Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I get messages (and often don't answer my phone; my ringer is off) in which it's obviously this automated thing but they immediately dock it down to "press 1 if..."
'Kay. So you call people and just clearly have a tone the second you hear a voice which could well be someone's answering machine
(Of course most of it would be automated, I guess)
Special place in hell for these people
by alex1138 - My Google Voice number got 37 calls from the same region in the past 2 days. All day, about every 50 minutes, rotating different 404 based numbers. It happens about twice a year from this area code (404). I know exactly where it is from. I had to park in Atlanta once and it required me to create an account on an app for that parking lot to pay. Of course I used my Google number. That service must have transferred or sold my number. Now my account gets bombed by them on a regular basis.by ogou
- I've been using the Android app SpamBlocker off F-Droid for several years to block unwanted calls and SMS. It blocks entire area codes, individual numbers, names and any pattern using regular expressions. It can silence, pickup and hangup or just send to VM. The developer has a github page and has provided many updates. https://f-droid.org/en/packages/spam.blocker/by TimBurman
- This rehashes much of the experience fighting email spam in the late 1990s / early aughts.
Initially the approach was a long list of rules, usually a whitelist and blacklist of known good and bad contacts, and then a large set of specific patterns and assigned weights. Procmail was an early standard here, later Spamassassin.
The biggest revolution came with Bayesian classification. YCombinator's Paul Graham (@pg) developed one such system. The idea here was that a small set of mail was classified into two categories, spam (unwanted) and ham (wanted), and the classifier went looking for patterns within each corpus, automatically assigning weights. This took much of the guesswork and assumptions out of the process, but still relied on contextual clues within the mail itself, though both data (the message payload) and metadata (email headers) could be used.
Following that were reputation-based systems, generally looking at domains or IP address space, where a sufficiently large-scale survey of mail patterns, initially based on honeypots, later largely conducted by large email providers themselves such as AOL, Yahoo, Hotmail, (this was the aughts, they still existed), and eventually Gmail and a few others. Senderbase/Ironport (later bought by Cisco) were another major contender here. These approaches strongly leveraged power-law relations, in which a small number of origins (IPs, CIDR blocks, ASNs) account for the vast majority of email spam. Generally: poor network hygiene practices, whether intentional or otherwise, show, and are actionable by peers / others.
Google especially, through Gmail, had access to a phenomenal amount of activity, and could detect both datacenter-based bulk mailing activity and residential proxy campaigns. Effectively its Gmail service serves as a huge, distributed, collection observatory, and can respond to new spam campaigns incredibly quickly. I don't have specific insights, but suspect that response times are measured in minutes if not seconds.
Google of course also has insight to the contents of emails, but network- and header-level adjudication is much faster, cheaper, and surprisingly effective.
This is why I'm strongly advocating carrier-based, network-level phone-spam mitigations, and whatever regulatory changes are necessary to incentivise providers to adopt these. On-device apps are fine, so far as they go, but would best work in concert with network-level countermeasures.
by dredmorbius - An ask: I'm trying to find out where substantive discussion by carriers AND other parties on mitigating phone spam (voice or text) is occurring. I'd very much appreciate replies here, email (see my profile), or hop on this Fediverse thread: <https://toot.cat/@dredmorbius/116984051310517623>
Broadband Breakfast does seem to be one of those entities. ATIS (<https://atis.org/>) is another, though as a telco alliance I consider it highly suss.
(Submitter.)
by dredmorbius - dontscamgrandma.com is probably apropos to share here for the elderly / vulnerable affected by scam proliferation. It's a trainer that roleplays people through getting the confidence to hang up and call their loved ones back.
Full disclosure I'm the founder, and I've got a couple dogs in this fight
by f1ay - T-Mobile’s Scam Shield works really well for me. But you have to get the premium tier.
- Fuck everything about this. It's like your drug dealer running AA meetings.by olyjohn
- There are a number of options. My view is that carrier-based filtering (rather than on-device filters) are where effort must be focused. Much as we learned with email: if you're routing traffic for many people, mass-contact attempts and patterns become quickly visible. Individuals see only a minuscule fraction of traffic, networks see overall patterns.
The other element is that carriers can act at the network level, noting how much abusive traffic arrives from given peers, and taking direct action against those peers. That could involve rejecting traffic outright, subjecting it to stronger challenges, and/or diverting it to investigative / law-enforcement bodies (I'd suggest both national and state entities) for both tracking and enforcement. Power-law relations mean that at any given time, a small number of networks will account for the overwhelming majority of spam, though which networks will likely change over time.
The key problem with this is getting the carriers to act, which ... will probably involve a few carrots and sticks. I'll address those in another comment, except to mention bonding: <https://oag.ca.gov/consumers/general/telreg>.[1]
Individual action will not solve this problem, but there are steps you can take.
Most major US carriers now offer some form of robocall blocking. "Scam Shield" from T-Mobile, "ActiveArmor" from AT&T, "Call Filter" from Verizon.
MVNOs (mobile virtual network operators) may or may not offer scam / robocall blocking themselves (though IMO they should, and should be required to). Some will identify spam calls, but those are still passed through to your handset.
Beyond this, there are on-device apps which can be used, some are carrier-based (e.g., "Call Filter Plus", from Verizon, similar tools exist for Verizon and AT&T), some are third-party. These of necessity share your voice/text activity with third parties, which is its own concern and consideration.
Full Android, iOS, and several full-featured Android alternatives (GrapheneOS, /e/OS, LineageOS, etc.) offer unknown caller rejection. Numbers not in your contact list are directed to voicemail. At present, few spam calls will leave voicemail, though some do, and as AI expands in capabilities, applications, and adoption this will all but certainly increase. I'd strongly encourage use of this.
Feature phones / dumbphones ... have far less capability. Most cannot even reject unknown numbers, which ... seems a ripe target for legislation and/or regulation. Phone frameworks such as AOSP / KaiOS seem to afford little capability for even creating a call-blocking app. This and other dumb devices (e.g., traditional landlines) are a strong argument for carrier/network level mitigations.
The company everyone loves to hate, Comcast/Xfinity, actually has one of the most sophisticated voice/text spam blocking systems, and one I'd like to see mandated to all carriers: <https://www.xfinity.com/support/articles/spam-blocker-overvi...>
It's risk based.
It classifies calls into three categories: high, medium, and low risk.
It adjudicates calls based on risk.
High-risk calls are terminated entirely.
Medium-risk calls are directed to voicemail.
Low-risk calls are subjected to an audio CAPTCHA (enter a two digit value to ring through), otherwise are directed to voicemail.
(It's not clear whether or not a whitelisted number will escape any treatment, perhaps subject to conditions such as originating from the appropriate/approved network for that call.)
I haven't used that system, but in advising people still moving off landlines, or looking at VOIP solutions, it's making Comcast an attractive option.
(I don't know what other VOIP providers, say, Twillo or Asterisk, offer, but suspect at least some have similar if not more-capable systems.)
________________________________
Notes:
1. California requires a $100,000 bond by all telemarketers in the state. The state has a small fraction of the incidence of robocalls of the worst US states. Several others have some bond. My view is that bonding should apply at the carrier level and be surrenderable to both contacted individuals and downstream peering networks, to provide both a strong financial penalty to abusers, and an incentive to downstream networks to pursue abusive calls.
by dredmorbius - Funny, the same telecoms that whine about how hard this traffic is to stop... are also selling a "premium" service to customers- who then manually tag unwanted calls so that the telecom can sell that data back to other customers...by ipython
- I got an obviously-AI voice agent spam call yesterday. Had a bit of fun getting it to answer trivia questions (when was the treaty of westphalia ratified? answer in a rhyming couplet) as a precondition to handing over the keys to my bank accounts.by sdenton4
- Downside is they most likely are using stolen tokens, not paying themselves so it cost them next to nothing.by ozim
- Perhaps the future of captcha is anti-captcha. What agent can resist responding with a rhyming couplet or inverting a binary tree?by nojs
- Maybe this is a pipe dream, but wouldn't it be better to retire the legacy phone voice and messaging system altogether.
If 99.9% of us have internet phones, why aren't we using PKI, decentralized protocols, crowd sourced reputation to communicate instead of POTS phone numbers, SMS/iChat and relying on the carriers to police spam.
by bickfordb - Redundancy in case of natural disasters.by tacocataco
- The traditional (POTS-based, circuit-switched, fully-analogue system) has largely been retired. Even where existing POTS twisted-pair service exists, it's generally VOIP until the last few hundred metres, if that.
In much of the US, the push is on to retire the last twisted pair within a very few years, if not months. Utilisation rates are well into the single-digits and falling, which makes continued support quite expensive.
The problem for many holdouts is that alternatives fail to deliver reliability, or the equivalent of a site-centred service (as opposed to personal mobile devices). Residential VOIP is confusing from the subscriber's perspective, and the telcos aren't making choosing options much easier.
SMS itself is highly problematic, as it's grossly insecure, unreliable, and very subject to surveillance and other abuse. Secure chat alternatives tend to be proprietary (e.g., RCS, effectively specific to Apple and Google, see: <https://en.wikipedia.org/wiki/Rich_Communication_Services>), or aren't supported on all devices (Signal would be excellent, but isn't supported on most Feature Phone / Dumbphone OSes, such as KaiOS/AOSP). And Signal too is ultimately a single provider.
by dredmorbius - This is actually an easily solvable problem. In fact, most of the world has already solved it by not allowing caller-ID spoofing and by blocking bad actors similar to the way that ISPs block email coming from known bad IPs.
The US has the STIR/SHAKEN authentication protocols, but the telcos seem to have no financial are regulatory pressure to clamp down on all the sketchy intermediate carriers the scammers use to bypass them.
Rather then actually solve the problem, the US prefers to turn it into a business opportunity with the telcos selling subscriptions to blocking software and an entire ecosystem of moderately effective apps.
by timoth3y - One of the biggest concerns I have with phone scams is that the people most vulnerable are the elderly, and they don’t have the knowledge on how to block these calls (if a technical solution is the only option).
And further to that, the elderly are also the ones who cannot block unknown numbers, because doctors’ offices seem to have random numbers they call you from (they may have a pool of numbers but it’s not reasonable to add all of them to contacts). Blocking all unknowns would block these important health related calls as well.
by orev - Yup. My doc's appointment reminders come from some service in another state. It's a pool of numbers, sometimes they come up as suspected spam. I suspect the dodgy guys deliberately offer very good rates for things like this so people won't block them.by LorenPechtel
- AARP's magazine and bulletin[1] are pretty much filled with scam-awareness articles every issue. It's an absolutely major concern.
________________________________
Notes:
1. Incidentally, the first and second largest-circulation magazines in the US now: <https://www.magazineline.com/blog/most-popular-magazines-in-...>.
by dredmorbius - And if you think spam calls on your cell phone are bad... oh boy, land lines get about 10x the calls. My theory is that because it's mostly older people who have land lines on top of the fact that spam laws are tighter for cell phones. There aren't enough land line users to complain, so not a big enough voice to make a public outcry. Cell phone users have no idea the problems that land lines have.
I know this because I had to spend 6 months taking care of my dad while he was dying. We had so many medical people calling us and making appointments, and doing tests, etc etc. And on top of it about 10-15 spam calls a day and it's impossible to differentiate via caller ID. This was all while I was also working full time from home. It's a real hellscape, and these phone scammers are really having a negative effect on people's lives. It made my life miserable at one of the hardest times of my life, and I have nothing but contempt for these fuckers, and no empathy left for the people making the phone calls either. They're all scumbags and deserve time in prison.
by olyjohn - > because doctors’ offices seem to have random numbers they call you from
This is a huge issue with scam/security awareness education. Too many legitimate orgs use the exact behaviors we tell people to avoid. Same thing with email, can't tell someone to never click links in emails when services keep relying on magic links, third-party notification domains, etc. SPF, DKIM, and DMARC do nothing because scammers will just typosquat.
In the phone number example, most of those numbers too are unlisted outbound numbers, you couldn't even google them to verify.
Half the battle is getting legitimate organizations to stop acting like scammers in the first place so that shady behavior becomes an obvious red flag again.
by thewebguyd - I no longer can answer my phone. I get at least 20-40 spam/scam calls per day, and many are legitimate companies calling for loans and refinancing offers, which started after I got a home loan. I cannot seem to stop them from calling, and even though my phone number is listed in National Do Not Call Registry for many years, it hasn't worked at all. The only relief is that on my iPhone, I was able to block all calls not found in my contacts (ie whitelist phone numbers only).
Now, my only worry is that I might get a call from someone who I need to talk to, but is blocked and I won't even know it. For example, what if I get an emergency call from police/fire/hospital and I won't even know it. I also tried using "Screen unknown caller" feature, but then, no one likes them and sometimes they think it is AI bot and they usually just hang up (which is great for spam caller but not for legitimate caller)
My only solution that I could think of is to have a dedicated phone line just for friends/family/work, and a second line for banking/shopping/utilities/everything else.
by otterpro - Live in Europe, last time I got a spam call 4-5 years ago it was my ISP asking of I wanted to add tv to my internet. Told them not to call me again and they didn't.by Hikikomori
- Right but what keeps the second line clean? You’re going to get spam there too.by bckr
- I too set it up so all unknown calls go to VM. I figure if legit they will leave a message. If two calls and no message I block the unknown number.by gbourne1
- The fix is a Google Voice number that you replace every few years. Keep your permanent number guarded for critical services only.
- What I did was implement a SIP number that asks for a random digit to be pressed before allowing the call through. It also connects to my CardDAV server, and any numbers in my address book don't get the prompt. This works for 95% of bogus calls. The only thing this stops is people not on my address book calling from hands-free. But this has never come up in conversation so I think I'm OK!by Maskawanian
- I get the comfort that "normal person" would send an SMS "it was me Greg, call me back" if you don't pick up and most of my family is on whatsapp anyway.
Scammers or spammers will never send an SMS with clarification that they wanted to call you.
by ozim - > I also tried using "Screen unknown caller" feature, but then, no one likes them and sometimes they think it is AI bot and they usually just hang up (which is great for spam caller but not for legitimate caller)
When its someone legit I find that they actually go through the effort. I've had USPS explain who they were to my phone and I was able to answer them as a result.