  8. Re:Unknown calls are bullshit by onepoint · · Score: 4, Informative

    net time you loose your phone, call the service department and tell them you lost your phone. they will pleasantly give you the location ( within 1 block ), the last 20 phone calls, and send that phone a text message. I've done this 3 times and got my phone back 3 times. it's all in the manner that you speak to the reps. also it does not hurt to keep your GPS active ( that helps pinpoint the phone to 1 block ).

    Onepoint.

    --
    if you see me, smile and say hello.
  9. Re:No, Technology isn't magic. by PayPaI · · Score: 5, Informative
    You can press a phone code to turn off your call id, and number forwarding, so that the recieving party cannot trace you. (in the u.s.) This was done so that victims of abuse could call home without fear of being traced. The phone company dosen't get that number either.
    Lies. The company gets the number no matter what. CID blocking is just that: blocks anyone with "Caller ID" from getting your number. Anyone with ANI will still get it. Do you think that you could block CID when you call 911? "Sorry, we don't know where you are!"
  10. moron, eh? by Anonymous Coward · · Score: 3, Informative

    1) i see nothing in the article you referenced to imply that *only* 800-number calls can be picked up, across the board. 2) Caller ID: "... This special code does not block the information from companies using Call capture technology ... Emergency services will most likely be able to show the restricted number using a service called Calling Line Identification Restriction Override (CLIRO), or by using general ANI services."

    the couple times i've been forced to call 911, they've certainly been able to locate me based on phone signal... and, well, i haven't got an 800-number, nor was i calling one.

    so, while technology may not be "magic" ... the idea that "CALLER ID BLOCKED" is a be-all and end-all statement isn't necessarily "moronic", either.

    1. Re:moron, eh? by Harik · · Score: 3, Informative

      So you're trying to tell me that phone companies blindy allow CLECS to send unknown calls into their system?

      Yup. Be nice though, he's probably just wrong, not trolling. Not too long ago, I would have argued the same, until I found out how to do it.

      ANI is spoofable on most switches. Trivially if you're using a digital service (ISDN or T1), less so on analog lines but still possible. Note that I'm not talking about Caller-ID here, but the ANI service that large T1/T3 customers get (NOT 800-only). The SS7 network is as badly designed as SMTP when it comes to spoofing.

      The issue is that it was designed to be spoofable for common applications such as forwarding, so that the original ANI was forwarded to the new destination, rather then getting a call from yourself/your company. Of course, there's no way to distinguish from a forwarded call and a new call, so effectivly you create a new call with bogus ANI and then patch it in to the inbound call.

      The other reason is DID lines need to be able to say what number is calling out. You could have hundreds or thousands of numbers all resolve to one trunk (Think any fortune-500 company), so it's the responsibility of the PBX to give the caller's ANI. As was pointed out on Schiner's blog, while you could filter ANI, the current software doesn't make it remotly practical to do so. So any DID line can spoof ANI.

      Whee!

  11. Re:It's probably the NSA by Mistlefoot · · Score: 5, Informative

    As an employee of a cell phone company who works in Customer Care I'll offer my two bits.

    1) When you call customer care ask for and write the down the Care agents name. If they hang up on (unless you are being incredibily agressive and swearing) that information will be handy to their Supervisor. Call back and let that be known.

    2) Both the IMEI number on the handset and Sim Care will be recorded. If both do not match on a disputed call this is strong evidence of cloning.

    3) You have 3 way calling, you have voice mail - two calls at one time is not an anomaly in itself.

    4) Ask for a Supervisor if you do not recieve care at a lower level.

    5) View your online account and watch you billing daily if you think this is a cloning problem. Trying to remember a call from 5 weeks ago is not easy.

    6) Don't dispute calls in general. Dispute specific calls. We can look up specific calls. Saying I have 47 billed minutes I didn't use means nothing. Saying, the call to 123-456-7890 on 6/03/06 at 2:57pm was not made by me. We can actually help with that.

    7) Correspond via email instead of calling. Over the phone pressure exists to keep the lenght of the call down. Via email agents can research your issue without having to leave you on hold - the pressure for resolution in a 5 minute phone call is not there.

    8) When you hear this often in a Call center you do become immune to it. People lie all the time - a popular one is "I have bad coverage" only to find out after reviewing their account that they've used 2800 minutes this month and are happy to accept a discounted handset with a 2 year deal. People with truly bad coverage do not renew for two years and have 2800 minutes usage per month. As such, it is easy for a Care agent to dismiss you without much investigation. Do not give up after 1 or 2 calls (or email). This does not mean that you are right, merely that your issue will be investigated more thoroughly the second or third time. This is normal in many businesses.

  12. Re:No, Technology isn't magic. by jaredcat · · Score: 4, Informative

    That isn't entirely true. I've worked in intercarrier billing for a little while, and I have seen many cases where ANI (Automatic Number ID) is not sent by the originating carrier.

    Now when you make a normal phone call from a normal world zone 1 LEC (local exchange carrier) to another world zone 1 LEC or wireless company, your LEC is almost always going to transmit that data. They don't have to do it, but they usually do it. Generally it makes it much easier for the techs and the billing people when things work this way because it lets you determine if a call is interstate/intrastate (different rate tables) or it can help you track down technical problems of all kinds.

    However, not every carrier sends this information. In fact, carriers with older or less complicated equipment (think phonecard companies and small international operators) sometimes can't even send ANI if they wanted to. Maybe they don't use SS7 and are using the ANI field to an identify an internal billing code. Maybe they have incompetant switch techs who don't know how to setup the signaling correctly. There are lots of legitimate reasons why a carrier would not send out ANI.

    Now for the criminals--- it is VERY EASY to spoof ANI and CLID. Many telecom scams are perpetrated this way. All it takes is for the criminal to be placing calls through a carrier which allows the customer to transmit digital signaling and then sends out whatever the customer sent to the next carrier rather than building ANI from the carrier's own customer database. Virtually all LECs let you do this if you have a T1 and a PBX. Virtually all small VoIP operators let you do this as well, so long as you have the ability to transmit the signaling to them.

    So getting back to the point, your carrier isn't neccesarily lying to you when they say you got a call from 'number unavailable'. Its entirely possible for a carrier NOT to get a call without an ANI. With a little research, they may be able to tell you what carrier the call originated from, but thats about it.

  13. Re:No, Technology isn't magic. by avxo · · Score: 4, Informative

    Triangulating a mobile phone to within a couple of hundred meters (frequently less than that) does not require police on foot, with three antennas. The cellular system, in order to work and not for any sinister big-brother type reason, has to track the rough relative position of a subscriber within a cell, to account for signal delay propagation.

    Just to elaborate a bit about timeslots: The GSM standards require that the phone transmit only in a defined time frame: three time slots after the phone has received the data. This gives the tower a well-defined interval during which to receive the data transmitted and to ensure that transmissions by different phones are separated by at least one guard period.

    But as the distance between the tower and the cell increases, the cell phone must transmit earlier and earlier to account for the increase signal propagation delay. This process is called "adaptive frame alignment" and is determined by a parameter known as the "timing advance" parameter. The TA is dynamically updated and takes values between 0 and 63 inclusive. This parameter determines how early, in microseconds, the phone has to begin transmission, to ensure that the signal reaches the tower at the correct time, and roughly locates the phone within a specific radius around the tower.

    Combining this with the fact that more than one tower usually sees the phone and the information from those other towers, the GSM system can triangulate the signal to within a couple of hundred meters, easily.