If a Caller Says, 'I Am with the IRS,' He's Not

Fortunately, I came to the opposite (and correct) conclusion, seeing as how I had received the call 30 seconds after attempting to use my Chase card for a large international purchase online and was able to quickly get that issue sorted. Still, it seems to current state-of-the-art that the rest of the bank is not aware of the phone numbers used by their fraud departments.

Searching for that phone number will (if it's legit) likely point to a contact page on the bank's website.

The phone companies are required to keep call records for at least several years. I tell the IRS investigator that I got such a call, and now they request the records from the phone company.

It's the same for robodialling. The FCC or anyone could put a major crimp if they wanted to, but no one really digs into complaints very much.

If any laws were to be changed I'd mandate a mandatory "This is the number the caller chose to identify oneself with" sticker around caller ID display on any phone witch such a feature.

Most non-residential buildings have a PBX which is interfaced with the PSTN (actually, a telco like AT&T) via some "trunking" system. Trunking systems, like SIP (which runs over IP on the regular old internet) and PRI (which runs over a T1), unlike simple analog circuits, carry multiple calls for multiple numbers at the same time.

The telco decides internally which PBX a call will be routed to, then presents the audio stream and signaling data (caller ID, destination phone #) to the PBX, which can do pretty much whatever it wants in response.

In a typical business installation, some numbers might be routed directly as calls to specific people's extensions (we call these DIDs), while others might ring several phones at once (and go to the first person to answer), a call queue, an IVR menu, a prompt to "dial your party's extension number," etc.

Or you could do something exotic, like Twilio.

The PBX is also responsible for connecting outbound calls to the outside world. It sends signaling data (CID, destination phone #) to the telco along with whatever audio it pleases, and the telco responds accordingly.

Hundreds of different phone numbers might route to a PBX. No one except the PBX is in a position to know which one makes sense to send as caller ID.

You might say we should only let PBXes send CID of numbers which are routed to them. But this breaks a use case where a business with many branch offices wants the same caller ID (in at least some cases) on outgoing calls from all its locations. To present the "main" number, you would now be forced to route the call over the internal network (typically a VPN, or else a leased line) to the main location's PBX, then out its trunk. This can get really hairy as you have a lot of load on this device as well as a single point of failure for potentially hundreds of locations.

So to support lots of different branch offices presenting the same CID, we now have to be in the business of maintaining a list of authorized CIDs we can send on a specific trunk line. Could it be done? Absolutely, but it isn't simple and telcos don't seem to think it's worth the effort/overhead. And all it takes is one telco who doesn't implement this requirement to make it worthless. (Just run your call spoofing website off an Asterisk instance trunked to that telco).

It might be nice to have a WHOIS equivalent for telephony - some way to find out the legal name of the entity which pays the bill for receiving calls at a specific number - but no one has gone to the trouble of creating an exhaustive database and forcing telcos to participate in it.

The scammers are definitely using a VoIP service around here anyway...

Though my understanding is that ANI isn't blockable by the caller. So if you have a toll-free number, you can see the calling number for callers that have blocked their caller id.

Love GV been using it for years.