Hacker News Reader

Comment by ceejayoz | Hacker News Reader

It's absolutely trivial. https://en.wikipedia.org/wiki/Caller_ID_spoofing

> Providers which market "wholesale VoIP" are typically intended to allow any displayed number to be sent, as resellers will want their end user's numbers to appear.

I've gotten calls from banks' 1-800 numbers that were 100% definite scams this way.

View on HN

..and there are plenty of non-nefarious reasons to want to spoof numbers. I used to have a VOIP setup at home that, when I dialed out, the call would appear to come from my cellphone[0]. Google Voice used to be able to do that too (no idea if it still does). Businesses often use this to have all their calls appear to come from the main office line or a 1-800 number. Or, when forwarding a call, you could make the 2nd leg outbound call appear to come from the original caller instead of the forwarder, things like that. Unfortunately as with so many things, bad actors are going to ruin it for everyone.

[0] I also found out that if I dialed my cell phone voicemail number from this VOIP phone, it bypassed my security code and went straight to my mailbox - since the outgoing number matched my cellphone number, it assumed it was me calling. A quick experiment showed I could then access anyone's voicemail (on that carrier at least) by simply setting my outbound number to appear as their cell number...

Such cases could be handled if there were a way to verify that a spoofed number is an authorized use. Your cellphone number belongs to you. Some bank's 800 number does not. What we need is a mechanism that prevents the scammers from lying while still permitting setups like yours.

I mean, that's what STIR/SHAKEN do.

> plenty of non-nefarious reasons?

aren't they all variations of "both numbers are provably yours"?

Define provably and yours.

When forwarding a call, the origin is not yours. When calling "in the name" of the company's switchboard, the number is not yours. When I use a number which is actually mine but comes from another country, it's not really provable.

Every provider should be responsible for verifying that their downstream customers are legitimate. If they deliver junk on behalf of their customers, they should get banned. That's how this problem gets solved. Your provider doesn't want to get black-holed, and now has an incentive to make sure your VOIP system is legitimate.

I fully support this behavior, however from what I read about Australias wiretap laws, they can't check the source number without a warrant :|

Reply on news.ycombinator.com