<div dir='auto'>To be fair with our aggressive fraud controls and our honeypots that are linked to our DDoS control system that nullroute SIP scanners, etc we don't see fraud much at all (it used to hit us a LOT, but we slow down scanners quite a bit), and most of what we do catch is speedruns toward NGNs and high cost prefixes in G20 nations these days just like the olden days. Less East Timor, more UK NGNs. Some Caribbean fraud but not a ton.<div dir="auto"><br></div><div dir="auto">Beyond this reservation telco, I'm with Matt, if there's bad actors out there in the US let's throw out some OCNs and we can build up high risk destinations.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Jun 17, 2019 19:18, Robert Dawson <rdawson@alliedtelecom.net> wrote:<br type="attribution" /><blockquote><html xmlns="http://www.w3.org/TR/REC-html40" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
<meta content="Microsoft Word 15 (filtered medium)" name="Generator"/>
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:HelveticaNeue-Bold;
panose-1:2 0 8 3 0 0 0 9 0 4;}
@font-face
{font-family:HelveticaNeue;
panose-1:2 0 5 3 0 0 0 2 0 4;}
@font-face
{font-family:HelveticaNeue-Italic;
panose-1:2 0 5 3 0 0 0 9 0 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal00, li.msonormal00, div.msonormal00
{mso-style-name:msonormal0;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msochpdefault, li.msochpdefault, div.msochpdefault
{mso-style-name:msochpdefault;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
span.emailstyle19
{mso-style-name:emailstyle19;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Interesting that you haven’t really seen that much domestic . . . I’d say that domestic fraud accounts for at least 40% of the attempts we have seen over the last year or so, with another 40% to NANP “island” destinations (DR in particular)
and the remaining to international. Definitely different than a few years back when almost everything was to African destinations.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The fraudsters are very smart and evolve over time, always have to be vigilant!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Paul Timmins <ptimmins@clearrate.com><br/>
<b>Date: </b>Monday, June 17, 2019 at 6:48 PM<br/>
<b>To: </b>Robert Dawson <rdawson@alliedtelecom.net>, Paul Timmins <paul@timmins.net>, "voiceops@voiceops.org" <voiceops@voiceops.org><br/>
<b>Subject: </b>RE: [VoiceOps] 605-562 - Arbitrage scam?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt;background:white"><!--removed inky banner--></p></div>
</div>
<div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'>I can just augment my existing one we developed in house easily enough. But the new behavior that's concerning is hacked endpoints calling the numbers. I'm used
to "traffic pumping" being free services people actually want leveraging arbitrage, but attracting fraudulent traffic from hacked handsets isn't something I've ever seen on domestic traffic before.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'>Bold, since it implies there's revenue share, and federal law can reach a tribe in a way that the usual banana republic telco fraud in the 3rd world can't.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'>-Paul<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'><o:p> </o:p></span></p>
</div>
<div>
<div align="center" class="MsoNormal" style="text-align:center"><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>
<hr align="center" size="0" width="100%"/>
</span></div>
<div id="divRpF615861">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black'> VoiceOps [voiceops-bounces@voiceops.org]
on behalf of Robert Dawson [rdawson@alliedtelecom.net]<br/>
<b>Sent:</b> Monday, June 17, 2019 6:25 PM<br/>
<b>To:</b> Paul Timmins; voiceops@voiceops.org<br/>
<b>Subject:</b> Re: [VoiceOps] 605-562 - Arbitrage scam?</span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black">Jumping in on this one late – Pine Ridge is most well-known for the Ogala Lakota reservation that is located there. Numbers are in fact owned by Native American Telecom which is tribally owned and has had traffic
pumping charges levelled against them as someone else mentioned. Payday lenders have used tribal law for years to get around usury laws, there was one company that was charging something like 900% effective interest. Repayment on a $10k loan was something
like $75k. Wondering if they can somehow skirt Federal telecom law too?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Paul, you are 100% correct – any fraud detection system that is only looking at International destinations would not pick it up . . . you definitely need something that can, at a minimum, be configured to look
at call velocity and volume to US destinations. I can make a recommendation if you are interested.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Rob<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">VoiceOps <voiceops-bounces@voiceops.org> on behalf of Paul Timmins <paul@timmins.net><br/>
<b>Date: </b>Wednesday, May 29, 2019 at 4:54 PM<br/>
<b>To: </b>Matthew Yaklin <myaklin@firstlight.net>, "voiceops@voiceops.org" <voiceops@voiceops.org><br/>
<b>Subject: </b>Re: [VoiceOps] 605-562 - Arbitrage scam?</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black;background:white">Yeah, what makes it notable in this case is it seems like it's dead air calls and hacked phones like traditional international fraud, not free conference call services.</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">On 5/29/19 4:16 PM, Matthew Yaklin wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div id="divtagdefaultwrapper">
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Nevermind.. you meant interstate calling fraud detection systems I assume. Sorry. Please ignore me. I just reread again.<o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<div id="Signature">
<div id="divtagdefaultwrapper">
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:HelveticaNeue-Bold;color:#000048">Matthew Yaklin</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:HelveticaNeue;color:#000048">Network Engineer</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:HelveticaNeue-Bold;color:#AEFF00">FirstLight</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:8.0pt;font-family:"Arial",sans-serif;color:#0078D7'>359 Corporate Drive │ Portsmouth, NH 03801</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:HelveticaNeue;color:#000048">Mobile 603-845-5031</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:HelveticaNeue;color:#000048"><a href="mailto:myaklin@firstlight.net">myaklin@firstlight.net</a> |
<a href="http://www.firstlight.net">
www.firstlight.net</a></span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:HelveticaNeue-Italic;color:black">This email may contain FirstLight confidential and/or privileged information. If you are not the intended recipient, you are directed</span></i><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:HelveticaNeue-Italic;color:black">not to read, disclose or otherwise use this transmission and to immediately delete same. Delivery of this message is not intended</span></i><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:HelveticaNeue-Italic;color:black">to waive any applicable privileges.</span></i><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
<div align="center" class="MsoNormal" style="text-align:center"><span style="color:black">
<hr align="center" size="0" width="100%"/>
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> VoiceOps
<a href="mailto:voiceops-bounces@voiceops.org"><voiceops-bounces@voiceops.org></a> on behalf of Matthew Yaklin
<a href="mailto:myaklin@firstlight.net"><myaklin@firstlight.net></a><br/>
<b>Sent:</b> Wednesday, May 29, 2019 4:14:02 PM<br/>
<b>To:</b> Paul Timmins; <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br/>
<b>Subject:</b> Re: [VoiceOps] 605-562 - Arbitrage scam? <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div id="x_divtagdefaultwrapper">
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Paul,<o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Why do you mention international toll fraud when that is an area code and exchange for<o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Pine Ridge South Dakota?<o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>And just imagining how small that company must be wouldn't a logical guess be more like they just messed up in some fashion?<o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>But in your defense that telecom company is fishy and Sprint tried to sue them. I am not sure what ended up happening. Typical crap with free conf stuff and having traffic sent
to a high cost area...<o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
<div id="x_Signature">
<div id="x_divtagdefaultwrapper">
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:HelveticaNeue-Bold;color:#000048">Matthew Yaklin</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:HelveticaNeue;color:#000048">Network Engineer</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:HelveticaNeue-Bold;color:#AEFF00">FirstLight</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style='font-size:8.0pt;font-family:"Arial",sans-serif;color:#0078D7'>359 Corporate Drive │ Portsmouth, NH 03801</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:HelveticaNeue;color:#000048">Mobile 603-845-5031</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:HelveticaNeue;color:#000048"><a href="mailto:myaklin@firstlight.net">myaklin@firstlight.net</a> |
<a href="http://www.firstlight.net">
www.firstlight.net</a></span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:HelveticaNeue-Italic;color:black">This email may contain FirstLight confidential and/or privileged information. If you are not the intended recipient, you are directed</span></i><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:HelveticaNeue-Italic;color:black">not to read, disclose or otherwise use this transmission and to immediately delete same. Delivery of this message is not intended</span></i><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:HelveticaNeue-Italic;color:black">to waive any applicable privileges.</span></i><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
<div align="center" class="MsoNormal" style="text-align:center"><span style="color:black">
<hr align="center" size="0" width="100%"/>
</span></div>
<div id="x_divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> VoiceOps
<a href="mailto:voiceops-bounces@voiceops.org"><voiceops-bounces@voiceops.org></a> on behalf of Paul Timmins
<a href="mailto:paul@timmins.net"><paul@timmins.net></a><br/>
<b>Sent:</b> Wednesday, May 29, 2019 3:50:35 PM<br/>
<b>To:</b> <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br/>
<b>Subject:</b> [VoiceOps] 605-562 - Arbitrage scam? <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black">Is anyone else seeing lots of long duration calls to the 605-562
<br/>
exchange that when you dial the respective number, it supervises to dead <br/>
air?<br/>
<br/>
Seems like a new kind of toll fraud that international fraud detection <br/>
systems won't catch.<br/>
<br/>
-Paul<br/>
<br/>
_______________________________________________<br/>
VoiceOps mailing list<br/>
<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br/>
<a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a><o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<p><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
</blockquote></body></html>