[VoiceOps] 605-562 - Arbitrage scam?

Mon Jun 17 19:18:43 EDT 2019

Interesting that you haven’t really seen that much domestic . . . I’d say that domestic fraud accounts for at least 40% of the attempts we have seen over the last year or so, with another 40% to NANP “island” destinations (DR in particular) and the remaining to international. Definitely different than a few years back when almost everything was to African destinations.

The fraudsters are very smart and evolve over time, always have to be vigilant!

From: Paul Timmins <ptimmins at clearrate.com>
Date: Monday, June 17, 2019 at 6:48 PM
To: Robert Dawson <rdawson at alliedtelecom.net>, Paul Timmins <paul at timmins.net>, "voiceops at voiceops.org" <voiceops at voiceops.org>
Subject: RE: [VoiceOps] 605-562 - Arbitrage scam?

I can just augment my existing one we developed in house easily enough. But the new behavior that's concerning is hacked endpoints calling the numbers. I'm used to "traffic pumping" being fr
Report This Email<https://shared.outlook.inky.com/report?id=YWxsaWVkdGVsZWNvbS9yZGF3c29uQGFsbGllZHRlbGVjb20ubmV0L2Y2MTZiOWUxYzNhYzNiZjU1ZWVlNGJkZTA0YTBmN2I0LzE1NjA4MTE2ODIuNjE=#key=72baefeae6ea9899179b232afe48772c>

I can just augment my existing one we developed in house easily enough. But the new behavior that's concerning is hacked endpoints calling the numbers. I'm used to "traffic pumping" being  free services people actually want leveraging arbitrage, but attracting fraudulent traffic from hacked handsets isn't something I've ever seen on domestic traffic before.

Bold, since it implies there's revenue share, and federal law can reach a tribe in a way that the usual banana republic telco fraud in the 3rd world can't.

-Paul

________________________________
From: VoiceOps [voiceops-bounces at voiceops.org] on behalf of Robert Dawson [rdawson at alliedtelecom.net]
Sent: Monday, June 17, 2019 6:25 PM
To: Paul Timmins; voiceops at voiceops.org
Subject: Re: [VoiceOps] 605-562 - Arbitrage scam?
Jumping in on this one late – Pine Ridge is most well-known for the Ogala Lakota reservation that is located there. Numbers are in fact owned by Native American Telecom which is tribally owned and has had traffic pumping charges levelled against them as someone else mentioned. Payday lenders have used tribal law for years to get around usury laws, there was one company that was charging something like 900% effective interest. Repayment on a $10k loan was something like $75k. Wondering if they can somehow skirt Federal telecom law too?

Paul, you are 100% correct – any fraud detection system that is only looking at International destinations would not pick it up . . . you definitely need something that can, at a minimum, be configured to look at call velocity and volume to US destinations. I can make a recommendation if you are interested.

Rob

From: VoiceOps <voiceops-bounces at voiceops.org> on behalf of Paul Timmins <paul at timmins.net>
Date: Wednesday, May 29, 2019 at 4:54 PM
To: Matthew Yaklin <myaklin at firstlight.net>, "voiceops at voiceops.org" <voiceops at voiceops.org>
Subject: Re: [VoiceOps] 605-562 - Arbitrage scam?

Yeah, what makes it notable in this case is it seems like it's dead air calls and hacked phones like traditional international fraud, not free conference call services.

On 5/29/19 4:16 PM, Matthew Yaklin wrote:

Nevermind.. you meant interstate calling fraud detection systems I assume. Sorry. Please ignore me. I just reread again.

Matthew Yaklin
Network Engineer
FirstLight
359 Corporate Drive │ Portsmouth, NH 03801
Mobile 603-845-5031
myaklin at firstlight.net<mailto:myaklin at firstlight.net> | www.firstlight.net<https://shared.outlook.inky.com/link?domain=www.firstlight.net&t=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eJxVj11PwjAYhf9LrxcY1RuWmIhxVAx0UfeRNSRLR19cx7th2o4hxv9ONd54ca7OycnzfJHBIIlI49xHtJ1up-M4TvbaWIf6vXGTHhwJiAPZaeVnElGDcoCwO3Y_RWNAugrhBP4lDMjvqizOVhb5QbHcioKf6rf5p2DLmx2dDy9saWuGKJ5esWZ5W9NwqLs8XNOSblKhkyI7lxfe-GjRZjNR5MjZ80Gki7BMHzpOV-H6Es94u7jdpDFNHlcDb-M7D6N7B6aXHmQv0UJABgumgk5qrKRSBqz1cEbJ0R77-38qf55JRqJ-QPy-AhxrX48.MEYCIQC0oiHIljMCllbmBuH36z4rtphSNFx15dLw_hNs3rC2egIhANAq-WtRl7CnissKP40hk4HRgg863OEh_1czShpalJWo>
This email may contain FirstLight confidential and/or privileged information. If you are not the intended recipient, you are directed
not to read, disclose or otherwise use this transmission and to immediately delete same. Delivery of this message is not intended
to waive any applicable privileges.

________________________________
From: VoiceOps <voiceops-bounces at voiceops.org><mailto:voiceops-bounces at voiceops.org> on behalf of Matthew Yaklin <myaklin at firstlight.net><mailto:myaklin at firstlight.net>
Sent: Wednesday, May 29, 2019 4:14:02 PM
To: Paul Timmins; voiceops at voiceops.org<mailto:voiceops at voiceops.org>
Subject: Re: [VoiceOps] 605-562 - Arbitrage scam?

Paul,

Why do you mention international toll fraud when that is an area code and exchange for

Pine Ridge South Dakota?

And just imagining how small that company must be wouldn't a logical guess be more like they just messed up in some fashion?

But in your defense that telecom company is fishy and Sprint tried to sue them. I am not sure what ended up happening. Typical crap with free conf stuff and having traffic sent to a high cost area...

Matthew Yaklin
Network Engineer
FirstLight
359 Corporate Drive │ Portsmouth, NH 03801
Mobile 603-845-5031
myaklin at firstlight.net<mailto:myaklin at firstlight.net> | www.firstlight.net<https://shared.outlook.inky.com/link?domain=www.firstlight.net&t=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eJxVj11PwjAYhf9LrxcY1RuWmIhxVAx0UfeRNSRLR19cx7th2o4hxv9ONd54ca7OycnzfJHBIIlI49xHtJ1up-M4TvbaWIf6vXGTHhwJiAPZaeVnElGDcoCwO3Y_RWNAugrhBP4lDMjvqizOVhb5QbHcioKf6rf5p2DLmx2dDy9saWuGKJ5esWZ5W9NwqLs8XNOSblKhkyI7lxfe-GjRZjNR5MjZ80Gki7BMHzpOV-H6Es94u7jdpDFNHlcDb-M7D6N7B6aXHmQv0UJABgumgk5qrKRSBqz1cEbJ0R77-38qf55JRqJ-QPy-AhxrX48.MEYCIQC0oiHIljMCllbmBuH36z4rtphSNFx15dLw_hNs3rC2egIhANAq-WtRl7CnissKP40hk4HRgg863OEh_1czShpalJWo>
This email may contain FirstLight confidential and/or privileged information. If you are not the intended recipient, you are directed
not to read, disclose or otherwise use this transmission and to immediately delete same. Delivery of this message is not intended
to waive any applicable privileges.

________________________________
From: VoiceOps <voiceops-bounces at voiceops.org><mailto:voiceops-bounces at voiceops.org> on behalf of Paul Timmins <paul at timmins.net><mailto:paul at timmins.net>
Sent: Wednesday, May 29, 2019 3:50:35 PM
To: voiceops at voiceops.org<mailto:voiceops at voiceops.org>
Subject: [VoiceOps] 605-562 - Arbitrage scam?

Is anyone else seeing lots of long duration calls to the 605-562
exchange that when you dial the respective number, it supervises to dead
air?

Seems like a new kind of toll fraud that international fraud detection
systems won't catch.

-Paul

_______________________________________________
VoiceOps mailing list
VoiceOps at voiceops.org<mailto:VoiceOps at voiceops.org>
https://puck.nether.net/mailman/listinfo/voiceops<https://shared.outlook.inky.com/link?domain=puck.nether.net&t=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eJxVkFtPg0AQhf_LPjdCV19KYmKNFGtaGpVL2JA0C0zDwrA0e8Fa43_v4psPk3k4k3O-Mz_EKiQBaY0566D0Su9s6_5OgmlBzav0Bi5w4LL0UGgj5GksvWkUNYxnTRbEAB9E4xw4ooDGAEI9DrPQKuDmiDCBC_AX5O-qyC-a51nfRJlmeTxVn6tvFm3ua7qy79FGVxEie_3AKsq6ivq2GjJ_Rwu6T5g45OmluMatG8G6dMnyDOPorWfJ2i-S5yGmW393DZdxt37YJyE9vGxt3IWPDkZIA0pyB3LiqGFBrAZ1hLnakTeNAq0dnGr4lx7l078q8xOcwyElgbSIvzfZumnm.MEUCIQDL4wkhPnyHZBHXLvbkhqtoa1BeR2ObkcNgaH4oS-TENQIgOqH_Z07jFbkB_HHlyl9ZDr--S4H3OtrNCCw8hYC-nts>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20190617/3f9605d6/attachment-0001.htm>