Hacker News new | past | comments | ask | show | jobs | submit login
On the Trail of the RoboCall King (wired.com)
80 points by rmason on May 9, 2019 | hide | past | favorite | 54 comments



Seems to me that the FCC doesn't actually want to stop these. Watch the senate commission deposition(?) of Adrian Abramavich. He says all these calls are routed through 5 or 6 tier-2+ VOIP firms who openly solicit robocall business and then blend the traffic to prevent the most obvious red flags. Just pull their licenses(?). Unless there's more to the story and everyone in the industry is getting rich from this, which sounds like is the case. Remember this is the same FCC that couldn't detect millions of fake anti-net neutrality comments. C'mon. Are we really dumb enough to think that they're that dumb?

If everyone in the industry is getting rich from this and the FCC is serving industry and not the people, then the plan of action would quite probably look like this:

1. Pass laws that make robocalls illegal to pacify the populace.

2. Charge one or two operators a year in civil court max, but not enough to actually deter people from doing it. And make sure to brand them names like "the robocall king" so that people think you've actually made a huge dent in robo-calling. Again, to pacify the populace.

3. Don't actually enforce the laws you passed on any meaningful scale and don't require technological changes which would stop this. Despite the fact that it doesn't happen in any other country, even third world ones, pretend that this is just a technologically intractable problem.

Pathetic.


No, this is not correct.

There have been several initiatives that the FCC as well as the FTC have done over the past 2 years.

They gave permission to providers to begin blocking unallocated numbers in 2017 which included IRS numbers and this reduced the number of IRS scam calls. Providers are not normally allowed to block calls so rules had to be formulated about when they could block calls like these.

The FCC authorized wireless providers to take measures to block spam text messages in 2018.

By the end of 2019, caller ID authentication is expected to be put in to use. The FCC cannot specify how providers are to implement a caller ID authentication system. An independent task force, the IETF, created an RFC for the STIR[1] and SHAKEN protocols to authenticate a caller's ID. These types of things have to take input from all involved parties and settle on a proposal after reviewing it and agreeing on it. The networks have agreed to implement it within their own networks first, at the behest of the FCC. This kind of system can't be implemented overnight and the FCC is not in a position to specify an implementation and force providers to use it.

In addition there have been a number of prosecutions of companies, like ABC Hispana Inc[2]. However, it is difficult to prosecute offshore providers in noncompliant countries although the FCC is proposing rules to allow it to charge such companies regardless.

[1] https://datatracker.ietf.org/wg/stir/about/

[2] https://www.ftc.gov/enforcement/cases-proceedings/152-3108/a...


Under Obama they made steps forward to stop these, penalties were drastically increased, and an actual investigation team was put together, but Trump defunded the efforts and now the complaint form leads to a massive master in pile with no hope of a single message being read.

The phone companies ARE able to stop the caller ID spoofing with a simple notch filter placed at the right point on the line, or packet filter on the right place on the firewall.

They could easily force businesses to give a valid return number on their calls and prevent jamming based caller ID spoofing, but instead they don't want to because these calls mean more money for them.


There are interesting correlations that lead people to believe the phone companies are doing more than merely enabling these criminals. It seems they are collaborating.

If you drive to a certain location with some level of frequency you will notice the location of the spoofed numbers are in those communities. This goes beyond neighbor spoofing, and suggests some level of information sharing between the robocaller and the phone carrier.

As of January, I started driving to Pleasanton, California every day for work. I also started visiting San Rafael about once month to visit friends who recently moved there.

In the last few months - almost every robocall I get is coming from Pleasanton or San Rafael prefixes.


>... but instead they don't want to because these calls mean more money for them.

This. If something is broken and nobody wants to fix it, follow the money.


The phone companies ARE able to stop the caller ID spoofing with a simple notch filter placed at the right point on the line, or packet filter on the right place on the firewall.

T-mobile already does, along with some other magic logic they have stopped almost all of the spam calls from reaching me. ...Occasionally they block my mom for a day or two, but it's worth it.


I have a t-mobile line and a Google voice number, I don't give out the T-Mobile number so 100% of legitimate calls come through Google Voice, but 100% of spam calls come through T-Mobile. Also I'm not sure when you're saying they added this magical filtering but I've tested spoofing calls to myself and other T-Mobile phones within the last few months and it works fine.


>Remember this is the same FCC that couldn't detect millions of fake anti-net neutrality comments.

Not couldn't - didn't want to.


That would be the point.


I wonder if one should not use a dialer to call them back, sending an automated message until someone listens and acknowledges? They have a huge outbound capability, but their weak spot is inbound and call completion - they expect basically no call to complete. So anything that keeps their agents busy will immediately reflect on the number of calls they make. Would it be legal?


I answer most robo calls and usually try to call back after I get them to hang up on me. The number is almost never in service. When it is and it leads to the scammer I'll sometimes continue calling and messing with them until my number is blocked by them. I've been messing with spam callers for more than 20 years. I wish more people would answer these calls and waste as much of their time as possible.


Not advisable to call them back from New Zealand at least. I've heard of a couple of people calling them back only to find out a month later that the number they called was actually a pay per minute number and they were charged upwards of $20 a minute.


Sometimes they leave a message on the voicemail, and in this case you do have a number to be called back. I wonder if it would be legal for you to recall them using a robodialer.

Say you implement something like this: https://www.wombatdialer.com/blog/blog/2017/03/17/outbounds-... this is a reverse IVR, that keeps calling until it gets an explicit acknowledgement. It is cheap to run (you set up a FreePBX somewhere), it does not tire, and can go on until it gets a confirmation.


It would need to be paired with something like Jolly Roger, above, which is darn good at spoofing a human for a while. It would need a variety of voices and scripts so the recipient humans wouldn't get trained on it too fast.


You could simply play a message of your voice that says "My number is 555-123-4444 please get me immediately off your list - press 7 to confirm". They will hang up and the dialer will call again. And again.


At least in the UK, the calling number is nowadays almost always spoofed.

I don't know enough about the telephone system to know if number spoofing is something providers could prevent?


Right but for the scam to work at some point they have to connect you to a human who asks for payment. So while the Caller ID may be spoofed the number embedded in the message wouldn't be.


Did you just fulfilled for "one ring" scam by calling them back?


I never called back a number unless I had an amusing conversation with someone first


I amuse myself by asking the "health insurance" and student loan callers for a number at which I can call them back. This generally causes an immediate disconnection. One guy was naive enough to give me a real number, but I never got around to hassling them.

In the days when the calls were for auto warranties, it was "What company do you represent, and in what state is it incorporated?" that caused them to disconnect.


I once had a solicitation for cable so I tried to get the guy to describe in as much detail as he would the porn options.

When I get calls from the home buyer scams I'll get to the point where they ask for my address. I'll make up something like 6843927991 Esplanada Terraced View Way Point Circle and I've never been called on it, they act like something is wrong with the system when they can't find the address.

Sometimes when I call numbers back I'll go right into a spiel asking if they're registered voters who want to see Trump president for life and what monthly support amount can we count on. I find it so amusing when I get responses like "this number can not receive unsolicited calls". I found for some reason people will usually stay on the line if you plow through the conversation, it's like they want to first explain why I shouldn't be calling them before hanging up.

For some reason my favorite name I've come up with for these people is Bobert Robertson. I'll play with them when they ask me to spell it, sometimes it's Bobrot Robyurtzon, the y is silent of course.

I've had people beg me to stop calling them, that I'm disrupting their work day. When you get into it it can be very amusing.


Isn't this what screen call is for Pixel?


The "in the wild" hack of the caller ID jammer is probably openly available if you look hard enough.

There are also likely phone system commands to quickly verify the incoming phone number a second time utilizing out of band signals. If how to derive how to do this, one might be able to detect spoofed caller ID and retrieve the actual source line information.

I wonder if either of these technologies could be used to detect robocalls.

Personally if I had the time and ability to write such a system, what I would do to incoming robocalls is go and route them (and pressing one if it is necessary) to an AI voice system just smart enough to pull the person's leg for a few hours making the person run in circles trying to explain the deal to what they think is a person who can't understand it. You know, robo the robo-call.


Something like https://jollyrogertelephone.com/ ?

If you haven't heard a few, listen to some of the calls on https://www.youtube.com/channel/UC3OxCWLEmoIhNMm-hnvBm9Q


For $20 US a year for an app, robocalls are down to a few a month from several a day on each of a VOIP and cell line. Nomorobo, Robokiller, and several more - do some research, read some reviews, and pick one. I only wish it was as easy to filter email spam for a 25-year-old email address. Telephone service providers may offer robocall filtering as well. One can deal with the problem now, or wait for Shaken/Stir, whichever.


Be super careful as you do that research - check the Terms of Service. Some, like Truecaller, are harvesting your call activity and network and reselling it.

It appears Hiya and Nomorobo have sensible policies.

However...

The problem is the completely randomized neighbor calls.

They are “calling from” real numbers belonging to real people.

Hiya Premium has neighbor blocking, but only prefix by prefix, and you can’t bulk add the prefixes.

It appears adding a prefix adds every individual number within that prefix to the phone’s block list, and each call block plugin can only block so many numbers, so the more prefixes you have, the more plugins have to be enabled.

“WideProtect” aims to simplify this, your mileage may vary:

https://itunes.apple.com/us/app/wideprotect-spam-call-blocke...


WideProtect almost looks like what I want, I wish you could just do regex filtering on the incoming numbers instead of this individual number crap.


It sickens me that one must pay to have this problem fixed. The FCC needs to step in and either require a fix or require the providers to setup customers with these services out of their own pockets.


I use "Should I answer?" On android, it's free for me and I block everything.

(not affiliated)


I pay for RoboKiller and still get 7-10 calls per day that make it through. It’s not a panacea.


Hiya worked the best for me.


Why are robocalls not a thing in my country? (Sweden)


Because (at least in Germany) it's illegal and comes with very high fines.

> telephone calls to consumers for sales purposes are illegal if the calling company is not in possession of an explicit and effective declaration of consent by the consumer

https://www.limegreenipnews.com/2017/08/germany-federal-netw...


Since a lot of the robo calls are part of scams and illegal, I don't think it's the fear of fines. I believe that market size and language barrier are a bigger issue: Plenty of people speak english, few speak german and even fewer are fluent enough in swedish to convince people to hand over their money.


The reason the number of robocalls exploded recently in the US is because the FCC's order defining what an autodialer is was overruled.

There is an interesting reply all episode about it: https://gimletmedia.com/shows/reply-all/awhk76/135-robocall-...


Might be a difference in the phone systems. Not sure if this is true anymore, but I've heard US caller IDs are easy to spoof, while it is basically impossible in Germany.

Also our regulatory bodies are most certainly stronger in this regard than the FCC.


I was getting what I think was Chinese calls a while ago, I'm guessing their dialler was accidentally calling the wrong country for a while.


In addition to the enforcement others mentioned, costs are higher.

Calls to Sweden mobile numbers are $0.07 to $0.20 per minute depending on the carrier, vs $0.01 to US numbers. Plus swedish speaking 'sales' talent is probably also more expensive than english speaking.


A lot of the replies suggest a language barrier being the reason, but we don't really get them here in Ireland, despite English being a national language.


Perhaps because the scammers only speak English? Most of them are in India and I don’t think Swedish is a strong suit of theirs. Just a guess.


Same here in Germany...


Developer of RoboStop here. If anybody here in the comments section happen to use an Android phone and are plagued by telemarketing calls from Indian dev shops offering to build you a website, check out my app! http://robostop.org. It's pretty simple, just hangs up on anyone not listed in your contacts. Very effective. Just make sure to turn it off when you order an Uber.

P.S. it's not on the Play Store anymore because I got booted off along with all of the other apps which access users CALL_LOG(s).


Is it just me or does it feel weird to download some random APK from a http site that then has access to my whole call log?


Say thanks to Google for requiring an exemption to access call logs and SMS on the Play Store.


This morning cops called me to tell me I had 5 min to move my car or it would get towed.

When my wife was pregnant the hospital called me to say she'd been admitted after falling in the street.

Surely hanging up on anyone not in your contacts is a bad idea?


I have to ignore numbers not in my contact list, I get 10+ scam calls a day.

I kind of worry about those situations but I'm just as likely to miss a call being on the phone to these arseholes anyway.

I really want the ability to block certain country codes on my phone, 99% of the scam calls are from outside of NZ.


I would not want that for the same reason. It's not great but I deal with them by 1) generally keeping my phone on silent and 2) only answering calls from people in my contact list. If they really need to reach me they will leave a voice mail, if not then it most likely wasn't important.

I'm not sure a cop would leave a message in the situation you mentioned above but otherwise it works OK. Some of the robo callers end up leaving a message but it's almost always 2 seconds or less so I don't bother listening, anything that short just gets deleted.


I'm getting daily calls where they leave a voicemail in Chinese. I live in a metro area where at most there are 0.05% Chinese speakers. The costs must be so low they just do not care.

Course I block the numbers but they seem to have an almost endless supply. Interestingly my Pixel doesn't report the call ever as suspected spam.


Calling to (continental) US numbers is easy to find for $0.01/minute, billed to the second. If you've got volume, it's cheaper.

Blocking numbers of spam calls is like blocking numbers of spam email; most of them are spoofed so it's most likely not to help.


I don't understand why the robocalls are a thing. Why are robocalls able to cause such a stir? Why are they referred to as "robocalls" in the first place, when this is such a lowbrow term that it might imply that the victims are part of the problem, due to an inability to adequately cope with something that requires very little effort to deflect.

To give them a special name, in and of itself, raises phonecall spam to a new level of shenanigans, when this is something of a script kiddie skill. Same as email, this is a mild nuisance. It's not some crisis tearing at the fabric of society.

It's sort of like complaining about how windows are transparent, and that you shouldn't need curtains to prevent people from looking inside. It's like there's this expectation that it should just be illegal to look inside any window.

If it's a phone number, people are going to call it. If you don't want to be disturbed, don't let your phone ring? If you only want to be disturbed by familiar individuals, only ring for those numbers, or screen voice mail?

Seems... almost too easy to deflect this sort of thing.


Except for literally causing financial harm to the elderly that they prey on. With email there has always been extra scrutiny, after all it is the tech literate who were and are most likely to use email. And by literate, I mean can turn on their computer and visit Gmail. I doubt we will see the similar scenario with email due to spam being commonplace since the beginning.

Not to mention every other person is actively bothered in the real world by a real alarm instead of just scrolling past while checking their email. Email spam vs robocalling is not even comparable in terms of the effects. I miss real phone calls from people, such as job offers, due to spammers forcing me to send everything to voicemail. I'm not a hateful person by any means, but I honestly wish the absolute worst on anyone who is behind scamming robocalls purely due to the amount of minor annoyance built over time.


From TFA: Emergency room doctors, nurses, and first responders were getting delayed alerts. This was not just an annoyance; it was a matter of life and death.

What is your "almost too easy" solution? Block all local calls? Have you applied for a job and expected a call back only to be directed to a cruise/timeshare?


Or they’re showing up a bit groggier on their next shift because their sleep/nap got disjointed.


Because, like spam email, it only has to work for a tiny fraction of a percentage of targets to be profitable, and enforcement is rare.

Except it's more annoying than spam email because it actively interrupts people.

And since origins are spoofed, I usually can't determine if it's a robocall unless I answer. Especially if you are expecting unknown number calls (selling something, etc.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: