[VoiceOps] Can't Figure This Scam Out

[Carlos Alvarez]

Wild guesses...

ID theft?  They give up their private info and that of the child, and it's
recorded.

Have you tried calling those numbers yourself, then see what happens?  And
if you do get dropped, call it again.  Thought...that they either intercept
the call and redirect it, or that on the "call back because we got
disconnected" they redirect the call.


On Thu, Nov 11, 2021 at 9:13 AM LICT VoiceOps via VoiceOps <
voiceops at voiceops.org> wrote:

> One of our clients is a small private school.
>
> For the past month, the school has been getting calls meant for other
> schools in the general area (within 20 miles or so)
>
> We have been able to get limited information from the caller like
> what number did they dial. They are definitely not dialing our client's
> DIDs.
>
> It seems that they are dialing a number that they found on an internet
> search, and the call is then forwarded to one of the DIDs at the school.
>
> We are seeing matching CDR records for our PBX and our carrier's CDR
> billing reports, so it does not look like a SIP hack.
>
> It seems that the number is forwarded for just a few minutes to our
> school, then goes dead, or rings busy, no longer forwarded to our client.
>
> The pattern here is that the caller obtained the number from an internet
> search of a school in the area. These are real people calling, as we have
> been able to call them back and verify. The callers who reached our client
> are as bewildered as we are.
>
> I am sure this is some sort of scam -- but I can't figure out what it is.
> Are the scammers recording the lines and seeing if they hear financial
> information? Seems like a longshot, but that is the only thing I can think
> of.
>
> I know there is little that can be done to prevent a call being forwarded
> to you upstream of the carrier, but would love to hear anyone's thoughts
> about this.
>
>
>
>
> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org
> https://puck.nether.net/mailman/listinfo/voiceops
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20211111/a1686d08/attachment-0001.htm>