FCC proposes $10 Million fine for spoofed robocalls

Thu Dec 19 19:27:16 UTC 2019

On Thu, 2019-12-19 at 11:02 -0800, William Herrin wrote:
> 
> I call your phone number.
> Your phone company compares my number against your whitelist. Ring
> through on match.
> If no match, "You have reached Name. Press 2 to leave a message.
> Press
> 3 to enter your code. Press 0 or stay on the line for an operator."
> Ring through on a valid code.
> If 0, the call connects to a call center where a live operator
> evaluates the call. Who am I? Why am I calling? Do I meet the
> plain-English criteria you've established for calls to allow through?
> If no, the operator offers to connect me to your voicemail. If yes,
> the operator dials you, explains who's calling and asks your
> permission to connect the call.

It really doesn't (currently at least -- until robocallers start using
voice recognition to defeat my system) need to be this complicated or
over-engineered.  A simple audio captcha works wonders.

   Hello.  If you are a telemarketer, press 1.  If you want to speak to
   somebody at this number, press 5.

Anyone pressing 1 gets their caller-id added to my blacklist and is
asked to add our number to their do not call list.  In reality all
telemarketers use robocallers so they don't even get that far.

Anyone pressing 5 rings through (with additional processing described
below).

But that's it.  That has blocked 100% of robocalling from actually
ringing the phones in our house for the last few years.

I couple the captch greeting system with a whiltelist (i.e. only
callers not on the whitelist get the above prompt -- callers on the
whitelist ring through directly with no greeting).  One gets on the
whitelist because (a) I add them explicitly, (b) their number was
called from our house phones (i.e. the PBX automatically adds all
outgoing numbers to the whitelist) (c) they pressed 5 at the prompt.

The result of that last one (c) is that people only ever hear that
prompt once and if they press 5, they never hear it again.  Unless of
course I remove them from the whitelist.  That has never had to be done
to the best of my recollection.

Of course I cannot know how many legitimate (robo)calls have not made
it through the gauntlet, but I also have not had anyone complain about
not being able to reach me.  I figure if it's really important, some
human from wherever the failed legitimate robocall is coming from will
eventually get in touch with me.

I do also get notified when a (i.e. a robo)caller doesn't choose either
1 or 5 and have noticed the very odd robocall that I would have liked
to have received (very few and far between -- maybe 1 or 2 a year), and
add them to the whitelist which works well since failed robocalls
typically get retried so I get it the next time around.

One might argue that having to deal with the notification on each
failed robocall washes out the value of the system, but I would argue
that reading a text message about a failed robocall, when I feel like
reading it, is a more than fair trade-off for not having to interrupt
what I am doing to answer the phone and get frustrated at another
phishing/scam/etc. attempt, and it gives me peace of mind that I will
catch (the very very few) failed robocalls that I did want.

b.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: This is a digitally signed message part
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20191219/f434404d/attachment.sig>