Scammers Buying Phone Numbers for Verifications

Scammers have a history of buying local and 800 phone numbers, using free Google numbers, and pirating phone numbers to conduct fraudulent verifications and other scams. The following article discusses the applicable Federal Communications Commission (FCC) regulation, telephone verification, two different legal apps for spoofing telephone numbers, a process known as orange boxing, guidance on scams from the Better Business Bureau (BBB), and additional information on avoiding scams.

Federal Communications Commission (FCC) Consumer Guide

Spoofing is the deliberate falsification of information transmitted on caller ID displays. However, blocking a number is not spoofing. The federal regulation governing spoofing is the Truth in Caller ID Act of 2009, which prohibits the transmission of misleading caller ID information in instances that will:

• Defraud
• Cause harm
• Wrongly obtain anything of value

Illegal spoofing can result in penalties of up to $10,000 for each violation.

Under this regulation, telemarketers are required to transmit or display their telephone numbers or that of the entity on whose behalf they are making the call. Furthermore, if possible, the caller should display the name of the company for which it is selling products or services. They must also display the telephone number that people can call and request the cessation of calls.

FCC Citation for Scamming

In June 2017, the FCC issued a citation to a Miami individual and his associated companies for violating the Truth in Caller ID Act of 2009. The proposed fine is $120 million based on 80,000 calls, which the FCC can verify. The FCC alleges that the scammers made 96 million illegally spoofed calls. “Neighborhood Spoofing” was the technique used by the scammers whereby the caller ID displayed the area code and first three digits of the recipients’ telephone numbers. Consequently, the recipients think the calls come from a neighborhood caller.

Telephone Verification

Telephone verification is a process where a website calls a consumer on their phone to verify their identity. Other names for this process are Phone Verification, Automatic Call Back Service, and Verification Service. Here is how it works. When a person makes a request to a website, that site automatically initiates a call or a text to the person’s phone that contains a randomly generated PIN. Upon receiving the PIN, the person enters it on the website, verifying their identity. However, as shown in the next two sections, spammers can use this process to get information from unwary persons.

Account Verification Scam

If an account holder has a phone tied to their account in the event of a forgotten password, and the scammer knows the victim’s email address or credit account number and their phone number, the account verification scam works as follows.

1. The scammer initiates a password reset on the victim’s account and requests the sending of a verification number to the victim’s phone.
2. The scammer sends a text to the victim posing as the email or credit provider saying, “We have noticed unauthorized activity on your account. Please respond to this text with the verification number being sent to your phone.”
3. If the victim responds with the verification number that they subsequently receive, the scammer will have access to their account.

Double-Digit Google Phone Scam

People that have posted classified ads with their phone number should be wary of this scam. Scammers use it to maintain their anonymity with Google Voice numbers. Since Google requires a valid phone number to be associated with new Google Voice numbers, the scammer picks a victim from published ads and sends them a text. The text may say, “I am interested in your ad.” Text back when you’re ready to talk.” When the scammer receives the response, he or she calls Google Voice and specifies the victim’s number as the link to the new number. Google Voice responds with a double-digit verification code. The scammer then texts the victim saying, “I am on a Google Voice line. When you receive a call, enter the double-digit code to connect.” If this happens to you, do not hit the code.

SpoofCard

SpoofCard is a mobile phone app that changes the caller name and phone number that displays on outgoing calls. The SpoofCard website claims that it works on any cell phone. Your identity is anonymous using SpoofCard caller ID spoofing. Users can also get downloadable recordings of their spoofed calls. In addition, calls can go directly to voicemail making receivers think they missed your call. SpoofCard has a feature to change your voice to a man or woman, or it can add background noise to disguise your identity. SpoofCard also sends anonymous text messages. The following table shows rates for SpoofCard packages.

SpoofTel

SpoofTel is another company that provides spoofing services. Users of the service must first establish a SpoofTel account. Use the spoofing service either through the SpoofTel website, the SpoofTel app, or by calling 1-866-SPOOF-ID (1-866-776-6343). To place a call follow these steps.

1. Log into your account.
2. Enter your telephone number in the top field.
3. Enter the receiving telephone number.
4. Enter the desired display number on the receiver’s display.

The features provided with the SpoofTel account are as follows.

• Short Message Service (SMS) Spoofing and SMS history
• Spoof Fax and Fax History
• Voice Alteration – use higher pitch for female voice or lower pitch for male voice
• Answering Machine Feature – If an answering machine answers the call, SpoofTel can send an uploaded message automatically.
• Auto Redial Option
• Time Limit for Calls
• Call Back URL

SpoofTel offers two different apps, a desktop app, and an iPhone app. The iPhone app requires a jailbroken phone or compatible device. Jailbroken refers to the practice of removing restrictions that Apple places on a device’s operating system.

The cost for caller ID spoofing is $0.10 per minute. SMS costs $0.50 per message. Voice changing costs $0.25 per call. Recording a call costs $0.50 per call. The use of soundboards is free.

Orange Boxing

Orange boxing is a term for call ID hacking. An orange box emulates a caller ID signal to spoof the caller ID display. The following three methods accomplish this emulation.

• A tape recording of a real caller ID signal
• A software program to generate a caller ID signal
• A hardware device that generates the caller ID signal

Follow these steps to use the orange box. First, make the call and wait for an answer. Then, send the caller ID signal. The orange box can also send a caller name and falsified date and time. When using an orange box, the answering phone displays the actual caller ID before receiving the spoofing caller ID signal. This limits the usefulness of the orange box.

Better Business Bureau (BBB) Advice for Dealing with Scammers

1. Do not send money to persons you have never met face-to-face.
2. Beware of unsolicited emails, and do not open links or attachments in them.
3. Question everything that you see.
4. Purchase online using only secure transactions.
5. Be cautious of people that you meet online.
6. Refrain from sharing personal ID information such as banking and credit card information, your birthdate, and your social security number.
7. Avoid acting under pressure.
8. Make all payments using secure, traceable transactions.
9. Whenever possible, work with local businesses that have proper identification, licensing, and insurance.
10. Be cautious when sharing personal information on social media.

Related: How to Prevent Your Numbers from Being Flagged as Spam or Scam Likely