Slashdot Mirror
Ask Slashdot: Dealing With VoIP Fraud/Phishing Scams?
An anonymous reader writes I run the IT department for a medium-sized online retailer, and we own a set of marketing toll-free numbers that route to our VoIP system for sales. Yesterday we began receiving dozens and now hundreds of calls from non-customers claiming that we're calling out from our system and offering them $1 million in prizes and asking for their checking account details (a classic phishing scheme). After verifying that our own system wasn't compromised, we realized that someone was spoofing the Caller ID of our company on a local phone number, and then they were forwarding call-backs to their number to one of our 1-800 numbers. We contacted the registered provider of the scammer's phone number, Level3, but they haven't been able to resolve the issue yet and have left the number active (apparently one of their sub-carriers owns it). At this point, the malicious party is auto-dialing half of the phone book in the DC metro area and it's causing harm to our business reputation. Disabling our inbound 800 number isn't really possible due to the legitimate marketing traffic. Do you have any suggestions?
I work for a law firm and this will not work.
Threats are a dime-a-dozen and no one takes them seriously.
What works is to get an actual lawyer to compose an email that actually originates from the law firm and/or send snail mail, on law firm letterhead, explaining why the scammer is suspect and asking for clarification.
It little behooves the best of us to comment on the rest of us.
In the past I have had to deal with L3 on some similar nonsensical "our abusive users are not our problem" crap. As you have already observed, they have a well refined hearing problem. First, decide how much the per call impact is to your business in your opinion. Estimate the number of calls per day and multiply by the per call rate and then by the number of days to come up with a daily and sum "rate of damages". Then have a lawyer letter drafted and sent to their legal department and make sure the letter shows that you also sent a copy of the draft to the FCC Attn: Fraud & Abuse at 445 12th Street SW, Washington, DC 20554.
In about the time it takes you to go to lunch, the problem will subside. At L3, FCC copied abuse resolution rolls down hill, pretty fast.
Yes, because making new marketing materials, distributing updated business cards and getting everyone involved to stop using the old number and separate the old number from the company is *such* an easy task and can happen overnight!
The phone number of a presumably reputable business that parties would likely recognize for their Caller ID number is a social engineering trick to get around one of the roadblocks and make people subconsciously overcome one of their answers to why this is a scam. Any act at this point is damaging the brand of the business, whether they capitulate and change their number, or whether the scamming entity continues to portray themselves as the company in question.
Let's change this a little bit and put a name to these calls... What if instead of "unnamed company", it was "Google" that had someone using their corporate phone number to do these calls? What about "Amazon", or "Microsoft", or "Apple", or "Cisco", or the "FBI"? Would your opinion about "just change your phone number" be the same?
Thirty four characters live here.
The problem is that there's a lot of legitimate reasons to "forge" the caller ID information. Many companies use a group of lines for outbound calls, any outbound call simply grabs the next available outbound line and uses it for the call. You don't want people calling in to those numbers though, there's no way for anyone to pick up a call on them since they don't go to an actual phone, so you set the caller ID to the correct inbound number for people to call (eg. the company's main number, or the main sales number (that gets distributed to the next available sales agent) or whatever number matches the type of outbound call) so callbacks go to the right place. And no the obvious solution won't work since the correct inbound number may not be with the same provider as the outbound line so you can't check whether the caller ID number's owned by the same entity that owns the line in use.