VoIP Call Spoofing: Understanding the Threat and Protecting Your Business

Spreading Call spoofing has become one of today’s most disruptive threats to modern communication systems. With more businesses than ever using VoIP calls to handle customer communications, scammers have found ways to spoof the display name information and trick recipients. For any organization that desires to safeguard its reputation, its customers, and its bottom line, it must understand not only how call spoofing works but also understand how this is related to number display manipulation, how to use a VoIP spoofing attack, and how to recognize a neighbor spoofing attack.

What is Call Spoofing and How Does it Work?

When someone calls and sends details to the caller’s phone screen, and the recipient sees it as a different number than the one calling, the phone is ringing with a call you did not make. This is called call spoofing. The tricky part is that attackers trick the signaling protocols to display a different number on the recipient’s device, causing the caller to appear as a trusted number, a store, or a government body. This depends greatly on the way caller ID data is managed within modern telephony networks, as the display name and number may be different from the real point of origin. All of these deceptive calls are made with an automated dialing system, a spoofing application, and SIP headers spoofing.

They are typically part of a robocall campaign that targets several thousand numbers.As analog phone exchanges have fallen out of use, so has spoofing, affecting almost every industry that uses outbound or inbound telephony.

The Role of Caller ID in Spoofing Attacks

Caller ID technology was created to help individuals recognize who they have received a call from before they answer. But this trust is exploited by call spoofing that modifies the voice call approval process to present the caller with a known area code, company, or number that it shares with a recipient’s contact. This data is sent with the call; it is not confirmed, meaning it can be put in and taken out with minimal effort, particularly on Internet-based calling, which can be manipulated more easily than a landline analog. This lack of verification is very much relied on by phishing and vishing operations to establish a false credibility.

Some of the reasons it is so easy to exploit caller ID are:

It is passed as untrusted metadata, not as trusted information.
The legitimate entries already exist and make it hard for the user to detach.
Older infrastructure was never put in place to support identity verification.
Any new message that shows on their screen is accepted without questioning.

How VoIP Calls Make Spoofing Easy

Since Internet-based telephony, it has been much easier to spoof than with the older analog systems. The caller ID in a VoIP calls is basically a field of data that is delivered along with the connection request, and many VoIP providers can send an arbitrary field without mandatory verification. It’s a really nice flexibility that is often misused because it was designed so that business entities could display their main number on the public display rather than their own extension. Low-cost VoIP plans, open-source VoIP software, and cloud-based dialers are used by attackers to create large amounts of spoofing traffic. Multiple carriers are required to send these calls through to the recipient, and tracking them to their origin is much harder compared to the traditional phone system, providing scammers with a layer of anonymity not normally available.

Some of the reasons the VoIP calls are appealing for fraudsters are:

Easy installation or entry, many platforms provide free or near-free trial accounts available
Quick access to bulk-dialing software and pre-made scripts.
Multicarrier routing is used to hide the real origin of a call.
It takes little to no identity verification to set up an outbound calling account.

Understanding VoIP Spoofing Techniques

The most common form of VoIP Spoofing is the alteration of SIP (Session Initiation Protocol) headers the signaling protocol used to set up and route Internet-based calls. These headers can be edited so that, regardless of where the call is originating, the attacker may present any number. There are a number of tools available on the market that promise to be a handy business service for changing outbound numbers, but often are used for impersonation and fraud. Things that are related include SIP trunking, IP-based routing, soft phone applications, and related aspects of how spoofed traffic is transferred across networks to a victim’s device. As the cost of the VoIP infrastructure and its availability have dropped significantly, the approach is now the foundation of most big-scale telecom fraud operations of today.

Typical technical approaches in VoIP Spoofing involve:

Attempt to modify the originating number in SIP headers.
Use of gateway providers that don’t validate outbound caller information.
Auto-dialers paired with number-spoofing scripts to run large campaigns.
Taking advantage of the weak security points of the connection between carriers.

What Is Neighbor Spoofing and Why Is It Dangerous

Neighbor spoofing is a type of fraud that uses a number with the same area code and local prefix as someone the user calls, so that it appears as if it is from a neighbor, colleague, or local company. For the most part, it will make it much more likely that someone will respond because people are more likely to answer calls from their own community. Neighbor spoofing has been one of the more popular methods for robocalls, insurance sales, and phishing, and is a direct threat to building trust between people and their phone screens.

This strategy is so powerful because of a mental shortcut used by people, that they assume anything with a local prefix is a trusted caller. This is being addressed by regulators and carriers through authentication requirements.

Do you know what signs to look for when calls are spoofed?

It is possible to avoid costly errors if manipulated calls are detected promptly. Some signs to look for are:

Unusual telephone inquiries for a reaction to a report for urgent response.
Inconsistent voicemail messages, when the notes or voice greeting are not appropriate for the business or user being called.
Unrecognized callback numbers.
Repeated calls from numbers that appear to be local but end up calling businesses unrelated to the caller.
Time delay or responsive pauses at the beginning of the discussion.
Requests for sensitive information/payment/accounts on an unsolicited basis.
Rapidly trying to decide without checking out the caller first.

Carriers can also report these at the Do Not Call registry, which also enables regulators to detect new fraud schemes.

How Call Spoofing Affects Businesses

If the company’s actual number is compromised by fraudsters, there are implications beyond the fraudulent phone call. The effects are normally noticed in several ways:

Loss of customer faith despite the company’s innocence in the matter.
Increased complaints, telephone numbers blocked, and low call response flags.
Damage to reputation via reviews, word of mouth, etc.
Miss out on lost business opportunities when callers do not answer incoming calls.
Identity is used over and over incorrectly and puts businesses at regulatory and TCPA risk.
More customer service time sis pent on working with fraud.

These are just a few consequences illustrating the importance of proactively protecting as well as reacting to damage.

How to Avoid Fraudulent Calls and Safeguard Your Business

There are several steps that businesses can take to mitigate exposure to fraudulent phone activity:

Please implement STIR/SHAKEN call authentication standards that check outbound numbers prior to them reaching the recipient’s device.
Work with a reliable communication platform to obtain verified registration of numbers, live monitoring of calls, and other verification calling infrastructure, such as Dialinger.
Periodically review outbound number usage in each department and campaign.
Inform staff/customers of common fraud schemes and how to identify them.
Ensure that suspicious activity is reported to carriers and regulators in a timely fashion.
Implement and/or adopt encrypted signaling and cloud telephony best practices for all communication channels.
Continuously check call measurements to detect exceptional traffic levels early.

When infrastructure is authenticated with proactive monitoring provides a dependable way to protect its brand integrity, customer trust, and communication platforms against the increasing tactics of fraud.

Why Dialinger?

The key to impersonation prevention is who and what touches your communication infrastructure, and this is where Dialinger’s security architecture shines through. Secure device access architecture takes the same authentication-first philosophy approach that protects against spoofed calls to the phone lines to all endpoints connected to the platform, not just the phone lines. There are a couple of reasons for this: