Crooks Trick Your Caller ID for Identity Theft
See the story here from ABC NEWS!
Spoofing Services Let Users Alter Caller ID; Learn How to Protect Yourself from Fraudulent Phone Scams
By ELISABETH LEAMY
ABC NEWS Consumer Correspondent
April 13, 2009—
Many of us rely on caller ID to screen our calls and protect our privacy, but maybe you shouldn't trust that little digital display. It turns out that when you pick up the phone, you can't always believe your eyes -- or ears.
Why? Because of a technological trick called "Caller ID Spoofing" that allows callers to change the name and number that come up on the display when they call someone.
It used to take sophisticated technology and expertise to "spoof" a number, but commercial spoofing services have brought the trick to the masses. Now, for as little as $10 an hour, customers can dial into a spoofing service that gives them the ability to change the number they appear to be calling from.
Spoofing services even offer you the ability to disguise your voice. A man can choose to sound like a woman, and vice versa.
Lancaster, Pa., Gets Spoofed
Crooks using their own spoofing equipment recently contacted hundreds of Lancaster, Pa., residents -- including Gail Gray, the mayor's wife. They pretended to be with a local bank and asked for sensitive account details.
Gray told ABC News she came close to giving the con artists sensitive financial information. "It threw a scare into me initially," she said. "It's like they knew they had a bite on the line and they were ready to hook one."
As the economy has gone down, financial scams have gone up, and this is one of the ploys the crooks are pulling -- spoofing the phone numbers of financial institutions to gain people's trust and then simply asking people for their financial details.
"We have got to update the laws in order to keep up with the sophistication of the criminals," said Sen. Bill Nelson, D-Fla.
Florida is the only state that has banned caller-ID spoofing. Florida legislators made spoofing a first degree misdemeanor punishable by up to a year in prison. The law went into effect in October 2008, and the spoofing industry is suing to overturn it. Idaho and Alaska have also considered anti-spoofing laws, but have not finalized any bills so far.
Click here to find out how to protect yourself from spoofing scams.
Spoofing Industry Defends Services
The U.S. Senate is considering a bill that would make only the fraudulent use of spoofing illegal. Nelson explained that caller-ID spoofing is like a crowbar. It can be used as a legitimate tool or to commit crimes.
"We need to give prosecutors the updated tools to go after this new, very sophisticated criminal that is using technology now in the place of the crowbar," he said.
Attorney Mark Del Bianco, who represents several spoofing companies, said banning spoofing would be an unconstitutional violation of free speech.
"There are many people that feel that because it can be misused you ought to make it as broadly illegal as possible, and that is just wrong," said Del Bianco.
Del Bianco listed several legitimate uses of spoofing. For example, secret shoppers that companies hire to anonymously test customer service sometimes spoof their numbers to hide their identities. Battered women's shelters use the technology to protect their residents. And business executives have used it to display their corporate phone number when they are calling somebody back from a private cell phone. But, of course, pranksters love the service, too.
Del Bianco said commercial spoofing services cooperate with law enforcement subpoenas. He said investigators are pleased when crooks use commercial spoofing services instead of their own spoofing technology, because the spoofing companies keep complete records of every call and make those records available to authorities.
Del Bianco said his clients offered to block bank phone numbers from their services, so callers would not be able to spoof them. But banks did not want to provide the numbers, so the effort stalled.
ABC News asked Del Bianco to explain the legitimate purpose of the voice-changing feature, which allows callers to disguise their voices and he said, "There may be none," but added that it's included as on option because "it's a part of the software."
ABC News tried out a spoofing service we found online. For $10 we purchased an hour of talk time. We then dialed the spoofing company's toll free number.
First, a recorded message prompted us to enter the number we wanted to call. Then another prompt allowed us to enter the number we wanted to appear to be calling from. A third message asked us if we wanted to disguise our voice. We then called co-workers and, sure enough, we were able to make it look like we were calling from a major national bank, the Internal Revenue Service, even the CIA.
How to Protect Yourself From 'Phone Phishing'
When somebody has the ability to alter the number that comes up on caller-ID, there's the potential they will abuse that power. Scammers who spoof numbers are usually calling people up and fishing around for personal financial information they can use to steal their identities, known as "Phone Phishing."
Every year, millions of Americans fall victim to phishing scams over the phone and online. And e-mail addresses can be "spoofed" too! There are several ways to protect yourself:
*First and foremost, never give out financial information over the phone unless you initiated the call.
*Keep in mind that your bank already knows your account number, etc., so would not be asking for it.
*Be wary of callers who ask for "confirmation" of personal information, such as social security numbers, credit card numbers and credit card security codes.
*Don't call phone numbers that are listed in e-mail messages or links. Instead, look up the number yourself online or go low tech and find it on your statement.
*Ask the callers if you may phone back with the information they have asked for, then call the institution directly to confirm.
*If you have already given your information to someone over the phone, contact the real company directly right away to alert them that you may have been scammed.
*Finally, monitor your bank accounts and credit reports to be aware of any suspicious activity.
You can find additional information about spoofing and phishing here:
The Federal Trade Commission is the nation's identity theft clearinghouse: http://www.ftc.gov/bcp/edu/microsites/idtheft/
The National Consumers League is a nonprofit organization that tracks fraud: http://www.fraud.org/tips/internet/phishing.htm
To order your free credit report and check it for suspicious activity: www.annualcreditreport.com
ABC News' Kim Berryman contributed to this report.
Copyright © 2009 ABC News Internet Ventures
By ELISABETH LEAMY
ABC NEWS Consumer Correspondent
April 13, 2009—
Many of us rely on caller ID to screen our calls and protect our privacy, but maybe you shouldn't trust that little digital display. It turns out that when you pick up the phone, you can't always believe your eyes -- or ears.
Why? Because of a technological trick called "Caller ID Spoofing" that allows callers to change the name and number that come up on the display when they call someone.
It used to take sophisticated technology and expertise to "spoof" a number, but commercial spoofing services have brought the trick to the masses. Now, for as little as $10 an hour, customers can dial into a spoofing service that gives them the ability to change the number they appear to be calling from.
Spoofing services even offer you the ability to disguise your voice. A man can choose to sound like a woman, and vice versa.
Lancaster, Pa., Gets Spoofed
Crooks using their own spoofing equipment recently contacted hundreds of Lancaster, Pa., residents -- including Gail Gray, the mayor's wife. They pretended to be with a local bank and asked for sensitive account details.
Gray told ABC News she came close to giving the con artists sensitive financial information. "It threw a scare into me initially," she said. "It's like they knew they had a bite on the line and they were ready to hook one."
As the economy has gone down, financial scams have gone up, and this is one of the ploys the crooks are pulling -- spoofing the phone numbers of financial institutions to gain people's trust and then simply asking people for their financial details.
"We have got to update the laws in order to keep up with the sophistication of the criminals," said Sen. Bill Nelson, D-Fla.
Florida is the only state that has banned caller-ID spoofing. Florida legislators made spoofing a first degree misdemeanor punishable by up to a year in prison. The law went into effect in October 2008, and the spoofing industry is suing to overturn it. Idaho and Alaska have also considered anti-spoofing laws, but have not finalized any bills so far.
Click here to find out how to protect yourself from spoofing scams.
Spoofing Industry Defends Services
The U.S. Senate is considering a bill that would make only the fraudulent use of spoofing illegal. Nelson explained that caller-ID spoofing is like a crowbar. It can be used as a legitimate tool or to commit crimes.
"We need to give prosecutors the updated tools to go after this new, very sophisticated criminal that is using technology now in the place of the crowbar," he said.
Attorney Mark Del Bianco, who represents several spoofing companies, said banning spoofing would be an unconstitutional violation of free speech.
"There are many people that feel that because it can be misused you ought to make it as broadly illegal as possible, and that is just wrong," said Del Bianco.
Del Bianco listed several legitimate uses of spoofing. For example, secret shoppers that companies hire to anonymously test customer service sometimes spoof their numbers to hide their identities. Battered women's shelters use the technology to protect their residents. And business executives have used it to display their corporate phone number when they are calling somebody back from a private cell phone. But, of course, pranksters love the service, too.
Del Bianco said commercial spoofing services cooperate with law enforcement subpoenas. He said investigators are pleased when crooks use commercial spoofing services instead of their own spoofing technology, because the spoofing companies keep complete records of every call and make those records available to authorities.
Del Bianco said his clients offered to block bank phone numbers from their services, so callers would not be able to spoof them. But banks did not want to provide the numbers, so the effort stalled.
ABC News asked Del Bianco to explain the legitimate purpose of the voice-changing feature, which allows callers to disguise their voices and he said, "There may be none," but added that it's included as on option because "it's a part of the software."
ABC News tried out a spoofing service we found online. For $10 we purchased an hour of talk time. We then dialed the spoofing company's toll free number.
First, a recorded message prompted us to enter the number we wanted to call. Then another prompt allowed us to enter the number we wanted to appear to be calling from. A third message asked us if we wanted to disguise our voice. We then called co-workers and, sure enough, we were able to make it look like we were calling from a major national bank, the Internal Revenue Service, even the CIA.
How to Protect Yourself From 'Phone Phishing'
When somebody has the ability to alter the number that comes up on caller-ID, there's the potential they will abuse that power. Scammers who spoof numbers are usually calling people up and fishing around for personal financial information they can use to steal their identities, known as "Phone Phishing."
Every year, millions of Americans fall victim to phishing scams over the phone and online. And e-mail addresses can be "spoofed" too! There are several ways to protect yourself:
*First and foremost, never give out financial information over the phone unless you initiated the call.
*Keep in mind that your bank already knows your account number, etc., so would not be asking for it.
*Be wary of callers who ask for "confirmation" of personal information, such as social security numbers, credit card numbers and credit card security codes.
*Don't call phone numbers that are listed in e-mail messages or links. Instead, look up the number yourself online or go low tech and find it on your statement.
*Ask the callers if you may phone back with the information they have asked for, then call the institution directly to confirm.
*If you have already given your information to someone over the phone, contact the real company directly right away to alert them that you may have been scammed.
*Finally, monitor your bank accounts and credit reports to be aware of any suspicious activity.
You can find additional information about spoofing and phishing here:
The Federal Trade Commission is the nation's identity theft clearinghouse: http://www.ftc.gov/bcp/edu/microsites/idtheft/
The National Consumers League is a nonprofit organization that tracks fraud: http://www.fraud.org/tips/internet/phishing.htm
To order your free credit report and check it for suspicious activity: www.annualcreditreport.com
ABC News' Kim Berryman contributed to this report.
Copyright © 2009 ABC News Internet Ventures
