In 2020, voice fraud generated almost $20 billion in losses in the US alone and this trend shows no signs of slowing down. Scammers employ a collection of different methods to extract information from consumers and businesses alike, but phone spoofing remains one of the most consistently used techniques. To protect their brands, company owners need to implement robust security systems and figure out how to stop phone spoofing attacks that involve their business numbers.
Malicious phone spoofing occurs when fraudsters mask their numbers and pretend that their calls are coming from known sources, like a local business. The main goal of this type of scam is to get valuable or sensitive information that can then be used to orchestrate another attack or sold to the highest bidder. And, the damage doesn’t stop there.
One of the biggest reasons why phone spoofing is so destructive is because it affects both the person receiving the call as well as the individual or entity being spoofed. If the average person receives a call from a known company, but it turns out to be a scam, the business will garner a negative reputation. And, the worst part is that business owners may not realize it right away.
Establishing and maintaining a safe business environment is a priority for all managers. But, many decision-makers assume that the government or their telecommunications carriers are implementing strict security measures designed to keep the networks safe. But, this isn't always the case, which is one of the reasons call spoofing attacks have exponentially increased over the last few years.
Our research suggests that 47% of Americans have been targeted by fraudsters using different types of impostor scams, which include illegal call spoofing. This may not seem immediately relevant to your business, especially if you have a reliable security system in place. But, fraudsters can early spoof your business number, target either employees or customers, and give your company a bad reputation.
There’s no denying that illicit phone spoofing can have a negative impact on any business, especially if this type of fraud isn’t identified early on. That said, you also need to understand when spoofing is illegal, why it’s dangerous, and what steps you need to take to safeguard your business.
Below, we’ll define illegal phone spoofing, discuss its impact, and provide tips to avoid being spoofed by fraudsters.
What Is Phone Spoofing?
Before delving any deeper, let’s go over the exact definition of phone spoofing. In its simplest form, phone spoofing is the act of masking a caller’s number and replacing it with another phone number. In other words, spoofing makes phone calls appear as if they are coming from one place, when in fact they originated in a completely different location.
Remember, phone spoofing in itself isn’t good or bad. This depends on who is using this technology and for what purposes. Legal spoofing occurs when a company or professional needs to mask its number, which is relatively common throughout a variety of different industries. But, when third parties mask their details for deceitful purposes or don’t have the authorization to spoof a number, this constitutes illegal spoofing.
In some cases, the goal of phone spoofing is to instill confidence in receivers in order to increase call answer rates. But, this practice can also be used to protect employer privacy, facilitate relationships with outsourcing service providers, and create a consistent experience for customers, among other goals. Unfortunately, not all individuals and entities that use spoof their phone calls do so for professional purposes.
Caller ID spoofing usually employs Voice over Internet Protocol (VoIP) technology, which gives callers the ability to change the name and number that appear on the receiver’s phone. There are many different VoIP providers you can partner with, but remember that the Federal Communications Commission (FCC) regulates caller ID spoofing. Therefore, if your company uses spoofing for legitimate purposes, you should stay up to date with any policy changes rolled out by the FCC.
There are many platforms that provide phone spoofing technology, but keep in mind that not all providers are the same. Businesses that need to spoof their calls have to partner with reliable spoofing technology providers in order to keep their numbers consistent across all communications.
When Is Spoofing Legal?
Many companies employ legal phone spoofing as an integral part of their operations. After all, average businesses usually have multiple departments and partner with different providers to deliver quality solutions. For example, you may manage a firm that has individual sales, customer service, technical, human resources, and customer success departments, all of which have unique extensions.
Each one of the departments listed in the example above usually has its own extension. And, depending on the number of employees, each team member may have a unique phone number to his or her desk. But, showing each individual number when making a call on behalf of the company may create the wrong impression. Through call spoofing, businesses can mask the extensions and show a single number that all of their clients are familiar with.
In the above example, having a spoofing platform available can provide a consistent experience across the board for customers. Likewise, if a business outsources some of the tasks from the different departments, the partners that manage these processes may also use call spoofing to make it look like the call is coming from the main company.
Almost every single outsourcing services provider masks its number in order to instill confidence in the people receiving the calls. Call centers and other outsourcing providers do this because consumers are more likely to believe sales calls and similar contacts if they come from numbers associated with their clients’ brands. Outsourcers usually spoof their calls to make them look like they are coming from toll-free or general customer service numbers that receivers are familiar with.
Many careers require constant traveling and unorthodox work schedules, so making calls from the office isn’t always an option. Professionals that specialize in these types of careers need to have the ability to contact providers and clients using their personal devices, while making it appear as if they are calling from the company’s number. Through spoofing technology, these professionals can rest assured that their clients will always get a consistent experience.
Spoofing can also be used for other legal purposes, as long as the company spoofing the number has authorization and the business being spoofed is aware of the situation. Therefore, legal call spoofing always creates a positive experience for customers, who are rarely able to tell that the call is spoofed.
Examples of Illegal Spoofing
Despite the fact that legal spoofing has a positive impact, the same cannot be said for illegally spoofed numbers. As we mentioned before, illegal spoofing occurs when the caller does not have the authorization to mask their details and use another company’s number. So, if a third party impersonates a company using its number, it’s illegal regardless of the purpose.
Illegal spoofers can target companies and use their numbers to target employees as well as customers. But, the problem is that these businesses don’t always realize that their numbers are being used for fraudulent activities. And, even though some never notice they are being targeted, other companies are suddenly hit with lawsuits or complaints from people that have been victimized by fraudsters using spoofed numbers.
Voice fraudsters that spoof phone calls can take a variety of approaches and try to extract valuable information from the call received. That said, obfuscation is one of the most common scams that deceitful parties try to run with voice spoofing. When fraudsters obfuscate their calls, they simply seek to mask their details without worrying which phone numbers appear on the receivers’ phones. These are more common in attacks performed using international or otherwise suspicious numbers.
Neighborhood spoofing requires more planning than obfuscation. In simple terms, neighborhood spoofing perpetrators attempt to mask their phone numbers and substitute them with details from a local company or person. While the receiver may not know the number, he or she is more likely to pick it up if it’s coming from close by.
Lastly, impersonation occurs when the caller carefully selects a number they want to spoof. In the vast majority of cases, deceitful parties that employ this technique will impersonate a business or person that the receiver definitely knows, like his or her mobile carrier. This means that people are more likely to pick up the phone and have their guard down, increasing the chances of falling victim to fraudulent activities. Note that this type of fraud is also known as the impostor scam, where callers pretend to be a person or company that the receiver knows.
Disadvantages of Having Your Number Spoofed
While illegal caller ID spoofing may seem like a consumer issue, there are many reasons why companies need to invest resources into combating this deceitful practice. As a business owner, your main goal should be to create a positive image for your brand and company as a whole. If there are fraudsters using your number to perform scams, it can tarnish your reputation and give your brand a negative image, especially if you serve a small local audience.
For example, one of the most common ways fraudsters take advantage of unknowing individuals is to pretend to call from local providers. This can be an energy company, water provider, or even a local accountant. In these cases, deceitful callers tell their targets that there has been a security breach and that they need to verify some information, like their social security numbers and similar details.
So, if there are criminals using your company numbers to perform these scams, they can give your brand a negative reputation without you even realizing it until it’s too late.
Furthermore, remember that consumers are not the only target that fraudulent parties want to take advantage of. Deceitful parties have managed to extract millions of dollars from large companies like Facebook and Google using simple email and voice spoofing. Criminals can also call your employees while impersonating other members of your internal department and request access to details or initiate fraudulent financial transactions.
The longer your phone numbers are spoofed, the higher chance that your company will suffer irreparable damage. If it’s not detected on time, illegal call spoofing can actually produce a collection of additional disadvantages that have a more direct impact than a tarnished reputation.
Some of the disadvantages of having your number spoofed include:
Victimizes Customers, Employees, and Even Providers
Business owners have to deal with a variety of different challenges to establish a successful business. But, most of these challenges affect either the internal side of the company or the external variables, like clients or providers. However, call spoofing scams can take different shapes and forms, so they can end up affecting your employees, customers, and providers all at the same time.
When you think about a spoofing attack that used your company’s number, your clients and their safety are among the first things that come to mind. Some fraudsters can extract names, email addresses, social security numbers, bank details, and other pieces of information from unknowing clients, resulting in huge financial losses.
Moreover, if clients provide ID details like full name, previous addresses, name of birth, and other pieces of information, fraudsters can then steal their identity. Identity theft can occur without the knowledge of the person being targeted and it can also result in thousands of dollars in financial losses as well as accumulation of debt.
The impact on employees is similar depending on how much information fraudsters manage to extract. Your team members may also release socials, dates of birth, family information, and other pieces of data usually used by ID thieves. With that said, remember that employees can also release crucial information about your company, like passwords, financial data, and even internal information that can benefit competitors. This can put your business itself at risk and result in bigger, more costly attacks later on.
Although these attacks are not as rare as consumer or employee attacks, fraudsters can even target providers and place fraudulent orders that are delivered, but never paid for. Besides ramping up your expenses, scammers that target your providers can strain relationships with your top partners and damage your reputation on that front as well.
Lower Answer Rates
Digital channels like email and social media are slowly taking over business interactions. However, many businesses still rely on phone calls as the main communication method with their customers. This includes industries like healthcare, where emails and similar channels are not always practical, as well as companies that target older audiences.
With the above in mind, there are many variables that influence whether a customer or prospect answers a call from your business. From the time of the call to the number that appears on the screen and the initial contact, all of these will help the receiver determine if they can trust your call.
Needless to say, if your number has garnered a bad reputation for being used by impersonators, people that get a call from your number are less likely to pick up your calls. Even if you develop a special script or verification method, there is no way that receivers can tell your real team members from fraudsters without a bit of help. If you put yourself in this position, there’s a strong chance you wouldn’t pick up the phone either.
As a rule of thumb, the best way to keep your answer rates high is to take control of your numbers and protect them against spoofers. Hiya is one of the best platforms in terms of the amount of control you get over your caller ID. Through our platform, you can make sure that your customers, employees, and providers always know that it’s you on the phone.
If you want to go the extra mile, you can always inform your customers and tell them what to expect whenever they get a call from your company. For example, in your client welcoming materials, you can include a section that details the phone numbers you use and provide a reminder to avoid divulging sensitive information over the phone.
Reduced Productivity and Fewer Resources
The majority of businesses have limited resources, so owners need to distribute their assets to ensure that productivity is at its highest. Unfortunately, your team productivity and the resources available can all be negatively impacted by fraudsters spoofing your business numbers. Even if these scammers don’t manage to deceive any of your internal team members, dealing with irate and confused consumers can become a major challenge in itself.
When consumers are scammed using spoofed numbers, they don’t always understand that criminals mask their contact details and pretend to be someone else. If your number is spoofed, you’ll probably receive a huge number of calls from disgruntled people who were targeted by spoofers. Rather than ignoring these requests and garnering the wrong type of attention, you have to dedicate resources to educating callers and making sure that your numbers aren’t being spoofed.
However, given the fact that most business owners are already working with a limited budget, handling calls from scammed consumers represents a significant investment. This, in turn, limits the number of resources you have available and hampers productivity, especially if your team is receiving a huge amount of calls.
Additionally, if your team is being targeted by spoofers, your employees will probably spend a lot of time answering and filtering deceitful calls. Even in cases where your team members don’t actually fall for the trick, they will still invest a significant amount of time and effort into an activity that doesn’t generate any revenue for your business.
Moreover, remember that a small percentage of spoofer attacks are actually successful. One single successful scam can produce tens of thousands of dollars in losses, so companies need to prevent these attacks at all costs. Instead of waiting until there’s been a security breach, the best way to combat illegal spoofing is to take control of your business caller ID information and monitor any suspicious calls that involve your company numbers.
How Are Industry Leaders Fighting Illegal Spoofing?
Telecommunication companies, lawmakers, consumer advocate groups, and industry leaders like Hiya have been working on developing solutions that help protect the entire voice communication ecosystem against illegal spoofing. One of the main ways that these stakeholders have been attempting to eliminate spoofing is by pushing for better legislation and supporting the development of better technology solutions to address the issue.
Regulatory entities have recently introduced the STIR/SHAKEN protocol, which consists of a set of rules that providers can follow to help identify illegally spoofed calls. When using this protocol, providers implement STIR technology to generate SIP Identity Headers. In a nutshell, these data elements contain information like the phone numbers involved in every call as well as the time, date, and attestation level of each number.
The attestation levels were developed to help providers categorize numbers based on the information found in their SIP Identity Header. There are three levels of attestation, which are A, B, and C. But, remember that these tags don’t necessarily reflect the reputation of the caller, so even though they serve as an indicator they are not perfect.
Let’s take a look at the three levels of attestation that SIP headers can contain.
Level A: Full Attestation
Full attestation, which is labeled as “A” on the SIP header, means that the phone service provider recognizes the whole number as legitimate. This means that the entire number is actually registered to the individual or entity that’s making the call. In other words, full attestation is the highest possible rank that a caller can receive in terms of trustworthiness.
Again, full attestation is a great signal, but it doesn’t tell the call receiver if he or she is being contacted by a reliable source. That said, the call received will at least ensure that the number that’s calling is the same one that’s being displayed, as long as it has the “A” label.
Not only this, but full attestation tags also tell the receiver whether the caller is authorized to use the number that appears on the caller ID. The attestation credentials are designed to be unique so that they can’t be easily forged, improving the accuracy and credibility of the whole system.
Level B: Partial Attestation
Partial attestation is the next level down in terms of trustworthiness and reliability. When this label appears, it means that the caller has been verified, but it’s not known whether he or she has the authorization to use the number. This usually occurs when the provider is only able to verify part of the number, which usually means that the caller is allowed to make the call, but the number hasn’t necessarily been attributed to this individual or company.
Let’s go back to our example about companies that have different departments and extensions. Like we mentioned before, every department or employee has an individual extension. However, if one of these isn’t registered with the telecommunications provider as belonging to the company, calls made from this number will have a “B” attestation, also known as a partial attestation.
As with full attestation tags, having a “B” label doesn’t necessarily guarantee that a caller can be trusted. But, it helps give receivers a better indication of where the call is originating. But, keep in mind that even if “B” attestation numbers seem legit, you should be careful whenever you receive calls from these numbers.
Level C: Gateway Attestation
Level “C” attestation, also known as gateway attestation, is the label used to tell receivers that only the call gateway was verified as coming from a reliable source. For instance, when calls are coming in from international providers that don’t produce any STIR data. Or, “C” attestation can also be given to calls coming from networks that aren’t compatible with the receivers’ carrier.
It’s important to note that level “C” attestation doesn’t always mean that the call can’t be trusted or that it’s coming from a caller that isn’t authorized to use that number. Many companies use VoIP connections to make and receive phone calls. However, VoIP calls don’t always carry STIR data, which means that these can be labeled accidentally as “C” or as failing the verification erroneously.
The example above shows some of the major flaws in the STIR/SHAKEN protocol, so even though this set of rules has helped to some degree, it’s far from a perfect solution. Companies also need to invest some of the resources into protecting business phone numbers and ensuring that employees and clients know when they are receiving fraud calls.
Protecting Your Company from Illegal Spoofers
While legislators are making advancements in some areas, waiting for new laws to come in may not be the best alternative to address a problem that’s already putting a huge amount of pressure on the industry. Fortunately, numerous technological advancements have empowered businesses and given them the ability to take control of their company numbers like never before.
Hiya is a voice intelligence and performance platform that allows you to manage your business phone numbers while also giving you the ability to see if any unauthorized parties have tried to use your phone number.
While lawmakers do their best to put better regulations in place, Hiya gives you the ability to combat illegal caller ID spoofing and protect your business from deceitful scammers. Thanks to our comprehensive set of features, companies can manage how their calls appear on their customers’ phones and choose how to handle fraudsters that attempt to spoof their numbers, not to mention the comprehensive set of analytics available through our platform.
Some of the steps you can take to protect your business numbers with Hiya include:
1. Safeguard All Business Phone Numbers and Extensions
All of your business numbers and extensions represent assets that you need to protect. Fraudsters can target any of these at any given time, so you need to ensure that your monitoring system is powerful enough to safeguard all of your business numbers simultaneously. If you only monitor your main lines, scammers may be using your internal extensions without you realizing it, even if these have never been used for external calls.
The good news is that Hiya Connect Secure Call can stop deceitful parties from mimicking your phone numbers, regardless of how many you have in your internal network. Our platform actually disrupts the spoofing process, so it actively prevents your numbers from appearing when the call is being made by an unauthorized party.
All you have to do is set up this feature into your phone system using our dedicated API and you’ll get to choose what happens to calls that are spoofed using your number. You can block these calls so that they don’t appear on the receivers’ devices at all. You can also choose to label it as fraud, so call receivers will see the warning and avoid answering the call. Lastly, you can allow the call to go through but strip it from the spoofed identity, so that they appear on receive devices with the original number.
2. Instill Confidence in Your Audience with Branded Calls
Did you know that less than 20% of customers answer phone calls that only show a number and no other information on the caller ID? But, if you take control of your caller ID and identify your company as a legitimate business, you can bump your answer rates to 65% or more. And, the reason for this huge increase boils down to good old brand confidence.
If you have a reputable brand that instills confidence in your audience, you’ll have much higher answer rates. And, one of the best ways to improve your reputation is to promptly display your brand name and logo whenever possible so that people start seeing it as a synonym of quality.
Hiya’s industry-leading voice performance platform gives you the ability to choose what appears on receivers’ devices whenever you make a call. Our platform can help you implement fully branded caller IDs that feature your number, company name, logo, and a custom message that tells the receiver what the call is about. This boosts your customers’ confidence levels and answer rates while creating a better experience at the same time.
3. Keep a Close Eye on Fraudsters that Attempt to Use Your Numbers
There are several telecommunications companies that operate in the US and the list of providers grows every year. Monitoring these networks manually is virtually impossible, so most companies have no idea how to keep an eye on the performance of their numbers or figure out how to improve their voice performance.
Hiya Connect with Secure Call now gives companies a complete set of insights and analytics to monitor their call performance metrics while also letting them see how many spoofing attempts from unauthorized parties they have over the last few years. Hiya users can produce intricate reports that give them detailed insights like how many times a number has been spoofed, blocked, or marked as spam. Hiya’s robust insight and analytics also show important performance metrics such as answer rates, or average call duration and compare these to industry averages extracted from 12 billion monthly data points from across 150 million devices.
The best part is that you can use these insights to create better voice procedures that result in higher answer rates, for example, calling customers at an exact time of the day or using one specific number to phone clients.
Finding a Reliable Voice Performance and Intelligence Tool
At Hiya, our main goal is to provide a set of powerful solutions that help companies improve the results obtained from their phone calls. We’ve spent countless hours developing a unique SaaS solution designed to improve answer rates, lower operational costs, enhance lead production, and generate a better customer experience.
We understand the importance of having a seamless outbound calling operation that gives your internal teams the best chances of success while boosting the credibility of your brand. Hiya Connect's advanced set of features is designed to protect your brand, improve the way you interact with your audience, and take full control of your business reputation.
The Hiya Voice Performance Platform is powered by a combination of innovative machine-trained algorithms that were developed by assessing more than 13 billion phone interactions. This, combined with the gargantuan size of the Hiya network, gives us the ability to provide unmatched voice performance metrics and cutting-edge features.
Ready to Learn More About Spoofing?
Click below to download Hiya's definitive guide to stop spoofing in your business.