Slashdot Mirror
T-Mobile Begins Verifying Calls To Protect Against Spam (theverge.com)
T-Mobile is beginning to roll out support for call verification technology, which will confirm that a phone call is actually coming from the number listed on caller ID. From a report: Now, if one T-Mobile subscriber calls another T-Mobile subscriber, the person receiving the call will see a message saying "Caller Verified" if they have a supported phone. Unfortunately, there's only one supported phone -- Samsung Galaxy Note 9 -- for the time being. Call verification won't put a stop to spammy phone calls, but it will start to help people identify which calls are actually coming from real people. As anyone with a phone knows, spammers have relentlessly spoofed local phone numbers in recent years, making it appear that you're getting an incoming call from someone you may know. Call verification is meant to combat that.
so it will block spammers spoofing T-Mobile's numbers to call other T-Mobile's customers. But won't block all other spoofers. As much as I'd like this to be a good start, I can't see how it can be useful.
Seems like a feature that is all about unauthorized spam and not spam in general.
Our caller ID box for a FIOS landline has been marking some calls as SPAM? for about six months. I wish this were true for all spam and spoofed calls. The latest, just two hours ago, was a medical scam with Caller ID "SPAM HEALTH CO."
I think excessive spam is existential crisis for voice calling. I no longer answer any calls from unknown numbers as chances of spam are near-certain. This has been going on for couple years, to the point that I permanently silenced voice call notifications on my phone - no vibrations, no ringing. Consequently, now it is much harder for legitimate callers to get through.
AT&T and Verizon have provided services like this for over 2 years (Sprint may also). AT&T Call Protect is an app you can download to do so and it's free.
I would prefer to just whitelist my contacts at this point. If I don't know you, I don't want to take a phone call from a seemingly random number. With all of the problems around strangers and kids, I can't believe that the industry is so pigheaded on making this a standard feature.
I use T-Mobile and recently they have been marking some incoming calls as "Scam Likely"
It's disgusting that in this day and age we have to put up with spam calls that appear to be coming from the SAME bloody phone number as our phones!
I guess the telcos are more interested in money then respecting customer's time.
What can customers do to change the situation since the FCC appears to be doing fuck all about it ?
Coming from a country where the caller pays and it's free to receive calls on mobiles, spam calls to mobiles are non existent. I get the odd tech support scam to my landline.
They need to just block anything that they can determine is spam. To start with, if the number is registered with the same carrier, it should be trivial to verify that the call is genuine, and drop it otherwise. Then they add something where they pass this verification on when sending calls outside the network, so if the call is from a number registered to Verizon, but Verizon hasn't verified it, it gets dropped, regardless of the carrier.
The lack of any system like this indicates that the phone companies don't want to solve the problem. I believe they make some small amount of money on putting calls through, and they don't want the volume of calls to drop.
Update the phone software system to get with the 21st century. A simple change, where the caller's provider takes a signed and registered cryptologic hash of the callers information and the receivers information and presents that during the call initiation, The receivers provider checks the certificate and verifies that the same provided information hashes to the exact same value, and that the certificate used matches the registered callers provider certificate, which is signed by a central governing authority in that country. At that point, the provider is verifying and attesting to the fact that the caller is who they say they are, and the provider is on the hook if the call was somehow spoofed within their own network.
Then add the feature where you push an extra button to encrypt the session
Which is why this is meaningless.
Corporatism != Free Market
This only works for calls between two phones on the T-Mobile network. Spammers don't use T-Mobile.
Really? Why bother, TMo?
Fix the broken system so that caller spoofing is impossible. It won't stop the robodiallers, spammers, etc., but it'll make it a lot easier to create definitive block lists.
I really could use something similar on my landline. The technical prerequisites for detecting and preventing caller ID spoofing are there, but where I live (Germany) CLIRO is sadly only available for special called parties like police and emergency services. CLIRO stands for Calling Line Identification Restriction Override and means that the real caller ID is always transferred.
But perhaps something like CLIRO Light could be introduced, where spoofed calls are automatically rejected at the telephone exchange, without or without notifying the called party. I would happily activate something like that. It would kill 90% of all spam calls because the spammers would run a much larger risk of being identified and fined.
C - the footgun of programming languages
About fucking time.
so they're preventing spam to the phone numbers that they sold to third parties in the first place.
F them, I'll stick with my current provider.
[Everyone see the problem with this paragraph? It comes up often in conversations where the verb "authorize" is used. Authorized by who? For adjudicating spam, the receiver's authorization is what matters.]
In your first example, the T-Mobile authorized the business to send the messages, but their authorization doesn't play a role in whether it's spam or not. The receiver didn't authorize, so therefore it's spam.
In your second example, the user signed up for messages (he authorized the vendor to send text), so it's not spam.
"Authorized spam" doesn't really make much sense. It's either an attempt to form an oxymoron (if "authorized" refers to the receiver) or it's deceitful (if "authorized" refers to an irrelevant party).
Is it just the United States that suffers from a non-functioning phone system?
Seriously, the US phone system is so over run with SPAM phone calls that land lines are useless and the problem is now destroying the cell system.
Do people in other countries suffer from the problem?
Is it just the United States that suffers from a non-functioning phone system?
Seriously, the US phone system is so over run with SPAM phone calls that land lines are useless and the problem is now destroying the cell system.
Do people in other countries suffer from the problem?
Anecdotally, I get very few spam / scam calls. I do get solicitations but those are from organizations where I regularly donate and thus do not mind them. Most of the spam I get is political calls during election season; and the occasional tech support / credit card rate scams.I work is slow I'll often play with the scammers for a while out of boredom. There's nothing like getting one to start screaming at you and laughing back at them.
I'm a consultant - I convert gibberish into cash-flow.
In Europe, Calling Party Pays, is the rule, so spammers don't like to make spam calls to cell phones because it costs them money over POTS calls.
The phone system in the US suffers from being "first" and needing to provide backwards compatibility. We also have "called party pays" for cell phones, which means the spammers are free to call any phone number without any added cost.
So I'm not so quick to disparage the US's system, but obviously there are technologic solutions we need to apply here. I'm for requiring the verification and registration of all spoofed numbers, if it's not in the list and doesn't belong to you and you attempt to spoof a number, it gets routed to the great bit bucket and you get the "I'm sorry, your call cannot be completed as dialed..." intercept.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Now that almost nobody accepts calls and relies on texts and messaging, it's a bit late for that.
Maybe it's just me, but if I see a call come from a number I don't know, I don't answer the phone.
Does this mean people have become Pavlovian to answering their phone regardless of anything else? Wouldn't it be easier to simply not answer the phone every time it rings? Or is that too simplistic?
Depends. I used to run operations in an east european subsidiary of Deutche Telecom. Local regulations required us that we overwrite any callerid sent to us by our customers that did not match the number plan that we have assigned to that customer. One day a marketing agency customer called us in panic, as apparently they were visited by some ... well built men ... upset about being constantly cold called about buying ads.
We also dropped any incoming call originating from outside our network claiming to be from a number within our numbering plan, the same as we did on the IP side. No source that claimed to be our own IPs coming form the upstream connections was allowed.
It's alarming that anybody can go to one of the many number-spoofing web sites, or download a number-spoofing app to their phone, and impersonate anyone.
No tech skills required
Most people take what displays on a Caller-ID as gospel, even if they heard of number spoofing. People can lose relationships, or even get beat up and killed over this (and I am sure there are many cases where this happened).
It was very criminal for companies to NOT have designed in verification when Caller ID was drawn up, built, and then introduced to the public decades ago.
How come it took until 2019 for any real security measures to be implimented?
I am worried that in the hurry to curb inappropriate number spoofing, we'll lose the ability to legitimately use such a service. They should have a system to check if the user is AUTHORIZED to use a number.
For example, as a physician I use a dialing service to be able to place calls from my cell phone to my patients, which identify as coming from my office.
It's for the same reason that TCP/IP networks and most of the associated protocols (SMTP, telnet, etc.) originally did not have any security designed in. During the design phase, the assumption was made that only trusted entities were going to be connecting to the network. Turned out in both cases that that was a bad assumption, unfortunately.
I wish AT&T would do this, as I get shitloads of calls on my AT&T service.
I've resorted to wildcard blocking certain partial numbers to help stifle it, but this is really something they could do on their end.
Just cruising through this digital world at 33 1/3 rpm...