15

It is in the news that the UK government is making a significant investment in "a clampdown on the use of cold calls to sell financial products". This involves significant investment in specialist skills:

The new fraud strategy, a response to the massive growth of web- and phone-based scams, will also result in what was billed as 400 new specialist investigators across police and the National Crime Agency recruited as part of a revamp for how the crime is investigated.

I have a UK mobile phone, and I get fairly frequent cold calls from geographic UK landline numbers. If I straight up make a GDPR Subject Access Request they invariably hang up. If I keep them talking I get all sorts of stories, the only commonality being that they involve lies. The last one was noteworthy in that the caller accused me of gas lighting them when I read out from the Companies House Web site that the company they claimed to work for was wound up five years ago. I do not know what the scam is, but I am sure it is a scam and the GDPR breach would seem to serve as "Al Capone's taxes", in that it is not really the problem but is easy to prove beyond reasonable doubt.

It seems that if the government wanted to make this activity a non-viable way of making money it would be trivial. Someone has paid for that telephone call, that entity must have a bank account that is known to the telephone operators. The GDPR breach seems clear, and the maximum penalty is £17.5 million. If the UK state wanted to "clampdown on the use of cold calls" it would not take a team of 400 sepalists to find these numbers, find out who is paying the bill from the telephone operator and start enforcement action. The risk reward ratio seems so unbalanced that it could be stopped tomorrow.

Why is cold calling still an issue in this day and age, given that the government cares about it?

11
  • 12
    This isn't anywhere near an answer, but I suspect your belief that a geographic caller ID implies a significant credit history is false. Virtual landlines are readily available from multiple providers (and sub-providers) ranging from the reputable [vodafone.co.uk/business/unified-communications/… to the extremely sketchy (not going to link, but I can find a large number advertising "no contract" options).
    – origimbo
    Commented May 3, 2023 at 10:10
  • 1
    @origimbo Vodafone I would consider a telephone operator, and expect them to be able to provide banking details of their customers. If an organisation was shaddy enough that they would not cooperate with police in investigating crime there are avenues to deal with that, including aiding and abetting/accessory after the fact type laws. There is a reason criminals use cryptocurrency, and I do not think you can buy a landline telephone number with cryptocurrency.
    – User65535
    Commented May 3, 2023 at 10:29
  • 17
    Why would they need a local footprint at all? I would think they'd use VOIP, which is definitely available in prepaid form using all kinds of payment methods that would be hard to track (crypto, prepaid card codes, stolen credit cards). Then all they need to pretend to be local is spoofing a local number which is also trivial.
    – JJJ
    Commented May 3, 2023 at 11:06
  • 7
    This seems more of a law enforcement and technology issue than a political issue. Depending on what calls you are calling about, many of them may come from overseas, using spoofing to appear domestic. Your question is also fairly unclear, veering between different terms: cold calling - a normal, if annoying and possibly now illegal commercial outreach approach. And scams - a certainly not legal intent to defraud. The distinction is important: a legitimate domestic actor may care about GDPR for example, an overseas fraudster would most certainly not. VTC, please be more specific. Commented May 3, 2023 at 17:05
  • 3
    FWIW, the US/Canada side of telephone fraud and robocalls was supposed to be addressed by a technology called STIR/SHAKEN. This is one critical coverage of it, which has been cited by others. Not saying it never works, but... it is not a simple problem, technically speaking, meaning that asking why the &%(# politicians aren't doing their job may be missing the point. Coverage of UK specifics Commented May 3, 2023 at 17:13

3 Answers 3

21

The thing about such scams is, there is money in it. And the scams may be originated nearly anywhere. So the incentives are enormous.

Here is a story about phone scams in Alberta, Canada. In one year the scammed money was $5.4 million. This is a province with a population of only 4.2 million people. The financial incentives are clear.

The comments have referred to some of the problems. Basically, it's an "arms race" between the various authorities and the scammers. The authorities get a technique. It hurts the income of the scammers. The scammers invent ways to get around it.

  • Some phone number prefixes are blocked? Spoof the phone number.
  • Some geographic regions are blocked? Spoof the region ID.
  • Some other thing is keyed on to detect the scammers? Spoof that.
  • Some pattern of scam becomes known? They change the pattern.

It used to be a Nigerian prince trying to get money out of his home country. Now it's Ukrainian businessmen. Or people from Hong Kong. Or whatever place is in the news. Or it's somebody connected to whatever politician is in the news, trying to get his illicit money to someplace safe.

Or it's just a guy pretending to sell shares in a bank that has been doing business for a century. When really he's just a scammer who photocopied some letterhead from that bank.

The scammers are prepared to move to a new scam quite quickly if the old one stops paying. Whether because it becomes known or the authorities get new equipment. Their offices are basically a cell phone and maybe a laptop computer. They can be out the door and "in the wind" in the time it takes to close the laptop and put the cell phone in their pocket. If they feel too beset by the authorities, these devices can easily be destroyed beyond recovery of the data.

So, even if the political forces are of good will and trying to help their citizens, the target is a moving one. And it is not universal by any means that the political forces are trying to help. Politicians mostly do what they believe will be good for themselves, as do a lot of people.

If a politician perceives his self interest to be in "happy citizens" then he may push for laws that help deal with scammers. And then the scammers all take "one step to the left, one step back, and one step to the right." And set up shop one street over doing "red" scams when the used to do "blue" scams. And the politicians have a lot of trouble catching up.

2
  • 6
    "Their offices are basically a cell phone and maybe a laptop computer." This isn't actually true. Their offices are massive call centres in India that have a handful of people doing actual call centre work to offer a fig leaf of an excuse to all the scammers.
    – nick012000
    Commented May 4, 2023 at 14:15
  • 1
    I think it was "Trilogy Media" on youtube (or perhaps one of its members) that tracked down a scam call center in (I think) Mumbai. It was a permanent office in one part of a building that was otherwise used for call centers of legitimate businesses. It was kept hidden from neighbours and authorities too. They delivered cockroaches, fart bombs and hand soap with blue ink. (Of course, being YouTube personalities only, it's not outside of reason the whole thing could've been fake, but I don't think so) Commented May 4, 2023 at 19:02
6

Frame Challenge: Technically, cold calling is functionally the same as just calling a random 10-digit number.

The mention of a GDPR Subject Access Request does seem to indicate that you think the group spamming you has more information that they could give you on the request.

It's entirely possible they're just robocalling random numbers in the area, and therefore don't actually have your number in question. It certainly wouldn't be impossible for one person to do that on a scale that surprises people...because there's not always someone on the other line. Regulating the software technology to do that would be difficult to do so politically...because the fundamental technology allows politicians to do fundraising campaigns, volunteer outreach, or even political surveys of their constituents - sometimes with voicemail or automated voice systems handling the multiple calls that go to voicemail or can't be serviced by a specific person on their end; they can tie the information of a phone number to a name and other information, but that's something that's not inherent to just robocalling random numbers in an area.

It's rather difficult technically to restrict said calls, since it'll be near impossible to distinguish why a call is made before a call is connected (See @Boba Fit's details about the potential arms race trying to resolve that), or even if the call being made is not just a wrong number.

And that's all before the scale of the issue - the video I linked was posted in 2019, but it sources a 2018 citation that in a year from then, half of all mobile phone calls will be scams. At that sheer scale, there's almost a guarantee that some of those calls (If not most of them), aren't as targeted as you may think that they are.

12
  • 2
    "Regulating the software technology to do that would be difficult" - rather than "difficult", a better description might be "possibly contrary to the interest of politicians". You mention some possible downsides, but these seem largely applicable to politicians rather than the general public (as much as I don't want to be called by scammers, I don't want to be called by politicians for fundraising campaigns or surveys), and downsides doesn't make something "difficult".
    – NotThatGuy
    Commented May 4, 2023 at 8:14
  • 1
    @NotThatGuy: That's a fair point about it being possibly contrary to the interest of politicians", but I will point out that classifying dialing a bunch of random numbers means you'd have to enforce calling wrong numbers (Off by a few, if just one, digit)...to the same effect as accidental butt dials - sometimes to 911l that's not solving the problem - that's re-classifying it. Your phone can, and will, dial nearly any 10 digit combination (Barring auto-shortcuts like 911), if that's what the user tries to do. Commented May 4, 2023 at 8:35
  • 2
    @AlexanderThe1st That's where intent and scale comes in. If someone occasionally calls a random or incorrect number, it's generally easy to argue that they didn't intend to do so, and they therefore shouldn't be charged with anything (some offenses require intent). If a company calls thousands of people, it's much harder to argue that they didn't intend to do so. Also, prosecuting someone for a single such offence would generally not be reasonable nor in line with the purpose of such a law (not that this would necessarily stop such prosecutions).
    – NotThatGuy
    Commented May 4, 2023 at 8:58
  • 1
    You can rate limit, but some businesses may have a legitimate need to make lots of calls. Some companies legitimately do automated calls, like taxi companies or delivery companies alerting people; or businesses offering a call-back function to people who call in; providing codes for 2-factor authentication and potentially other alert services especially aimed at people without smartphones. And some companies offer centralised call services to many businesses, with vast call volumes. And it can be done from overseas, or simply by jumping from provider to provider.
    – Stuart F
    Commented May 4, 2023 at 12:01
  • 1
    Disagree with this answer. Nobody's saying it needs to be a robot that blocks cold calls before they happen. It would be enough to put the perpetrators in jail. Just like cars don't stop you driving a bank robber away from the crime scene, neither should telephones stop you from calling to sell scams. In both cases the police track you down by other means (possibly including data recorded by the machines involved) Commented May 4, 2023 at 19:04
4

Its a spoofed number

So, you go to the police with the number they used. If it is a genuine number (which it may not be), the person who owns that number did not make the call. The police investigate and determine this is the case. Then what?

The scammer is in a country with no extradition treaty using a burner phone bought with a fake ID and used for a couple of weeks before being dumped. If you can’t find them, you can’t prosecute. If you can find them, you can’t prosecute because they are outside the reach of UK jurisdiction.

You can go into your phone handset right now and change the number that is displayed when you make calls - on an iPhone you do it through Settings->Phone->My Number.

This is a feature, not a bug. There are many legitimate reasons for changing this. For example, perhaps a company wants their sales team all use the same toll-free number and not to give out their individual moments. While this is a little less likely today, when caller ID was developed at the dawn of the mobile phone era, this would have been normal. So that’s how its designed.

19
  • 6
    This merely turns the question into "why is call spoofing permitted?". It would certainly be technically possible for phone companies to prevent it. Commented May 4, 2023 at 3:28
  • 7
    @DJClayworth Making the caller number reliable (hard to spoof) would require replacing basically the entire core telephone infrastructure with something completely different. Behind the scenes there's something called Signalling System 7 which is a system developed half a century ago. It treats numbers just like e-mail treats addresses: they're just random metadata slapped on, there's no fancy cryptography involved to authenticate them. You can't just replace this system without breaking interoperability with other networks worldwide.
    – TooTea
    Commented May 4, 2023 at 8:09
  • 1
    I doubt there is still (strictly speaking) any technical reason to allow spoofing. For sales people not wanting to reveal their private numbers, I imagine there are a whole range of ways in which one can redirect one's calls to go through a line you own, without having to actually be in the same physical location (VPN has solved that problem a long time ago for redirecting internet connections).
    – NotThatGuy
    Commented May 4, 2023 at 12:40
  • 1
    @DJClayworth "why is call spoofing permitted?" Its actually very difficult to prevent. The signalling protocols for phone exchanges were developed decades ago when owning a phone exchange was expensive and rare, so they didn't bother with security. These days anyone can have one, but there is still zero security in the protocols. Fixing this would require a software upgrade in all exchanges globally, and ain't gonna happen. Commented May 4, 2023 at 14:26
  • 1
    I do not have an iPhone (but an Android phone), in Europe. You are saying that in your country you can put whatever number in your iPhone and it will be the caller ID that I will see? This cannot work in France at least.
    – WoJ
    Commented May 4, 2023 at 16:29

Not the answer you're looking for? Browse other questions tagged .