At Hiya, our Phone Reputation Service engine is constantly evaluating phone number behavior to sniff out the spammers and scammers. The service runs in real time, observing traffic patterns and collecting reports from users provided to us directly or via our partnerships, as well as from public sources such as the FCC Consumer Complaints database. In all, a new high-volume scammer coming online is detected within about 15 minutes of their first scam call!
Today, our service runs fairly consistently with approximately 100,000 spammers being tracked within the +1 dialing code (which includes the United States, Canada, and much of the Caribbean). During the five months prior to the holidays, the total active spam number count fluctuated only by about +/- 10%. (We exclude the holiday season from our analysis because every year, the spammers and scammers take the holidays off just like the rest of us. At the lowest point, we’ll see nearly a 30% drop in active numbers from around Christmas through the new year.)
Despite this relative stability in the total spam number count, we can see a lot of turnover within the numbers themselves. On average, we see around 5,000 numbers every day that join the spam list, replacing roughly the same amount of phone numbers that have stopped being active. This gives us our first insight: overall, the scam activity within the United States and Canada is fairly stable. There is a consistent amount of phone numbers being used for scam at any one time… however, the numbers themselves are constantly rotating in and out to help the scammers avoid detection.
We wanted to get a better grasp on how these scam numbers behave and how long they remain active. To do this, we took a closer look at 13,000 phone numbers which arrived as new spammers into our service over a three-day period. Our goal is to explore the space of “turn and burn” scam numbers, who do a large and very brief batch of scam activity.
The first thing to do is whittle this back to our probable phone scammer set. 8.5% of the new numbers primarily sent text messages (which could be text spam, interesting in its own right) so those are eliminated. A large portion of the remainder (61.8%) are numbers we have seen create a lot of activity long before our test window. These numbers likely fluctuate within their spam status, which is also outside of our target behavior. All told, we found 11.4% (close to 1,500 numbers) in our set fit the criteria of having no prior or continued call traffic outside of our test time window.
It’s worth repeating: Over 1 in 10 of every new spam number that Hiya detects is a number that will only exist for, at most, a few days. In fact, 72 of them aren’t even valid phone numbers! This almost certainly indicates “spoofing”, a scammer who is hiding their actual phone number in favor of a fake one. Phone numbers in the United States must abide by the rules of the “North American Numbering Plan”, which defines area codes and 10-digit phone numbers for the US, Canada, and over 20 other countries within the Caribbean. This numbering plan has some special rules such as which digit can be a ‘1’, not to mention which area codes have been assigned. Some scammers don’t bother to check if their pretend number is valid before they start using it.
All told, we estimate these numbers created over 80 million calls in three days. What were they doing? The best place to look is our user reports. Hiya receives well over half a million reports against phone numbers every month from our users who are looking to help inform and protect others receiving the same calls. Our ~1500 turn-and-burn scammer numbers have together amassed nearly 15,000 comments against them. As expected, 92% of these reports arrived within a five-day window around the segment we’re analyzing. Most of these numbers have little to no history in our records before being used for the scam campaign. (Hiya has user reports going back to early 2010).
To get an overall picture of the complaints, we fed all the comments left against these numbers into a word cloud.
The results aren’t too surprising: the top four words are “call credit card scam”. Reviewing the comments manually, a few very common scams stand out:
- Vacation scam: Mentions of a “free stay” in a rental property
- Lower your credit card debt, reduce your interest rate
- Medical service scams (e.g. medical alarm services or elderly “wellness” programs)
These align strongly with what we have seen in the larger spam/scam space: there is a lot of activity right now around vacation scams (perhaps the scammers assume we all have Seasonal Affective Disorder and need to go somewhere sunny?), and the ever-present offers to reduce credit card debt.
Unfortunately, the one statistic that Hiya cannot measure is how many innocent people fall victim to these scams. Our hope is that services like ours can provide some advance warning, and make sure everyone stays suspicious of unexpected threats or unlikely offers. The best way to bring an end to the influx of scam activity is to make sure it’s not profitable for the scammers!
