[VoiceOps] Can't Figure This Scam Out

[Aaron C. de Bruyn]

I've been seeing something similar targeted at a healthcare client over the
last few months.
Same exact situation where patients are calling some random number that
isn't in our systems, but it gets forwarded to our systems for a few
minutes/hours.
Because this particular client has 30+ locations, we started noticing it
when calls were being misrouted to other locations.  (i.e. patient calling
Houston office gets routed incorrectly to the San Francisco office)
We initially suspected a 3rd-party marketing service that was issuing
semi-temporary numbers to use in Facebook ad campaigns, but a decent amount
of numbers didn't line up.
I also arrived at the possibility of this being used to monitor the calls
for credit cards, social security numbers, or other private information.
I'm still gathering data from end-users to try and track it down.

-A

On Thu, Nov 11, 2021 at 8:13 AM LICT VoiceOps via VoiceOps <
voiceops at voiceops.org> wrote:

> One of our clients is a small private school.
>
> For the past month, the school has been getting calls meant for other
> schools in the general area (within 20 miles or so)
>
> We have been able to get limited information from the caller like
> what number did they dial. They are definitely not dialing our client's
> DIDs.
>
> It seems that they are dialing a number that they found on an internet
> search, and the call is then forwarded to one of the DIDs at the school.
>
> We are seeing matching CDR records for our PBX and our carrier's CDR
> billing reports, so it does not look like a SIP hack.
>
> It seems that the number is forwarded for just a few minutes to our
> school, then goes dead, or rings busy, no longer forwarded to our client.
>
> The pattern here is that the caller obtained the number from an internet
> search of a school in the area. These are real people calling, as we have
> been able to call them back and verify. The callers who reached our client
> are as bewildered as we are.
>
> I am sure this is some sort of scam -- but I can't figure out what it is.
> Are the scammers recording the lines and seeing if they hear financial
> information? Seems like a longshot, but that is the only thing I can think
> of.
>
> I know there is little that can be done to prevent a call being forwarded
> to you upstream of the carrier, but would love to hear anyone's thoughts
> about this.
>
>
>
>
> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org
> https://puck.nether.net/mailman/listinfo/voiceops
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20211111/9815b53b/attachment-0001.htm>