Slashdot Mirror
State Attorneys Urge FCC To Combat Neighborhood Spoofing (biglawbusiness.com)
Attorneys general from 35 states are urging the Federal Communications Commission to allow telephone companies to block illegally manipulated calls that appear to come from consumers' neighborhoods. From a report: The rule change could help reduce "spoofed" calls from numbers with the same area code as the consumer, or even calls from the consumer's own number. Combating junk marketing calls has been a top consumer protection priority for FCC Chairman Ajit Pai. The FCC last November adopted a set of robocall rules that allowed telephone companies to proactively block calls from invalid, unassigned or unused numbers. The agency then sought public comments on empowering telephone companies further. The attorneys general want to the FCC to create new rules specifically targeting neighborhood spoofing, they said in comments filed Oct. 9 with the agency.
Combating junk marketing calls has been a top consumer protection priority for FCC Chairman Ajit Pai.
Just start castrating anybody caught doing it. It'll soon die out.
(and no, it's not too harsh)
No sig today...
I feel loved.
I realize certain infrastructure bits need to be able to do this, but why not a regulation that requires outbound data be verified to be under the control of the "real" sending entity? A service (Skype, say) initiating an outbound call with a user-entered number must first validate control (voice call or SMS, etc) and record/audit such validation before putting injecting it into the POTS.
Make that a best-practice at the ITU, but enforce it by regulation for domestic.
That just leaves international calls as suspect (which has long been the case anyways) and international-but-still-in-NANPA calls as notable (ditto).
Hire a Linux system administrator, systems engineer,
These days, one of the most effective ways to avoid spam calls is to ignore numbers that look like they're from my own exchange.
The FCC last November adopted a set of robocall rules that allowed telephone companies to proactively block calls from invalid, unassigned or unused numbers.
Can't imagine why that hasn't worked? It's not like they have a giant list of valid numbers to use as spoofing sources.
Who believes Ajit Pai actually cares about or is working on this?
.:Semper Absurda:.
They may think of it as "neighborhood" spoofing, but prefixes of mobile phone, which most people are using now, aren't based on neighborhoods because of their mobility. So when your prefix is 123 (for example), and you constantly get calls from 121, 123, 124 (for example), you know the caller ID is bogus because nobody is going to call you who just happens to have the same mobile prefix as you. Not only are these scammers basing their tactic on outdated land-line logic, but even that is flawed because local prefixes are usually not sequential.
Anyway the point is, scammers are morons, phone companies are grossly negligent in not addressing the problem, and everyone of us has been forced to put up with this garbage to some extent for far too long.
At Googleâ(TM)s presentation yesterday they demonstrated a feature in the upcoming Pixel 3 phones where an AI bot will answer your call and ask who the callerâ(TM)s name and the purpose of the call. Itâ(TM)ll then transcribe that info in a notification, where you can then choose to take the call or send it off into voicemail/disconnect.
I stopped reading at "Combating junk marketing calls has been a top consumer protection priority for FCC Chairman Ajit Pai."
I get nearly one call a day from the same middle three digits as my own phone number, to the point where I do not ever answer those calls and block them every time. It is crazy the degree of manipulation that incoming calls can undergo in this modern age.
I'd almost say that enough of a change would be to simply make it so that if a number calls me, I am guaranteed to be able to call back and tie up the line they are using. So many incoming spam calls you can't even call back on.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Don't allow anyone to spoof numbers at all! Still allow blocking of caller id for anonymous whistleblowing, but NOBODY has a right to call people with MY phone number showing up as the called number! Let's try nuisance-calling thousands of people while spoofing US Senator's phone numbers and see what happens...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
I absolutely trust Ajit Pai to work hard to protect consumers.
#sarcasm
The PBX at my place of employment takes care of the business calls. Business associates who have my cell phone number are already in my address book so I can identify them when they call, and I answer those. I have a relatively small family, and all of their phone numbers are ALSO in my address book, making caller ID work well for them, too. Unless it's Publisher's Clearinghouse calling me to figure out where to drop off that big check, anybody else is an unwanted call. Whether that's bill collectors, telemarketers, or politicos, if they're not in my book, they can talk to my voicemail. Furthermore, the majority of my interaction with my family members is through text messaging anyway, since those are 'auto-delayed' if I'm busy. If I'm in a meeting, and you call, I won't answer the phone, and if you don't leave a voicemail (the new definition of ghost-knocking - extremely rude) I will NOT call you back. If you text me with 'hey, got a minute' chances are you'll get a response as soon as I'm free. Eventually the bastards will all switch to SMS messaging. I'm already getting those, but again, it's auto-delayed, and I can immediately block the originating number if it's bullshit, so it's a one shot for them. In any case, telemarketing is going the way of the fax machine. It's a relic of a much older age that has reached it's saturation point, and it's just a matter of time before the industry either evolves or dies.
Can someone explain how this spoofing works and why this is possible? This is a tech site, {i want the technology behind this not the politics.
This post was the most on-point. Basically Verizon is allowing this type of fraudulent traffic to pass through their network unfettered. They've been publicly called out on it, too. Here on Slashdot, even. They're the primary offender in America at least right now, but I'm sure plenty of smaller players have dirty hands too. This would all stop if they flipped a switch.
Perhaps there should be a "block neighborhood numbers not on your contacts list" feature.
iPhone has a way to block calls that aren't on your contact list. Go to Settings -> Do Not Disturb -> Allow Calls From and set it to 'All Contacts'. Then turn on 'Do Not Disturb' (the half-moon icon in the Control Center).
It is possible because a business wants to be able to call you, but not reveal the true number, because they don't want callbacks. It is technically possible because the underlying protocol is very simple and doesn't authenticate anything.
About half my calls on my FIOS landline have a caller ID that starts with "SPAM?" I don't think that the callers do this for my benefit, so it must be Verizon. This is a start, but a true caller verification system is what's needed.
Do it right or don't do it should satisfy both privacy and keeping the peace.
If the caller want's to provide his number is must be correct.
If the caller does not wish to provide his number, then no calling number should be displayed.
Provide an option to block all calls with no number provided.
If your bill is late and they decide to pester you about it, they spoof your local prefix in the same way, so it's not just 'junk marketing' calls (although Comcast/Xfinity is 'junk' if you ask my opinion). Hope the levy nice hefty fines against them for that.
At any rate if I don't normally answer calls from numbers I don't recognize anyway, doubly so if it's in the same prefix as me, since that makes zero sense. As with many things I don't know why anyone would fall for this. Let everything you don't recognize go to voicemail, if it's important they'll leave a message to call back, if it's bullshit or it's not important they won't.
On the flip side, legitimate call centers and technical support firms need to be able to provide the callee a consistent contact point. Can't personally advocate nuking it entirely, but they (telcos) really should be more careful with their crap.
There is no XUL, only WebExtensions...
The "second" telco involved has no way to verify the information from the first telco, so it can do nothing but pass it along. The first telco is the scammer.
Sometimes this transport crosses international borders. Some scammer in a foreign country buys service from his local telco, which then routes the call to the US telco. The US telco has even less ability to validate the information, and the foreign telco has no reason to follow US law.
That's not a highly technical description, but it's close enough.
Basically, anyone can spoof a number for their outbound calls. The local phone companies don't do any verification of the spoofed number... they just pass it on through the system and collect the money for the call.
They could set up a system which verifies numbers and also certifies legitimate spoof uses (such as a central PBX) but that would cut into their profits and would take time and effort.
On the receiving end, phone companies could flag and reject calls coming from outside their area without a valid return number. This, again, would cost them money so they aren't interested in doing it.
When I had ATT landline, I used to get robocalls with a local number caller ID but it would also say "Out of Area" which was a dead giveaway. I knew not to answer those calls.
I've since switched to Charter Spectrum phone service and set up NoMoRobo and the number of robocalls has dropped dramatically.
I don't read your sig. Why are you reading mine?
And to fix America's problem, switch from the stupid billing system you have where a mobile caller pays to receive calls. Make the caller pay, like the rest of the world.
Lots of people are doing away with landlines. I don't ever get spam calls on my cellphone, it costs the spammers money. I get the odd "microsoft call centre" call on my landline, but that's ok, they're fun to mess with.
Basically, anyone can spoof a number for their outbound calls.
Can you explain how I, a wireline end-user, can do that? There is no input method I know of that lets me send bogus caller ID data.
They could set up a system which verifies numbers and also certifies legitimate spoof uses (such as a central PBX)
Scammers can buy central PBX systems, too.
On the receiving end, phone companies could flag and reject calls coming from outside their area without a valid return number. This, again, would cost them money
Au contraire. They'd sell this service and make a huge profit, just like they already charge $10/month for caller ID name and number and don't give refunds when they don't actually provide all the data. (This is a direct analogy to touch tone dialing, which many telcos charged a monthly fee for long after they had installed the hardware so every line could do DTMF.)
We don't want an end to the calls we want an end to the number spoofing. Put the calls through so you can bill for them, but provide us with the actual CLID so we know who to be infuriated at.
Some time ago, they used the CLID that they were supposed to use. This allowed a "who's calling me" industry to spring up.
Then they changed their tactics to only spoof the last-4 digits (the north american number plan allows for 3-digit area code followed by 3-digit exchange, followed by 4-digit extension)
When we cottoned onto that they started adding 1 to the area-code and exchange, dunno why, because if you're in greater atlanta, 1/4 of us have 770-xxx-yyyy numbers and when they added 1 they made the calls look like they were from Mexico. I guess this is good for scamming central americans (mexico, honduras, guatamala, el slavador, panama) but not-so-much for the rest of us.
Lately, they's simply started spoofing well-known numbers, for example numbers registered to Wells Fargo, BofA, etc. This will fool a few more, but most of us are paranoid and will insist that we call the bank back on the number on the back of the card or top of the statement.
I'm not sure what an appropriate punishment should be? Staked out in a desert? Launched into space with no suit? Or thrown into the Ganges with concrete boots?
captcha: hurting very apt.
Most of the problem here arose out of number portability. In the days of yore, when the telco owned the given block of numbers (and customers couldn't port them away), they could simply reject inbound calls with their own numbers set as the originating phone number. Think the same thing as source route verification for network packets in Linux. With the advent of number portability, when you could port your phone number to Bill And Ted's Excellent VOIP Co., all that went out the window.
...si hoc legere nimium eruditionis habes...
Please don't stop them, I haven't lived in my phone's area code in 10+ years, any time I get a call from my area code and exchange, I know it's spam/scam caller. Makes it super easy to filter them out.
Spoof your phone number. Since you can't Googleit yourself:
https://www.techwalla.com/arti...
https://lifehacker.com/5853056...
The legitimate PBX owner would need to be certified by the local phone company. This takes time and effort. (They could charge for this service.)
They could charge for this service. Probably wouldn't go over well with customers.
I don't read your sig. Why are you reading mine?
You're so mad about something that you're rejecting logical arguments. So, "breaking how phones work properly" is a good answer to exactly what? Do you really believe that every handset requires a DID? Do you even know what a DID is?
You're a fucking idiot, but at least you're not a shill.
In the days of yore, when the telco owned the given block of numbers (and customers couldn't port them away), they could simply reject inbound calls with their own numbers set as the originating phone number.
Almost. It was quite possible for a company to have a local number for people to call but actually be operating out of another area code. In fact, a lot of companies did that instead of paying for an 800 number because it gave them a local presence while still saving the customer money. The phone company sold that service (I forget what they called it, something about a "remote number" I think). Other companies could sell that, providing a local number and using call forwarding to send it to the destination.
Calls from that distant company into the local area should bear the local number that local callers are likely to recognize instead of an unknown number from three states away.
It's just like today, when you call an 800 number that winds up at an Indian call center. When someone from that call center calls you back the number displayed should correspond to a US number known to the customer and not the local number for the call center.
Spoof your phone number. Since you can't Googleit yourself:
Neither link provides any way for ME to spoof my number. The closest you get is that I can pay for a service where someone else will spoof while forwarding my call through them. The claim was that anyone can spoof their number, and telling me how other people can do it for me isn't me doing it myself.
The legitimate PBX owner would need to be certified by the local phone company.
Define "legitimate PBX owner". I didn't steal the damn thing, I bought it for my own use and paid for it. Now I'm paying you, telco, for service. How is this illegitimate? Are you saying that I, a private citizen, should not be able to run my own PBX if I want to?
They could charge for this service. Probably wouldn't go over well with customers.
You're kidding, right? People already pay for caller ID service, why wouldn't they pay for "block illegitimate PBX owner's calls" service, too? It's a win-win for the telcos, just like the original Caller ID service was.
Don't know the number? Don't answer it, do a quick search on it, then block it. Ba bye, don't let the door hit you in the ass
Anonymous comments are as pathetic as the anonymous "sources" that contaminate gutless journalism from the New York Time
I received a phishing? call, where the guy claimed I had earned the right to a new much lower interest rate on my credit cards due to my good payment record.
He asked if I wanted it on my Visa or Mastercard. I said Visa. He then asked for my Visa card number. I blew up at him big time. I was at work and people in the surrounding cubes laughed at my excellent comeback. I then called the number back and got a woman with children at home who said it had been going on all day and could not get it fixed.
The guy called back and asked why I had hung up on him. This time the calling number was from Egypt, with 00-00 for the last digits. Yah, right. I swore at him and hung up. He called back and asked why I was so mean. You gotta be kidding.
I want to know how the phone company does not know what a call center is, what a robo-caller is, and why they cannot recognize and block all calls coming from those places.
So why can't the phone number know and block calls coming from a local number where the originating call is from "far" away from the local number region? Like from a different area code or continent? Really?
wake up and hold your nose
According to GP they would be fine with the 800 number under their control.
Why is it so complicated to only allow you to use your own number. Tell em which of your numbers should be the call back number if it needs to go to a switchboard or something. Whoever decided any old number will do should be hung on a telephone pole :/
I don't understand WHY it even works. Gonna be some kinda dumb to get your health insurance from the people making illegal calls, nothing will go wrong there , right?
BTW If I was interested I would have talked to you one on the other dozen calls....How about some famous AI in the spambots-if we hang up on you repeatedly it is probably a clue.
> The ONLY reason is so the person can't call you back directly
Mine sets the caller ID so that they CAN call back, or see who is calling. So precisely the opposite of what you thought the "ONLY" use is. And in order to make the caller OD be accurate, we have to set it ("spoof" it) to be a number we don't control.
It's a local non-profit organization, made up of several volunteers who can help people in certain situations. Other cities have similar organizations. People needing help can call us. Most of the calls are asking the same question, so a recording can answer that question, but a few people need to talk to a live immediately. People who need help call and get basically two options:
For location and directions, press 1
To talk to a live person, press 2
If they press 2 to talk to a live person, the system forwards the calls, dialing out to volunteers until it finds a volunteer who can answer. This is called call hunting, or a hunt group - finding someone who can take the call. It then routes the incoming call to the volunteer.
In order for the caller ID to be *accurate*, our system sets the caller ID on the outgoing calls to be - the number of the person who is calling. If Fred calls, the person receiving the call gets Fred's number on the caller ID, because Fred is calling.
The phone company has no way of knowing that Fred is on the other side of the call. They only know that our system is making / routing a call out.
Other people have posted other valid uses, largely around making the caller ID accurate or useful. The thing is, the phone company doesn't know who initiated the call, only which system is routing the call to them. They have no technical means to restrict it to be accurate about who initiated the call because they have no way of knowing who initiated the call.
If by chance you're familiar with network routing, it works the same way. Suppose your router tells your computer "I have an incoming connection for you from 123.45.67.89â. Can your computer know if the router is telling the truth? Nope, your computer only knows that your router at 192.168.1.1 is trying to pass the connection to you. It has no way of knowing where the connection originated, other than to trust all of the routers along the way.
I guess I'm missing something. I have a very simple rule that blocks 100% of telemarketing calls, political calls, non-profit calls, and even plain old wrong number calls: if I don't recognize the number or it hasn't been added to my contacts, I ignore the call. If it's a legitimate call, they'll leave a voice message and then I'll know to add the number to my contacts. Spoof away, I don't care. I need no legislation, no technology, no outside intervention to eliminate telemarketing calls. I just ignore them. If I have time, I'll even answer the call then immediately hang up. Let them think there's something wrong with the line.
Got a call at work today asking if we had a certain number. It happen to be our fax number but it was some member services with some credit card when they answered.
I just can't deal with it any more. Went to white listing. Any number not in contacts gets silently sent to voicemail. Most of them don't leave messages so that's manageable for now.
I use a voice mail service and route all calls to that. The one I use actually keeps a list of such callers and proactively blocks them - giving them a Not In Service message if they do actually get to voice mail. I black list any such numbers so I only ever get a call from them once plus I report them to the voice mail service to help others - akin to how spam filter reporting works. It's extremely rare at this point for me to answer a call from a number not already in my phone's address book. Plus the service has a few other features I find personally useful (your mileage may vary).
I noticed this too. Maybe the timing was just coincidental, and maybe it wasn't. I tend to believe the latter.
As much as I think Pai and Trump are weapons grade asshats, I don't think this particular problem can be laid at their feet. I think it's almost certainly just coincidental timing. Now what IS their fault is the fact they haven't done much about it but even then for things like this that is probably just a case of the wheels of government moving slowly.
Seriously, just fucking kill the technology already. nobody needs to pay a service provider .50c/minute for trashcan quality, and absolutely no security at all.
We have the technology to create an ALLOW list where only people on our allow list can call us. Not a real programming feat. BUT NO. Easy fixes are not to be trusted. People who spoof or telemarket need to die.
Politicians who exempt themselves need to die. It is MY phone andI lease the line. If people want to use my equipment or line for their business purposes, they can PAY me. Otherwise, they should die.
I almost never answer my phone unless it's VERY obvious who it is.
Let it ring, if it's important they can leave a voicemail. 99% of the time they don't, so I assume spam, and move on with my life.
There's more than just my cellphone to reach me with. If it's important enough they'll contact me.
I tend to rant.
I don't know much about CID and spoofing admittedly, but isn't there some way behind the scenes to digitally sign the CID data (public private keypair for example... the public key would be my phone company's key). ANyway, the idea I'm thinking of would be that caller ID w/o a signature could be sent to voicemail, caller id with a cypto signed signature would be trusted and I'd set my phone to ring. Just poking ideas.... but I see that spoofing has a valid purpose, but there's got to be a way to double check CID data.