Robocalling and Communication Id Spoofing
Total Page:16
File Type:pdf, Size:1020Kb
ATIS REPORT ATIS-I-0000081 ATIS Report on – Robocalling and Communication ID Spoofing:ROBOCALLING Better Understanding Illicit and Unwanted CallsAND and How to Counter Them COMMUNICATION ID SPOOFING: Better Understanding Illicit and Unwanted Calls and How to Counter Them February 2021 It is well recognized within the telecommunications industry that illicit and nuisance calling, specifically illegal scam robocalls, has led to a significant loss of customer trust in the global telephone network. To restore this trust, carriers and service providers (SPs) have gone to considerable lengths to design and deploy services that will mitigate the impacts of these illicit calling campaigns. This report aims to provide a detailed summary of both the many types of illicit calling and the measures being deployed to counter them. It explains why there is no “silver bullet” that will instantly and forever eliminate all illicit robocalling and why, instead, the industry must deploy many separate components in combination to maximize mitigation with ABSTRACT minimal blocking of wanted calls. A summary is included of the various U.S. actions and some international regulators to assist carriers and SPs in this effort. As these bad actors continue to evolve their techniques, further countermeasures will need to be developed to cope with these new threats. Accordingly, this report concludes with recommendations for future action by the Alliance for Telecommunications Industry Solutions (ATIS) and other organizations. As a leading technology and solutions development organization, the Alliance for Telecommunications Industry Solutions (ATIS) brings together the top global ICT companies to advance the industry’s most pressing business priorities. ATIS’ nearly 200 member companies are currently working to address the all-internet protocol (IP) transition, 5G, network functions virtualization, big data analytics, cloud services, device solutions, emergency services, M2M, cyber security, network evolution, quality of service, billing support, operations, and much more. These priorities follow a fast- track development lifecycle — from design and innovation through standards, specifications, requirements, business FOREWORD use cases, software toolkits, open-source solutions, and interoperability testing. ATIS is accredited by the American National Standards Institute (ANSI). The organization is the North American Organizational Partner for the 3rd Generation Partnership Project (3GPP), a founding partner of the oneM2M global initiative, a member of and major U.S. contributor to the International Telecommunication Union (ITU), as well as a member of the Inter-American Telecommunication Commission (CITEL). For more information, visit www.atis.org. NOTICE OF DISCLAIMERATIS-I-0000081 AND LIMITATION OF LIABILITY The information provided in this document is directed solely to professionals who have the appropriate degree of experience to understand and interpret its contents in accordance with generally accepted engineering or other professional standards and applicable regulations. No recommendation as to products or vendors is made or should be implied. NO REPRESENTATION OR WARRANTY IS MADE THAT THE INFORMATION IS TECHNICALLY ACCURATE OR SUFFICIENT OR CONFORMS TO ANY STATUTE, GOVERNMENTAL RULE OR REGULATION, AND FURTHER, NO REPRESENTATION OR WARRANTY IS MADE OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR AGAINST INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS. ATIS SHALL NOT BE LIABLE, BEYOND THE AMOUNT OF ANY SUM RECEIVED IN PAYMENT BY ATIS FOR THIS DOCUMENT, AND IN NO EVENT SHALL ATIS BE LIABLE FOR LOST PROFITS OR OTHER INCIDENTAL OR CONSEQUENTIAL DAMAGES. ATIS EXPRESSLY ADVISES THAT ANY AND ALL USE OF OR RELIANCE UPON THE INFORMATION PROVIDED IN THIS DOCUMENT IS AT THE RISK OF THE USER. NOTE - The user’s attention is called to the possibility that compliance with this document may require use of an invention covered by patent rights. By publication of this document, no position is taken with respect to whether use of an invention covered by patent rights will be required, and if any such use is required no position is taken regarding the validity of this claim or any patent rights in connection therewith. Please refer to https://www.atis.org/policy/patent-policy/ for more information. COPYRIGHT INFORMATION ATIS-I-0000081 Copyright © 2021 by Alliance for Telecommunications Industry Solutions All rights reserved. Alliance for Telecommunications Industry Solutions 1200 G Street, NW, Suite 500 Washington, DC 20005, USA No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without the prior written permission of the publisher. For information, contact ATIS at +1 202-628-6380. ATIS is online at https://www.atis.org. iii TABLE OF CONTENTS 1. EXECUTIVE SUMMARY 1 2. INTRODUCTION AND SCOPE 3 2.1 INTRODUCTION 2.2 SCOPE 3. PROBLEM DEFINITION AND SOLUTION OUTLINE 5 4. DEFINITIONS, ACRONYMS, AND ABBREVIATIONS 7 4.1 DEFINITIONS 4.2 ACRONYMS AND ABBREVIATIONS 5. ROBOCALLING ECOSYSTEM STAKEHOLDERS 10 5.1 SUBSCRIBER 5.2 ENTERPRISE 5.3 PUBLIC ACTOR 5.4 COMMUNICATION PLATFORM AS A SERVICE (CPAAS)/TELEPHONE NUMBER (TN) RESELLER 5.5 ORIGINATING SERVICE PROVIDER 5.6 TERMINATING SERVICE PROVIDER 5.7 ANALYTICS SERVICES 6. ILLEGAL ROBOCALLER INDUSTRY 19 6.1 ILLEGAL CALL CAMPAIGN TYPES 6.2 TECHNOLOGIES LEVERAGED IN CAMPAIGNS 6.3 TARGET NUMBER SOURCING 6.4 ILLEGAL ROBOCALL INDUSTRY PROFITABILITY MARGINS 6.5 ONE-RING SCAMS 7. SHORT MESSAGE SERVICE (SMS) SPAM AND FRAUD 24 7.1 SPAM 7.2 INTERCONNECT FRAUD 7.3 GREY ROUTES 7.4 CURRENT MITIGATION MEASURES 7.5 GAPS 8. ILLEGAL ROBOCALLERS AS AN ADVERSARY 27 8.1 NEIGHBOR SCAMS 8.2 RESPONSES TO MAJOR EVENTS 9. ILLEGAL ROBOCALLER IMPACTS 30 9.1 CALL VOLUMES 9.2 FCC CONSUMER COMPLAINT DATABASE 9.3 FTC CONSUMER COMPLAINT DATABASE 9.4 FINANCIAL IMPACT 9.5 CONSUMER CALL ENGAGEMENT 10. SUCCESS CRITERIA 35 10.1 GENERAL SUCCESS CRITERIA 10.2 MEASURABLE SUCCESS CRITERIA 11. ROBOCALLING MITIGATION METRICS 37 11.1 ROBOCALL METRICS 11.2 ANALYTICS SERVICES METRICS 12. UNINTENDED CONSEQUENCES AND MITIGATION AIMS 40 13. CATEGORIZATION AND COMBINATION OF ANTI-ROBOCALLING MITIGATION TECHNIQUES 42 14. MITIGATION COMPONENTS IN USE OR IN DEVELOPMENT 45 14.1 STIR/SHAKEN – SP-TO-SP VERIFICATION 14.2 SHAKEN/STIR ROLLOUT METRICS 15. ADDITIONAL TOOLS TO HELP COMBAT ROBOCALLS 51 15.1 REPUTATION COMPILED FROM MULTIPLE EXISTING SOURCES 15.2 DATA COLLECTION AND ANALYSIS 15.3 TRACEBACK 15.4 CALL BLOCKING (ORIGINATION, TRANSIT, AND TERMINATION) 15.5 BLOCKLIST AND ALLOWLIST 15.6 NETWORK APPLICATIONS 15.7 PHONE AND OTHER LOCAL APPLICATIONS 15.8 REASSIGNED NUMBERS DATABASE 16. DISPLAY TO CALLED PARTY 55 16.1 HUMAN FACTORS 16.2 SUMMARY OF DISPLAY GUIDELINES FROM ATIS-1000081, ATIS TECHNICAL REPORT ON A FRAMEWORK FOR DISPLAY OF VERIFIED CALLER ID 16.3 DISPLAY EXAMPLES AND OPEN ISSUES 16.4 DATA INTEGRITY AND CHOICES OF DATA SOURCES FOR CALLING NAME 16.5 ENHANCED CNAM (eCNAM) 16.6 ADVANTAGES OF eCNAM 16.7 eCNAM AND ALTERNATIVE IDENTITY DELIVERY METHODS 16.8 LEGACY CONSUMER SOLUTIONS 17. FRAMEWORK FOR CONVEYING VETTED RICH CALL DATA VIA “RCD” PASSPORT 64 18. REGULATORY 66 18.1 FEDERAL ACTIVITY 18.2 NANC CALL AUTHENTICATION TRUST ANCHOR WORKING GROUP 18.3 STATE LEGISLATIVE ACTIVITY 18.4 INTERNATIONAL 18.5 OTHER INTERNATIONAL ISSUES 19. CONSIDERATIONS FOR FURTHER WORK 75 19.1 ORIGINATOR REGISTRATION 19.2 NO GUARANTEED DELIVERY OF SHAKEN PASSPORTS 19.3 FAIR ACCESS TO IDENTIFICATION IN THE TELEPHONY NETWORK 19.4 FAIR TREATMENT OF ANALYTICS 20. REFERENCED INDUSTRY ORGANIZATIONS 79 21. CONTRIBUTORS TO THIS REPORT 81 APPENDIX 83 APPENDIX A APPENDIX B TABLE OF FIGURES FIGURE 6.1: A DIAGRAM OF A TYPICAL LEAD-GENERATION CALL SYSTEM 20 FIGURE 8.1: THE NEIGHBOR SPOOFING SHIFTS TO AN AREA-CODE-ONLY MATCH 27 FIGURE 9.1: ROBOCALLS OVER TIME 30 FIGURE 9.2: FTC COMPLAINTS BY CALL TYPE BY YEAR 31 FIGURE 9.3: OCTOBER 2019 - SEPTEMBER 2020 COMPLAINTS BY MONTH BY CALL TYPE 32 FIGURE 9.4: NUMBER OF REPORTS AND CONSUMER AMOUNT LOST BY CONTACT METHOD 33 FIGURE 13.1: COMPONENT TECHNIQUES USED IN COMBINATION TO PROVIDE ILLICIT CALL MITIGATION SERVICES 42 FIGURE 13.2: EXAMPLE MITIGATION COMPONENTS USED AT EACH CALL STAGE 43 FIGURE 14.1: ATIS ENTERPRISE IDENTITY DISTRIBUTED LEDGER NETWORK 48 FIGURE 16.1: DISPLAY EXAMPLE 1 56 FIGURE 16.2: DISPLAY EXAMPLE 2 56 FIGURE 16.3: eCNAM 58 FIGURE 16.4: CNAM AND RCD INTERACTIONS 59 FIGURE 16.5: POTENTIAL IMPLEMENTATION OF MODIFIED CNAM DISPLAY 60 FIGURE 17.1: DELIVERING RICH CALL DATA VIA “RCD” PASSPORT 63 TABLE OF TABLES TABLE 16.1: SYNOPSIS OF HIYA STUDIES 56 TABLE 16.2: PROS AND CONS OF REUSING THE CNAM DISPLAY FIELD 63 1 EXECUTIVE SUMMARY ATIS-I-0000081 EXECUTIVE SUMMARY It is well recognized within the telecommunications industry that illicit and nuisance calling — specifically illegal scam robocalls — has led to a significant loss of customer trust in the global telephone network. In fact, eight-in-ten Americans say they do not generally answer their cellphone when an unknown number calls.1 To restore this trust, carriers and service providers (SPs) have gone to considerable lengths to design and deploy services that will mitigate the impacts of these illicit calling campaigns. This report aims to provide a detailed summary of both the many types of illicit calling and the measures being deployed to counter them. Many types of bad players generate these calls. This report explains why so many different types of fraud are perpetrated and describes the multiple techniques required to address them. There is no specific solution that will, on its own, stop all malicious use of false or misleading call identification. Most carriers and many independent providers have call blocking and call information reporting services. Yet many questions remain about how these are provided and why, for example, they sometimes fail to eliminate all illicit calls. This report answers those questions by describing the various anti-robocalling techniques and how they work together to provide mitigation services.