Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can scam callers fake a mobile phone number?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 156 posts

Re: Ask HN: How can scam callers fake a mobile phone number?

#111

Post by b112 »

jamal-kumar wrote: post #40

Back in the day you used to be able to spoof caller ID using in-band signalling. it was like a few fun sounding handshake tones and some static-sounding data that you would play after the official one, and that was called orange boxing. That was the Bell 202 FSK signal and I remember hearing it on landlines up until a decade ago if the phone was picked up as soon as it started ringing. In Canada caller ID also includ…

Again only crazy people give me actual phone calls anymore

I was going to say "Wait!", but then realised all my calls were from recruiters and HR departments.

So I guess you're right.

Re: Ask HN: How can scam callers fake a mobile phone number?

#112

Post by ryandrake »

marckemil wrote: post #93
mef wrote: post #38

Earlier quoted context omitted.

on iOS, the "Silence Unknown Callers" feature has completely eliminated this for me.

Canadian physician here: yeah, this is hell for us trying to reach patients through the hospital system, which is "unknown" by default. Straight to voicemail and you can't really leave a message. Totally agree though, this problem is very time consuming, if only for the time it takes me to look at my phone and decide not to answer the call - a few seconds of my life each time. My worst day was a few days ago; 7 calls…

You're going to hate me then: I go a step farther than OP: Do Not Disturb mode 24 hours a day, 7 days a week. No notifications, no messages, no phone ring at all. I make sure my voicemail is never full. Leave a message and if it's important I will get back to you.

If I have a sick relative and explicitly expect an urgent call, I can easily and briefly turn off DND mode.

If the concept of a telephone never existed, and "Phone App" was invented today, it would be considered extremely intrusive and likely not (at least on iOS) pass App Store review. Think about it: Here's an app that allows any random person to cause your device to 1. interrupt whatever foreground app you have running with system-level UI (notification or full-screen takeover), and 2. ring and vibrate your device without your consent. If we weren't already familiar with telephones, we would never accept such an obnoxious app!

Re: Ask HN: How can scam callers fake a mobile phone number?

#113

Post by 310260 »

ravenstine wrote: post #65
hungryforcodes wrote: post #52

Just never answer the phone. If they really want to talk to you -- they'll find another way.

Or they'll leave a message. The real answer to the problem is to deprecate the legacy telephone system. It will never be as secure or user-configurable as just about any modern implementation of voice/video over IP.

>deprecate the legacy telephone system

The legacy telephone system is being deprecated. All three US mobile operators now have VoLTE (ENUM) interconnection with each other. STIR/SHAKEN call verification is happening between the mobile operators and large consumer VoIP operators like Comcast and Charter. VoIP is far cheaper to operate than POTS and most all operators are using it now and shuttering their legacy networks.

The issue has to do with regulations around the phone system. Rural call completion to small operators is a requirement - as it should be - but has loopholes that encourage abuse. This rural call completion regulation also comes with the ability for small operators to charge certain prices for call completion so they can afford to keep their high-cost rural customers serviced. The larger carriers pay these fees to connect their subscribers to those of the rural carrier.

However, some smaller operators have also been using these higher rates as a means of profiteering by allowing massive amounts of spam traffic through their networks towards the larger carriers.

Re: Ask HN: How can scam callers fake a mobile phone number?

#114

Post by deadcore »

drcongo wrote: post #98
deadcore wrote: post #28

The how - depending on the protocol. Signalling System No. 7 - ISDN User Part spec (found here: https://www.itu.int/rec/T-REC-Q.763-199912-I/en ) allows you to specify both a calling party number (3.10) and generic number (3.26) (the UK spec adds an additional presentation number so you have 3). This will typically require the help of an operator which is 'connected' to the network on the PSTN. A real business case c…

Does that addition in the UK spec add any extra protection? I've never had a spam call with a spoofed number in the UK as far as I'm aware, and definitely never seen that thing that happens in the states where a call comes in showing the name or company name of the caller, even if they're not in the receiver's address book.

The UK spec adds a few fields which I can not remember all off the top of my head. One addition is the 'presentation' calling line identifier, which is screened like the 'calling party number'. The generic calling line identifier is not screened, hence the addition

ref what the screening bits are: https://www.dialogic.com/webhelp/csp1010/8.4.1_ipn3/exsapi_q...

As for if the UK & spoofing, it's a very real thing with very real business cases and abuses.

Re: Ask HN: How can scam callers fake a mobile phone number?

#115

Post by seba_dos1 »

Do you know how e-mail lets you set anything you want in 'From' field and only relies on optional stuff like DMARC to, maybe, verify it?

It's almost exactly the same with phone calls, that 'From' field is just set at a provider level instead of user level - and there are many providers over the world, including some that allow the user to set this field however they like.

Re: Ask HN: How can scam callers fake a mobile phone number?

#116

Post by jdofaz »

Since you are on T-Mobile verify you have scam id and scam block enabled: https://www.t-mobile.com/support/plans-features/self-service...

> which was also inside their network

A phone number isn't like an IP address, the call isn't coming from that number and almost certainly didn't originate on the t-mobile network

The FCC recently reduced the amount of time some companies have to implement STIR/SHAKEN to June 30, 2022.

https://docs.fcc.gov/public/attachments/DA-21-1593A1.pdf

>The Commission recently shortened the extension for a subset of small voice service providers likely to be the source of illegal robocalls.

Re: Ask HN: How can scam callers fake a mobile phone number?

#118

Post by ale42 »

sschueller wrote: post #97
TACIXAT wrote: post #60

It is actually incredibly easy! If you are using a voip line, it is just a configurable field in the UI. You can do it with any voip phone app (e.g. [1]) and a voip provider (e.g. [2]). I have an old archived video showing it here [3]. It is not so interesting though, just me poking around in a voip provider's UI. To address the other question about phone providers verifying stuff. SHAKEN/STIR [4] protocols are suppo…

It's ridiculous that phone companies allow this. Anyone wanting to set caller ID via voip should be forced to provide some sort of verification that the number is theirs and the phone company should not route it if it fails verification. We only have 3 major cell carriers here is Switzerland, it should be trivial for the 3 to verify each other's numbers to see if those customers even exist. Unlike the US each cell pr…

It's not as easy... For example, it is possible and legal to use your own number to call from a VoIP provider, so the recipient can call you back on your actual phone.

On the other hand, it should be possible to detect at least a percentage of spoofed caller IDs and block them (e.g. non-existing numbers).

Re: Ask HN: How can scam callers fake a mobile phone number?

#119

Post by JoshGlazebrook »

smegsicle wrote: post #99

paris hilton knew how to do it back in 2006, checking lindsey lohan's voicemail by pretending to call her from her own phone https://www.infoworld.com/article/2658949/paris-hilton-accus...

It still seems crazy that even though carriers knew how easy it is to spoof numbers, even back then, they still decided to just skip any voicemail passcode authentication if you were calling your own number from your own number to get to your voicemail.

It's like letting someone in your house because they're holding up a paper cutout of someone else's face that you know in front of their actual face and that's good enough.

Re: Ask HN: How can scam callers fake a mobile phone number?

#120

Post by sgc »

ryandrake wrote: post #112
marckemil wrote: post #93

Earlier quoted context omitted.

Canadian physician here: yeah, this is hell for us trying to reach patients through the hospital system, which is "unknown" by default. Straight to voicemail and you can't really leave a message. Totally agree though, this problem is very time consuming, if only for the time it takes me to look at my phone and decide not to answer the call - a few seconds of my life each time. My worst day was a few days ago; 7 calls…

You're going to hate me then: I go a step farther than OP: Do Not Disturb mode 24 hours a day, 7 days a week. No notifications, no messages, no phone ring at all. I make sure my voicemail is never full. Leave a message and if it's important I will get back to you. If I have a sick relative and explicitly expect an urgent call, I can easily and briefly turn off DND mode. If the concept of a telephone never existed, an…

That is just the android facebook app in lite mode! I tried it for about 24 hours once after much social pressure. Now I just look at my wife's feed if she mentions something interesting.
Post reply on HN