<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    It's likely being done as a way to track searches.  I was involved
    in a company (that shall remain unnamed) that did something very
    similar.  They provision a DID that's forwarded to the "real"
    number, and display that in the search results so they can track
    that a search resulted in a call.  It's data gathering.<br>
    <br>
    <div class="moz-cite-prefix">On 11/11/2021 8:50 AM, Mark Wiles
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:BN0PR13MB4711110A943A6CDD0A71D080AF949@BN0PR13MB4711.namprd13.prod.outlook.com">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <meta name="Generator" content="Microsoft Word 15 (filtered
        medium)">
      <style>@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        font-size:11.0pt;
        font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}span.EmailStyle18
        {mso-style-type:personal-reply;
        font-family:"Calibri",sans-serif;
        color:windowtext;}.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri",sans-serif;}div.WordSection1
        {page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
      <div class="WordSection1">
        <p class="MsoNormal">One of my co-workers is more so on the
          school side of our business… and she ran into something
          similar in the past… I still lean towards Google or BW.<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <div style="border:none;border-top:solid #E1E1E1
          1.0pt;padding:3.0pt 0in 0in 0in">
          <p class="MsoNormal"><b>From:</b> VoiceOps
            <a class="moz-txt-link-rfc2396E" href="mailto:voiceops-bounces@voiceops.org"><voiceops-bounces@voiceops.org></a> <b>On Behalf Of
            </b>Carlos Alvarez<br>
            <b>Sent:</b> Thursday, November 11, 2021 11:39 AM<br>
            <b>To:</b> VoiceOps <a class="moz-txt-link-rfc2396E" href="mailto:voiceops@voiceops.org"><voiceops@voiceops.org></a><br>
            <b>Subject:</b> Re: [VoiceOps] Can't Figure This Scam Out<o:p></o:p></p>
        </div>
        <p class="MsoNormal"><o:p> </o:p></p>
        <div>
          <p class="MsoNormal">Pest control and locksmith services are
            very ripe for fraud, and in fact are often sold/advertised
            in a pretty sleazy way.  Schools are confusing, unless
            they're trying to capture something to do with for-pay
            private schools.<o:p></o:p></p>
          <div>
            <p class="MsoNormal"><o:p> </o:p></p>
          </div>
        </div>
        <p class="MsoNormal"><o:p> </o:p></p>
        <div>
          <div>
            <p class="MsoNormal">On Thu, Nov 11, 2021 at 9:35 AM Mark
              Wiles <<a href="mailto:mwiles@akabis.com"
                moz-do-not-send="true" class="moz-txt-link-freetext">mwiles@akabis.com</a>>
              wrote:<o:p></o:p></p>
          </div>
          <blockquote style="border:none;border-left:solid #CCCCCC
            1.0pt;padding:0in 0in 0in
            6.0pt;margin-left:4.8pt;margin-right:0in">
            <div>
              <div>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I’ve
                  been seeing a similar issue in the past week or so
                  with a pest control business we provide services for…
                  they’re getting calls that were meant to be for other
                  pest control businesses.<o:p></o:p></p>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It’s
                  starting to look like it’s related to TNs seen in web
                  searches… and in call cases, the TNs are not those of
                  the primary business… but a Google number (owned by
                  BW).<o:p></o:p></p>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It
                  seems like maybe Google is having an issue?<o:p></o:p></p>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                <div style="border:none;border-top:solid #E1E1E1
                  1.0pt;padding:3.0pt 0in 0in 0in">
                  <p class="MsoNormal"
                    style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b>
                    VoiceOps <<a
                      href="mailto:voiceops-bounces@voiceops.org"
                      target="_blank" moz-do-not-send="true"
                      class="moz-txt-link-freetext">voiceops-bounces@voiceops.org</a>>
                    <b>On Behalf Of </b>LICT VoiceOps via VoiceOps<br>
                    <b>Sent:</b> Thursday, November 11, 2021 11:02 AM<br>
                    <b>To:</b> VoiceOps <<a
                      href="mailto:voiceops@voiceops.org"
                      target="_blank" moz-do-not-send="true"
                      class="moz-txt-link-freetext">voiceops@voiceops.org</a>><br>
                    <b>Subject:</b> [VoiceOps] Can't Figure This Scam
                    Out<o:p></o:p></p>
                </div>
                <p class="MsoNormal"
                  style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                <div>
                  <p class="MsoNormal"
                    style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">One
                    of our clients is a small private school.<o:p></o:p></p>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">For
                      the past month, the school has been getting calls
                      meant for other schools in the general area
                      (within 20 miles or so)<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We
                      have been able to get limited information from the
                      caller like what number did they dial. They are
                      definitely not dialing our client's DIDs.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It
                      seems that they are dialing a number that they
                      found on an internet search, and the call is then
                      forwarded to one of the DIDs at the school.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We
                      are seeing matching CDR records for our PBX and
                      our carrier's CDR billing reports, so it does not
                      look like a SIP hack.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It
                      seems that the number is forwarded for just a few
                      minutes to our school, then goes dead, or rings
                      busy, no longer forwarded to our client.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The
                      pattern here is that the caller obtained the
                      number from an internet search of a school in the
                      area. These are real people calling, as we have
                      been able to call them back and verify. The
                      callers who reached our client are as bewildered
                      as we are.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I
                      am sure this is some sort of scam -- but I can't
                      figure out what it is. Are the scammers recording
                      the lines and seeing if they hear financial
                      information? Seems like a longshot, but that is
                      the only thing I can think of.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I
                      know there is little that can be done to prevent a
                      call being forwarded to you upstream of the
                      carrier, but would love to hear anyone's thoughts
                      about this.<o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                  <div>
                    <p class="MsoNormal"
                      style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
                  </div>
                </div>
              </div>
            </div>
            <p class="MsoNormal">_______________________________________________<br>
              VoiceOps mailing list<br>
              <a href="mailto:VoiceOps@voiceops.org" target="_blank"
                moz-do-not-send="true" class="moz-txt-link-freetext">VoiceOps@voiceops.org</a><br>
              <a
href="https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpuck.nether.net%2fmailman%2flistinfo%2fvoiceops&c=E,1,juZe4gK4TdlhGyqljNX3Zl9QjmiFQKVxXGINfsliNKhohPKmPChLTzZ19XXwWc6akUY94AJhwAEmchY1kPmjHpRO1uRgDvtPM40gc40BhKAM3HwBHQ,,&typo=1"
                target="_blank" moz-do-not-send="true">https://puck.nether.net/mailman/listinfo/voiceops</a><o:p></o:p></p>
          </blockquote>
        </div>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <pre class="moz-quote-pre" wrap="">_______________________________________________
VoiceOps mailing list
<a class="moz-txt-link-abbreviated" href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>