While most people are trying to figure out how to block robocalls from automated systems, others are trying to find a way to be able to sign-up for robocalls.
It's difficult for anyone to know the specific mechanics of how phone numbers get "flooded" with phone calls.
If you are simply curious about how telemarketing calls work, do not have a business number that has been compromised, or want to know where robocall lists come from, this question will exhibit complex intent.
First, let us examine the basics.
The average person does not willingly engage in such harassment on their own.
Rather, the telecom network, coupled with data brokers who continuously obtain and sell user lists to the highest bidder, perform the function of creating these lists.
Bad actors use various weaknesses in telephony routing and aggregation, co-registration forms, and cloud APIs to create and deliver indiscriminate lists of phone numbers that can be targeted.
Once we understand how lists are created and we establish legal boundaries on the intentional targeting of number for telemarketing purposes, it will also allow us to develop a forensic mitigation timeline to stop this activity on a permanent basis.
Summary: A quick overview on targeting and mitigation
Numbers get into telemarketing databases mainly through public scraping, data broker sales, and Automatic Number Identification (ANI) capture via toll-free numbers.
It is a gross violation of the law to submit another person's phone number to an automated system.
The Telephone Consumer Protection Act (TCPA), along with other harassment laws, can and will impose large fines and/or criminal charges against the wrongdoer.
To mitigate this type of harassment, the victim must implement a phased approach.
The first step to mitigation is to immediately add filters through the victim's wireless carrier (if possible).
Log timestamps.
Build an evidence packet for regulators.
While registering for national "Do Not Call" lists can help reduce the number of phone calls made by legitimate businesses, there are exceptions.
This includes calls made by debt collection agencies or political campaigns.
In order to truly defend yourself from unwanted calls, you need to know the supply chain that provides consumer data to telemarketers.
The truth about how numbers are added to spam lists
There are many questions surrounding how to stop receiving spam phone calls.
Many people wonder how they can sign up to receive spam phone calls because it appears as though they cannot see any way to do so.
Numbers are automatically obtained and stored in databases by automated systems.
Toll-free phone calls and collection of hidden data
When a person dials a toll-free phone call (for example, an 800 or an 888 number), caller ID blocking does not work as it does for regular phone calls.
Automatic number identification (ANI) is utilized inside the telephone system for billing purposes and therefore cuts out a user's right to privacy by allowing a telephone company to obtain complete ANI information about that person.
By using automated systems, companies obtain and sell this ANI information the instant a telephone call is made.
If a telephone call is terminated after only one ring, that number will still be logged, tagged, and in all likelihood sold to a third-party data broker.
This type of technology was originally created to facilitate billing between telephone service providers for long-distance service, but has evolved into a tool used by call centers to collect — without notification or consent — private data about telephone numbers.
How bot technologies obtain private data using web scraping
When a cell phone number is placed on a publicly accessible classified advertisement, forum, or social media profile, it begins a countdown of when that phone number will be captured by a "bot."
Bots continuously scrape information from classified ads, forums, social media, and other websites.
A number scraped from a website recently is an exceptionally valuable piece of private information; it indicates the number is currently valid and has been verified as such by an actual person.
Data brokers subsequently compile this scraping information and pair it with demographic data.
This data is then collected and sold in bulk to many different types of entities, including legitimate marketing companies, offshore scam operations, and lead generators.
In fact, the time between when an individual posts a number on a public forum and the time that individual receives their first automated ring is typically less than 48 hours.
Abuse of co-registration and trial forms
In some instances, legitimate web forms are deliberately used for malicious purposes.
Lead generation websites that provide insurance quotes, mortgage rates, automobile warranties, etc., often have lengthy consent clauses buried within their small print.
When an individual submits a phone number through a lead generation site, he or she is actually granting permission for dozens of affiliated companies to make contact with him or her.
This practice is referred to by the lead generation industry as co-registration.
A user who requests a quote for solar panels may believe he or she is only requesting a quote from a specific lead generation site, when in fact he or she is automatically auctioned off to 50 separate call centers via an API.
Because of this loophole, the user will experience numerous unsolicited phone calls from different sources and this will feel like a coordinated attack; however, it is actually occurring completely within the boundaries of consent-based marketing.
Is it possible to sign up someone for spam calls?
There is a subset of searchers looking to harass or prank someone by signing them up for spam calls.
In both cases, individuals are either abusing web forms or using automated scripts to accomplish their goals.
Knowing how the above-mentioned tactics work, and the potential ramifications (criminal and civil) associated with such tactics, is essential.
How cloud API abuse works
Cloud communications services provide Access Programming Interfaces (APIs) that allow legitimate businesses to send messages and place voice alerts.
Criminals may create scripts that send out multiple requests on hundreds of Access Programming Interfaces (APIs) simultaneously to the same target phone number.
This method is dependent upon abuse of legitimate infrastructure.
Automated account greetings, blank voicemails, and two-factor authentication codes flood the victim's phone—granted by poorly secured trial accounts from major telecom provider’s API that are easy to create now.
Auto-dialers and SMS bombers
SMS Bombers or Auto-Dialer Software are widely distributed through underground forums.
While these programs may be considered harmless by the curious “techies”, in reality, they create congestion in the telecom networks where they are deployed.
Moreover, using this type of program is illegal in almost all developed countries, and direct violations of civil and criminal laws exist for Automated Calling and Text Messaging systems, including within the US.
Legal mapping and jurisdictional considerations
Flooding someone’s phone with automated messages is not a harmless prank; it is illegal.
In the US, the Federal Telephone Consumer Protection Act (TCPA) prohibits using Automatic Dialing Systems and Pre-recorded Messages and imposes strict penalties for the unlawful operator of such automated systems; therefore, individuals found using auto dial technologies to intentionally flood a user's device may be subject to thousands of dollars per instance for each violation.
The United Kingdom has the Information Commissioner’s Office (ICO), which administers the Privacy and Electronic Communications Regulations (PECR).
Their severe penalties apply to the malicious use of Automated Calling systems to cause undue anxiety to another person; additionally, intentionally targeting an individual could be prosecuted under Criminal Harassment Laws.
There are no “grey” areas regarding the weaponization of a telecommunications infrastructure.
Every case has and continues to maintain severe penalties for all those who use and abuse such technology.
Defensive playbook: Forensic mitigation timeline
After a number has been exposed, either by chance, web scraping, or targeted attack, generic advice (e.g., "do not post your number online") is meaningless.
Follow a formal, aggressive triaging protocol:
Day zero: Impedance & radio silence
Do not answer unknown callers.
Answering confirms that your number is still active and raises the amount that data brokers will pay for it.
Each time you answer, hit an "opt-out" button, or yell at the operator, the auto-dialer records it as a high-value target.
When you receive a spam call on an Android device, immediately enable the native OS spam feature built into the Google Phone app (it uses a huge, real-time call database to filter incoming callers for you).
You can enable something similar on your iOS device; go to Settings and turn on "Silence Unknown Callers" to send unverified calls immediately to voicemail and not ring the device.
Third-party blocking apps may provide more security, but your native OS is your first line of protection.
Days 1 to 7: Register with the FCC or TPA
Register with the National Do Not Call Registry (DNC) in the U.S. or Telephone Preference Service (TPS) in the U.K. by going to the Website of each.
This does not eliminate illegal spoof robocalls or offshore scammers, but it will force legitimate, compliant businesses to remove your number from their lists within 31 days.
This removes the "legal" marketing noise, allowing for a greater ability to isolate, identify, and investigate the malicious players who are still calling you.
Many exemptions apply to the regulation of these types of registries; Political Organizations (POs), Debt Collectors (DCs) and Charitable Organizations (COs) are legally exempt from using the DNC registries.
Create an evidence packet (Weeks 2-4)
When you submit complaints regarding excessive telephone calls, it gives the regulatory body (Federal Trade Commission/FTC, International Consumer Ombudsman/ICO) the best opportunity to investigate.
Setup a spreadsheet logging: 1) exact date and time of each call received, 2) telephone number of the caller; 3) notes about caller ID spoofing, if any; 4) transcription of any voicemail left by the caller.
This step is critical, and completely sanitized and organized evidence submitted via an online form will greatly increase the chances of getting the telephone number traced back to the original telephone company.
The telephone company can then trace the upstream carriers to whom they routed the telecommunications calls.
To do this, you will need to have all required fields completed, both on the form to submit your compliant to the FTC and ICO, and also to have the documents attached as indicated.
Understanding the technology behind the high volume of calls
Understanding how the telecommunication system works will help you understand why efforts to block unwanted calls via traditional means do not work.
Spoofing caller ID and CNAM
Caller Name Presentation (CNAM) allows you to associate a name with a telephone number for the purpose of displaying a name along with a call coming from that number.
Spoofed Caller IDs pose significant problems to CNAM systems, and the telecommunications industry has a history of not being able to verify the physical location of their customers.
One of the most common ways that telemarketers and other malicious callers disguise their phone number is through the use of Caller ID Spoofing.
Many malicious callers use "neighbor spoofing" as a psychological manipulation technique by using the same area code as the person receiving the call.
For example: A call center located in another time zone can easily route calls via Voice over Internet Protocol (VoIP) through an Interconnected Provider, making it appear that the call is coming from a local telephone prefix in order to entice the person receiving the call to answer the phone.
STIR/SHAKEN & the ongoing battle against Caller ID spoofing
In the ongoing battle against rampant, widespread call spoofing, regulatory authorities are driving the creation of new authentication frameworks.
Across North America, multiple carriers have implemented STIR/SHAKEN-like protocols that provide digital signatures and verify caller IDs on behalf of calling parties.
Each time a call is initiated, the originating carrier will create a digital certificate to authenticate the originator's legal authority to use the telephone number that is being called.
However, there is an inconsistent adoption of these protocols and systems among carriers.
While tier-1 carriers place strict requirements upon their calling parties to adhere to the STIR/SHAKEN framework, many smaller and regional (rural) carriers, as well as international gateway providers (Gateway Providers), do not possess the infrastructure necessary to perform digital-verification of caller ID.
As a result, scam operators are taking advantage of the weak points in the STIR/SHAKEN framework by routing their telephone traffic via non-compliant network nodes so that the call is stripped of a verifiable digital signature prior to reaching the end-user's device.
The economics of phone numbers and the underworld call list ecosystem
The continued existence of a profitable and nearly ubiquitous ecosystem is driven by a simple financial incentive.
On the dark web and through underground broker sites, scammers are purchasing and selling the most recent and verified active lists of telephone numbers for substantial amounts of money.
The business model for a typical scam operator utilizes a Cost-Per-Action (CPA) model.
For instance, an automated dialer may be able to contact approximately 10,000 numbers per hour; therefore, the scammer only needs a small percentage of the outdialed numbers to answer and respond to generate revenue.
By realizing that your phone number is merely an economic commodity in a mass-market, low-margin business, you can eliminate your emotional frustration with the process and concentrate exclusively on technical mitigation.
Ultimately, telemarketing laws and regulations will not prevent continued marketing calls.
The overwhelming majority of spam phone calls, regardless of whether they are illegal and/or annoying, remain legal.
The phone system supports nothing but telephone connections.
Everything else (legitimacy, legitimacy checks, etc.) occurs above the network.
When you connect a phone to a network without providing or verifying your identity, you run the risk of being flooded with calls.
If you or someone you know has been a victim of a large influx of calls as a result of having their number deliberately targeted by an abusive telemarketer, the only reasonable and effective response will be to employ an aggressive and unemotional strategy.
Using filtered carrier-service OS calls, collecting evidence in a methodical manner, and reporting actionable information about the perpetrator to regulatory authorities is the best way to put an end to such activities, and to reclaim control of your device.
Is it possible to sign another number up for telemarketing purposes?
Yes. Intentionally sending automated dialing systems or web forms to a person's phone and flooding their line is a violation of the law.
Under U.S. (TCPA) and British (PECR) laws regarding telemarketing, these practices carry severe criminal and financial penalties for the perpetrator.
How fast will scraped numbers be targeted by automated dialing systems?
Any number that has been posted publicly on social media or on a forum is highly susceptible to scrutiny and bots will scrape such numbers (yet another reason to stay connected to your email).
As a result, telemarketing lists will increase dramatically within 24-72 hours after the number has been posted.
Does picking up and answering the phone result in getting more spam calls?
Absolutely!
You create additional spam opportunities by picking up and responding to an incoming call.
The automated system that dialed your number views the call as an active call (someone picked up the phone), assigns it a high value, and resells that phone to other telemarketers, which results in exponential increases in call volume.
How should businesses react when their main phone line is flooded with calls due to telemarketing?
Immediate action is required!
If your business receives a large number of unsolicited or harassing calls on a daily basis, there are certain steps that should be taken to stop the flood.
First, contact your telephone service provider to have them implement upstream blocking of the affected line.
Then collect SIP traces and detailed logs of all call activity and send that information to regulatory agencies in order to establish a paper trail demonstrating the disruptive effect on your business, which may lead to a lawsuit.
