Number substitution: how it works and what is dangerous

[Cloned Boy]

How does phone number spoofing work?​

A phone call has a Caller ID identifier, which can be used to both identify the number of the caller and transmit your outgoing number. Caller ID is responsible for displaying the number on the smartphone screen during an incoming call.

Using this identifier, attackers can replace their number by replacing it with another one when calling. This becomes a way to carry out various fraudulent schemes.

To change the Caller ID, it is enough to use the services of telephone operators and order SIP telephony, one of the protocols for exchanging data on the network. This service allows you to edit the characteristics of voice calls, including the Caller ID itself. Simply put, the user can come up with and enter almost any numbers (usually on the provider's website), which will replace his real number. The composition of the "new" number can be arbitrary and depends only on the imagination of the user ordering such a service.

Fraudsters can use substitution of numbers:

• Another subscriber, either accidentally or intentionally, if they plan to call on behalf of a specific person, such as their family or friends.
• Large companies, including numbers of banks and other organizations.
• "Beautiful" numbers containing a large number of zeros or other identical digits, which allows scammers to gain more trust due to the association with hotlines.

Well-known examples:

One large bank allowed you to find out your card balance by replacing your number with a known client's cell phone number and calling an automated number. This only worked for regular (non-premium) accounts, but that's the bulk of the bank's clients.

For about a year, a scheme of ordering a car at the expense of a large company worked for a taxi service if calls were made by substituting a number known to the operator. The carrier's employees only sent the company invoices for the services allegedly provided to it.

The potential losses and problems in these cases are difficult to overestimate.

Is it possible to use the number substitution service myself?​

Anyone with access to telephony protocols can replace Caller ID. It is not necessary to use special software for this. Some services are available from telecom operators, and they can be used without leaving home. Others are used with the connivance or closed agreement with the provider. The popularity of number substitution is due to several factors:

• It can be used for legitimate purposes and was originally provided as a service for businesses. Large companies can use number spoofing to have their employees call from a common number that customers will identify as the official number of the organization.
• The process of providing the number substitution service and using specialized software for this is not a crime. Liability arises only in the case of using a substitution number for fraudulent purposes. Substitution of a number may also be considered prohibited in cases where it is used by collection agencies or companies advertising their goods and services.

For these reasons, almost anyone with the means to do so can change their number. Virtual operators charge a fee for the change service. You can also manipulate Caller ID using special software, which is also freely available on specialized resources. In recent years, number change has become available through bots in the Telegram messenger, which also use IP telephony to change the number. However, using such a service is much easier and faster than using regular services.

The dangers of using spoof numbers​

Cellular operators recognize number substitution as a current threat to subscribers and businesses. The following are cited as arguments:

• Potential damage and financial losses to individuals;
• Reputational risks for companies whose phones are used for substitution;
• Subscribers' distrust of telephone calls in general.

The latter factor directly affects the profits of the operators themselves, so more and more attention is paid to means of counteracting substitution. If this is a good measure to combat violations, then unnecessary problems may arise with the legal use of technology.

It is noted that the mobile numbering of the Big Four operators is protected by verification systems, but the danger of using number substitution often comes from other mobile operators, which still creates risks for business.

The fight against substitution is carried out not only by telecommunications companies, but also by banks, government agencies and other organizations. Almost every major player in the market has its own anti-fraud systems, but in 2023, counteraction to number substitution is used especially actively.

Measures to combat number substitution in 2023​

Since December 2022, a single platform for verification of telephone calls (EPVV) "Antifraud" has been in operation in Russia. The system was launched by a division of Roskomnadzor and is designed to unite all telecom operators, not only those included in the "Big Four", under one flag.

The task of the Antifraud system is to check that the subscriber is actually making a call. This is done by receiving confirmation from the operator that owns the number from which the call is made. This check is done in real time, and then the information is sent to the operator that owns the number being called. Based on this information, the operator decides whether to allow or block the call to its subscriber.

A unified database of calls in a near-real mode is currently being created, where calls from all telecom operators connected to the system will be stored. The database will allow government agencies to significantly reduce the time it takes to consider incidents, as well as identify operators who have violated the rules for skipping a number.

All operators are required to connect to the Antifraud system. All operators must do this before March 1, 2024, otherwise the company will receive a large fine: from 600,000 to 1,000,000 rubles for legal entities. The more operators log into the system, the more active and accurate the verification is. After this, a call from a substituted number will simply not reach the addressee. In addition, there is a unified verification system of the State Radio Frequency Center, to which operators are also connecting en masse.

However, small regional telecom organizations have difficulties connecting to the system, since this requires a special software and hardware complex, or a SaaS solution in the cloud. And if large mobile operators already have anti-fraud platforms, then connecting small companies is associated with certain obstacles: they simply do not have the technical capacity for this.

Accordingly, for now, fraudsters still have loopholes to use number substitution, but the further the unified anti-fraud system develops, the fewer of these loopholes will be available, and Russian residents will not have to deal with unwanted, or even dangerous, calls.

The solution to the problem of number substitution and mistrust of the call source opens up new opportunities for subscriber identification and integration of telephone systems with other systems and services:

• Automatic verification of the identity of subscribers when providing services based on the telephone number;
• Automatic routing of calls to appropriate services based on the phone number;
• Confirmation of phone numbers and subscriber actions in call-based services - CallPassword ID.

CallPassword ID is a new verification method where the user initiates a call to a number generated by an algorithm. The system checks the user's number and the number being called, ensuring fast, convenient and secure authorization. More details on how the method works are described in this article.

10 Best Call Spoofing Apps for Android

Source