Scammers Turn To Caller ID 'Spoofing' To Pose As Police

Jun 17, 2015
Originally published on June 17, 2015 6:18 pm

Most people know to hang up on con artists supposedly calling from the power company or the IRS, demanding money. The problem is, there's little the police can do — even when the scammers go so far as to impersonate the police themselves.

The fake police scam, or "spoofing," has been making the rounds for the last year or so.

Cmdr. Joseph Chacon of the Austin Police Department's intelligence division says they saw a wave of these calls this spring from people claiming to be Austin police.

"We've seen them saying that they need to send money so they can get a loved one out of jail," Chacon says. The scammers "want them to buy cash cards and then give them the card numbers over the phone, and then they're able to take that money and use it."

But why would anyone fall for that? The simple answer: Caller ID.

"We have people that are calling using 'spoof' numbers that are very similar or identical to numbers that we use, that we call from," he says.

"Spoofed" calls are calls that come in showing an altered number on the caller ID.

Dave Huras is very familiar with spoofing; he's the president of the Communications Fraud Control Association, a joint effort of telecoms and law enforcement. He says the fact that people can change their caller ID isn't a flaw in our phone system — it's a feature.

"There are customers who legitimately want to be able to deliver a different phone number showing up at the other end, so it was built that way," he says.

For instance, companies might modify their caller ID to show a single customer service number, or police detectives might want to display a generic residential number when doing investigations.

The problem is, Internet phone services have democratized phone spoofing. There are websites that make the trick available to anybody. And now that people are pretending to be cops, some wonder whether our phone system is too flexible.

But Huras says it's too late to change that.

"Basically, to get rid of spoofing at this point would take an entire retooling, re-architecture of telephony networks across the world," he says. "You are talking about multi, multi, multi billions of dollars, and it's just not practical."

It is technically possible, sometimes, to trace spoofed calls, but it's a challenge. You need cooperation from multiple companies, and the trail often goes overseas. Law enforcement might do it on a big case, but it's not something that most local cops would know how to initiate.

Mark Coil is the deputy chief of the Shelby Township police, a small suburban department outside Detroit.

"I don't know of one case where we've just gotten the number on its own and traced it back," he says. "Usually there's some sort of other evidence or there's something else to tie it together."

Sometimes there's a money trail, or the victim knows the fraudster. But generally, there's little local police can do to solve these crimes. Instead, they just warn people — over and over again — to be on guard. But skepticism has its own cost.

Coil says he has seen that when he has called people about their family members who really are in jail.

"You know, when you're really truly trying to make phone calls to have somebody come bond somebody out, and they say, 'Well, I don't believe you are who say you are,' and you have to give them your number, and then they have to call you back and, you know, it dilutes people's trust or belief in who they're really speaking with," he says.

It's like that old cartoon about how on the Internet, no one knows you're a dog. Except in this case, on the phone, no one knows if you're really a cop.

Copyright 2015 NPR. To see more, visit http://www.npr.org/.

Transcript

DAVID GREENE, HOST:

And now to an old-fashioned kind of hacking - hacking into people's wallets using an old tool, the telephone. The Federal Trade Commission says complaints about fraudulent phone calls jumped 67 percent last year. Now, many people know how to hang up on con artists supposedly calling from, say, the power company or the IRS, demanding money. Others get into arguments with them and post the results online.

(SOUNDBITE OF VIDEO)

UNIDENTIFIED WOMAN #1: Give me your physical address, or I am calling the police.

UNIDENTIFIED MAN #1: Yes, you do not have to do that.

UNIDENTIFIED WOMAN #1: Yes, you do.

UNIDENTIFIED MAN #1: The police will be coming to your doorstep.

UNIDENTIFIED WOMAN #1: Then they won't mind if I call them, will they?

GREENE: The problem is, there's little the police can do, even when the scammers impersonate the police themselves. Here's NPR's Martin Kaste.

MARTIN KASTE, BYLINE: The fake police call scam has been making the rounds for the last year or so. Commander Joseph Chacon runs the Austin Police Department's intelligence division, and he says they saw a wave of these calls this spring. These are calls from people who claim to be Austin police.

JOSEPH CHACON: We've seen them saying that they need to send money so that they can get a loved one out of jail. They want them to buy cash cards and then give them those card numbers over the phone. And then they're able to take that money and use it.

KASTE: But why would anyone ever fall for that? The simple answer is caller ID.

CHACON: We have people that are calling using a spoofed number that looks very similar or identical to numbers that we use, that we call from.

KASTE: Spoofed calls are calls that come in showing an altered number on the caller ID. Dave Huras is very familiar with spoofing. He's the president of the Communications Fraud Control Association. It's a joint effort of telecoms and law enforcement. He says the fact that people can change their caller ID isn't a flaw in our phone system. It's a feature.

DAVE HURAS: There are customers who legitimately want to be able deliver a different phone number showing up at the other end. So it was built that way, absolutely.

KASTE: For instance, companies might want to modify their caller ID to show a single customer service number, or police detectives might want to display a generic residential number when they do investigations. The problem is, Internet phone services have democratized phone spoofing. There are now websites that make this trick available to anybody. And now that people are pretending to be cops, some wonder whether our phone system is too flexible, but Huras says it's too late to change that.

HURAS: Basically, to get rid of spoofing at this point would take an entire retooling, re-architecture of telephony networks across the world. You are talking about multi-multi-multi-billions of dollars, and it's just not practical.

KASTE: It is technically possible, sometimes, to trace spoofed calls, but it's a challenge. You need cooperation from multiple companies, and the trail often goes overseas. Law enforcement might do it on a big case, but it's not something that most local cops would even know how to initiate. Mark Coil is the deputy chief of the Shelby Township police. It's a small suburban department outside Detroit.

MARK COIL: I don't know of one case where we've just gotten the number on its own and traced it back. Usually, there's some sort of other evidence or there's something else to tie it together.

KASTE: Sometimes, there's a money trail, or maybe the victim knows the fraudster. But, generally, there's little the local police can do to solve these crimes. Instead, they just warn people, over and over again, to be on guard. But that skepticism has its own costs. Deputy Chief Coil says he's seen that when he's called people about their family members who really are in jail.

COIL: You know, when you're really, truly trying to make phone calls to have somebody come bond somebody out and they say, well, I don't believe you are who you say you are, and you have to give them your number, and then they have to call you back and - you know, it deludes people's trust or belief in who they're really speaking with.

KASTE: It's like that old cartoon about how, on the Internet, no one knows you're a dog. Except in this case, on the phone, no one knows if you're really a cop. Martin Kaste, NPR News. Transcript provided by NPR, Copyright NPR.