Seems like an awfully large oversight to reuse the encryption key between subsequent calls.

I wonder if this works when leaving voicemail in the second call? Since the approach requires a long call for a long decryption, dialing straight to voicemail would be non-cooperative and avoid alerting the victim until after.