My own phone number is now spam texting me

https://www.theverge.com/2022/3/28/22999719/spam-texts-own-phone-number-verizon-att-tmobile

by Syntaf • 4 years ago

350 250 4 years ago

Much like 3G is being shut down, maybe SMS should be shut down too. It’d be easier for carriers to make sure the last email address holdouts make accounts than trying to play wackamole with such an insecure protocol. Then we don’t have to worry as much about SMS unfortunately being used so heavily for web auth

rhinoceraptor2• 4 years ago

There's no viable replacement, much like there's no viable replacement to email.

There are plenty of other ways to accomplish what SMS and email do, but you will always need SMS and email. And the world is not creating standards like SMS and email anymore, at least with any widespread adoption success.

jedberg4• 4 years ago

I'm not sure about that. I almost never use SMS anymore. When I'm messaging with someone on an iPhone, I use iMessage with my email address as the identifier. When I'm talking to someone on Android I use Google Messages (again no SMS). The only time I actually use SMS is when I'm getting a text for a service like my car is ready for pickup or my table at the restaurant is ready, but those could easily be switched to IP based notifications, especially since they are already coming from a computer.

dotancohen• 4 years ago

I personally use SMS because I refuse to accept Whatsapps terms of service. I'll take an exploited open protocol over spyware.

JetAlone• 4 years ago

I have had plenty of people ask me for Whatsapp contact info. It's frustrating to tell them I don't have it. At one point it was a real estate agent who insisted on it, and refused to use email, or any of the other popular apps I use. I found it difficult to believe that he'd rather lose my business than use another system for me, but, there you go.

nikanj• 4 years ago

The article says the operators are losing the war on scammers, but are they really fighting it? SHAKEN/STIR has been delayed time and again, and all signs point to operators seeing it as an additional revenue stream (”Pay $5.99 per month for Real CallerID”), not a tool to curb spam

radicality• 4 years ago

Huh, only read the headline and the first few sentences so far, but just got a text exactly like this few hours ago! Going back to reading the article, hopefully it’s not some zero-day.

asteroidp• 4 years ago

Worse. It's the system working as built and intended

newman8r• 4 years ago

For a long time, you could get into any voicemail account by spoof calling that phone number to itself - most of the time they weren't password protected.

hedora4• 4 years ago

There is / was a similar gmail security vulnerability, where emails "from" you went into your sent box.

This was supposedly used to forge harassing emails from work accounts, which provided proof of false accusations.

vinnymac• 4 years ago

I received this exact text message today. I’ve since deleted it.

Additionally hours later I received a text about smoking weed.

Both links in these text messages, after further investigation, brought me to Russian owned sites as the article described.

MiddleEndian3• 4 years ago

Your phone company knows the originator info of your calls and texts (or at least enough hops until they reach some even more untrustworthy than normal phone provider). They simply don't give you that info and instead show you an unverified caller ID that anyone can basically set to anything by whoever is contacting you.

Blame your phone company and the FCC for not solving this (and for not providing you with the data to solve it yourself).

sb057• 4 years ago

FWIW the FCC nominally levies a fine of up to $10,000 per caller ID spoofing incident:

https://www.fcc.gov/spoofing

encryptluks2• 4 years ago

Except, when it comes to prosecuting people they usually make a deal where they pay a $50k fee or whatever, or they just don't have jurisdiction over the spammers and they'd rather sanction Russia than sanction India or other countries that are originating a lot of the SMS and robocall spam.

spencerf• 4 years ago

This is only valid if it’s a US company and many of these are originating outside of the US. Many shady companies outside of the us simply ignore the fines.

MiddleEndian3• 4 years ago

FWIW the FCC nominally levies a fine of up to $10,000 per caller ID spoofing incident:

But they could just prevent it entirely by giving us the originator info. The process is basically like this:

Alice calls Bob.

Phone system says "Alice, who do you want to tell Bob you are?"

Alice says "Bob!"

Phone system says "OK!" and bills Alice because they know who Alice is.

Bob gets a call from Alice but displays as Bob because Alice requested to display as Bob.

Bob goes "Wtf?"

Bob reports it to the FCC but he can only report getting a call/text from his own number.

FCC goes "Ooh those naughty caller ID spoofers we'll get them good next time! Too bad there's no way to prevent this..."

kurthr• 4 years ago

It’s interesting to me that the carriers are intentionally devaluing the one protected monopoly they have. Nobody wants to receive phone calls or even SMS any more, because the spam/spoofing is so bad. One has to assume that they plan to simply monetize it until it’s gone. Then, it will be just IP over 5G with a race to the bottom.

In the mean time anyone who can’t just whitelist phone numbers loses. Being a business must suck.

mort962• 4 years ago

Who can just whitelist phone numbers? I get calls all the time from numbers I wouldn't have known to whitelist; colleagues, people in other companies who I'm collaborating with on some project, food delivery people, customer support calling me back, etc.

I usually ignore calls from abroad at least, but even those I can't block; I'm constantly spam called by different anonymous numbers from the UK, but I also have colleagues in the UK whom I want to be able to accept calls from. I once got an unsolicited call from a French number which I ignored, only to find out that it was the phone number of a food delivery person who was there with my food. Just last week I got a call from an unknown German number; in that case, it was a call from a colleague in Germany.

I don't think a whitelist of phone numbers is a workable solution for most people.

kevin_thibedeau2• 4 years ago

Another win for MBA idiocy where ethical behavior is treated as leaving money on the table.

makeitdouble2• 4 years ago

That ship has long sailed, and I don't think young people for instance value much having a phone number, except for conforming to social norms (e.g. getting called back for a job offer) and SMS confirmation codes.

Carriers are milking it as much as they can now, as they don't have leverage to otherwise stop any progress that would make phone numbers finally irrelevant.

ravenstine• 4 years ago

Maybe they want to devalue it.

I mean, who wants to run a phone company anymore? Selling data is where it's at, and old-school phone calls are for grandpas.

eyelidlessness• 4 years ago

I would probably say this is overstated, except today I got a phone call from “Djibouti” with a fake foreign code which was obviously a call spoofing a local area code, matched a very prominent local business, and left a message about… auto warranties.

mrjin• 4 years ago

Well, this issue was actually trickier than it looks. The real problem is the protocols our communication infrastructures built on was designed without almost any authentication & authorization mechanism. It wasn't a big issue when it designed as copper wires were required to make calls but it means basically anyone get those endpoints details can send SMSes, make calls claiming to whoever they want given now almost everything is on IP network. Yes you were right about that those telcoes do know what was the problem and how to fix it but they simply have no incentive to fix it as: 1. it needs overhaul of the current infrastructure, which needs lots of money and effort to proceed. 2. It requires all parties in the network to coordinate. One single exception means the issue remains or you will have to drop interconnection with those are not ready yet. 3. Negative impact to their revenue. So here comes the status quo.

smordistan• 4 years ago

Or just use the originator info.

bmitc• 4 years ago

Blame your phone company and the FCC for not solving this

I do. They don't care. AT&T doesn't even care that their cell network barely gets above 1 or 2 bars in a major metropolitan area. They mislead consumers by displaying 5Ge as the network (it just means you're on 4G but in an area that might have 5G service). My phone is really not a phone anymore, at least 95% of the time. I do make outgoing calls myself and only answer when I have a definite expected call from a known number. I use video chat apps for both audio/video calls for family.

mrtksn4• 4 years ago

My phone company apparently provides anonymous spamming service. New data protection rules forbid them to share your name and phone number, so they went ahead and created a service where marketers can call people without a phone number.

You want to reach females aged 30-35 in a city? Simply call or send an SMS from the API and you will be connected to a random one who matches your criteria.

At least, that's what my spammer told me when I insisted on telling me who gave them my phone number. Apparently, I gave the consent to be included in the pool at the time of purchasing some data package or something like that.

DavidPeiffer• 4 years ago

That's ridiculous. Are you comfortable naming and shaming the company? I'd be curious to research other complaints or details on it.

villaaston1• 4 years ago

What phone company is that?

nyanpasu64• 4 years ago

Why can a SMS spoofer use any number they want, but I can't get a second phone number to create Discord accounts without being tracked?

fredophile• 4 years ago

Probably because discord will send a text to the number to verify it. Spoofing a number is easy as long as you don't care about receiving replies at that number.

joecool1029• 4 years ago

You can, just register prepaid phone line with top-up cards purchased in cash from a store. If you use a Google Voice or other VOIP service, this shows up as VOIP and they won't let you use it. Annoying but it's the cheapest/easiest workaround I know of.

paxys• 4 years ago

Voice calls and texts are ironically the worst aspects of owning a phone these days. I recently decided to just use my phone permanently on airplane mode while at home, and the overall experience has been a lot better. I wish I had the ability to block all calls and texts while on cellular data as well. All my communication can happen a lot more effectively over iMessage, Facetime, WhatsApp, Messenger and more.

hedora4• 4 years ago

Think that's bad? Our kids have tablets with 5g data (they were basically free...)

I managed to lock them down, except they still get spam texts. There's no way to disable incoming texts, even though they're supposedly data only devices.

grecy2• 4 years ago

I have a data-only SIM in my iPhone that does not have a phone number. It can not make or receive calls, it can not send SMS messages.

I still get SMS spam on it.

throwaway98797• 4 years ago

I’ve silenced all unknown callers on my iPhone.

I rec folks do the same.

I undo this anytime I get a good delivery tho

aidenn0• 4 years ago

Call ID spoofing is annoying yet plenty of people don't understand it.

I get called at least once per month from (a different each time) someone in the same exchange as me saying they had a missed call from me. Presumably they got a spam call from my number, as I get about 5 spam calls per day with caller-id spoofed to a random number in my exchange.

hedora4• 4 years ago

One day I got really angry calls on my cell phone (number XXX-YYY-ZZZA) from the owner of a lost phone with number YYY-ZZZ-AAAA.

They were apparently calling from a land line in area code XXX, and didn't know how to dial long distance on a touch tone phone.

I tried to explain that they needed to dial "1", then their number to reach their lost phone.

They kept calling, then screaming about how I stole their phone and to stop screwing with their head; they knew how to use a phone.

After about 5 minutes, I gave up and blocked the number.

notRobot• 4 years ago

I was on a group call with a bunch of friends a couple nights ago. My Indian friend was telling me that they have very little spam SMSs and robocalls.

They speculated that it is because in India the person making the call or sending the text is the one who pays for it. So spamming is expensive.

Also, apparently spoofing numbers is unheard of in many countries, the US seems to have it particularly bad.

If anyone here is familiar with the technicalities of how this stuff works, what are your thoughts on the hypothesis?

wielebny• 4 years ago

They speculated that it is because in India the person making the call or sending the text is the one who pays for it.

Wait, what, do people in US pay for receiving texts or calls?

jedberg4• 4 years ago

Yeah, we do. It sucks because we pay for the spam calls.

Most cell plans now include unlimited incoming calls and texts, so it's not really a problem, but the sender does not pay anything either, which is a problem.

chupchap• 4 years ago

Spam SMS are a thing here,even if your number is added to a govt DND database. As far as spam calls go, fintech companies have call centres frequently calling everyone asking if they need a loan.

The telecom authority here has been fighting against misuse of calls and SMS for years now. It all started when the Finance minister received such a call while he was speaking in the parliament :D https://economictimes.indiatimes.com/industry/telecom/raja-o...

Even with all this action the number of calls are quite a lot and this is the reason most folks have Truecaller installed to weed out unwanted calls.

What changes with region is the type of spam you get. I have never received a call for tech support, not to mention you need to provide two-factor authentication for each transaction and the fact that credit card is used by only a few.

Nitramp• 4 years ago

Same im Europe (at least the parts I ever lived in). I think it's indeed the commercial incentive - once the caller/sender has to pay anything, however small the fee, it's no longer economical to spam.

I remember making sending emails cost a tiny fraction of a dollar was proposed some time back in the nineties to stop email spam. That was superseded by effective bayesian spam filters. The cost of that is that it's near impossible to self host email servers these days, as all those filters will label you as a spammer. Otoh requiring some payment solution would also be a strong barrier...

visarga• 4 years ago

I remember making sending emails cost a tiny fraction of a dollar was proposed some time back in the nineties to stop email spam. That was superseded by effective bayesian spam filters.

That is what made me interested in ML (it was an article by Paul Graham - "A plan for spam"), years later I am an ML engineer.

YetAnotherNick• 4 years ago

I get loads of spam text and calls in India(even with DND) so the story is weird to hear.

Sateeshm• 4 years ago

I'm from India and i get about 10 spam calls a day. Mostly Bank offers

lathiat• 4 years ago

About 6 months ago here in Australia I had a run of getting spam called by a number which was the same as my number but off by 1 digit. Seemed like a clever method to peak peoples interest but made it pretty obvious to me it was spam.

mnw21cam• 4 years ago

peak -> pique.

pjerem5• 4 years ago

Can someone "eli5" why this possibility of spoofing even exists and is allowed ? What are the legitimate use cases of this feature ?

EDIT : thank you all for your answers !

I suppose it’s the same thing that allows you to receive messages from "SOME BRAND" and … why not. But this could be easily regulated. I don’t understand why anyone can spoof anything they want. Also, I don’t understand why my iPhone don’t allow me to block messages from "SOME BRAND" as if it was from any other sender.

ggm3• 4 years ago

https://datatracker.ietf.org/wg/stir/documents/

its not exactly ELI5.

The CLI (Caller Line ID) field of a "incoming call" message isn't adequately policed. This is sort-of baked into how telephony works. It's stupid, and it should have been thought about more. The CLI field isn't how the call routes, its just how the caller announces who you are. Telephone call routing uses other data fields, its part of SS7 and the other signalling systems the phone network uses. The field which comes up a mobile call, inside "payload" isn't how it routed.

Imagine some company has the indial range 667 2200 to 667 2299.

If you dialled from your assigned handset 667 2241 the CLI can say 667 2200 so it looks like you come from the switch (in this example we assume the company's PBX operator is on 2200, and you publish 2200 as the incoming call number) so people don't learn your office handset: thats why they permitted it.

I have no idea why they allow to to "lie" above your indial group range. But they do.

STIR is how in a VOIP world people are approaching the fix. But really? the FCC and other national regulators have to tell the telco to stomp on the fakeout, when people inject calls into their system.

This has parallels with "envelope sender vs RFC822 header" in email. Or spoofed source if your ISP doesn't do BCP38. Guess what: SPAM is a problem in email (duh) and spoofed source is how DDoS can happen. "telling lies" in end-to-end communications is not helpful.

pjerem5• 4 years ago

Thank you for explaining me :)

marcus_holmes2• 4 years ago

If this is baked into telephony, why we don't have this problem in Europe?

(genuinely curious why this happens in the USA but not here)

YATA0• 4 years ago

Phone support is a good example. You may have 20 support reps that have unique numbers, but when they call out to you, the number that shows up is the support dispatch number.

Support dispatch may be subcontracted out to an entirely different company (that may change over the months/years), so you'd still need to ability to spoof numbers you technically don't own.

I agree there needs to be more controls and regulations in place though. The status quo is unsustainable.

pjerem5• 4 years ago

Thank you for explaining me :)

closeparen• 4 years ago

The idea of a phone line having a specific number is a consumer thing. In the business world your connection is some number of concurrent channels. The business’s PBX decides what number should be displayed as caller ID when setting up an outgoing call on one of those channels. Inbound and outbound routing may be different (just like a domain’s outbound SMTP server may not be the same as its MX record) so allowing only the numbers that are routed to that PBX doesn’t work. You need something like the SPF record. That thing is called STIR/SHAKEN and it’s only being rolled out now.

pjerem5• 4 years ago

Thank you, I get a better understanding now. If I understood correctly, those are more or less the same issues the mail world is trying to solve with DMARC.

gumby• 4 years ago

This goes back to when caller ID was introduced (80s?). There was a lot of opposition.

Anyway, a company could have what was called a PBX — a bunch of lines would come in and the operator would connect them (by plugging cables — I still remember this system). When they replaced that with electronic “exchange” — Private Business eXchange you could dial straight out from your desk. However there were fewer lines coming in than extensions. For direct dial the PBX could either set all outgoing calls to be the main number or could send the direct dial number for the desk phone that made the call.

We had a system like that into the late 80s though by that time we weren’t getting a bundle of incoming lines.

This system does have an advantage: it lets staff make calls using phone number controlled by the company. So when someone leaves they can be forwarded to the appropriate person, like email addresses.

For the last 15-20 years I’ve just used my mobile number which means when I leave a company I continue to get phone calls. I’ve always left on good terms so this isn’t terrible, but what if I had not?

Since nobody calls on the phone any more this may be less of a problem, but phone numbers are still used as authentications for services like WhatsApp. These numbers need to go away.

pjerem5• 4 years ago

Thank you for explaining me :)

fortran773• 4 years ago

This goes back to when caller ID was introduced (80s?). There was a lot of opposition.

The opposition was fascinating. Nobody predicted spoofing, of course, but I saw teary-eyed people crying on publicly televised hearings in NYC arguing both sides of Caller ID!

- One women's group was against it. "We don't want women who are in safe homes or moved in with relatives to have to reveal their location when having to call their abusive partners"

- One women's group was for it: "We want to know who calls us and says obscene things."

Total craziness!

See: https://www.google.com/books/edition/Caller_ID_Technology/84... for some of the hearing minutes

daneel_w3• 4 years ago

"But this could be easily regulated. I don't understand why anyone can spoof anything they want."

No, unfortunately it's not easy to regulate. It would involve not just all domestic operators, but also all telecom service aggregators (e.g. Twilio, Infobip, Sinch, and a thousand more), to find common ground and coordination of a working register of what company has the rights to what SMS sender name within one nation's network, whether it's numeric or alphanumeric.

STIR/SHAKEN (which regulates usage of numeric caller IDs for phone calls) has taken ages to come to fruition, and that's despite the huge technical benefit of phone numbers being inherently anonymous and already belonging to a specific network operator. With the sender of an SMS the logistics are very different, and that's before even touching on the enormous business of legitimate SMS services and how these should be able to compete on the open market.

dimgl• 4 years ago

Happened to me this morning. Completely freaked me out.

jlmorton• 4 years ago

One of the very best features of Android Messages is that you no longer get spam texts.

The combination of Pixel and Google Fi means you never get spam calls, or spam texts.

nieve• 4 years ago

Apparently the spam calls and texts I get don't exist? That'll make them less annoying in the future.

jrockway• 4 years ago

The good news is that Verizon has all these grand plans to intercept your browsing data and use it to target ads, but they can't even implement the most rudimentary spam protection on SMS, so I don't have high hopes that they're going to make any money by spying on everyone.

One could argue that since the more messages you receive, they more you pay, they have no incentive to reduce spam; whereas with ad tracking, as long as they find some advertiser willing to pay 100 million dollars for a 1% increase on click throughs on their overpriced toothpaste, they'll have a financial incentive to do a good job. So maybe we're actually really screwed.

Sad that a cell phone company can't be just a cell phone company. They were pretty good at that.

InCityDreams• 4 years ago

"One could argue that since the more messages you receive, they more you pay,..."

Laughs in €uropean. Btw €5.99 unlimited calls, unlimited texts (that the receiver doesnt pay for [maybe my US friends do....must check] 100Gb a month. Had the same tel.no for nearly 20 years, several different operators. My US friends are very jealous (though at least one has unlimited EU calls and texts).

thatguy09002• 4 years ago

Pretty much everyone in the US has unlimited calls and texts. You have to go looking for obscure senior citizen plans meant to be emergency phones for anything that is charged by the text and minute. Our service costs way more than 6€ though

Animats• 4 years ago

The "STIR/SHAKEN initiative" was supposed to fix this.[1] There's now a whole system with signed certificates, much like SSL certs, to sign caller ID info. The info is at least good enough to find out which carrier generated the phony data.

You should file a complaint with the FCC that your carrier has not clearly not properly implemented STIR/SHAKEN, since they badly mis-identified the source of a call. While calls from outside the US can be unsigned, the carrier should detect that the number is inconsistent with the source.

There are "A", "B", and "C" level of verification. "A" calls are probably legit. The others, maybe not.

If you're in California, try making a personal data request to your carrier for the detailed STIR/SHAKEN data for that call.

[1] https://commlawgroup.com/2021/stir-shaken-robocall-mitigatio...

sillysaurusx4• 4 years ago

The Federal Communications Commission (“FCC” or “Commission”) requires that all voice service providers (“VSPs”), with some exceptions discussed below, implement the STIR/SHAKEN caller ID authentication framework in the Internet Protocol (“IP”) portions of their networks by June 30, 2021.

So stoked that there’s finally a way to fight back against robocalls, and that carriers are being forced into compliance. Thanks for pointing this out.

runjake• 4 years ago

It's 2022.

The carriers aren't being forced at all (yet).

genewitch• 4 years ago

In other news this week, google drive and SMS spam has ramped up. Coincidence?

karlshea• 4 years ago

My impression is STIR/SHAKEN is only for voice calls, not SMS.

I'm no longer getting almost any robocalls on Verizon as of a couple of months ago when they "turned on" STIR/SHAKEN. What I am getting instead is the same volume of spam text messages.

sillysaurusx4• 4 years ago

I’m starting to get those too. From the trump campaign, of all things. Somehow they got ahold of my number and keep asking me to go save America.

Not sure which is worse, someone trying to sell me stuff or that.

How much volume? Is it a daily annoyance? My wife seems to get hit harder than me, but as far as I can tell we’ve both been equally careless about sharing our number online. So I’m dreading the day that these people figure out how to turn text messages into a gmail spam inbox.

It feels like it’s time to just write a Bayesian filter and proxy all text messages through it. It was theoretically easy to do that back when you could send texts just by emailing a special address, but sadly I think carriers ditched that feature. Nowadays I’m not sure where to start if the goal is to proxy our texts like that, but I’d like to.

willis9362• 4 years ago

I've gotten nearly a dozen in the past week. It's pretty unnerving with the recent history of zero-click iMessage exploits. These are SMS, but maybe there's a privately known SMS zero-click exploit.

Spam SMS ought to be even easier for carriers to filter than voice. They need to do it and soon.

registeredcorn2• 4 years ago

It's interesting to hear how many spam texts you're getting.

I've got a private phone and a work phone on T-Mobile. My private number gets maybe 1 spam text per month, but 2-3 robocalls per week, while my work phone gets 3~ spam text messages per week and about the same number of robocalls.

Overall, the number of robocalls I've been getting has gone down somewhat, but not noticeably. It's probably decreased by something like less than 10%.

I had no idea anything had been done to robocalls, I really hadn't noticed any sort of decline.

creeble• 4 years ago

I had the same experience, but in the last week it seems like something broke, or a different switch was flipped.

I'm back to getting 4-10 robocalls every day. One text. Some are detected as spam by Verizon, but my phone still rings.

IncRnd2• 4 years ago

STIR/SHAKEN are only for VOIP calls not for text messages like shown in the article.

flatiron• 4 years ago

And as far as blaming the carrier if a call comes in with a B or higher rating it’s going to present the number as legit. That’s not the carriers fault!

pards4• 4 years ago

STIR/SHAKEN also covers Canada [1] but it's a neutered law with little impact since it only covers VOIP calls, not SMS or traditional landline calls.

I guess I should drop my old skool Bell Canada landline in favour of a VOIP line...

[1] https://www.canada.ca/en/radio-television-telecommunications...

julianlam• 4 years ago

I ended up using VoIP for both my cellular and landline connections. I would recommend it for the latter, but not the former.

When WiFi and 3G signals are thrown into the mix, real-time communications go south fast...

To STIR/SHAKEN's credit, however, the only spam calls I've received go to the cellular number assigned to the SIM card I have that is purely for data (so I can make those VoIP calls outside of home wifi range)

ehPReth2• 4 years ago

How do we protect SMS? I’m kind of confused but I understand I guess why it wasn’t also addressed in the initial rollout… does STIR/SHAKEN even allow for SMS authentication?

I guess you could keep your phone number by porting it and get the call spoof protection?

bogomipz• 4 years ago

'The"STIR/SHAKEN initiative" was supposed to fix this.'

This was only for voice calls not SMS. From a FAQ On Neustar's(SS7 provider) site:

"5. Does STIR/SHAKEN apply to SMS/text messaging? Currently STIR/ SHAKEN applies to phone calls only. However, work is on-going in the communications industry to evaluate the best authentication method for SMS / text messaging."[1]

It's unclear as to my why it does not currently cover SMS. Perhaps someone else could shed some light on why this is. SMS certainly uses the same SS7 infrastructure as voice calls.

[1] https://www.home.neustar/resources/faqs/stir-shaken-for-busi...

zbentley2• 4 years ago

There are "A", "B", and "C" level of verification. "A" calls are probably legit. The others, maybe not.

TIL.

I know that makers of phone/texting apps are primarily targeting users who don't know or care about this kind of stuff, but man it would be awesome if that kind of info were available whenever an inbound call or text arrived on my phone. Just like email headers, I'd love to be able to see the raw authentication grade and other metadata.

21435• 4 years ago

Over here in India there's a DND (Do Not Disturb) registry [1].

The link [1] links to Telecom Regulatory Authority of India (TRAI) website.

You sign up to DND by dialling a number that is dependent on your carrier (therefore you need to do this separately for all your phone numbers [3]), and go through the "Press 1 for English [2]... Press 2 for so and so... " etc. Takes a couple of minutes.

Once I signed up, the number of marketing and similar silly calls/messages have been nearly eliminated.

Maybe something similar — something that allows people to opt out of such calls/messages — can be implemented in USA.

[1] https://trai.gov.in/faqcategory/unsolicited-commercial-commu...

[2] The language question because there are plenty of languages in India.

[3] Tangent: do people not use multiple phone numbers in USA? Like, I wanted to buy an iphone but it does not support multiple SIM cards (unless you convert one of the SIM to an e-sim [4] which I'm hesitant to do because if I later switch back to an Android phone that does not support e-sim, I'll have to go to my phone company to get a physical sim. Too many hassles. ). Also I'm told iphones sold in China has dual sim capability [5], but I can't go to China just to buy an iphone.

[4] https://support.apple.com/en-ph/HT209044

[5] https://support.apple.com/en-ph/HT209044

jedberg4• 4 years ago

We have that here too. Usually when you sign up your spam calls actually increase because spammers use the list of "banned numbers" as a list of "verified numbers of real humans".

With CallID spoofing its so hard to track down that violators never get enforced.

In India you have the advantage that the caller pays, which means you have a phone system that somewhat securely verifies who the caller is so they can be billed. In the US the receiver pays so there is no system in place to verify who the caller is.

LilBytes• 4 years ago

Plus, if the call comes from overseas they're not going to respect the DND from your country unless the fake caller is also from your country of origin.

I can't say definitively but the vast majority of my spam calls are from South Asia or South East Asia (I'd guess Philistines based on accent). They typically don't respect the Australian Do Not Call register so much.

21435• 4 years ago

Usually when you sign up your spam calls actually increase because spammers use the list

Why is that information public? Shouldn't only the "middleware" equivalent be aware of who has signed up?

In the US the receiver pays so there is no system in place to verify who the caller is.

What?! Why?!

kwhitefoot3• 4 years ago

In the US the receiver pays so there is no system in place to verify who the caller is.

What? That's bonkers. Why on earth should the receiver pay?

tallanvor2• 4 years ago

Most of the scam calls and texts these days come from outside of the US, and unfortunately India is a huge source of those calls - wages are low and English language proficiency is high. And it's not just the US that has this problem. Here in Norway a common scam telemarketing call are "investment opportunities" that show up as coming from a UK number, and if you answer, it's very clear that the person is calling from a call center in India.

21435• 4 years ago

If it makes you feel any better, Indians also get spam calls from other Indians.

We hate it as much as you do.

scgtrp• 4 years ago

do people not use multiple phone numbers in USA?

Not really, no. Dual SIMs are kind of a niche feature here, and most users I've heard of do it with a US SIM plus one for some other country they travel to frequently.

Curiosity: what are the use cases for two SIMs from the same country?

21435• 4 years ago

Curiosity: what are the use cases for two SIMs from the same country?

I don't know the exact reason, but here are some thoughts on that:

Hypothesis 1:

In India, only the caller pays for the call. The callee pays nothing. I say this because I was surprised to learn that in USA, the callee pays.

Long long ago — before calling via the internet through WhatsApp, Signal etc became a thing — in India if you (or rather, your SIM card) travel to another state within India (say from Kerala to Karnataka), your phone goes into a "roaming" mode.

When you're in roaming (when your SIM is in a different state from where it was originally registered), both the caller AND the callee would have to pay.

So, if you're from one state and you intend to live in another for a condsiderable amount of time (perhaps because you got a job in another state), then it makes sense to sign up for a new phone number in that new state so that you wouldn't be charged when you get calls from family and friends from your home state.

However, this reason is no longer valid because in order to stay competitive phone companies stopped charging you for incoming calls if you go to another state within India.

Hypothesis 2:

Business people tend to have multiple phone numbers to handle the high volume of calls they receive, or to separate work and personal calls.

Hypothesis 3 (my reason):

I initially had a number that I used for personal calls.

Later, a new provider came on the scene with better rates, faster internet, better clarity etc, and I signed up for that as well because why not. This was before phone number portability was introduced.

My mobile data and work calls is through one provider, my WhatsApp is signed up via the other number, and most friends also call me via this other one.

And in some places only one of the provider has a proper strong cell coverage.

It's technically possible to merge that all into one number, but I haven't bothered.

Also, calling directly via phone (as opposed to via the internet) is still very common here because it's super cheap. For example, calls from Jio to another Jio number is free I think.

hyperman1• 4 years ago

I had it a while for a work and a personal phone number. Also when someone was sick and I took her phone calls. There are probably ways to reroute the phone calls, but this was quick, easy, and I can do it on my own without involving the phone company (any bigco tends to mess up anything you ask)

ratww2• 4 years ago

Curiosity: what are the use cases for two SIMs from the same country?

Having SIMs from different carriers to take advantage of different rates. This is mostly in countries where call prices are unregulated and calling someone using a competitor carrier can be a surprise that costs sometimes 10x more.

This is more common in poorer countries.

nub• 4 years ago

Owing to its unpopularity, or to which its unpopularity owes, Apple has only supported dual SIM for a few generations.

Curiosity: what are the use cases for two SIMs from the same country?

I have one line on Verizon and one on T-Mobile for better coverage, robustness to congestion.

iOS 13 has a "cellular data switching" feature for dual SIM that automatically chooses networks based on availability.

Data from one network even provides "WiFi calling" capability for the other line.

signal114• 4 years ago

The big reason they were popular in India was that one had to pay for long-distance calls (yes, even on mobile) if you called interstate (or more accurately, inter-telecom “circle”), and many people had lives that spanned two or more circles.

The other crucial reason is that it was near-free to have as many prepaid SIMs as you wanted, you paid only if you used it to make calls (receive was, and remains, free, like in Europe). And VoIP numbers aren’t allowed in India.

These days, all the carriers have national licenses, there’s no long-distance charges, and you have to pay a nontrivial sum (nontrivial unless you’re a relatively rich Indian) every month to keep your SIM active. Whether you make calls with it or not.

This has been a slow, “boil the frog” change, and the relatively extremely well-off Indians on HN will probably be the last to notice, but the need to have multiple SIMs in India isn’t as strong as it was in the 2000s.

JJzD• 4 years ago

Separation of private mobile 24/7 and office mobile during office hours. Office mobile is also abandoned when you switch jobs, so can we freely shared because the responsibilities won't follow you

fortran773• 4 years ago

Curiosity: what are the use cases for two SIMs from the same country?

One phone number, registered to your business, that you never give to anyone other than 2FA, contact number for bank accounts, credit card confirmation etc. And one phone number that you use for business and personal calls.

I still get spam calls on phone #1, of course, but it protects me against SIM swap attacks from people who get access to the second phone number

kwhitefoot3• 4 years ago

Same here in Norway. It is an offence to make an unsolicited commercial call to a number that has been on the register for more than a month. It can cost the caller 300 USD per call in fines.

I have had perhaps two unsolicited calls in the last five years and one of those was from a number apparently in London, UK.

rcMgD2BwE72F• 4 years ago

Maybe something similar — something that allows people to opt out of such calls/messages — can be implemented in USA.

Why not opt in instead?

signal114• 4 years ago

My Indian friends complain that despite being on the DND list, the unsolicited commercial message situation in India is pretty bad, due to the lack of data protection laws.

do people not use multiple phone numbers in USA?

The e-SIM is the easiest way to get two numbers on the same iPhone. Having multi-SIM phones isn’t popular for a number of reasons, including the fact that Americans and Europeans can get a 2nd number via services like Skype and Vonage anytime they want — something India still prohibits.

Incidentally I wrote about having multiple SIMs in India a week ago[1]… they’re an interesting historical accident, and the well-to-do in India will continue to use them, but they’ll become increasingly less common as telcos raise prices.

[1] https://news.ycombinator.com/item?id=30770786

pards4• 4 years ago

Perhaps all of us in North America should sign up for the Indian DND list since that's where the majority of our spam calls originate! I signed up for the Canadian "do not call" lists when it came into effect and it only served to increase the spam calls/texts I receive.

rapunkill• 4 years ago

It's extreme but changing to a Qc number will prevent most spam calls

phendrenad2• 4 years ago

I'd love to see a post-mortem of what went wrong here, but alas our lowly civilian eyes will probably never get to see it. We just get to sit here and hope we don't wake up one morning and blearily click on a zero-day message that gets past our mental defenses by coming from our own number. Don't click the link, citizen, if you do, it's your fault and therefore your responsibility to prove any fraud or identity theft. Fun times.

senectus1• 4 years ago

I have a series of sms from a local Bank/Super company called "ANZ".

today I got an obviously scam sms from the SAME number/source as the official ANZ sms'

SMS is a junk protocol. it just needs to be banned entirely. its got no controls or protection whatsoever.

ungamedplayer• 4 years ago

But we use it for 2fa. Can't wait till spammers figure out how to abuse spoofing and 2fa.

daneel_w3• 4 years ago

The problem isn't the SMS "protocol", but that operators still haven't been able to find an amicable solution to regulating sender names/numbers that doesn't interfer with legitimate usage, e.g. commercial businesses doing EBR texting to their customers. The problem isn't entirely comparable to that of caller ID spoofing for phone calls, and is legally and technically more complicated than you imagine.

k1rcher• 4 years ago

Received this exact text, word for word with the same suspicious phishing link, from my own number, a few hours ago.

kwhitefoot3• 4 years ago

I have the impression that this sort of problem is bigger in the US than in other countries. Is this really the case? And if so is it because the US is simply a larger target or do telecoms systems in other countries do a better job of combatting it?

pkaye• 4 years ago

I think that English being the many language makes it a bigger target since it's a common second language spammers can learn.

ratww2• 4 years ago

I think it is the ability to spoof caller id, mixer with the fact the US is a rich country, mixed with the fact a large part of the world speaks the language.

7steps2much• 4 years ago

In other countries the caller pays for calls/texts. The way I understand it that isn't the way it works in the US (something about callers not knowing if they are calling landlines or mobile phones?)

For example, over here in Austria you can tell exactly what type of "line" a callee uses and so you know in advance how much you have to pay (even though in practice most people have unlimited calls/texts).

This means that when running a spam bot you will soon run into big issues because it simply doesn't pay off financially to send that many texts and calls.

mcv4• 4 years ago

Having the caller pay nothing and having the callee pay for the call does sound like it invites abuse, and discourages callees from even picking up the phone.

In Netherland, it used to be that the caller pays. Technically they still do, but many subscriptions come with unlimited calls and texts these days.

Phone numbers that cost extra money tell you that before they connect you.

noduerme• 4 years ago

Sorry, I just scanned the comments and didn't find anyone mentioning this:

It's really easy to spoof a phone number for SMS if you know which network the person's phone is on. Trivial if you know how. There's no black magic to this. At least, it was so a couple years ago. The last time I fooled with that for fun, I spoofed one of my friends admitting to another that he'd slept with the other guy's wife and decided afterwards he was gay. I managed to insert it from his phone number into our group chat as it appeared on android. (I think it might've ended up in a separate chat sequence on iphone). That was funny.

There's no dark arts here.

dfawcus• 4 years ago

So having read this, the answer seemed obvious:

Send a text (iMessage) to myself on the phone. Then look at it, and block my own number. The phone then reported it would block calls, FaceTime, messages from my own number.

Since I don't expect to ever need to call/message/FaceTime myself, that seems like a zero cost solution.

temp0826• 4 years ago

I'd be more worried about these spam texts coming from my number to my own contacts that I have previous conversations with than to myself. E.g. why wouldn't my grandmother click some link I sent to her? (My first thought was that these texts could just be from some malware on the phone itself, possibly with access to the contacts. But if it's actually an externally sourced spoof, that's obviously less dangerous...unless they somehow got my contacts I guess)

bearjaws• 4 years ago

The main issue is OTHER people getting spam calls or texts from your personal number.

I got one of the Android stock text messages last week for when you auto-respond to a missed call. 'sorry can't speak right now' from a phone number I never called.

So a spam caller used my phone # to call, the person auto hung up with a response, and the real text message went back to my phone... It's absurd.

ehmorris• 4 years ago

This will prevent your texts from syncing between your phone and other devices, like a MacBook. I learned this the hard way by debugging a relative’s text-syncing issue.

rbut2• 4 years ago

I run a SaaS, whose users can enable sending SMS from their number.

We have an agreement with a bulk SMS provider to allow us to do this (we had to show proof of our application, our mobile number verification process, and give our use case).

When users send an SMS from within our application, we send it as if it came from their number. Then recipients can then reply directly to their phone. Our users love it.

So yes, there are real use cases where the ability to do this is beneficial.

WaxProlix• 4 years ago

"Our users love it" is not the same as "yes,there are real use cases where...", which is not the same as "this is good and correct because..."

Users can love or hate all kinds of things, and often those preferences are at odds with security or other best practices.

Aspire to better.

rbut2• 4 years ago

The alternative is a shared number, which then requires logic to determine which user sent a message to X. When receiving a reply from X, you must determine which user to associate the reply to and then forward it to them. This can and does go wrong. Especially if multiple users are messaging the same recipient within a time period.

If we have validated our users mobile numbers via a TOTP code, informed them that they are sending SMS as their number, then how is it different to an application like Signal or iMessage linking your messages to your mobile number? It's not.

And that's why it's allowed with certain SMS gateways. The SMS gateways are doing the due diligence to ensure you are sending spoofed messages appropriately and only as the user who actually owns the number.

Edit: The spammers are most likely using gateways who aren't doing these checks. The solution is to fine or shut these gateways down.

yread• 4 years ago

Happened to me with email. Even with DMARC active and set to reject 100% on my domain, outlook somehow found it a good idea to deliver those emails to my spam folder

m1gu3l• 4 years ago

semi related: is anyone else seeing hotmail addresses bypass apples ios known number feature?

dghughes• 4 years ago

My elderly mother got a call from a Doctor for an appointment reminder saying "press 1 to confirm". It was one of those robo voice calls. What was disturbing is the doctor's name was nobody she knew or heard of. But the call mentioned a doctor's appointment she actually did have. The robocall had the day and time correct but the nurse there said they never called my mother they don't have any automated system to call patients. Mom almost answered the robo call if it wasn't for the ominous "press 1" which I tell her to never do.

I put mom and dad on the do not call registry here in Canada but it doesn't help. Constant calls from Amazon, Visa, Revenue Canada etc. It's either the robo voice or someone with an Indian accent.

grecy2• 4 years ago

I put mom and dad on the do not call registry here in Canada but it doesn't help.

I worry about my Dad with this. I tell him constantly to hang up no matter who they say they are as a matter of habit. If he really wants he can initiate a call with that organization to ensure it's actually them.

Despite me saying this repeatedly, I've heard him give personal info over the phone to cold callers offering discount electricity rates.

diebeforei485• 4 years ago

If she has an iPhone:

Settings > Phone > Silence Unknown Callers

It's a nuclear option but it works

szczepano• 4 years ago

The problem with data protection acts is that they try to protect data and it won't work cause the data they try to protect is outside people houses. Everything that is outside house is public and we just need to assume you need to provide data about it so we can verify your identity like with public key. Just to give example, when you live the house anyone can ask you anything ex. ask your neighbour about your name, anyone can read your house number, can see you or take photo of you legally or illegally that's different topic but we should protect peoples privacy inside their houses instead of trying to protect something we can't cause everyone see us how we are when we leave the house. It's basic public / private key problem. Everything outside house is public key and everything inside is private key.

So with phone we shouldn't protect people identity, address and/or company name but protect people from disruption with calls they don't want to answer and give them ability to verify who was calling, by even seeing their photo cause yes if I'm your neighbour I can see you and if I move next to you next year I can see you too. Wow.

There should be 2 call indexes one for contacts that should behave same as it's behaving now and second index for anything else that you shouldn't receive notifications but you can check this spam missed calls index and verify anyone that called you and add them to contacts - just how the old good paper phone book worked.

This empowers people to be able to make decision if I want those people to call me or not, cause you can always call back and it should be widespread when you call someone first time expect they might won't answer your call same as if you email someone they might not answer cause your mail is in spam.

mysterydip• 4 years ago

Literally just got one of these. Very annoying

yashkadakia• 4 years ago

We need a GIF of Nelson going "Stop spamming your self, stop spamming your self"

https://getyarn.io/yarn-clip/921915b0-4a3b-4e96-beed-eb7b50a...

fortran773• 4 years ago

_Calling_ a person from their own (faked) phone number was a tried-and-true technique for getting someone's voice messages back in the day. It used to be that voicemail PINs were optional, and if you called your own phone number, you'd get access to the voicemail playback menu.

It's trivially easy to fake a caller ID, whether for voicemail or SMS.

kup0• 4 years ago

Getting robocalls from spoofed local numbers in my area code.

Extremely frustrating because they look more legitimate this way, like it's a local business calling me back or something.

Provider: Boost Mobile (MVNO for Sprint/Tmo)

johnklos• 4 years ago

The age of the traditional phone system is ended.

Years ago, bills were introduced Congress that would've made falsifying Caller ID illegal, but certain people said it would be too onerous for small businesses. One bill passed in the House and was sent to the Senate, where it was promptly ignored (H.R.251 - Truth in Caller ID Act of 2007).

Lots of people, both those who know nothing about technology and those who know enough to know better, say this isn't enforceable because too many people are doing it.

Bullshit. Like spam, if you establish punishment for those who allow spam, you have a very simple mechanism for enforcement.

In the old days, when we got spam, we'd forward it to the administrators of the system that sent it or the administrators of the network where it originated. They'd warn, punish, and/or remove the person / system responsible for the spam.

These days, abuse@yahoo.com doesn't work, GoDaddy, Cloudflare and others won't do shit unless you find their web page for reporting abuse, then jump through hoops to shoehorn the spam in to their intentionally shitty web page, and even then they pretty much ignore it. Google just ignores everything sent to abuse@google.com.

Imagine if every spam that's ignored led to a fine. It'd be chaos and mayhem, but within a year we'd be back to how things were in the early '90s. Of course that wouldn't affect spam from the rest of the world, but imagine if large US networks stopped accepting email entirely from Chinanet until they started acting on abuse complaints.

The same can be done with Caller ID. You've got a T1 that lets you set your own Caller ID? Great. You might not get caught, but you can set what you want.

Your upstream provider might ignore it, but they connect somewhere larger, too. So let's say AT&T customers are getting complaints about phone calls with false Caller ID, and AT&T looks in their logs and sees that they're coming from your upstream. Now your upstream is in trouble unless they fix it. If they don't, they get a nice hefty fine.

How do they fix it? They force you to stop. If you don't, it's illegal, so they can contact the authorities. Or, they could just terminate you.

This is just like egress filtering in the networking world. If your network is passing along lots of spoofed traffic and someone contacts you to tell you, and you just pretend it's not your problem, you should be punished. You shouldn't allow traffic to leave your network that claims to be from sources that aren't on your network.

"But routing!" Bullshit. If it's coming on to your network from elsewhere, you should be required to say from where, so the originating network can be identified.

However, businesses don't want to be bothered putting any time or energy in to this. Businesses rarely do a thing because it's the right thing to do, unless they can make it a marketable advantage. They need to be forced to do this by law, by threat of loss of money.

Caller ID spoofing should've been illegal all along, and businesses which do nothing about it should be punishable. Because that's not the case, the old fashioned phone system might as well completely die.

thatguy09002• 4 years ago

"SMS phishing, or “smishing,”"

Why does the media do this?

daneel_w3• 4 years ago

"Journalists" are desperate to stand out.

AdmiralAsshat• 4 years ago

Literally got this exact text this morning. Definitely seems to be a Verizon problem.

yftsui• 4 years ago

This is a new level of spamming that this morning I got a text message from myself:

"Free Msg: Your bill is paid for March. Thanks, here's a little gift for you: ${short link redacted}"

The short link is hosted on Cloudflare which eventually redirect to a Russia TV website 1tv.com or 1tv.ru

< HTTP/1.1 302 Found

< Date: Tue, 29 Mar 2022 17:37:58 GMT

< Transfer-Encoding: chunked

< Connection: keep-alive

< Location: http://1tv.ru

< CF-Cache-Status: DYNAMIC

< Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yEU2D%2FlNvx216BeQ8TK2oONisk12pAzUW7FlYuTb2Uth9LIT8pcSQyKok1FASqproAoWqBc%2FHaje8lf8pihU2kTSzuoslYERPQvnvRSv%2FyHKIDQ3%2F8e1hSaYMKEn"}],"group":"cf-nel","max_age":604800}

< NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

< Server: cloudflare

< CF-RAY: 6f3a605d595039ad-SEA

< alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

geocrasher• 4 years ago

Around the same time you were posting this, I got the exact same message which was supposedly from my own number. Talk about pervasive.

InitialBP• 4 years ago

Hopefully this will help some others deal with spam SMS.

A few months ago I started getting huge group text spam to hundreds of emails that were almost identical to my own

(changed obviously) if my number was : 123-454-9938 then i would get in a group chat with numbers from 123-454-9900 all the way to 9999. They were using email -> sms specifically which is a relatively new feature that allows you to text mobile devices on carriers that support email to SMS. [1]

Super annoying - but AT&T at a minimum allows you to call and request that they disable this feature for your account. If anyone else is getting constant sms spam from email addresses this is the way.

Disclaimer: I don't know and have not run into any issues where legitimate companies are using this feature yet. If so, then obviously you won't be able to receive those texts. At the moment there is no capability with carriers (that I've seen) that would allow you to create an "allowlist" of domains to accept texts from, but until that exists I won't be dealing with email to sms as it's just a huge cesspit of spam.

1 - https://www.att.com/support/article/wireless/KM1061254/

jasonladuke0311• 4 years ago

They were using email -> sms specifically which is a relatively new feature that allows you to text mobile devices on carriers that support email to SMS.

I don't think this is true? In ye olden days of text messages, SMS and MMS were relayed via email, IIRC. I remember emailing pics to a friends phone using the MMS email address. The format was unique to each carrier but included the phone number, obviously.

wildzzz• 4 years ago

I used to annoy my friends by sending emails to their sms email address (1234567890@vtext.com or whatever) using open email relays. You could spoof the sender name as whatever you wanted and most sms clients would just show that.

My own phone number is now spam texting me

Related Stories