Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can scam callers fake a mobile phone number?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 156 posts

Re: Ask HN: How can scam callers fake a mobile phone number?

#41

Post by pwg »

phkahler wrote: post #19
pwg wrote: post #6

Because the design of the original caller-id system allows the initiator of the call to attach any set of numbers they like as the caller-id value that is shown on your phone.

Which is hilarious because the phone company used to charge extra to bring you this information as if they were telling you who was calling. That's a service I'd almost be willing to pay for today if it actually worked.

Which is also why it is simply an "initiator settable field". When "the phone company" brought out the service (for a monthly fee) there was only one "phone company" and so they could be assured that they themselves were setting the value to the correct source.

Now that the phone network looks more like the internet (many different companies all exchanging "calls" with each other) that decision, way back then, has the unintended side effect of allowing the robocall spammers to set whatever set of ten digits they like on their outgoing calls.

Re: Ask HN: How can scam callers fake a mobile phone number?

#42

Post by glenneroo »

localhost wrote: post #24
smeej wrote: post #16

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example.…

I remember many years ago getting a random phone call from someone who claimed they were a detective investigating a case. The detective sensed my skepticism right away over the phone and suggested that I look up the phone number for his police department, and to ask for badge number ZZZ when I call. I called back, everything was above board, they came and interviewed me (they wanted to see if I still had something i…

You can't drop a story like that on us and not tell us what "the item" was ;)

Re: Ask HN: How can scam callers fake a mobile phone number?

#43

Post by heffer »

ghostpepper wrote: post #30

I live in Canada, and I and most people I know receive spam calls from spoofed numbers on a semi-regular basis. Sometimes the number only a few digits off from my number, but other times it has a name like TOLL FREE SERV. A common lure is claiming they are Service Canada or Canada Revenue Agency (or the nonexistent Revenue Canada), and the call will open with nonsensical threats like “A warrant has been placed in you…

If you are on Telus or any of their other brands you should be able to configure "Call Control". This feature prompts an unknown caller to type a given digit before the call is actually connected. Filters out 100% of all spam and other automatically dialed calls. Very very rarely I had people miss the prompt and as a result not being able to reach me. We're talking like 2 calls in 3 years. They reached me via email and all was good in the end.

Re: Ask HN: How can scam callers fake a mobile phone number?

#44

Post by pxx »

skyde wrote: post #15
jaywalk wrote: post #13

Earlier quoted context omitted.

The problem is that carriers (especially smaller ones) have been dragging their feet on implementing it, and nobody can use it to actually block calls until essentially everybody supports it and is interoperating. Until then, phones will just show calls between STIR/SHAKEN carriers as having verified caller ID.

would it be possible to tell my carrier to simply block all call that are not (STIR/SHAKEN)? If all my friend are on carrier that support it, I am not interested in receiving call from people that are not on a carrier that support it.

You can do this in software on your phone (assuming Android).

Re: Ask HN: How can scam callers fake a mobile phone number?

#45

Post by noneeeed »

smeej wrote: post #16

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example.…

Also, if you were rung on a landline, ring back on your mobile.

I'm not sure if it's always the case, but I believe that a call to a landline only terminates when the caller hangs up. This certainly used to be the case.

This allows scammers to ask you to hang up and call them back on the number on your card (for example), but they just mimic the dial-tone and ring, then they have another scammer answer the phone.

This is not an issue on a mobile.

Re: Ask HN: How can scam callers fake a mobile phone number?

#46

Post by cryptonector »

Signalling system 7 has no authentication.

That's the bottom line.

Adding authentication is pretty obviously not trivial, not just because of protocol upgrade issues, but also because end-to-end authen. won't be easy to add at all, and hop-by-hop authen. w/ something like "egress filtering" won't work in the age of phone number portability.

What might work is a TCP-like return routability test. I.e., have the network ask the ostensible device "did you mean to make this call?", though that might have other issues (think of how SYN spoofing can be used for DDoS attacks).

I.e., preventing caller ID scams is really hard.

Re: Ask HN: How can scam callers fake a mobile phone number?

#47

Post by soco »

jontas wrote: post #34
smeej wrote: post #16

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example.…

It can even be a problem if you do initiate the call. My mom got taken in by a scam where she googled "American Express phone number" and a scammer's website or paid ad (she isn't sure which it was) was showing at the top of the results with the wrong number.

Yet another example of the often discussed "Google search results infestation"...

Re: Ask HN: How can scam callers fake a mobile phone number?

#48

Post by ceejayoz »

grendelt wrote: post #37
smeej wrote: post #16

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example.…

This. A while ago, my wife got a call from a collections agency on my phone. They asked for her name, I asked "which one?" She said "I can only talk to ____." I said, "I understand but which one would are you looking for the older or younger?" "I can't share that information." "Then I can't put you in touch with who you're looking for if you can't tell me who you're looking for." "I can only speak with ____." I said…

> No, that's the public portion of a social security number.

It really isn't.

Re: Ask HN: How can scam callers fake a mobile phone number?

#49

Post by heffer »

moron4hire wrote: post #20

I think a much better question is, why can scammers spoof a phone number? We hear lots of excuses from the carriers about how this is out of their control, this is how the system works, etc. Why don't they feel like they have a fire lit under their asses to fix the issue? My immediate guess is that they must make money off of scam calls somehow. A scam call is still a call.

The same principle is applied when you use call forwarding on most SIP providers. They "spoof" the real caller's Caller ID when forwarding the call, so that the forwarded call reaches your phone with the number of the actual caller, not some random number assigned to your account or the provider. If they didn't do this you wouldn't be able to call the original caller back directly from your call log.

This would be a legitimate use case for Caller ID spoofing.

Re: Ask HN: How can scam callers fake a mobile phone number?

#50

Post by BeefWellington »

smeej wrote: post #16

Hoping this is something that doesn't need to be said here, but just in case: This is why you should NEVER provide personal information over the phone if you didn't initiate the call. It doesn't matter if your caller ID says it's your doctor's office or your bank or whatever. Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example.…

> Hang up and call them back at the number you normally use to reach them, from their website or the back of your credit/debit card for example. Make sure you're talking to the people you think you are.

This is not foolproof either. In some older landlines even hanging up doesn't necessarily disconnect you.

This means an attack works like:

1. Attacker dials their victim, alleging to be "Interpol", "VISA Card Services" or some other similar thing.

2. Victim takes this advice, "hangs up" and picks up and dials back.

3. After victim hangs up, attacker plays dialtone noise down the line, which they have not disconnected.

4. Victim picks up and "dials" the actual thing they want to be sure of, but is really just listening to a fake call the attackers play to them.

5. Attacker answers "Thanks for calling X".

This isn't to my knowledge true of mobile calls but it's important to know it's not foolproof either.

There's some discussion of that here: https://security.stackexchange.com/questions/100268/does-han...

Post reply on HN