Hubbry Logo
Phone fraudPhone fraudMain
Open search
Phone fraud
Community hub
Phone fraud
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Phone fraud
Phone fraud
from Wikipedia

Phone fraud, or more generally communications fraud, is the use of telecommunications products or services with the intention of illegally acquiring money from, or failing to pay, a telecommunication company or its customers.

Many operators have increased measures to minimize fraud and reduce their losses. Communications operators tend to keep their actual loss figures and plans for corrective measures confidential.[1]

According to a 2011 survey by CFCA, an industry group created to reduce fraud against carriers, the five top fraud loss categories reported by operators were:[1]

  • $4.96 billion – compromised PBX/voicemail systems
  • $4.32 billion – subscription/identity theft
  • $3.84 billion – International Revenue Share Fraud
  • $2.88 billion – by-pass fraud
  • $2.40 billion – cash fraud

Types of frauds

[edit]

Fraud against users by phone companies

[edit]
  • Cramming is the addition of charges to a subscriber's telephone bill for services which were neither ordered nor desired by the client, or for fees for calls or services that were not properly disclosed to the client. These charges are often assessed by dishonest third-party suppliers of data and communication service that phone companies are required, by law, to allow the third-party to place on the bill.
  • Slamming is any fraudulent, unauthorized change to the default long-distance/local carrier or DSL Internet service selection for a subscriber's line, most often made by dishonest vendors desiring to steal business from competing service providers.
  • False Answer Supervision is a misconfiguration of telephone company equipment, by negligence or design, which causes billing to start as soon as the distant telephone begins ringing, even if a call is busy or there is no answer. The cost is typically subtle but recurring as subscribers repeatedly pay some small amount for calls which were never completed.[2]

Fraud against customers by third parties

[edit]
  • PBX dial-through can be used fraudulently by placing a call to a business then requesting to be transferred to "9-0" or some other outside toll number.[citation needed] (9 is normally an outside line and 0 then connects to the utility's operator.) The call appears to originate from the business (instead of the original fraudulent caller) and appears on the company's phone bill.[citation needed] Trickery (such as impersonation of installer and telecommunications company personnel "testing the system") or bribery and collusion with dishonest employees inside the firm may be used to gain access.[citation needed]
  • A variant is a call forwarding scam, where a fraudster tricks a subscriber into call forwarding their number to either a long-distance number or a number at which the fraudster or an accomplice is accepting collect calls. The unsuspecting subscriber then gets a huge long-distance bill for all of these calls.[3]
  • A similar scheme involves forwarding an individual PBX extension to a long-distance or overseas number; the PBX owner must pay tolls for all of these calls. Voice over IP servers are often flooded with brute-force attempts to register bogus off-premises extensions (which may then be forwarded or used to make calls) or to directly call SIP addresses which request outside numbers on a gateway; as they are computers, they are targets for Internet system crackers.
  • Autodialers may be used for a number of dishonest purposes, including telemarketing fraud or even as wardialing, which takes its name from a scene in the 1983 movie WarGames in which a 'cracker' programs a home computer to dial every number in an exchange, searching for lines with auto-answer data modems. Sequential dialing is easy to detect, pseudo-random dialing is not.[4]
  • In the US, owners of customer-owned coin-operated telephones (COCOTs) are paid sixty cents for every call their users make to a toll-free telephone number, with the charges billed to the called number. A fraudulent COCOT provider could potentially auto-dial 1-800 wrong numbers and get paid for these as "calls received from a payphone" with charges reversed.
  • Autodialers are also used to make many short-duration calls, mainly to mobile devices, leaving a missed call number which is either premium rate or contains advertising messages, in the hope that the victim will call back.[5] This is known as Wangiri (literally, "One (ring) and cut") from Japan where it originated.
  • 809 scams take their name from the former +1-809 area code which used to cover most of the Caribbean nations, since split into multiple new area codes, adding to the confusion. The numbers are advertised as offering services to callers in, typically, North America; they look like Canadian or US telephone numbers but are actually costly premium international calls that bypass consumer-protection laws that regulate premium numbers based in the victim's home country. Some advertise phone sex or other typically premium content. Ways to elicit calls include leaving unsolicited messages on pagers, or making bogus claims of being a relative in a family emergency to trick users into calling the number, then attempting to keep the victim on the expensive call for as long as possible.[6] A later version of the 809 scam involves calling cellular telephones then hanging up, in hopes of the curious (or annoyed) victim calling them back.[7] This is the Wangiri scam, with the addition of using Caribbean numbers such as 1-473 (Grenada) which look like North American domestic calls.[8]
  • Pre-paid telephone cards or "calling cards" are vulnerable to fraudulent use. These cards show an access number that can be dialed to bill worldwide toll calls to the card via a passcode printed on a particular card. Anyone who obtains the passcode can make calls charged to the card.
  • Carrier access codes were widely misused by phone-sex scammers in the early days of competitive long distance;[citation needed] the phone-sex operations would misrepresent themselves as alternate long-distance carriers to evade consumer protection measures which prevent US phone subscribers from losing local or long-distance service due to calls to +1-900 or 976 premium numbers. This loophole is now closed.[citation needed]
  • In the US, area code 500 and its overlays permit a "follow-me routing" in which, if the number has been forwarded to some expensive and arbitrary destination, the caller is billed for the call to that location. Similar issues existed with area code 700 as the numbers are specific to long-distance carriers (except 1-700-555-4141, which identifies the carrier). Because of the unpredictable and potentially costly rate for such a call, these services never gained widespread use.[citation needed]
  • Telemarketing fraud takes a number of forms; much like mail fraud, solicitations for the sale of goods or investments which are worthless or never delivered and requests for donations to unregistered charities are not uncommon.[citation needed] Callers[who?] often prey upon sick, disabled and elderly persons;[citation needed] scams in which a caller attempts to obtain banking or credit card information are also common.[citation needed] A variant involves calling a number of business offices, asking for model numbers of various pieces of office equipment in use (such as photocopiers), sending unsolicited shipments of supplies for the machines, and then billing the victims at inflated prices.[citation needed]
  • Caller ID spoofing is a technique used with many frauds to impersonate a trusted caller such as a bank or credit union, a law enforcement agency, or another subscriber. When the telephone rings, the number displayed as caller is the faked trusted number. These calls may be used for vishing, where a scammer impersonates a trusted counterparty in order to fraudulently obtain financial or personal information.
  • Call clearing delays, in some United Kingdom exchanges, could be abused to defraud users. For many years only the caller could disconnect a call; if the called party hung up the call it would not be disconnected. A thief would call a household and impersonate, for example, a bank or the police, and encourage them to call back, using a trusted number known to the victim. The caller could then play a recording of dial tone to trick the victim into thinking they were making a new call, while actually remaining connected to the original call; someone impersonating a bank or police officer would then come on the line.[9]
  • Cordless phones had additional vulnerabilities; with some models a scanner radio could intercept analogue conversations in progress, or a handset of the same or a similar model as the target system may be usable to make toll calls through a cordless base station which does not authenticate calls. Obsolete analogue mobile telephones have stopped working in areas where the AMPS service has been shut down, but obsolete cordless phone systems may remain in service as long as analog telephony is supported.
  • A scam involving Indian call centers targeting American or Canadian customers demanding "unpaid taxes" by impersonating government officials was reported in 2016.[10] Similar government impersonation scams include the SSA impersonation scam.
  • Every day, hundreds of scam calls are received on the US mainland which offer the recipients grant money from the Federal Government, but requesting a "small administration fee",[11] although there are no fees associated with applying for or receiving a government grant.
  • During the 1980s, a common form of premium-rate fraud involved manipulating children (often through television commercials, such as during Saturday morning cartoons) to call a premium-rate number without their parents' knowledge or permission, sometimes going so far as to ask a child to hold the phone receiver up to the television set as it played DTMF tones to automatically trigger the dialing of a premium number.[12] Such practices are now illegal in the United States.
  • The Can You Hear Me? telephone scam was alleged to be used in North America in 2017: the caller would ask a question with the answer "yes", then use a recording of the "yes" to make telephone transactions.
  • SMS pumping is a form of fraud where attackers exploit the messaging systems of businesses to generate revenue by sending high volumes of messages to premium-rate phone numbers. To achieve this, fraudsters target vulnerabilities in SMS gateways or APIs used by businesses for customer communication (such as verification codes or notifications messages).[13]

Fraud between phone companies

[edit]
  • Interconnect fraud involves the falsification of records by telephone carriers in order to deliberately miscalculate the money owed by one telephone network to another. This affects calls originating on one network but carried by another at some point between source and destination.[citation needed]
  • Refiling is a form of interconnect fraud in which one carrier tampers with CID (caller-ID) or ANI data to falsify the number from which a call originated before handing the call off to a competitor. Refiling and interconnect fraud briefly made headlines in the aftermath of the Worldcom financial troubles; the refiling scheme is based on a quirk in the system by which telecommunications companies bill each other – two calls to the same place may incur different costs because of differing displayed origin. A common calculation of payments between telecommunications companies calculates the percentage of the total distance over which each telecommunications company has carried one call to determine division of toll revenues for that call; refiling distorts data required to make these calculations.[citation needed]
  • Grey routes are voice over IP gateways which deliver international calls to countries by mislabeling them as inbound local mobile telephone calls at destination. These "SIM box" operations are common in third world nations with exorbitant official international rates, usually due to some combination of tight control by one state-supported monopoly and/or excessive taxation of inbound overseas calls. Governments who believe themselves entitled to charge any arbitrary inflated price for inbound international calls, even far above the cost of domestic calls to the same destinations, will legislate against any privately owned, independent, competitive VoIP gateway, labeling the operations as "bypass fraud" and driving them underground or out of business.[citation needed] As a VoIP gateway in such a regulatory environment typically does not have access to T-carrier primary rate interface or PBX-style trunks, its operator is forced to rely on a hardware configuration with Internet telephony on one side and a large number of mobile SIM cards and handsets on the other to place the calls as if they were from individual local mobile subscribers.

Fraud against phone companies by users

[edit]
  • Subscription fraud: for example, signing up with a false name, or no intention to pay.[citation needed]
  • Collect call fraud: most automated collect call systems allow the caller to record a short audio snippet, intended to identify the caller so that the recipient can decide whether or not to accept the charges. With the system being automated, the caller could insert any message they want, free of charge, as long as it fit within the short allotted time, and the recipient could refuse charges. A variant is to refuse a collect call at the higher operator-assisted rate, then call the person back at a lower price.
  • Person-to-person call fraud: Under archaic operator assistance systems, a person-to-person call only charged a caller if they could reach a specific person at the other end of the line. Thus, if coordinated beforehand, a caller could use a false name as a code word, with the recipient rejecting the call, and no one would be charged.
  • Intentional non-return of rental equipment (such as extension telephones) when relocating to a new address. The equipment would then be used at the new location without paying a monthly equipment rental fee. This has become rare as most telephones are now owned outright, not rented.

Frauds against phone companies by third parties

[edit]
  • Phreaking involves obtaining knowledge of how the telephone network operates, which can be (but is not always) used to place unauthorized calls. The history of phone phreaking shows that many 'phreaks' used their vast knowledge of the network to help telephone companies.[citation needed] There are, however, many phreaks who use their knowledge to exploit the network for personal gain, even today.[citation needed] In some cases, social engineering has been used to trick telecommunications company employees into releasing technical information.[citation needed] Early examples of phreaking involved generation of various control tones, such as a 2600 hertz blue box tone to release a long-distance trunk for immediate re-use or the red box tones which simulate coins being inserted into a payphone.[citation needed] These exploits no longer work in many areas of the telephone network due to widespread use of digital switching systems and out-of-band signaling. There are, however, many areas of the world[which?] where these control tones are still used and this kind of fraud still continues to happen.[citation needed]
  • A more high-tech version of the above is switch reprogramming, where unauthorized "back door" access to the phone company's network or billing system is used to allow free telephony. This is then sometimes resold by the 'crackers' to other customers.[citation needed]
  • Caller name display (CNAM) is vulnerable to data mining, where a dishonest user obtains a line (fixed or mobile) with caller name display and then calls that number repeatedly from an auto dialer which uses caller ID spoofing to send a different presentation number on each call. None of the calls are actually answered, but the telephone company has to look up every number (a CNAM database "dip") to display the corresponding subscriber name from its records. The list of displayed names and numbers (which may be landline or wireless) is then sold to telemarketers.[14]
  • Payphones have also been misused to receive fraudulent collect calls; most carriers[who?] have turned off the feature of accepting incoming calls or have muted the payphones internal ringing mechanism for this very reason.[citation needed]
  • Cloning has been used as a means of copying both the electronic serial number and the telephone number of another subscriber's phone to a second (cloned) phone. Airtime charges for outbound calls are then mis-billed to the victim's cellular phone account instead of the perpetrator's.

See also

[edit]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
Phone fraud, also known as telecommunications fraud, refers to the unauthorized use, tampering, manipulation, or deceptive exploitation of telephone services—such as landlines, mobile phones, or related systems—to illegally obtain money, personal information, or other benefits from individuals or organizations. This form of fraud encompasses diverse schemes that target vulnerable populations, including the elderly, low-income individuals, and non-native English speakers, often by impersonating trusted entities like government officials, charities, or businesses to extract sensitive data or payments. Common types include SIM swapping (or SIM jacking), where fraudsters hijack a victim's phone number to access accounts; cloning, involving the duplication of SIM cards for unauthorized calls; subscriber fraud, such as using stolen identities to activate services; and telemarketing scams like advanced-fee fraud (e.g., promising rewards for upfront fees), pyramid schemes, and charity imposters. Other prevalent variants are wangiri fraud (one-ring scams prompting costly callbacks to premium numbers), smishing (SMS-based phishing), international revenue sharing fraud (abusing premium-rate services), and PBX hacking (exploiting unsecured phone systems for free international calls). Recent developments include AI-powered voice cloning and deepfake impersonation scams. The impacts of phone fraud are substantial, with global losses estimated at $38.95 billion as of 2023 (a 12% increase from 2021), including $39.89 billion in direct fraud expenses for telecom operators in 2021 alone, representing about 2.22% of their revenues. Victims suffer financial theft, identity compromise, unexpected billing for unauthorized usage, and emotional distress, while operators face revenue leakage and regulatory scrutiny; in the United States, such crimes are prosecuted under federal laws like 18 U.S.C. §§ 2325-2327, emphasizing the need for robust prevention measures like fraud alerts and secure authentication.

Overview

Definition and Scope

Phone fraud, also known as telephone fraud or communications fraud, encompasses the unauthorized or deceptive use of telephone systems—whether traditional landline, mobile, or Voice over Internet Protocol (VoIP)—to exploit victims financially, technically, or personally. This includes tactics such as impersonation, unauthorized access to services, and manipulation of call routing to generate illicit revenue or steal sensitive information. Unlike broader cyber fraud, phone fraud specifically targets voice and telephony infrastructure, often leveraging the perceived trustworthiness of phone calls to bypass user skepticism. Key terminology in phone fraud includes several specialized mechanisms. Vishing, or voice phishing, involves fraudulent phone calls or voice messages that employ social engineering to trick individuals into divulging personal data, such as bank details or passwords, typically by posing as trusted entities like government agencies or banks. Robocalling refers to automated outbound calls using pre-recorded messages delivered via autodialers, often initiating scams by urging recipients to call back premium numbers or provide information, though not all robocalls are fraudulent. SIM swapping, also called SIM hijacking, occurs when fraudsters convince a mobile carrier to transfer a victim's phone number to a SIM card they control, thereby intercepting calls, texts, and two-factor authentication codes to access linked accounts. Premium rate fraud, a form of toll fraud, exploits high-cost international or premium-rate numbers by hacking into phone systems to route large volumes of calls to these destinations, allowing fraudsters to share in the inflated per-minute charges. Phone fraud is distinct from adjacent crimes like traditional phishing, which primarily relies on email or websites to deceive victims, whereas phone fraud centers on voice interactions and telephony vulnerabilities; however, it may incorporate hybrid attacks combining voice calls with SMS messaging, such as smishing follow-ups. This boundary excludes purely digital phishing but includes telephony-based deceptions that may transition to other channels. In its modern scope, phone fraud has evolved to include emerging technologies like AI-generated deepfake voices, which post-2020 have enabled scammers to clone audio samples of family members or officials for highly convincing impersonations, as seen in incidents where fraudsters used synthesized voices to authorize fraudulent transfers.

Historical Development

Phone fraud, initially manifesting as toll fraud, emerged in the early 20th century alongside the expansion of operator-assisted long-distance calling systems. In the 1920s and 1930s, perpetrators exploited the reliance on human operators by impersonating callers or using deceptive tactics to place collect or person-to-person calls without payment, often targeting rural or international lines where verification was lax. By the 1940s and 1950s, as automated switching began to supplement operator services, fraudsters adapted by abusing third-party billing or stolen authorization codes, leading to estimated annual losses in the millions for carriers like AT&T. These early schemes relied on social engineering rather than technology, highlighting the vulnerabilities in manual telephone networks before widespread direct dialing. The 1960s marked a technological turning point with the invention of the blue box, a device that generated multifrequency tones to mimic signaling and bypass billing for free long-distance calls, ushering in the phone phreaking subculture. This era's phreaking movement gained prominence in the 1970s through figures like John Draper, known as Captain Crunch, who popularized tone-based hacks using everyday items like cereal box whistles to access trunk lines. By the 1980s, phreaking evolved amid telecom deregulation, with fraud surging through the introduction of 900 and 906 premium-rate lines, where scammers advertised misleading services like job leads or psychic readings to rack up charges on victims' bills. The 1990s saw further escalation with cellular cloning fraud, where criminals intercepted and duplicated analog mobile phone signals using software-defined radios, enabling free airtime and international roaming abuse, costing the industry up to $650 million annually by mid-decade. The 2000s transitioned phone fraud toward digital infrastructures following the 1996 Telecommunications Act's deregulation, which proliferated VoIP services and international interconnects. Fraudsters exploited VoIP vulnerabilities, such as unsecured SIP protocols, to launch international revenue sharing fraud (IRSF), rerouting calls to high-cost premium destinations in countries like Moldova or Benin, where carriers shared revenues with fraudulent operators. This period's scams often involved "bypass" routes that evaded tariffs, with losses exceeding hundreds of millions globally as small telecom entrants facilitated gray-market call termination. From the 2010s onward, mobile-centric fraud dominated, with SIM swap attacks emerging as a potent threat by hijacking victims' phone numbers through social engineering carrier employees. These attacks peaked in the late 2010s, particularly from 2019 onward, as criminals targeted cryptocurrency holders by intercepting two-factor authentication codes to drain wallets, resulting in over $72 million in U.S. SIM swap fraud losses in 2022 alone. High-profile cases, such as the 2019 indictment of nine hackers for $2.5 million in thefts, underscored the tactic's ties to digital asset crime, prompting enhanced carrier verification protocols. In 2023, the FBI investigated 1,075 SIM swap attacks with losses approaching $50 million; by 2024, reports reached 982 complaints with nearly $26 million in losses, reflecting the ongoing shift to sophisticated, identity-based phone exploits.

Global Impact and Statistics

Phone fraud imposes substantial economic burdens worldwide, with the Global Anti-Scam Alliance estimating total global scam losses at $1.026 trillion in 2024, a significant portion involving phone-based tactics. In the United States, losses from scam calls estimated at $25.4 billion annually, affecting over 56 million victims according to a 2024 Truecaller report. The Federal Trade Commission (FTC) reported that consumers lost more than $12.5 billion to all forms of fraud in 2024, a 25% increase from the previous year, with imposter scams—frequently conducted via phone—accounting for $2.95 billion of those losses. Telecom fraud is a global phenomenon not unique to any single country, exhibiting particularly high prevalence in nations such as Pakistan, Kenya, and South Africa, where scams can represent a significant portion of GDP or expose populations to elevated risks due to regional vulnerabilities. Additionally, many scams linked to Chinese networks operate from Southeast Asia, contributing to transnational criminal activities. Regionally, developing countries face heightened vulnerability due to limited regulatory oversight and infrastructure, exacerbating the overall financial toll. Victim demographics reveal disproportionate impacts on vulnerable populations, particularly the elderly. In the US, individuals aged 60 and above filed over 101,000 complaints with the FBI's Internet Crime Complaint Center (IC3) in 2023, representing a substantial share of reported cases, with total elder fraud losses reaching $3.4 billion that year. European studies indicate similar patterns, with adults over 65 facing elevated risks due to an aging population and factors like isolation, where fraud victimization rates are higher among those living alone. Developing regions experience amplified effects from weaker enforcement, leading to broader socioeconomic strain on under-resourced communities. The societal repercussions of phone fraud extend beyond finances, eroding public trust in telecommunications services and contributing to widespread mental health challenges. Victims frequently report severe emotional distress, including anxiety, depression, shame, and post-traumatic stress disorder (PTSD), with studies highlighting prolonged psychological trauma especially in cases of substantial loss. This fraud is increasingly linked to organized crime networks, as detailed in INTERPOL's 2023 and 2024 assessments, which document how technology-enabled syndicates, including Asian-based groups, operate global scam operations that fuel human trafficking and money laundering. Such connections underscore phone fraud's role in broader criminal ecosystems. Trends indicate a sharp escalation in phone fraud incidents, with spam robocalls reaching a six-year high in 2025, increasing by 20% year-over-year from 2024 according to the Public Interest Research Group (PIRG). The FCC has noted a corresponding rise in consumer complaints about unwanted calls, driven by evolving tactics like AI-generated voices; robocall volumes in the first nine months of 2025 reached 40.8 billion, an increase of approximately 5.2% over the same period in 2024, amid ongoing regulatory efforts.

Types of Phone Fraud

Scams Targeting Individuals

Scams targeting individuals, often referred to as vishing or voice phishing, involve fraudsters using phone calls to impersonate trusted entities and deceive consumers into divulging personal information or sending money. These schemes exploit the immediacy of voice communication to build false credibility and pressure victims in real time. Common tactics include government impersonation scams, where callers pretend to be officials from agencies like the Internal Revenue Service (IRS). Fraudsters claim the victim owes back taxes or faces legal action, threatening arrest or fines unless immediate payment is made. In tech support frauds, scammers pose as representatives from companies like Microsoft, alleging a computer virus or security breach requires remote access or payment for fake repairs. Romance scams have evolved with voice manipulation technologies, such as AI-driven cloning, where perpetrators create synthetic voices to mimic romantic interests and solicit funds for fabricated emergencies. The mechanics of these scams rely on technical and psychological manipulation. Fraudsters frequently employ caller ID spoofing to disguise their numbers as legitimate sources, such as official government lines, making the call appear authentic. They create urgency by insisting on immediate action—warning of impending arrest, account closure, or disaster—to bypass rational decision-making. Payments are demanded through untraceable methods like gift cards, wire transfers, or cryptocurrency, which are difficult to recover. A notable case is the surge in grandparent scams across North America from 2022 to 2025, where scammers impersonate a grandchild in distress, often claiming arrest or accident abroad and needing urgent funds. According to the FBI's Internet Crime Complaint Center (IC3), nearly 400 victims aged 60 and older reported losses totaling $3.8 million in 2022 alone, averaging about $9,500 per victim. Overall elder fraud losses rose 11% to $3.4 billion in 2023 and reached $4.9 billion in 2024, highlighting the escalating impact. These scams leverage social engineering principles, particularly authority and scarcity, to manipulate victims during live interactions. By invoking authoritative personas like law enforcement or experts, fraudsters compel compliance through fear of consequences. Scarcity tactics, such as limited-time offers to "resolve" the issue, heighten pressure and reduce skepticism.

Frauds Involving Mobile Devices

Frauds involving mobile devices exploit vulnerabilities in cellular networks, SIM cards, and smartphone features to gain unauthorized access or incur unauthorized charges. These schemes target the infrastructure supporting mobile communications, such as subscriber identity modules (SIMs) and call routing, often bypassing traditional security measures like two-factor authentication (2FA) reliant on SMS or voice codes. Unlike general phone scams that rely on deception during conversations, mobile device frauds manipulate the device's connectivity and software ecosystem, leading to significant financial losses for individuals and heightened risks for digital asset holders. SIM swapping, also known as port-out or SIM hijacking, occurs when fraudsters impersonate victims to convince mobile carriers to reassign the victim's phone number to a SIM card under the fraudster's control. The process typically begins with the collection of personal information—such as date of birth, address, or the last four digits of a Social Security number—obtained from data breaches, phishing, or public records. Armed with this data, the fraudster contacts the carrier's customer support, posing as the victim who has supposedly lost their phone or SIM, and requests a number transfer to a new SIM. Social engineering tactics are central, including feigning urgency, providing partial personal details to build credibility, or even bribing or coercing carrier insiders known as "plugs" to approve the swap without full verification. Once successful, the victim's calls, texts, and 2FA codes are rerouted to the fraudster's device, enabling account takeovers for email, banking, or cryptocurrency wallets. This bypasses SMS-based 2FA, as the fraudster intercepts one-time passcodes (OTPs) sent via text or voice, facilitating further unauthorized transactions. Wangiri scams, derived from the Japanese term for "one-ring" (wangiri), involve fraudsters initiating brief calls from international premium-rate numbers that ring once before disconnecting, enticing victims to return the call out of curiosity. These numbers, often spoofed to appear local or from unfamiliar area codes like 232 (Sierra Leone) or 809 (Dominican Republic), connect victims to high-cost international lines upon callback. Charges accrue immediately upon connection, including setup fees and exorbitant per-minute rates—sometimes up to $40 per minute—shared between the scammer and the premium service provider. The scam thrives on volume, with automated systems generating thousands of missed calls daily, and variations may include voicemail messages feigning urgency, such as claims of package deliveries or family emergencies, to prompt callbacks. While not directly installing malware, these frauds exploit mobile billing systems, leading to unexpected charges on victims' accounts. Mobile malware distributed via voice-based attacks represents a rare but emerging threat, where voice phishing (vishing) tricks users into installing spyware during or following fraudulent calls. In cases involving Android malware like FakeCall, attackers first use vishing to impersonate banks or authorities, urging victims to download "security" apps that serve as droppers for the malware. Once installed, the malware requests accessibility service permissions, allowing it to hijack the device's dialer and redirect outgoing calls to attacker-controlled numbers—displaying a fake interface mimicking the legitimate bank contact. This enables real-time interception of sensitive audio, such as account details shared during calls, and exfiltration of SMS, contacts, and location data to command-and-control servers. While not purely voice-activated in installation, the malware's operation during calls amplifies fraud by recording conversations and facilitating ongoing deception, with campaigns targeting financial institutions in regions like Europe and South America. A notable incident illustrating these risks is the July 2020 Twitter hack, where perpetrators used social engineering to access internal tools, compromising high-profile accounts including those of Barack Obama, Joe Biden, Elon Musk, and Bill Gates to post fraudulent Bitcoin giveaway messages. Although the core breach involved phone-based spear-phishing of Twitter employees rather than direct SIM swapping on the platform, the involved hackers, including Joseph James O'Connor, frequently employed SIM swaps in related schemes to steal cryptocurrency. These attacks netted approximately $120,000 in Bitcoin from the scam tweets alone, with O'Connor's broader SIM swapping activities resulting in the theft of over $794,000 in cryptocurrency from victims, highlighting the technique's role in enabling large-scale digital asset fraud.

International Revenue Sharing Fraud

International Revenue Sharing Fraud (IRSF) is a sophisticated telecommunications scam in which fraudsters exploit revenue-sharing agreements between international carriers by artificially generating high volumes of calls or messages to premium-rate numbers they control, thereby siphoning off a portion of the termination fees paid by originating networks. These schemes typically involve accomplices who register or lease international premium-rate numbers (IPRNs) in jurisdictions with high per-minute rates, allowing fraudsters to profit from the inflated traffic without incurring the full cost of origination. The fraud relies on the complex global routing and billing structures of telecom networks, where originating carriers bear the expense of the calls while a share of the revenue—often 35-70% depending on agreements—flows to the destination provider controlled by the perpetrators. Fraudsters commonly gain access to networks through compromised private branch exchange (PBX) systems, particularly IP-based ones in enterprises, or by deploying botnets of infected devices to automate and scale the call generation. For instance, hackers infiltrate unsecured VoIP PBX setups to route thousands of short-duration calls to accomplice-controlled IPRNs in countries with favorable premium-rate regulations, such as those in parts of Africa including Togo and Benin, where rates can exceed $1 per minute. This method mirrors earlier toll fraud tactics but has evolved significantly since the mid-2010s with the widespread adoption of VoIP technologies, enabling cheaper and more covert origination of traffic via softphones or cloud-based services, shifting from traditional fixed-line exploitation to digital infrastructures that are harder to monitor. The revenue split allows fraudsters to capture a substantial cut after paying minimal fees to local providers, often netting millions per campaign before detection. IRSF accounts for a significant portion of global telecom fraud, contributing to the estimated $6.23 billion in annual losses from this type alone in 2023, representing about 16% of the total $38.95 billion in telecommunications fraud worldwide as reported by the Communications Fraud Control Association (CFCA). These figures underscore IRSF's scale, with operators in high-traffic regions like Europe and North America often absorbing the brunt due to their role as origination points. Detection remains challenging because fraudulent traffic is frequently masked as legitimate international calls, blending seamlessly with normal roaming or business communications through varied call patterns, short durations, and use of valid numbers to evade blacklists. Real-time monitoring and international intelligence sharing are essential, yet jurisdictional barriers and the rapid adaptation of fraudsters—such as rotating numbers or using encrypted VoIP—complicate proactive blocking.

Internal Frauds Within Telecom Networks

Internal frauds within telecom networks encompass unauthorized activities by employees or external actors that exploit operator infrastructure for personal gain or malicious purposes, leading to significant revenue leakage and security breaches. These frauds differ from external scams by targeting core network elements such as switches, billing systems, and signaling protocols, often resulting in undetected free services or data interception. According to the Communications Fraud Control Association (CFCA), such internal vulnerabilities contribute to the broader telecom fraud landscape, where global losses reached $38.95 billion in 2023, representing 2.5% of worldwide telco revenues. Insider threats typically involve telecom employees who abuse their privileged access to network resources, such as reselling unauthorized entry to switches for free international calls or data usage. For instance, in a prolonged scheme at AT&T from 2012 to 2017, corrupt employees unlocked approximately 2 million devices by installing malware via IMEI codes, enabling fraudsters to resell unlocked phones and bypass carrier restrictions, resulting in losses of over $200 million for the operator over the seven-year period. Similar cases have been reported globally, where insiders collude with external parties to manipulate billing systems, allowing premium-rate call rerouting without revenue capture, thereby eroding operator trust and operational integrity. External hacks often exploit legacy protocols like SS7 (Signaling System No. 7), which lacks robust authentication, enabling attackers to intercept calls, track locations, or eavesdrop on SMS without physical device access. A notable example occurred in 2014 when German researchers demonstrated SS7 flaws allowing hackers to spy on Ukrainian officials' communications, highlighting how nation-state actors and criminals alike can purchase access from rogue insiders or unsecured nodes. By 2017, these vulnerabilities escalated to financial crimes, with hackers using SS7 to intercept two-factor authentication codes and drain bank accounts, as evidenced in real-world attacks reported across Europe and the US. Despite ongoing migrations to secure alternatives like Diameter in 5G networks, SS7 remains in use for backward compatibility, perpetuating risks through 2025. Bypass fraud represents another critical internal network threat, where fraudsters reroute international voice traffic through unauthorized gateways to evade high termination fees, disguising overseas calls as local ones using VoIP and SIM box devices loaded with multiple local SIM cards. This manipulation exploits telecom interconnect points, causing operators to forgo billions in interconnection revenue annually; for example, in high-cost markets like India and Africa, SIM farms with hundreds of SIMs can route thousands of calls daily, leading to undetected losses until traffic anomalies are analyzed. Detection relies on advanced monitoring of call detail records (CDRs) for irregular patterns, such as disproportionate local traffic from single numbers, underscoring the need for real-time analytics to mitigate these infrastructure-targeted schemes.

Technological Defenses

Technological defenses against phone fraud encompass a range of automated systems and protocols designed to authenticate calls, detect suspicious patterns, and block malicious traffic at both network and user levels. These solutions leverage digital signatures, artificial intelligence, and signaling protections to mitigate spoofing, anomalous behaviors, and unauthorized access without relying on manual intervention. One primary defense is caller ID authentication through the STIR/SHAKEN framework, which uses digital certificates to sign and verify the legitimacy of originating calls across interconnected networks. Implemented mandatorily for large U.S. carriers in June 2021, STIR/SHAKEN assigns attestation levels (A, B, or C) to calls based on the originating provider's verification of the caller's identity, reducing spoofed robocalls by enabling recipients to trust or flag unsigned calls. In Europe, adoption began accelerating in 2024, with France enforcing STIR/SHAKEN for VoIP calls using national fixed numbers starting October 2024 to combat CLI spoofing. AI-based detection systems employ machine learning algorithms to analyze call metadata, such as duration, frequency, and routing patterns, identifying anomalies indicative of fraud like sudden spikes in international traffic. These models, trained on vast datasets of historical calls, assign real-time risk scores to flag potential scams before they connect. For instance, Google's AI-powered scam detection, rolled out for Android in 2025, processes voice and text interactions to detect conversational fraud patterns, building on earlier reCAPTCHA technologies adapted for telephony to prevent toll abuse. At the network level, carriers deploy firewalls to monitor and block premium-rate number traffic associated with international revenue sharing fraud (IRSF), where fraudsters route calls to high-cost lines for illicit payouts. These systems use numbering intelligence to validate destinations and throttle suspicious volumes, preventing unauthorized premium charges. Additionally, upgrades to SS7 signaling include dedicated firewalls that filter malformed messages and restrict unauthorized queries, addressing the protocol's lack of native encryption to curb interception and location tracking exploits. User-facing tools complement these measures by providing real-time identification of scam calls through crowdsourced databases and AI integration. The Truecaller app, for example, blocks spam and identifies unknown callers using pattern analytics, serving over 450 million users worldwide as of 2025 and preventing billions of fraudulent interactions annually.

Regulatory Frameworks

In the United States, the Telephone Consumer Protection Act (TCPA) of 1991 established key restrictions on telemarketing and robocalls, prohibiting unsolicited autodialed or prerecorded calls to mobile phones without prior express consent and limiting such calls to residential landlines during certain hours. Subsequent amendments, including those under the 2019 TRACED Act, expanded enforcement powers and reporting requirements for illegal robocalls. The Federal Communications Commission (FCC) has further advanced these protections through 2023 rules that closed implementation gaps in the STIR/SHAKEN caller ID authentication framework, mandating its adoption by all originating and gateway voice service providers on IP networks to verify caller identities and reduce spoofing in phone fraud schemes. Non-compliance has resulted in substantial penalties, such as the FCC's $225 million fine in 2021 against telemarketers for transmitting over one billion spoofed robocalls. In the European Union, the ePrivacy Directive (2002/58/EC) governs the confidentiality of electronic communications and prohibits unsolicited commercial calls, providing a foundation for member states to address phone fraud through national implementations that ban harmful telemarketing practices. Although the proposed ePrivacy Regulation, intended to modernize these rules with enhanced cross-border mechanisms, was withdrawn by the European Commission in February 2025, ongoing frameworks like the European Electronic Communications Code (2018/1972) promote cooperation among national regulatory authorities for reporting and mitigating cross-border fraud incidents, including those involving spoofed calls and premium rate services. These directives emphasize provider obligations to secure networks and report breaches, facilitating unified enforcement across the EU. On the international level, the International Telecommunication Union (ITU-T) has developed recommendations to address SS7 protocol vulnerabilities exploited in phone fraud, such as unauthorized location tracking, SMS interception, and call diversion; these include deploying signaling firewalls, implementing session timeouts for USSD and SMS, using secure encryption like TLS 1.2, and establishing bilateral agreements between telecom regulators and financial authorities to share fraud intelligence. Complementing these, the GSM Association (GSMA) issues Fraud Management Guidelines via its Fraud Manual (FF.21), which details detection and prevention strategies for mobile network fraud types, including international revenue sharing fraud, by advising operators on traffic monitoring, risk assessment, and collaborative blocking of suspicious international routes. External pressures, such as regulatory demands from foreign bodies, can lead to rapid improvements in anti-fraud measures within telecommunications. For example, in China, despite the enactment of the Anti-Telecom and Online Fraud Law in December 2022 and the blocking of billions of suspicious calls by the Ministry of Public Security in 2025, technical vulnerabilities such as virtual or disposable numbers persist, enabling anonymous fraud operations until compelled by international cooperation. These pressures have accelerated rectifications, as seen in repatriations of over 7,600 Chinese nationals from scam centers in Myanmar in 2025 and the extradition of suspected ringleader Chen Zhi from Cambodia in January 2026 following joint investigations. Such transnational efforts expose gaps in domestic enforcement and drive swift enhancements to anti-fraud protocols. In investigating telecom network fraud cases, electronic data serves as the primary source for establishing facts. Key types of data include chat records, platform logs, call records, device data, and app backends. Investigative methods such as remote inspection and big data analysis are utilized to prevent data loss and identify patterns. Topological associations, linking cases, devices, and persons, are established through entry/exit records, login information, and co-defendant statements. These digital evidences are supplemented by prosecutorial investigations to ensure completeness and comprehensiveness. Enforcement efforts underscore global coordination, as demonstrated by Interpol's Operation Jackal III in 2024, which targeted West African organized crime groups engaging in financial fraud networks—often leveraging phone-based scams—and resulted in nearly 300 arrests across 21 countries, the blocking of over 720 bank accounts, and the seizure of more than $3 million in assets, including cryptocurrencies tied to fraudulent activities. Cross-border cooperation plays a vital role in investigating telecom network fraud, particularly through joint actions with foreign police to capture suspects in overseas locations, verify travel records and visas, dismantle scam nests, and collect evidence such as smuggling routes and inducement information, thereby enabling repatriation and the disruption of international crime groups. For example, in January 2026, China extradited Chen Zhi, the suspected ringleader of a major cross-border telecom fraud syndicate operating scam centers in Cambodia and Myanmar, following a months-long joint investigation with Cambodian authorities that involved arrests, asset seizures, and revocation of his citizenship. Similarly, in February 2025, collaborative raids by Chinese, Thai, and Myanmar forces in the Myawaddy region of Myanmar led to the capture and repatriation of 2,876 Chinese telecom fraud suspects to China, with confiscated devices providing critical evidence of criminal networks. These efforts highlight the importance of international law enforcement collaboration in combating transnational phone fraud.

Consumer Education and Best Practices

Consumers should be vigilant for common signs of phone fraud, such as unsolicited calls demanding immediate action, threats of arrest or legal consequences, or requests for personal information like Social Security numbers or one-time passwords (OTPs). Legitimate organizations rarely pressure individuals to make hasty decisions or pay via untraceable methods like gift cards, wire transfers, or cryptocurrency. Additionally, calls from spoofed numbers that appear familiar but originate from unknown sources often indicate fraudulent intent. To protect themselves, individuals are advised never to share OTPs, credit card details, or other sensitive information over the phone, even if the caller claims to represent a trusted entity; instead, verify the request by independently contacting the organization using a known official number. Upon receiving suspicious unknown calls, do not answer, call back, or respond to prompts; if you receive a suspicious phone call asking for money, personal information, or involving threats, hang up immediately, block the number, and avoid responding to yes-or-no questions that could be recorded for misuse; if harassment continues, use phone blocking features or apps for interception and report it to authorities or relevant anti-fraud centers such as the Canadian Anti-Fraud Centre. Using call-blocking apps or carrier-provided tools can help filter unwanted calls, while registering on the National Do Not Call Registry reduces legitimate telemarketing but does not stop fraudsters. For businesses, implementing employee training programs on vishing—voice phishing—is essential; these should emphasize recognizing urgent or authoritative tones, verifying caller identities through secondary channels, and reporting incidents promptly to foster a culture of cybersecurity awareness. Effective training includes simulations of scam scenarios and principles like making content memorable, actionable, and tailored to common fraud tactics affecting vulnerable groups. Awareness campaigns play a crucial role in educating the public. The U.S. Federal Trade Commission's (FTC) consumer alerts and "Pass It On" campaign provide resources on spotting imposter scams and other phone frauds, encouraging sharing of prevention tips within communities to amplify reach. In the UK, Action Fraud's phishing awareness initiatives, including promotions during Phishing Awareness Week, urge reporting of suspicious communications and have contributed to removing over 27,000 scam-related messages between April 2020 and April 2025 through collaborative efforts with telecom providers. Reporting suspected phone fraud is vital for disruption. In the U.S., forward spam texts to 7726 (SPAM) to aid carriers in blocking sources, and report incidents to the FTC at ReportFraud.ftc.gov or the FCC for enforcement. This short code is also used internationally in countries like the UK, Canada, Australia, New Zealand, and Sweden, where telecom operators share data to combat cross-border spam; for example, UK networks allow free forwarding to 7726 for suspicious SMS or calls.

References

Add your contribution
Related Hubs
User Avatar
No comments yet.