Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can scam callers fake a mobile phone number?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 156 posts

Re: Ask HN: How can scam callers fake a mobile phone number?

#131

Post by FigmentEngine »

fxtentacle wrote: post #85
deadcore wrote: post #28

The how - depending on the protocol. Signalling System No. 7 - ISDN User Part spec (found here: https://www.itu.int/rec/T-REC-Q.763-199912-I/en ) allows you to specify both a calling party number (3.10) and generic number (3.26) (the UK spec adds an additional presentation number so you have 3). This will typically require the help of an operator which is 'connected' to the network on the PSTN. A real business case c…

Thank you for this rabbit hole. Today I learned a lot about modulation, frequencies, and how DSL works :) In the end, the most surprising snippet of knowledge for me was that Erlang (that Amazon S3 is built in) was invented by Ericsson for live patching ISDN phone routing systems without dropping any ongoing call.

I do not believe S3 is written in Erlang... do you have a source for this?

Re: Ask HN: How can scam callers fake a mobile phone number?

#132

Post by MichaelBurge »

ale42 wrote: post #118
sschueller wrote: post #97

Earlier quoted context omitted.

It's ridiculous that phone companies allow this. Anyone wanting to set caller ID via voip should be forced to provide some sort of verification that the number is theirs and the phone company should not route it if it fails verification. We only have 3 major cell carriers here is Switzerland, it should be trivial for the 3 to verify each other's numbers to see if those customers even exist. Unlike the US each cell pr…

It's not as easy... For example, it is possible and legal to use your own number to call from a VoIP provider, so the recipient can call you back on your actual phone. On the other hand, it should be possible to detect at least a percentage of spoofed caller IDs and block them (e.g. non-existing numbers).

The VoIP provider could forward the call to your phone as a middleman, or there could be 3 numbers(1. Who to bill 2. Calling number 3. Reply-to number) and only #3 is user-configurable.

Re: Ask HN: How can scam callers fake a mobile phone number?

#133

Post by garciasn »

FigmentEngine wrote: post #131
fxtentacle wrote: post #85

Earlier quoted context omitted.

Thank you for this rabbit hole. Today I learned a lot about modulation, frequencies, and how DSL works :) In the end, the most surprising snippet of knowledge for me was that Erlang (that Amazon S3 is built in) was invented by Ericsson for live patching ISDN phone routing systems without dropping any ongoing call.

I do not believe S3 is written in Erlang... do you have a source for this?

SimpleDB is; maybe they confused them.

Re: Ask HN: How can scam callers fake a mobile phone number?

#134

Post by drcongo »

deadcore wrote: post #114
drcongo wrote: post #98

Earlier quoted context omitted.

Does that addition in the UK spec add any extra protection? I've never had a spam call with a spoofed number in the UK as far as I'm aware, and definitely never seen that thing that happens in the states where a call comes in showing the name or company name of the caller, even if they're not in the receiver's address book.

The UK spec adds a few fields which I can not remember all off the top of my head. One addition is the 'presentation' calling line identifier, which is screened like the 'calling party number'. The generic calling line identifier is not screened, hence the addition ref what the screening bits are: https://www.dialogic.com/webhelp/csp1010/8.4.1_ipn3/exsapi_q... As for if the UK & spoofing, it's a very real thing with…

Thank you.

Re: Ask HN: How can scam callers fake a mobile phone number?

#135

Post by andrewshadura »

mullen wrote: post #94
jmholla wrote: post #58

Earlier quoted context omitted.

How does one do that? Do I need another app? I don't see a setting for this in my Android settings.

In the Phone App, under Settings -> "Spam and Call Screen", there are bunch of Spam and Call Screening options.

There's also an app called YACB which offers advanced filtering.

Re: Ask HN: How can scam callers fake a mobile phone number?

#136

Post by xp84 »

jaywalk wrote: post #8

> Shouldn't my mobile phone network verify that the caller - which was also inside their network - is a valid subscriber? Since the advent of number portability, the area code and prefix no longer signify anything about what carrier a particular number belongs to. You could very easily take your T-Mobile number to Verizon, for example.

The number itself is no longer permanently their network, sure - however, they have instant access to look up* any number and find who presently owns it - which they must use to be able to route calls successfully. It's completely true that say, T-Mobile could today refuse to connect a call when the caller pretends to be calling from a T-Mobile owned number and yet is calling from outside their network.

Sure, it would only kill a subset of the spam if they could only do this when they currently control the spoofed number themselves, however it would still do something!

* Source: https://teraquant.com/local-number-portability-and-how-to-tr...

Re: Ask HN: How can scam callers fake a mobile phone number?

#137

Post by moron4hire »

heffer wrote: post #49
moron4hire wrote: post #20

I think a much better question is, why can scammers spoof a phone number? We hear lots of excuses from the carriers about how this is out of their control, this is how the system works, etc. Why don't they feel like they have a fire lit under their asses to fix the issue? My immediate guess is that they must make money off of scam calls somehow. A scam call is still a call.

The same principle is applied when you use call forwarding on most SIP providers. They "spoof" the real caller's Caller ID when forwarding the call, so that the forwarded call reaches your phone with the number of the actual caller, not some random number assigned to your account or the provider. If they didn't do this you wouldn't be able to call the original caller back directly from your call log. This would be a…

Yeah, no, not buying it. I mean, not buying that's the only way it could be done.

Re: Ask HN: How can scam callers fake a mobile phone number?

#138

Post by xp84 »

thesis wrote: post #82
lowlevel wrote: post #35

Earlier quoted context omitted.

This is what I do, and feel is the only solution now. Phone always on DND/only allow contacts to ring. A whitelist approach if you will.

This is great and all until there’s an emergency and someone is trying to reach you.

Yeah, it's less than ideal, but this is the future that the lazy carriers have brought us to. Hopefully, someone trying to reach me in an emergency would have the brains to send a text.

Re: Ask HN: How can scam callers fake a mobile phone number?

#139

Post by cookiengineer »

The easiest way is to have a SIP gateway that uses a too long number to display. Usually it's around 12-13 digits for the subscriber number depending on the country code, so all digits before that (after in SIP) will be cut out on most phones.

I think the relevant spec for that is E.164 which enforces 15 digits overall (1-3 for country code and 12 for subscriber number).

There are also lots of SIP gateways that have an ISP license or a phone provider license. They're the same types that allow to fake the numbers for their customers, and usually you can transfer some still in use mobile numbers to them as well. Because apparently law enforcement doesnt do anything against them.

And yes, never use 2FA via SMS. Never.

Re: Ask HN: How can scam callers fake a mobile phone number?

#140

Post by Spivak »

cookiengineer wrote: post #139

The easiest way is to have a SIP gateway that uses a too long number to display. Usually it's around 12-13 digits for the subscriber number depending on the country code, so all digits before that (after in SIP) will be cut out on most phones. I think the relevant spec for that is E.164 which enforces 15 digits overall (1-3 for country code and 12 for subscriber number). There are also lots of SIP gateways that have…

Saying no to 2FA SMS is a little harsh. It’s strictly better than 1FA password. What you probably mean is don’t use SMS for account recovery.
Post reply on HN