[VoiceOps] 605-562 - Arbitrage scam?
Ryan Delgrosso
ryandelgrosso at gmail.com
Tue Jun 18 14:56:05 EDT 2019
I had built a system not so long ago that tracked day over day traffic
from my network by destination NPA/NXX and was able to pinpoint this
sort of thing by simply looking for seismic deviations from the norm
(volume or cost). Sure we would get occasional false positives when a
new customer with a really specific marketing business might turn up,
but it really wasn't hard to build and resulted in a good measure of
safety from a backstop perspective.
We just used the systems output to focus manual investigations, not to
power an automated system. Too much risk in automating domestic traffic
cutoffs.
FWIW we were an end-user network, not a wholesale network so we didnt
get the random sampling that wholesalers might which would likely have
changed some of the knobs on my selected criteria.
On 6/17/2019 7:20 PM, Matthew Yaklin wrote:
> I am not sure if this is feasible for someone to do easily so I do not
> bother you too much... but does anyone have a spreadsheet of the nanp
> npa-nxx(s) you keep a very close eye on for fraud? I am not sure how
> well we keep an eye on such things here. I would like to explore it
> more. Naturally we keep an very close watch on international and brute
> force attacks.
>
> Matthew Yaklin
> Network Engineer
> FirstLight
> 359 Corporate Drive │ Portsmouth, NH 03801
> Mobile 603-845-5031
> myaklin at firstlight.net | www.firstlight.net
> This email may contain FirstLight confidential and/or privileged
> information. If you are not the intended recipient, you are directed
> not to read, disclose or otherwise use this transmission and to
> immediately delete same. Delivery of this message is not intended
> to waive any applicable privileges.
>
> ------------------------------------------------------------------------
> *From:* VoiceOps <voiceops-bounces at voiceops.org> on behalf of Robert
> Dawson <rdawson at alliedtelecom.net>
> *Sent:* Monday, June 17, 2019 7:18:43 PM
> *To:* Paul Timmins; Paul Timmins; voiceops at voiceops.org
> *Subject:* Re: [VoiceOps] 605-562 - Arbitrage scam?
>
> Interesting that you haven’t really seen that much domestic . . . I’d
> say that domestic fraud accounts for at least 40% of the attempts we
> have seen over the last year or so, with another 40% to NANP “island”
> destinations (DR in particular) and the remaining to international.
> Definitely different than a few years back when almost everything was
> to African destinations.
>
> The fraudsters are very smart and evolve over time, always have to be
> vigilant!
>
> *From: *Paul Timmins <ptimmins at clearrate.com>
> *Date: *Monday, June 17, 2019 at 6:48 PM
> *To: *Robert Dawson <rdawson at alliedtelecom.net>, Paul Timmins
> <paul at timmins.net>, "voiceops at voiceops.org" <voiceops at voiceops.org>
> *Subject: *RE: [VoiceOps] 605-562 - Arbitrage scam?
>
> I can just augment my existing one we developed in house easily
> enough. But the new behavior that's concerning is hacked endpoints
> calling the numbers. I'm used to "traffic pumping" being free
> services people actually want leveraging arbitrage, but attracting
> fraudulent traffic from hacked handsets isn't something I've ever seen
> on domestic traffic before.
>
> Bold, since it implies there's revenue share, and federal law can
> reach a tribe in a way that the usual banana republic telco fraud in
> the 3rd world can't.
>
> -Paul
>
> ------------------------------------------------------------------------
>
> *From:*VoiceOps [voiceops-bounces at voiceops.org] on behalf of Robert
> Dawson [rdawson at alliedtelecom.net]
> *Sent:* Monday, June 17, 2019 6:25 PM
> *To:* Paul Timmins; voiceops at voiceops.org
> *Subject:* Re: [VoiceOps] 605-562 - Arbitrage scam?
>
> Jumping in on this one late – Pine Ridge is most well-known for the
> Ogala Lakota reservation that is located there. Numbers are in fact
> owned by Native American Telecom which is tribally owned and has had
> traffic pumping charges levelled against them as someone else
> mentioned. Payday lenders have used tribal law for years to get around
> usury laws, there was one company that was charging something like
> 900% effective interest. Repayment on a $10k loan was something like
> $75k. Wondering if they can somehow skirt Federal telecom law too?
>
> Paul, you are 100% correct – any fraud detection system that is only
> looking at International destinations would not pick it up . . . you
> definitely need something that can, at a minimum, be configured to
> look at call velocity and volume to US destinations. I can make a
> recommendation if you are interested.
>
> Rob
>
> *From: *VoiceOps <voiceops-bounces at voiceops.org> on behalf of Paul
> Timmins <paul at timmins.net>
> *Date: *Wednesday, May 29, 2019 at 4:54 PM
> *To: *Matthew Yaklin <myaklin at firstlight.net>, "voiceops at voiceops.org"
> <voiceops at voiceops.org>
> *Subject: *Re: [VoiceOps] 605-562 - Arbitrage scam?
>
> Yeah, what makes it notable in this case is it seems like it's dead
> air calls and hacked phones like traditional international fraud, not
> free conference call services.
>
> On 5/29/19 4:16 PM, Matthew Yaklin wrote:
>
> Nevermind.. you meant interstate calling fraud detection systems I
> assume. Sorry. Please ignore me. I just reread again.
>
> *Matthew Yaklin*
>
> Network Engineer
>
> *FirstLight*
>
> 359 Corporate Drive │ Portsmouth, NH 03801
>
> Mobile 603-845-5031
>
> myaklin at firstlight.net <mailto:myaklin at firstlight.net> |
> www.firstlight.net <http://www.firstlight.net>
>
> /This email may contain FirstLight confidential and/or privileged
> information. If you are not the intended recipient, you are directed/
>
> /not to read, disclose or otherwise use this transmission and to
> immediately delete same. Delivery of this message is not intended/
>
> /to waive any applicable privileges./
>
> ------------------------------------------------------------------------
>
> *From:*VoiceOps <voiceops-bounces at voiceops.org>
> <mailto:voiceops-bounces at voiceops.org> on behalf of Matthew Yaklin
> <myaklin at firstlight.net> <mailto:myaklin at firstlight.net>
> *Sent:* Wednesday, May 29, 2019 4:14:02 PM
> *To:* Paul Timmins; voiceops at voiceops.org
> <mailto:voiceops at voiceops.org>
> *Subject:* Re: [VoiceOps] 605-562 - Arbitrage scam?
>
> Paul,
>
> Why do you mention international toll fraud when that is an area
> code and exchange for
>
> Pine Ridge South Dakota?
>
> And just imagining how small that company must be wouldn't a
> logical guess be more like they just messed up in some fashion?
>
> But in your defense that telecom company is fishy and Sprint tried
> to sue them. I am not sure what ended up happening. Typical crap
> with free conf stuff and having traffic sent to a high cost area...
>
> *Matthew Yaklin*
>
> Network Engineer
>
> *FirstLight*
>
> 359 Corporate Drive │ Portsmouth, NH 03801
>
> Mobile 603-845-5031
>
> myaklin at firstlight.net <mailto:myaklin at firstlight.net> |
> www.firstlight.net <http://www.firstlight.net>
>
> /This email may contain FirstLight confidential and/or privileged
> information. If you are not the intended recipient, you are directed/
>
> /not to read, disclose or otherwise use this transmission and to
> immediately delete same. Delivery of this message is not intended/
>
> /to waive any applicable privileges./
>
> ------------------------------------------------------------------------
>
> *From:*VoiceOps <voiceops-bounces at voiceops.org>
> <mailto:voiceops-bounces at voiceops.org> on behalf of Paul Timmins
> <paul at timmins.net> <mailto:paul at timmins.net>
> *Sent:* Wednesday, May 29, 2019 3:50:35 PM
> *To:* voiceops at voiceops.org <mailto:voiceops at voiceops.org>
> *Subject:* [VoiceOps] 605-562 - Arbitrage scam?
>
> Is anyone else seeing lots of long duration calls to the 605-562
> exchange that when you dial the respective number, it supervises
> to dead
> air?
>
> Seems like a new kind of toll fraud that international fraud
> detection
> systems won't catch.
>
> -Paul
>
> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org <mailto:VoiceOps at voiceops.org>
> https://puck.nether.net/mailman/listinfo/voiceops
>
>
> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org
> https://puck.nether.net/mailman/listinfo/voiceops
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20190618/2b7c7d6e/attachment-0001.htm>
More information about the VoiceOps
mailing list