Hacker News Reader

Comment by Clubber | Hacker News Reader

I've recently had a bunch of calls and it seems like the callers are spoofing other people's numbers. I came to this conclusion when I didn't answer and called back. It was just a regular person who didn't know anything about it. A few days later, someone called me thinking I was robo calling them.

View on HN

Yeah this is called 'neighborhood' spoofing - they do it to get numbers similar to yours (sometimes they'll even appear as a known contact).

I use an app called nomorobo ($2/month) that's basically a blacklist that gets continually updated to block these calls prior to ringing my phone. The way they deal with the neighborhood spoofing is having local access to your contacts so they don't accidentally block any real numbers (though those that happen to be an exact match will go through).

My spam calls went from one to two a day to zero.

I've been using a free alternative to Nomorobo called Hiya that's been working really well, for what it's worth.

I think Hiya uploads your contact list to the cloud - I'd rather pay the $2/month rather than rely on an unknown business strategy.

Agreed, but how do you know for certain they don't surreptitiously upload your contacts after you have granted permission?

Sounds like you are on iOS?

Interesting, but honestly 2$/month seems very high unless you get a lot of these calls.

2$/month is not “very high” unless you’re living in the third world.

I don’t mind paying it either since I can report numbers that get through to their blacklist. I feel like I’m fighting back.

It's high when you're basically paying because of a fatal flaw in the telecom system.

I’d prefer just an iOS whitelist (which seems like a much easier solution to this problem) - but this doesn’t exist.

The do not disturb work around mutes all notifications which makes it useless for me.

Yes. I called a number back one time when I saw that it had a Facetime option. I figured it must be a real person. Somebody answered my video call and they weren't very happy with me.

They've been spoofing numbers for quite some time. It only stands to reason that randomly generated spoofed numbers will be numbers belonging to other owners of phones. They think they're being clever about it: use the same area code and exchange numbers as the target, and randomly generate the final digits, hoping you'll think you know the caller and will answer.

I actually use this to screen calls because my exchange and area code are from T-mobile in Pierce County WA circa 2003 and I've long since moved away from that area.

The strategy falls flat when calling a cell phone, but seems to make a lot of sense when targeting landlines. A call from "someone around town" seems worthwhile to pickup.

Add in the fact that people with landlines are more likely to be older people whose priors expect a human to be calling, and the only real question is why don't the spammers catalog and then exclusively target landline prefixes with this method.

It seems like ILECs could start offering a service based on ingress filtering source addrs based on numbers they know haven't been ported out, but Ma Bell is the antithesis of innovation.

I get robocalls "from Quincy, Mass" on my iPhone which has a Quincy number. I haven't lived there in 7 years and have no genuine interaction with anyone there.

It's been years since I looked at any of the telephony standards but... why is phone number spoofing still a thing?

Your telco knows what phone number you pay for. Can't they just not connect calls that claim to be coming from not-that-number?

This works fine for calls from your landline or cellphone. It doesn't work as well go businesses which may legitimately split incoming and outgoing service, so the outgoing carrier really has no way to know what source numbers are legitimate. There's also a pretty big business in traffic resale, and none of those guys have any idea.

What would be more useful is accessible path information, so I can complain to my carrier about a call, and they can find out where it came from and throw people or companies off the network.

"so the outgoing carrier really has no way to know what source numbers are legitimate."

It shouldn't be difficult to get a single number that is legitimate and limit the caller id to that number. Any telecom carrier whose customer is requesting a wide variety of phone numbers ought to know that something sketchy is going on.

Let's say I'm a not entirely small company, with employees with phones on their desks who call customers and have direct numbers to be called. When they call out, the caller id should be their desk number so the people they're calling know it's them and answer the phone.

But the carrier that handles inbound calling charges an arm and a leg for outbound, so I'd like to use another carrier for outbound; I don't want to change my inbound carrier.

In that case there should still be some similarity among the numbers (area code, exchange, etc), and it wouldn't be difficult to tell the outgoing provider that you're going to be using a particular block of numbers. At a minimum, the outgoing calls shouldn't have numbers from different area codes every day.

Reply on news.ycombinator.com