| Caller ID Spoofing By George Molczan |
Caller ID Spoofing: Can it really happen?
Yes, Caller ID can be spoofed. The art of spoofing can be technical and complex,
however, as it applies to Legal and Law Enforcement's use of Caller ID information it is
simple.
What is spoofing? Spoofing is intentionally forcing the telephone number delivered
as part of Caller ID to a number other than the telephone number of the calling line.
How is it done? There are a number of ways to change or spoof caller ID information,
the technical details of which are beyond the scope of this article. However, here are a
few of the ways Caller ID can be spoofed:
• Use of a Spoofing Service - by far the easiest - A search of the Internet will
result in a number of companies offering the service.
• From a PBX (Private Branch Exchange) that has an ISDN- PRI (primary rate
interface)
• Use of a Voice over Internet Protocol (VoIP) telephone service and the proper
Internet Protocol (IP) phone and gateway to the public network
• Use of an "Orange Box" - An Orange Box is a device that simulates the Caller
ID information as normally sent by the telephone company to the called party. While
Orange Boxes work, their use is complex in terms of coordination.
• Social Engineering - convincing an operator to use a bogus telephone number
to place a call
Regardless of how the spoofing is accomplished, the called party has no way to
know the information on their Caller ID unit is being spoofed. From a law-enforcement
investigative view point there should be concern when evidence a call was received
from a particular number and the source of the evidence is information displayed on a
Caller ID unit.
To substantiate the information on the Caller ID unit, a good first step is to subpoena
call records from the telephone company (service provider) providing service to the
called number. In this scenario, it is only be necessary to request the "terminating" call
records. There should be a call record that matches the date, time and calling number
with the information the called party received on their Caller ID unit. If there is still doubt,
request the service provider to supply the raw-data call record for the call in question.
The information in the raw data record will provide the actual calling party number (CPN)
and additional information, such as the call was operator handled.
There are legitimate reasons for changing Caller ID information. One is when call-
centers place outgoing calls for multiple clients and set the Caller ID information to show
the client they are representing. Other legitimate reasons for spoofing Caller ID
information include when it is appropriate for Law Enforcement agencies to do so.
There are times when spoofing Caller ID information may be fraud or at least
unethical. An example of fraud is to gain access to a Voice Mail (VM) box, (Some VM
systems use the Caller ID telephone number to allow access to a VM box). Many VM
systems have a simple safeguard through the use of a personal identification number
(PIN), however its use is normally optional.
An example of Caller ID spoofing that may be considered unethical is for a collection
agency to spoof their Caller ID to trick someone into answering their phone.
Caller ID spoofing should not be confused with the ability of the calling party to block
transmission of their Caller ID information. In this case the receiving party receives the
message "Private" in lieu of the Caller ID information.
The FCC rules covering delivery of the Calling Party Number (between carriers) and
privacy functions are in the Federal Register at 47 C.F.R. §64.1601. Consumer
information regarding Caller ID may be found at the FCC Consumer Facts, Caller ID
web page.
________________
Copyright © 2006 George Molczan, all right reserved.
The information provided herein should not be considered as legal advice. The reader
is advised to seek legal counsel regarding use and/or application of Caller ID information
or any other information provided herein.
Revised 11-6-06