Ask HN: Why do I get robocalls from recently-called area codes? | Hacker News Reader

Ask HN: Why do I get robocalls from recently-called area codes?

56 pointsgnicholas80 comments

Over the past few weeks, I've started receiving robocalls from area codes that I happen to have just called or received a call from.

At first I thought this was just me noticing a pattern that wasn't really there, but when I looked back at my phone records I could see that I had literally never received a phone call from either of these area codes, and that within a day of talking with someone in that area code I started getting robocalls.

Has anyone else experienced this? How would robocallers get this information — interception, buying it from my cell phone company, or something else?

Even if they're just buying a list of area codes I've talked to, this seems completely inappropriate. And if they're getting the actual numbers, that's even worse.

View on HN

for voice calls, the best thing I ever did was set up my own asterisk system with a DID that answers as an IVR saying something like "you have reached $NAME, this is an anti-spam system, please confirm you are a human by entering the digits five three zero nine to be connected".

If people then put in the DTMF tones for 5309, or whatever code it might be this month, it initiates an outbound call to my actual cellphone and bridges the calls together.

In many cases I don't give out my direct cellphone number to 3rd parties, or anyone who isn't a close family member or colleague, I only give out the DID of the system with the filtering IVR on it.

I do still receive the occasional coldcall spam on my cellphone's direct number, which isn't entirely avoidable, but those are only random calls which aren't looking for me in particular. By only giving out the phone number of the filtering DID, I avoid my number being entered into many random third parties' CRM systems which are inevitably subject to data leaks, copying, data sharing with other 3rd parties, sales and marketing campaigns, etc.

Does this system pass through the original caller's info on caller id?

yes, it preserves caller ID on the outbound call initiated on the SIP trunk, my wholesale voip provider allows me to pass CID on outbound calls.

Seems like something people would pay for.

I have been thinking about turning it into a small project people can pay for, would first want to set up a series of scripts that could auto-provision everything immediately upon payment. Right now it's all manual since I'm the only person with the equivalent of admin/root on the asterisk system, and I've customized it for only my needs and those of my spouse.

It certainly doesn't sound like a trivial project, but given the preponderance of spam calls these days it seems like perfect timing for a product like this.

Should be able to do it all through VoIP.ms subaccounts. Complexity would be having to port in phone numbers (around here, that auto cancels your cellular account!), but see my other post, people could forward all calls to the server and proven humans would ring a soft phone.

Can you provide more details about how you set this up? Does it provide a similar benefit to using Google Voice with call screening enabled?

If my phone number is already out in the wild (apparently), is there anything I can do at this point? Or is the only solution to get a new phone number, never give it to strangers, and only give out a virtual number with screening?

It's related to what I do for work so what I've done I would not recommend to everyone... It's a FreePBX/Asterisk VM (CentOS 64-bit) that runs on a system in colocation somewhere at a major traffic exchange point. It is one of a number of VMs that run my personal infrastructure.

It has a SIP trunk to a wholesale voip provider, where several DIDs reside.

The incoming calls to the DIDs first hit my SIP trunking provider, which sends the incoming call signals to my voip server, which processes the call flow by starting with the IVR announcement I previously described.

It is generally the same idea as google voice with call screening but I have approached it from a DIY perspective where I want to have full admin access over everything, except at the SS7/PSTN level where the DIDs are at my SIP trunking provider. Everything related to the incoming and outgoing calls I can customize for other unique purposes.

Thanks! The more I read HN, the less I realize I know!

One way to do this without setting up a server or moving your phone number to another provider:

1. setup an unconditional redirect for all calls on your cell phone to a voip.ms DID that you set up ($1/month).

This redirect functionality is baked into the gsm system:

https://www.geckobeach.com/cellular/secrets/gsmcodes.php

2. On voip.ms, setup an IVR with a recorded message. Set it up to connect extension “1-2-3-4” or whatever your code is to your softphone. You should be able to whitelist numbers to auto-forward to your soft phone.

Cool thing is you can setup voicemail through this so you receive them as email attachments. SMS still works through your cell phone. Outgoing calls still go through your cellphone.

This sounds very cool! A couple naive questions:

How do income calls come in? Do I use an app instead of the phone app?

Does this introduce any additional latency into my inbound calls? I dislike Google Voice for this reason.

How hard would this be for someone to set up (assuming said person just had to google "soft phone" to understand your comment)?

Are there any security, reliability, or other risks to be aware of?

as the above poster has described it you would need a SIP softphone client running on your cellphone, over your data service, connected to your voip service provider's account.

definitely there would be more latency.

Though it makes me wonder how/why they find Google Voice’s latency is noticeable. I can’t tell when someone is calling me locally or from across the continent. Maybe GV has few (and overloaded) POPs?

1. Through the softphone (think Skype, but more configurable).

2. Yes, more latency in most situations on incoming calls. Voip.ms does let you choose servers in different cities/countries, so your ISP’s routing starts to matter. It might be better or worse than Google Voice, I don’t have any experience with GV.

3. I think most people here could figure it out, but having to google “softphone” isn’t a great start :)

4. Nice thing about this whole setup is that you can turn it all off in a few keystrokes on your phone, and then your cellphone rings normally. You don’t have to worry about your phone number being lost unless you get sim-swapped. If voip.ms goes down, your incoming calls will stop until you deactivate it as above.

One positive is that you can set up your incoming calls to simultaneously ring multiple phone numbers and softphones if you wanted.

I do greylisting. The first call from an unknown number plays asterisk standard recordings - SIT + "please try again". A successive call from the same number rings through. Legitimate callers have had no problem. I set it up this way because it was originally operating on a landline "in parallel" so that if the server failed the phones would still work.

Next up is some kind of system that takes calls from places that you can never reach directly and instead call you back at bleeding-eyes-o'clock (eg doctors' offices), answers the call, and puts the caller on hold while I wake up. "Bucket of stomach fluid" can be a two way street.

I often get robocallers that call twice if I don't answer the first time. I guess because most people assume two calls is an urgent matter and they REALLY want you to pick up.

My low tech solution is to never answer calls from numbers that aren't in my contacts list. Everyone else can leave a voicemail.

Wow, that's rough. I definitely don't get those.

I think despite the obvious enumerability of phone numbers, most spam must be done off targeted lists. I've got a few SIP trunks with newly obtained numbers, and they don't really get spam.

Thing is, with robocalls, your a program is sequentially dialing numbers so even if you never share your phone number with anyone you'd still get robocalled. It's not very hard to guess a valid number whereas trying to build valid emails via brute force is not possible in the same way.

That is true and I cannot avoid the robocalls which are dialing a whole block of almost 10000 numbers in an NPA-NXX.

Generally I don't answer unknown numbers since almost anyone that needs to reach me is either in my contact list, will reach me by Signal or another method, or I already know to expect a call from them. Of course this doesn't eliminate the possibility of receiving an incoming call from spoofed caller ID that is a perfect 1:1 match with an existing entry in my address book, but that's quite rare.

I can only avoid the ones that are the result of some 3rd party that has an entry for me as firstname,lastname,phonenumber in some CRM system for marketing database. It does help a lot on the targeted calls.

Seems like in theory this could be solved by having your asterisk system connect the call.

Then block all numbers on your phone except your system.

It could, I'm not quite ready to take that step yet.

Or I could use exclusively a SIP softphone (zoiper) on my android phone to connect directly to my asterisk system as an extension, and only accept calls on that, which would come from the incoming filter call flow.

The downside of that is that phone calls wouldn't work when in very marginal data coverage/rural areas, since voip-over-LTE-data relies on a fairly solid and packet loss free network connection, and the additional battery drain of maintaining a persistent sip client-to-server session on the phone all the time.

I do have several extensions set up in zoiper for other purposes but I don't keep it running all the time.

Cell companies using deep packet inspection to analyse data have been known to throttle voip calls to mobiles.

I think the minimum std for voip is around 56k so you dont need much bandwidth, but data over mobile phone networks is typically a burst of data which is the opposite of landline networks. I could use freeswitch (asterisk rival) on 2.5g quite easily, but you really are at the mercy of a cell masts traffic management software, however in the android app store there are some apps which let you override the cell mast traffic management so you can remain attached to the cell mast of your choosing when you want to. That also helps you avoid being triangulated for location purposes.

Voice to handset always had highest priority as traffic, then text and then data, but the last two may have changed priority in recent years.

I literally do the same thing, except "press 1 if you are a human". I haven't had any robocalls get through.

I don't have a direct cell number as I just use a cheap data-only iPad plan with my iPhone only, combined with a VoIP iOS client (Bria).

I use VoIP.ms for my service. It's basically hosted Asterisk with a nice web UI on top, as well as purchasing and managing DIDs.

Related, I used this system for a condo buzzer when I lived in a building a few years ago. Set my name on the condo dialer to ring a specific DID for the condo buzzer to call, pointed towards VoIP.ms IVR, then just played DTMF 9 repeatedly to unlock the door and let them in. I triggered an SMS to send to me when this occurred so I'd know when someone was downstairs on their way up.

Massive security hole, but not exploited once the entire time (except by me a few times when I forgot my keys).

Eh, security hole is still there without your system, and someone being "nice" to a social engineer who forgot their fob in the apartment, etc.

The condo buzzer idea is legendary! I feel like you could have also waited for a reply to the SMS, or an interaction with a push notification via an app like pushsafer.com, so you could unlock the door from your phone!

the buzzer system may not wait 'on the line' very long because it's expecting to receive either a DTMF tone for unlock door within 5 to 15 seconds of the call being answered, or a disconnect such as if a person in their condo is holding a POTS phone and just hangs it up when an unknown person buzzes them, denying entry.

That’s correct, waiting for a push + acknowledgement would be too long which is why it just automatically does it.

I did the push so I’d be able to track unexpected usage and there wasn’t a single one the entire time.

you set it up so that the IVR announcement WAV file you uploaded was a recording of the DTMF tones for "9" repeatedly? so basically anyone that pressed your buzzer number would get auto-entered into the building?

hah I did something similar at a small startup working out of a big live/work loft when they ran out of key fobs to give us. You'd buzz our unit which would call a Twilio number which sent a message to the super secure "front door" slack room saying "someone is at the door. let them in?" and you'd open slack on your phone and hit the button to let yourself in. Very secure stuff.

if you only have a data-only plan and use a voip service, how do you get sms? do they provide sms too? this was one of the issues that kept me going down a similar route a number of years ago.

Voip.ms user here. They bridge sms to email for you. It's a bit clunky, and doesn't work with some TOTP systems, but it's okay. (TOTP issue is to do with the number being listed as voip in some database I bilieve, I suspect transferring in a number may fix this)

ok, yah, that does sound a bit clunky for general use, but probably fine for this use case.

i'm at the point where imessage is enough for 2/3 of my contacts, but wouldn't want to preemptively freeze out the other 1/3 (and i definitely don't want to use whatsapp or whatnot).

As another user of this system, SMS-to-email is one of my favourite features. Answering texts from my (Linux) desktop is hardly an iOS exclusive now, ha!

GP here. I use iMessage with an email address, and Signal and other data based messengers and I’ve been doing so since 2014 almost exclusively when I started thinking about using a data plan for my phone service.

As a result my SMS usage is very minimal and VoIP.ms works well for the occasional 2FA code (from dumb banks that both force 2FA and only do it via SMS) or delivery notification SMS. In some cases the 2FA code doesn’t get received and I need to use the number assigned to the SIM. This works but I need to track which services do this so I have a tag in 1Password, just in case I need to change the SIM or provider one day.

You can find an unofficial app in f-droid called VoIP.ms for SMS. It works well now and even sends notifications on my phone that has no Google Play.

I run my own PBX too, and like you I had the IVR message for 'press 1 to connect your call'. Too many legitimate callers are morons though and couldn't figure out how to press 1. A lot of bitching especially from Gov service's oe similar, when I got around to calling them and wondering why they hadn't called me. "We did, but got a wierd message". Fucking infuriating. It worked great for stopping spam and robo callers though.

That's why paying attention to the message is important. If you give me your number, but when I call I get an automated response system, I'd hang up as well, thinking I probably got the wrong number.

In the case of the top-comment I wouldn't because it confirms that I'm calling the person I want to call. I guess if you'd make that change, you will probably catch a lot of your problems.

Yeah I get that. I didn't want to give people more information than they already know though. Having an automated message that TELLS YOU who you are calling, seems counter-productive from my standpoint. If you're calling me, you should already know who I am. I don't want to give you my name and then have some random ass spammers use that information to make it seem like a legitimate call.

Difference between them going "I am calling to speak to penguincoder" (having gotten the name from MY message), or going "I am calling about your cars extended warranty".

Wow, that's awesome!

I was lazier and just abandoned the telephone system altogether.

As a counterpoint, I frequently get robocalls from area codes near where I travel. I recently visited Virginia and received robocalls from Virginia area codes for a while. A couple years ago I visited California and received more than the usual number of robocalls from California. A few years ago I visited Seattle and received robocalls from Washington. I most recently moved within Texas and the constant robocalls changed area codes to the more common local one.

I really _really_ wish I could flag an incoming call to my telecom provider and get paid money for it charged to the caller. Then let the telecom provider prove that it was or wasn't malicious.

So far I haven't had this issue. I am in Seattle (for years), still have my 415 (San Francisco) phone number, and can still filter spam by ignoring calls from 415.

If you don't mind sharing, which provider are you using? And, if it is Verizon, have you opted out of data sharing?

T-mobile. I've opted out of all sharing that I'm aware of. But as I'm sure you're also aware, it's an endless fight; modern "businesses" frequently reset settings, rename settings, or add new settings with defaults that benefit them instead of the customer.

I moved to Vegas from California, and on my California number never received any Nevada area robocallers. When I see that it is a Nevada number, I just answer.

I recently switched from using regular AT&T cell plan to a VoIP provider and a T-Mobile hotspot. After transferring my number to the VoIP provider, I've gone from 5-10 robocalls per day to one every few days to a week. Haven't received an SMS spam message.

Maybe their spam filters block many of these robo calls but they let them through if you had some recent contact in the same area/digits?

Interesting hypothesis. But I get enough identical-seeming spam from other random numbers that I doubt they have much in the way of spam filters.

For a few years I have been experimenting with some creative anti spam manual techniques. Hard to say if they are working but these days I do rarely get spam calls. What used to be multiple per day is now down to about one. Could be coincidence however.

1. Often I will end an incoming call as fast as possible if it seems like a spammer. When you do this while the first ring is happening sometimes a few seconds later you will receive a second call from the same phone number. I then end that call as fast as possible again (without answering of course). I am hoping that some of these spam phone software systems have automated processes to mark numbers that are no longer dial-able.

2. Sometimes I answer as fast as possible and then play the oldschool sounds of a dialup modem or fax machine. I have even jokingly done this just making the sounds of a dialup modem with my voice. Many times the automated system hangs up after I do this. Again I am hoping they have something built in to their automated spam system to mark numbers that are fax / modems / non-people.

3. I have also tried answering the phone and then completely covering the mic or playing some simple white noise. This does not usually seem to work and eventually someone picks up. I doubt they are marking my number in this case as it has gone to an actual human.

I have two phones: personal and work. On the personal phone, I'll waste their time and string them along as long as I can. On the work phone, I don't.

I haven't found it to make any difference in terms of repeat calls, so I advise everyone to waste as much of their time as possible. My favorite is "ohhh, let me get my grandma" and put the phone down.

For SMS spam, I do my best to get them taken down ASAP. Report to their host (abuse@______, root@_____, etc.), their link shortener and SSL cert provider. I've flooded a few of their links too.

mobile or landline? If landline is your phone capable of displaying Caller ID? If yes, can you check the firmware of your landline phone as Caller ID uses v23 protocol, so your landline has dialup modem abilities and anyone with access to your landline could remote control your landline phone. Had the data and time changed on my landline phone in my case, just someone showing off their full spectrum dominance!

If landline has your phone company been hacked or your security services yanking your chain?

If mobile, is your device rooted? Is you sim card hacked? Any component with a cpu may have the ability to independently use the hardware, so a sim card phoning home independent of the phone OS, it all depends on how the circuit board is designed.

Your phone is listening and it's not paranoia (2018 https://news.ycombinator.com/item?id=28973345

LTE Phone Number Catcher: A Practical Attack against Mobile Privacy https://www.hindawi.com/journals/scn/2019/7425235/

Not the link I was looking for but it will probably convey the same info which is your Decap of a Cell Phone SIM card [video] https://news.ycombinator.com/item?id=12674846

And dont forget the arm processor used for wear levelling purposes in (micro)sd cards, also another attack vector depending on how its wired.

Update: today I received a text message about booking air travel while I was still on the phone with an airline.

I called my cell carrier and they said that even they do not have my phone records until several hours later, and besides they don't sell phone records.

When I called Apple, the senior advisor told me that maybe my Facebook app is listening to me since "that's just the way the systems are set up". I was floored that an Apple employee (a senior rep, no less) would say such a thing. She didn't indicate how the app would have permission to do this if not granted it at the OS level. Regardless, I don't even have the FB app installed.

I'm now going to swap my SIM card into a different iPhone and see if the issue persists.

If you look up the carrier of each number you called, are there any commonalities across them?

Have you opted out of CPNI resale in your cellular carrier’s preferences system?

Who did you talk to in these area codes? Was it, for example, a call center for a business or another automated system that could have sold your number to someone? If it was a personal contact then I'd write it off as a coincidence.

On Android, some apps can get call log permission and upload your call log and phone number to their servers, which the app developer may then sell for marketing purposes...

Especially look out for free utility apps and trivial simple games... They nearly all do something shady like this.

This is a really good point. I'm on iOS and don't think I've ever given permission to an app for this. I assume iOS wouldn't let apps harvest this info without asking?

Maybe it's the other way around for the personal call and the client has a compromised device that leaked your number?

One was an outbound call to Epson customer support in Long Beach. The other was inbound and outbound calls with a customer, calling from her personal cell phone (DE number, calling from upstate NY).

I thought the first was a coincidence because it was intrastate. The second one was much more suspicious because of the distance and my lack of prior connection to DE.

Is there an app on your phone sharing your call logs?

Might actually have been the one that OP called, as they seemed to be the trigger for it. I think their logs are shared, not OP's.

Really not sure what's going on there. Tempted to chalk it up to a funny coincidence, but it doesn't seem like it.

I'd chalk it up to an app on your phone tbh. Android is particularly susceptible to this if you have READ_CALL_LOG permission on for some apps.

We might need more information.

I get a number of local code spam calls, but have seen an increase in state code calls.

Are the area codes you're seeing local to you, or distant? Or, what's the likelihood that someone in your region would be calling the same area codes?

I live in the Bay Area, and the area codes are from SoCal (not one of the major ones) and Delaware.

I previously received robocalls from my local area code, and random ones from around the country. But not from these area codes.

Do you have any apps installed that have permit to access your dialer or contacts app?

None have access to either, outside the iOS Phone app!

Welcome to the club. They know when I get off work and wake up now.

Do you wake up at 7AM and get off work around 5PM?

Nope, I come and leave when I want, even break time. Three years together, what a brilliant hack. Choose wisely.

I used to! Two things that have made a big difference:

1) Pay for a real spam filter from your telecom (usually free in highest tier plan). It’s remarkable hope much it catches, and I have never received a complaint in 5+ years

2) Buy a long term burner— your telecom usually sells a reasonable plan, or free if you pay for high tier coverage.

Me: same cell # for 25 years-22 too many with sprint (good spam shield when it didn’t crash) and more recently t-mobile (great spam guard and burner (named Digits)—both free upon request if you have a sufficiently expensive plan)

To piggyback on this thread, does anyone know if I can block a specific phone number provider (e.g. block all Twilio calls)?

I think you can do that ironically if you use Twillio as your primary incoming phone number.

Oh my goodness, my employer uses Twilio as our phone provider. If people started blocking Twilio, then for example a customer might call our support team to ask a question, and then after we research the issue we would we unable to call him back. So I sure hope that doesn't become a thing... whew

Well if Twilio is facilitating robocalls, I hope it does become a thing. Then maybe they’d want to stop robocallers from using their service.

not at the client device level like your cellphone, no you can't. Would have to be done by your carrier at the SS7/PSTN level which as an individual phone system subscriber, is totally opaque to you.

does anyone know who is the telecom company that provides routes the calls from the robocallers?

There are hundreds, you'd have to play whack-a-mole with myriad VoIP and second- and third-tier wireline providers to get them all. And that presupposes that the accounts are even legitimate. A lot of robocalls are delivered through hacked SIP credentials.

I know people like to pick on them because they do seem to turn a blind eye to all but the most egregious spammers, but Twilio is only the source of a lot of spam calls because they are a large carrier in their own right. It's like all of the people moaning about Californians being the most common place of origin for people moving to their area; that's true, because California has the most number of people.

If it's literally just hundreds they should be able to handle it no problem. Even if they had to staff up to do it, no problem.

US Congress authorized FCC to fine robocallers. There are now billions of dollars in such fines racked up. But no way was authorized to enforce collecting on the fines, so nobody pays them.

Which carrier do you use ?

It's an MVNO, which makes me extra suspicious that the reason they have low prices is because they're selling my information.

I use RedPocket (w/Verizon service) and I get ~the same low number of spam calls as my family members who pay Verizon directly, so apparently an MVNO can be cheap without selling your number to spammers...

I have the exact same thing happen to me. I'll talk to someone from a diff area code that I never get robo calls from, and then bam, robo calls from that area code.

I'm on Verizon

Reply on news.ycombinator.com