<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 12/2/20 4:49 PM, Patrick Labbett
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div dir="ltr"><br>
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif">However, it's
not clear (to me) how the Attestation aspect of things will
work (and if it even effects the typical customer): </div>
<div class="gmail_default" style="">
<ul style="">
<li style="font-family:arial,helvetica,sans-serif">Does just
being a customer of the Originating Carrier give the Call
Center's calls Full Attestation?</li>
</ul>
</div>
</div>
</blockquote>
<div class="gmail_default" style="">That depends on the originating
carrier's policies. They could attest A a number that they've
verified to be yours.<br>
</div>
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="">
<ul>
<li>As a call center, if spoofing a number not owned/in
inventory, would that be Partial Attestation?</li>
</ul>
</div>
</div>
</blockquote>
That depends on the originating carrier's policies. They could
attest A a number that they've verified to be yours. Otherwise, they
would attest B because they could verify the origin of the call, but
not the accuracy of the caller ID.<br>
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="">
<ul style="">
<li style="font-family:arial,helvetica,sans-serif">Does the
owner/location of the spoofed number matter, i.e. :</li>
<ul style="font-family:arial,helvetica,sans-serif">
<li>Partial Attestation: Number owned by Originating
carrier, but not by customer making call</li>
<li>Gateway Attestation: Number not owned by Originating
carrier (and by extension not owned by customer making
the call)</li>
</ul>
</ul>
</div>
</div>
</blockquote>
We mark forwarded calls as C, paying customers B, and customers
we've taken the time to verify their ID as A. Some carriers do only
A and C since customers can't specify their own caller ID (such as
Comcast residential voice, or cell carriers)<br>
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="">
<ul style="">
<li style=""><font face="arial, helvetica, sans-serif">Will
different Terminating carriers treat Attestation
designations differently?</font></li>
</ul>
</div>
</div>
</blockquote>
<font face="arial, helvetica, sans-serif">Of course! My T-Mobile
phone doesn't display signed calls in any specific way, but others
may. Our customers get a [V] in front of the caller ID with name
data if we verified attestation A, nothing for any other form of
attestation or no validation at all.</font><br>
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="">
<ul style="">
<li style="">Is this largely a framework that carriers will
implement some day in the future?</li>
</ul>
</div>
</div>
</blockquote>
The standards for how we treat this stuff are loose to give carriers
flexibility in how they convey it to the customers.<br>
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="">
<div style="font-family:arial,helvetica,sans-serif">Am I way
overthinking this? (Yes.) <br>
</div>
</div>
</div>
</blockquote>
<p>Not nearly as bad as many!<br>
</p>
My personal plan of attack for call centers:
<blockquote type="cite"
cite="mid:CADO1n1qzDJsf5=CAyqC8PrNbTRD6ebtXZJzF2bEbxhe4fthgBw@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="">
<div style="font-family:arial,helvetica,sans-serif">
<ul>
<li>Document permission and business use case for numbers
spoofed on behalf of customers</li>
<li>That's it - that's the whole plan. </li>
<li>????</li>
</ul>
<div>Aside from making sure my carriers know I exist and
that I have permission to use those numbers, what else is
there?</div>
</div>
</div>
</div>
</blockquote>
<p>Sounds good to me. For a lot of carriers, a simple explanation
they can easily verify (like you call the number, and they answer
with your client's name) is probably adequate.</p>
<p>-Paul</p>
<p><br>
</p>
</body>
</html>