Phone spam and fraud is a pervasive problem threatening the consumer voice experience. In Q1 2023, one-quarter of all unknown calls received by consumers around the world were spam and fraud. As operators and regulators have taken steps to address the spam and fraud problem, a direct response has been the growing use of number rotation. That’s where callers acquire multiple phone numbers — sometimes hundreds of thousands — and swap them out when they’re believed to be at risk of getting flagged as spam or fraud.
Number rotation has long been a prime tactic of scammers and spammers, but increasingly it is being promoted to legitimate businesses as a way to avoid spam labels. So, how can carriers protect their subscribers by separating wanted calls from unwanted calls and scams? Good analytics.
That was the advice offered by Hiya’s Director of Product Management Jonathan Nelson in his June 13 webinar titled The Insidious Effect of Number Rotation on Voice Security and KYC.“ The webinar was part of the KYC Summit 2023, a special series focused on Know Your Customer strategies, solutions, and best practices.
Nelson says that number rotation goes directly against Know Your Customer efforts because the practice of number rotation is designed to prevent analytics services from getting to know the caller.
To start, let’s take a look at the scale of the problem and see who is using number rotation.
How prevalent is number rotation?
According to Nelson, number rotation is seen in more than half of the illegal robocall campaigns that Hiya observes. These are calls from Hiya’s honeypot, a collection of hundreds of thousands of Hiya-owned phone numbers that are used to capture and analyze spam calls so Hiya can block the fraud calls and label the nuisance calls. In fact, more than a quarter of these illegal robocalls use 100% rotation, which means each phone number only makes a single call before moving on to a new number.
Number rotation is used in more than half of illegal robocall campaigns.
In addition to the honeypot, Hiya also receives user reports from customers around the world using Hiya’s call protection services through their carrier, mobile device manufacturer, and the Hiya mobile app. Customers are able to report calls they consider spam or fraud. These user reports show that a high percentage of unwanted calls (fraud or nuisance) comes from new numbers — numbers that Hiya has never observed before.
Nearly one in three — 31% — of all calls reported to Hiya as unwanted are using number rotation. And most of those (20%) use a different phone number for every single call.
31% of all calls reported to Hiya as unwanted use number rotation.
So, why are so many calls from new numbers spam?
“Generally, what we see is that illegal callers and aggressive callers use this tactic to hide from analytics — to remove the ability for analytics to get to know the caller, to know what they're doing and how people are reacting to them,” Nelson said.
Legitimate callers using the same strategy
Legitimate companies are also using the same strategy. In fact, last month Hiya conducted a survey of 300 business leaders in the US, and 60% said they rotate numbers at least multiple times a month. 29% even change their numbers automatically or on a daily basis.
Hiya conducted a survey of 300 business leaders in the US and asked them how often they rotated their phone numbers.
A worrying trend
“There's this increasingly worrying trend that rotating through numbers is getting presented to calling enterprises as something that any company should do simply as part of managing their reputation," Nelson said. “It promotes this concept that any phone number is going to get flagged by a reputation service eventually if you make enough calls, so the best practice is to just continuously move across a large set of different phone numbers.”
The problem with this, Nelson says, is that legitimate callers and spammers are using the same evasive tactic. “Good analytics should not be the adversary of legitimate callers,” he said. “We already have one adversary — scammers — so legitimate callers should not adopt the same tactic.”
It’s clear to analytics services that new numbers have a higher chance of being spam. And Nelson warns that one result of increased number rotation could be that analytics services that are less sophisticated than Hiya might choose to simply label all new numbers as spam, just as some have done with potentially spoofed numbers that have a six-digit match with the call recipient.
“A less mature analytics service could decide that all new numbers are just simply always at risk and they’re going to flag any new number until proven otherwise,” Nelson said.
What’s the solution?
Nelson says that number rotation should not be a sanctioned practice in the calling industry and carriers can protect their subscribers from the impacts of this practice by using good analytics. For example, Hiya’s call protection system Hiya Protect goes beyond simply analyzing the incoming phone number; it uses Adaptive AI to analyze every aspect of a phone call and determine whether that call is wanted regardless of the number used. Hiya Protect includes four layers of protection:
- Base number protections – Provides the foundation of spam protection by understanding historical trends and characteristics that can indicate a higher risk of spam from certain calling numbers.
- Spam Threat Scanning – Uses the characteristics of a call observed in real time to determine each individual call’s unique risk of being spam — regardless of the calling number. It continually observes the patterns of spammers in network traffic to understand the current characteristics of the latest spam and fraud campaigns.
- Personal Call Filtering – Uses past interaction history to understand which calls are important to individuals and protect them from targeted attacks. Similar to an email spam filter, Personal Call Filtering is aware of relationships between the two parties of a call.
- Enterprise Caller Scoring – This layer considers not just the number calling, but the reputation of the calling organization. Similar to how credit agencies assess the creditworthiness of individuals across all their lending history, it evaluates the reputation of an enterprise across calls from all of their calling lines.
For more information about Hiya Protect, visit our website or send us a message to learn more. Click here to watch the webinar for more details focused on Know Your Customer strategies, solutions, and best practices.
Related: What is number rotation and why is it so insidious?
