Caller ID spoofing: Protection against fake VOIP calls

Varun Kapoor *

Another type of "Spoofing" is carried out very often by cyber thugs when they use voice calls as a means of committing crime on unsuspecting victims. Caller ID Spoofing basically means calling from one particular number and displaying a totally different number to the receiver of the call.

The chosen target receives a call one day – the number being displayed is +442345 34534. This is a number from United Kingdom (+44 is UK code).

The target picks up the call and the caller is speaking in a funny English accent. The target naturally thinks that the call is from UK. The caller says that the target has won a lottery of Pound Sterling 2 Million from any fictitious company and to get his money he just needs to give his account details to the caller so that the money may be transferred to him.

The poor unsuspecting victim believing that the number being displayed is from UK and the person speaking also sounds English/foreign, falls for the trap and provides the account details to the cyber thug and the mistake is made. The criminal now has vital personal information of the victim and he can use this to financially defraud the victim of his hard earned money. The crime of Caller ID Spoofing has been executed.

Caller ID spoofing is based on the technique of VOIP calls. That Is the Voice Over Internet Protocol. These are not telephone calls but internet calls.

Caller ID spoofing is the process of changing the caller id to any number other than the calling number. In some cases criminals become members of services available on the internet (like covertcalling.com etc) and they are issued with a personal identification number (PIN).

Customers dial the number given to them by the company, their PIN, the destination number and the number they wish to appear as the Caller ID. Often such websites provide services for free for a trial period.

Some services even provide facility for changing the voice of the caller so that even the voice cannot be recognized or detected. This caller ID spoofing is generally done to defraud the victim of money by either tempting him/her with lucrative offers or are threatened with an emergent situation demanding immediate action.

It is also used in certain erotic call services. Here the victims are made to believe that they are speaking to female speakers in South East Asian or Western countries and they are made to pay bills that run into many thousands or even Lakhs of Rupees. Whereas in reality they were only talking domestically, the charge of which would be neglible as compared to what they are compelled to pay.

Such calls appear in the CDR of the victim as an internet call and they cannot be traced by the conventional means. The website that has provided the caller id spoofing to the criminal has to be contacted and the IP address of the criminal can only be obtained from them.

Once this IP address is obtained the call can be traced to either a SIM card; a Modem or a Data Card/Dongle. Then this particular SIM, Dongle or Modem has to be connected to a user and then to an individual.

Such an elaborate procedure has to be followed just to solve such a crime – often the police do not have the know-how to do it and hence avoid it or many times the IP address obtained leads the investigators to another country or to a fake identity and thus a dead end is reached and the victim gets no relief both in terms of getting his money back or at least getting the offender apprehended.

The best way around this offence is to first know that such caller id spoofing can and does occur. Hence taking calls from unknown foreign numbers can be avoided and also there should always be a doubt while speaking with unknown numbers or persons over the phone – it may be a fake and spoofed call.

If you have a doubt you can ask the person to hold while you call the displayed number from another phone. If the number is busy or you reach the company or agency that the person says he belongs to, then the call is not spoofed.

The final check you could make is to enter the number in question in a search engine. This allows you to see if the company has the number on their website or if the company has mention of a scam that is going on. It also allows you to figure out what other people are saying about number.

[Views expressed in the column are of the author himself]