Phone Scams, from Sketchy Telemarketing to Targeted Threats
Fraudulent phone calls used to be everywhere. But just because the volume is going down doesn’t mean they’re less dangerous. In fact, today’s phone scams aren’t random – they’re extremely targeted and extremely effective. By learning how they’re built and why they keep working, you can reduce your risk of being a target.
See Stopping Phone Scams with Alex Quilici for a complete transcript of the Easy Prey podcast episode.
Alex Quilici is the CEO of YouMail, a company that’s trying to protect America’s phone numbers. They offer an app that blocks robocalls and other stuff you don’t want on your phone. And they also collect data on what the bad guys are doing to look at trends and help phone carriers keep fraud off their networks.
Alex’s first company was in the era before smartphones, and it was essentially Siri over an 800 number. It got him into AI, large data, and telephony. YouMail initially started as a voicemail company. But it offered an “Out of Service” message, and Alex noticed users using that message to block robocallers and scammers. Then a loved one got caught by a tech support scam. Alex realized YouMail could become a tool to help protect people. He also wanted to go to the source of the scam. Once a scammer reached your phone, it was too late – he wanted to be able to shut scammers down at the source.
It’s too late when you’re blocking a call or text on the phone. You want to try to figure out where they’re coming from and shut it down at the source.
Alex Quilici
The State of Unwanted Calls
On a daily basis, there are probably over a trillion calls connected worldwide. Every month, there are around five billion robocalls, about half of which are unwanted. That includes telemarketing, phone scams, spam, and similar calls. Interestingly, the other half are wanted. They’re things like appointment reminders and calls from your credit card company letting you know that you missed a payment. Even though they are robocalls, they’re useful and people do want to get them.
Of robocalls, there’s roughly five billion a month … about 50% of them are unwanted. They’re telemarketing, scams, spam.
Alex Quilici
Stopping phone scams is an interesting conundrum because you can’t just block all robocalls. Some are calls people actually want. It’s important to distinguish between legitimate customer service calling someone back and a scammer pretending to be customer service. And legitimate telemarketing still exists. But it’s overwhelmed by everything else. And we’re seeing more and more sketchy telemarketing, which is harder to stop because you have to prove they’re not legitimate.
There are also fewer phone scams now. One reason for that is targeting. Scammers aren’t just calling as many people as possible and hoping someone bites. They’re getting lists from data brokers, breaches, and other scammers and are designing scams that specific people are more likely to fall for. The other reason is that scammers are switching modalities. They’re not doing as many phone calls because they’ve switched to email, text messaging, and social media.
We are seeing the scam calls go down. There used to be crazy amounts of scam calls, and there’s fewer of them now.
Alex Quilici
Shutting Down Scam Callers
Phone Scams are coming from all sorts of places – large criminal organizations, smaller criminal groups, and even shady businesses. We’ve seen very little progress against sketchy telemarketers. There has been a decent amount of progress against some of the larger ones using illegal robocallers. Some of them were spoofing caller ID, which is actually a criminal offense. There has been some progress, but not as much as Alex would like to see. With scammers, there has been some progress, and some scam organizations have been shut down. It takes a while for them to pop back up, but they do.
When a particular phone carrier is aiding and abetting the people making the calls, we’ve seen a lot of success getting those shut down. When that happens, the total number of robocallers drops temporarily. But someone new always pops up. Bigger carriers are harder, because they have a lot of legitimate traffic, too. They can argue that they’re not trying to help scammers, they’re just getting through along with the legitimate callers. It’s a struggle to get big carriers make more of an effort to help. Whether or not they have a legal obligation to do so is going to have to go through the courts.
How Phone Scams Trick You
The top trick in phone scams is still urgency, often financial urgency. A common one is saying there’s a large charge on your credit card for something you definitely didn’t buy, and asking you to press something if it wasn’t you. Another one is claiming that there’s a warrant out for your arrest and you need to deal with it immediately or the police are going to arrest you. They work by making you afraid. When they combine the story with personal data from data breaches, they can sound very convincing.
The combination of data and driving a sense of urgency is really effective.
Alex Quilici
The phone scammers are advanced enough to spoof your local police department’s phone number. Alex saw a post on Facebook recently where someone pretended to be a local sheriff so effectively that the person was actually on his way to the sheriff’s office when they asked for gift cards. He found out when he put the call on mute and called the sheriff to confirm. It was so detailed that he thought it was real at first.
It’s important to know how things really work so you can tell when things are off. Think about taxes. Everybody messes up their taxes to some degree at some point. When that happens, the IRS sends a letter and gives you plenty of time to resolve it. If they’re calling and telling you that it must be resolved right now, that’s a scam. But you have to know how things are supposed to work to spot those kinds of scams.
You have to kind of know how stuff operates to know it’s really just obviously a scam.
Alex Quilici
Identifying Phone Scams
YouMail uses a lot of classification to identify legitimate calls from phone scams. They use AI to break call audio into different pieces – identifying the topic, techniques involved, and if it matches known phone scam behavior. AI is quite good at that. When it scores highly, they can be confident it’s fraud and start looking for similar calls, potentially tracing it back to the source.
But AI is a double-edged sword. Phone scammers are also using it to vary their messages so it’s no longer identical calls. But all phone scammers have to behave roughly the same way on principle, and AI is pretty good at spotting those techniques. It’s sad, but you can think of scammers as extremely motivated marketers. They’re adopting tools immediately and extremely good at targeting and convincing people they’re legitimate.
And it’s profitable. It costs probably a tenth of a cent to make a call. Last year there were around 25 billion phone scam calls. And phone scams made about $25 billion. That’s a dollar a call, which are insane profit margins. Call volume is going down, but profits are just increasing. They’re getting better and better at optimizing the scams and getting the most out of each person they reach. It’s incredibly profitable now.
We did the math … [scammers made] a dollar a call. Those margins are better than Google. So that’s why they keep doing this. It’s super profitable.
Alix Quilici
Businesses are Targets Too
Businesses are also at risk of phone scams – in some ways more, because businesses have to answer the phone when it rings. One of the things that has changed is that it’s not just a landline in an office building anymore. Many employees get work calls on their personal phones. Bad guys also take advantage of the fact that businesses don’t have normal consumer protections, either.
Vishing and smishing attempts to try to get access to the enterprise are huge dangers to businesses. This includes things like imitating the CEO and asking employees to do something, or pretending to be someone from operations needing you to “verify” yourself. Once they get network access, the bad guys can cause chaos. The thing about companies is that they’re only as secure as their weakest link, and that’s an employee’s personal phone. It only takes one to compromise the whole company.
The thing about the enterprise is … you’re as vulnerable as your weakest link. And the weakest link is your employee’s personal cell phone.
Alex Quilici
Studies have shown that training can help protect businesses, but the effects are brief. YouMail actually has some large customers interested in shutting down anything that mentions their name. Banks, for example, are often happy to work with carriers to make sure criminals imitating them go away. That protects employees as well as customers. Unfortunately, many companies think that it should be the carriers’ problem and they shouldn’t have to put money or time into making it stop. So they sit there while the damage continues.
Solving the Phone Scam Problem
Carriers have so far been dragged kicking and screaming into doing things to react to past phone scam problems, but scammers move on to something else. If they wanted to address the SIM farm problem, for example, you’d start with not letting anyone get a SIM unless they show ID. Alex thinks they should start implementing know your customer (KYC) procedures everywhere. But that’s not enough – they also need to observe traffic and see if it makes sense. If a dentist is suddenly making a million outgoing calls, it’s time to see if someone took over their account.
The way we fix the phone scam problem is getting everyone at every level to pay more attention. Every carrier needs to be watching every number for signals that it’s doing something suspicious. This is a service YouMail provides. They need to know who their customers are and act on it. When they see bad behavior, they need to stop that customer, or if they’re on another carrier go after that. Everyone has to attack these guys aggressively.
I think the way [scam calls] get fixed is people start paying a lot more attention at every level.
Alex Quilici
Companies don’t want to put a lot of money into things that don’t positively impact their bottom line. But a lot of fighting phone scams is just insurance against a big risky event in the future. For carriers specifically, they make money from phone scams even if they don’t intend to. It’s doubly bad for them – they spend money to fight it and they lose revenue. But the government is starting to ramp up enforcement. Alex thinks we’re going to see more enforcement over the next year, and that will start pushing these criminals out of phone scams.
Protecting Yourself from Phone Scams
Avoiding answering your phone is a good strategy. If you’re not expecting a call from a particular party at a particular time, just let it go to voicemail. You can always call back. This is especially effective for older adults and kids who assume a caller is who they say they are. It’s sad that we’ve gotten to that point. But on the other hand, voicemail isn’t a bad thing. They leave a message, you listen to it, and if they’re legitimate you call them back. Going to voicemail will also give you a second to think. Alex always tells people to pause for a second and don’t react right away. Taking time to think will help you better spot unusual or suspicious things.
The magic combination is a sense of urgency, a known brand or experience, and real consequences if you don’t do it. They inspire an emotional reaction. And that means you should be suspicious. Have a policy of not dealing with anything right away – take their information and say you’ll call back. If they say there will be consequences, tell them you’re okay with that and know that nothing is going to happen. One piece of good news is that you don’t have to use phone calls at all for a lot of these things now. A lot of traditional telephony is moving to other channels like apps, and those can be very secure.
Anything where there’s a sense of urgency, a known brand, known experience, and real consequences, in theory, if you don’t do it. That’s the magic set of triggers.
Alex Quilici
Learn more about YouMail and their services at youmail.com. If you are a carrier, go to youmailps.com to learn about their services for carriers. You can connect with Alex Quilici on LinkedIn.