Ask HN: How can scam callers fake a mobile phone number?

I'm with T-Mobile and I just received a phone call on my mobile phone from another number where everything except for the last 3 digits was exactly matching my own number. I found that suspicious, but I was curious enough to pick up the call. The other person greeted me with "We are very important this is Interpol!" in seriously broken English, so I suspected a spam call and hung up to try to call them back. That didn't work because the phone number they were calling me from does not actually exist. Like I immediately get the T-Mobile announcement informing me that this is an invalid number.

Now I am wondering:

- How can a spam caller call me with a source phone number that does not exist?

- Shouldn't my mobile phone network verify that the caller - which was also inside their network - is a valid subscriber? Otherwise, how can they bill someone for this call?

- How does this kind of scam call work technically?

STIR/SHAKEN is supposed to stop the spoofing. For an explanation, see https://en.wikipedia.org/wiki/STIR/SHAKEN

> - How can a spam caller call me with a source phone number that does not exist?

The same way they make a call with any source number. The two source numbers in a call (ANI and CallerID which don't need to be the same) have historically been not required and not validated. See stir/shaken for a modern effort to change this. Coming soon to a carrier near you; maybe.

Being able to set the source number enables many useful things as well as some spam/harassment/fraud uses. It requires a lot or coordination to allow the former and restrict the latter.

TLDR: don't trust caller id. Don't call people back unless you know the number/it's an expected call.

> - Shouldn't my mobile phone network verify that the caller - which was also inside their network - is a valid subscriber? Otherwise, how can they bill someone for this call?

Call billing records don't use caller id in the way you're thinking. If you pay for incoming calls, they're charged regardless of the source number, but it's recorded for informational purposes.

For outgoing calls, the call record is made closer to the source and is tied to the line that made the call, not the source number.

For intercarrier calls (which almost certainly the case here), the source carrier bills its customer and the interconnecting carriers count minutes on calls and settle up for net difference in flows (calling carrier pays, but interchange fees are going to zero among US carriers)

> - How does this kind of scam call work technically?

Get a phone account where you can set the caller id and calls are cheap; call a lot of people; successfully scam one or two; take the money and run.

Some voip accounts let you set caller id. Traditional primary rate interfaces (T1) usually do too.

Caller id is just a user settable field. There are two numbers, ANI which is how telcos are supposed to keep track of who to charge. NO one uses it, because users don't like it. And caller id is sent out on the second ring, but again, user can set that to anything. Corps have to adhere to the TCPA, others don't and SIP calls are cheap and globally routable. https://www.fcc.gov/sites/default/files/tcpa-rules.pdf

> The Federal Communications Commission requires use of the protocols by June 30, 2021

Spoofing still exists, though. Is the issue now that our phones are backwards-compatible with the insecure system?