HN user

afo

82 karma

Founder of Nomorobo. Destroyer of robocalls.

Find us at https://www.nomorobo.com

Posts4
Comments33
View on HN

A better analogy that I use (especially with nontechnical folks) is the return address on an envelope.

You can, technically, write anything in it and there’s no way to guarantee it’s authentic.

Happy to talk about the landline product. Just for clarification, the mobile product works completely differently.

1. Yes, pretty much. Here's a more in-depth answer to what happens when the call is answered - http://www.6083716666.com/

2. Yes, we do get a log of the incoming calls. We use that to analyze the high frequency calling patterns across millions of phone lines and build the blacklist. The more people that contribute, the better the algorithm gets.

3. We globally manage the whitelist and good robocalls (school closings, pharmacies, doctors offices, etc)

4. We don't work with POTS lines yet. The older technologies are tougher to protect than the modern ones.

Even with all these high profile settlements, it's still not stopping the problem.

Just today, we (Nomorobo) see 25 different numbers pushing Windows tech support scams. It's like that every. single. day.

This is an emergency call from Windows Microsoft. Your Windows license key have been expired all services are suspended on your computer. To renew call our toll free 1-877-231-6134.

https://www.nomorobo.com/lookup/844-805-7111

https://www.nomorobo.com/lookup/855-328-4888

https://www.nomorobo.com/lookup/844-517-8655

https://www.nomorobo.com/lookup/844-904-1444

https://www.nomorobo.com/lookup/972-441-0548

...

https://www.nomorobo.com/lookup/855-895-6786

(edit: formatting)

I found that strange, too. Apple made it seem like it was China only but it's not.

Those features of CallKit are what we (Nomorobo) use to stop the robocalls.

Completely agree. For the carriers, robocall blocking is not a technical problem, it's a legal/liability one.

This makes third party call blocking products a better/easier solution for carriers to recommend as a solution.

We updated the app based on that feedback.

We used to show "unblockable" because there was a problem with false positives. Lots of families had sequential numbers that were accidentally getting blocked.

Now, if you give us access to your contacts (local processing only, never transmitted to our servers) we can completely block them.

We (Nomorobo) protect you from both neighbor spoofing as well as "standard" robocalls. We add over 1,300+ new robocaller numbers every day. It's pretty crazy out there.

They are absolutely targeting cities with large Asian populations. It's not random.

This is the breakdown for incoming calls to the Nomorobo honeypot for 4/1/2018-4/23/18 that have called more than one line from 212-244-[0000-9999] (the last 4 digits change frequently, just like regular neighbor spoofing).

Data source: Our honeypot consists of over 300k lines from around the country that people have gotten rid of, mostly due to getting so many robocalls. It's the main weapon that we use to build our blacklist.

  to_npa	to_nxx	calls	lines	city, st
  646	233	1383	642	NEW YORK, NY
  347	218	935	783	BROOKLYN, NY
  415	965	266	266	BOLINAS, CA
  917	563	192	147	NEW YORK, NY
  718	878	176	152	FLUSHING, NY
  617	767	57	56	SOMERVILLE, MA
  562	200	56	56	LONG BEACH, CA
  626	427	50	40	LOS ANGELES, CA
  201	546	44	44	HACKENSACK, NJ
  323	203	19	19	LOS ANGELES, CA
  650	492	19	19	MOUNTAIN VIEW, CA
  832	293	15	13	HOUSTON, TX
  857	488	12	12	BOSTON, MA
  845	262	10	10	SPRING VALLEY, NY
  585	286	10	10	ROCHESTER, NY
  949	393	9	9	MISSION VIEJO, CA
  206	535	9	9	SEATTLE, WA
  267	457	8	8	PHILADELPHIA, PA
  716	989	7	7	BUFFALO, NY
  310	400	7	7	LOS ANGELES, CA
  510	250	7	7	OAKLAND, CA
  516	279	6	6	GARDEN CITY, NY
  929	200	6	5	FLUSHING, NY
  909	214	3	3	ONTARIO, CA
  315	982	3	3	UTICA, NY
  848	260	3	3	METUCHEN, NJ
  908	360	3	3	MILLINGTON, NJ
  301	825	2	2	ROCKVILLE, MD
  212	687	2	2	NEW YORK, NY
  202	813	2	2	WASHINGTON, DC

Nomorobo founder here. I'm the "robocall guy" that everyone quotes in the news.

Instead of just popping my head into every comment, I wanted to give some insight into what's actually happening out there.

Background: I won the FTC Robocall Challenge back in 2013. I turned my prototype/idea into Nomorobo, which is the leading robocall blocker out there. In 4 years, we've stopped over 630 million robocalls from reaching people.

I'll actually be testifying at next week's House subcommittee hearing on robocalls.

# Not picking up unknown numbers

Unfortunately, this is what people think is the best solution. Even the government gives this advice. #1 is to use a robocall blocker and #2 is to not answer numbers that you don't recognize.

That frustrates me to no end. That's not a good answer.

"Doctor, it hurts when I do 'this'. Then don't do 'that'."

I really get worried when people say they turn on Do Not Disturb. What if there's an emergency? You have no idea who needs to call you.

This is especially important for people with kids. Is it a school? Is it a neighbor?

This is an actual story that happened to me - no BS.

My Uncle wound up in the hospital last month. Ambulance had to come pick him up off the bathroom floor and everything. No one in the family knew it was happening.

I got a call from a number that I didn't recognize but, since I trust Nomorobo, I answered it. It was my Uncle telling me what happened, what hospital he was in, etc.

Damn good thing that I answered that call.

But the fun doesn't stop there.

A few hours later, I go over to his house to pick up a bunch of his stuff and bring it over to the hospital for him. While I'm getting things together, his old flip-style cell phone starts ringing. I figure it's one of his friends that's worried about him.

I answer it.

"Congratulations! You've won a free cruise."

# Neighbor Spoofing

Yep - if the number shown is close to yours and it's not in your contacts, it's probably a robocaller. But spoofing is the norm with robocall scams.

Our algorithm detects over 1300 new robocalling numbers every day and they're basically all spoofed.

Whatever number is shown usually can't be called back. It usually doesn't belong to the actual robocaller. And they usually try to make the call take a confusing journey through "the tubes" that's impossible to trace back.

Neighbor spoofing is really hard for carriers to stop because a lot of people have sequential numbers and they don't want to accidentally block good calls.

It's especially confusing when people don't understand what's going on and they call back the unknown number:

Person A: Why did you call me? Person B: I didn't call you. Why are you calling me? Person A: Because you called me. Person B: No, I didn't. Person A: Yes, you did. Person B: Leave me alone, crazy person. [blocked]

But, as an app on your phone, it's really easy for us to stop.

If you give us permission to look at your contact list (they never leave your phone and are never stored by us), then we can fully block all neighbor spoofed calls. If you don't give us that permission, we simply identify them as "Robocaller" whenever they call.

# Wasting their time

Don't waste YOUR time. It will not help. You are trying to warm up the ocean by pissing into it.

The scale that these automated callers work at is unbelievable.

According to our stats, 40% of all calls in the US are spam robocalls.

Someone mentioned Jolly Roger Telco. We worked with them this holiday season to make www.DoNotCallChristmas.com. It was fun and it makes people feel good but that's about the only impact it has on the problem.

# So...why don't the carriers just make the calls stop?

There are a lot of tech people here on HN. You know TFW someone says to you, "Oh, that's easy - you just hook up a database to a web page, right?"

"And put some that blockchains in there while you're at it."

Well, it's the same way with the phone system. It's not as easy as it looks.

The phone system has a birth defect. Call it one of the worst cases of technical debt, ever.

When it was first created, it was a closed, trusted system (with AT&T running the whole shebang). No one could imagine a situation where someone would lie about the caller ID so they didn't require it to be verified.

But then the system changed. Deregulation. The rise of VoIP. Interconnectivity.

Whoops. Toothpaste is out of the tube. It's tough to put it back in.

So, yes, secure and verified caller ID systems are being worked on (STIR/SHAKEN) but it's years off.

Will it reduce voice spam? Of course. But, this problem will NEVER go away.

People still get ripped off every day by thinking that the Nigerian Price is going to make them rich.

# What about the Do Not Call list?

The laws that govern automated calling were written back in the early 90's.

I was using a 14.4k baud modem and connecting to BBSes at that time. The internet as we know it didn't exist. People were still paying by-the-minute for long distance phone service. Then technology rocketed past regulations.

Today, the Do Not Call list is virtually useless against modern robocalling scammers.

At the House subcommittee hearing next week, I'm actually going to advocate that the government scrap all the existing laws and rewrite them with a simple, plain thought:

High frequency, automated phone soliciting should be opt-IN, not opt-out.

You must have the express written permission of the person that you are calling. Period. Full stop.

It doesn't matter if your number is on the Do Not Call Registry or not. It doesn't matter if you're calling a landline or a cell phone. It doesn't matter if it's a business or a residential line.

Got permission? OK. Don't have permission? Nope.

Note: If you're sending a purely informational message, this doesn't apply. I'm only talking about commercial solicitations here. Think of it like preventing modern day door-to-door salespeople. Ride hailing notification, doctor's office reminders, schools closing, etc. just aren't the same type of thing.

# Closing thoughts

So, in 2018, the best way to stop these types of scams is by using a robocall blocker. I'm highly biased here but I think Nomorobo is the best one out there. We understand the problem and the solution better than anyone else. It's completely free on landlines and has a 14-day free trial on mobile. On top of all that, we're extremely privacy friendly.

And, while I never blame the victims, there is a bit of a shared responsibility that we all have here. The more people that use robocall blocking technology, the less effective these scams will be. The less effective they are, the less of them there will be. It's a virtuous cycle.

Let me know if there's anything else that you'd like to dig into. I'm all ears.

Right now, we only grab one recording per phone number so that's the date that we recorded it.

But, the response to our sampling system has been really strong so we're expanding that to grab one recording per day per number. That way you can also go back in time and see the different scams that have been sent from the same number.

We're also building some deeper analytics so that you can see call volume by robocaller and graphs that show the changes over time.

The spammers rotate through new numbers every few hours. We're actually adding 1,300 new numbers per day and the full blacklist is over 700k entries.

As for getting connected to the phone system - Yeah, they have to jump on the phone network somewhere and, in theory, the best way to stop these guys would be to at the ingress point.

The problem is that the phone system is built for interconnection. Even just one bad actor letting the traffic on spoils the system. Layer on top of that the way the network routes calls through multiple hops through multiple carriers and tracking the calls back to the source is nearly impossible. Throw in common carrier regulations (you can't just willy nilly block calls coming over the network) and it amps up even more. Finally, allow all this to be done for fractions of pennies and you get the perfect storm for robocalls.

As for the neighbor spoofed calls, make sure that you enter your phone number in Nomorobo so that we can make sure we protect the correct number block ([Area Code]-[Exchange]-[0000-9999]). In our initial release, we were only able to identify these calls but not block them. It had to do with blocking calls from families with sequential phone numbers. But, in our last release, if you give the app contact access, we can now scrub those numbers and fully block the neighbor spoofed calls.

It's been a bit of a balancing act between being privacy conscious (not needing your email/phone number/invasive contact access) and getting the job done. The balance that we've struck is this - you don't have to give us any of that and you'll get really good protection. But, if you try out the service and start to trust us more, we can do an even better job.

And finally, yes - it's going to take a lot of effort to tackle this problem. While Nomorobo isn't perfect - admittedly, the sim ring landline version is just a crazy hack that the carriers can't stop - the past 4 years have seen some great progress in the fight.

As more and more people become aware of robocall blockers and we show that it's actually a very safe way to protect people, only then will the larger industry come along (kicking and screaming the entire way).