Counterfeit Caller ID is creating headaches
Peter Svensson Associated Press Mar. 2, 2006 12:00 AM
NEW YORK - Last fall, U.S. Rep. Tim Murphy's office started getting phone calls from constituents who complained about receiving recorded phone messages that bad-mouthed Murphy.
The constituents were especially upset that the messages appeared to come from the congressman's own office. At least, that is what Caller ID said.
"People thought we were making the calls," Murphy said.
The calls, which the Pennsylvania Republican estimated in the thousands, were apparently placed with fake Caller ID. That has been possible for a long time, but it generally required special hardware and technical savvy.
In the past few years, Caller ID spoofing has become much easier. Millions of people have Internet telephone equipment that can be set to make any number appear on a Caller ID system. And several Web sites have sprung up to provide Caller ID spoofing services, eliminating the need for any special hardware.
For instance, SpoofCard.com sells a virtual "calling card" for $10 that provides 60 minutes of talk time. The user dials a toll-free number, then keys in the destination number and the Caller ID number to display. The service also provides optional voice scrambling, to make the caller sound like someone of the opposite sex.
Caller ID spoofing appears to be legal, though many of its uses are not. The Federal Communications Commission has never investigated the issue, spokeswoman Rosemary Kimball said.
Lance James, chief scientist at security company Secure Science Corp., said Caller ID spoofing Web sites are used by people who buy stolen credit-card numbers. They will call a service such as Western Union, setting Caller ID to appear to originate from the card holder's home, and use the credit-card number to order cash transfers that they pick up.
Exposing a similar vulnerability, Caller ID is used by credit-card companies to authenticate newly issued cards. The recipients are generally asked to call from their home phones to activate their cards. Some card companies maintain, however, that they use additional means to confirm new cards. And Caller ID spoofing may not work for calls to 1-800 numbers, where the hardware can identify calls using a separate technology.
Both SpoofCard.com and SpoofTel.com say they will surrender call logs to authorities in response to subpoenas. SpoofCard.com's site says the service is "intended for entertainment purposes only."
Telephone companies can trace calls to their origin regardless of the Caller ID information they carry, but the process is laborious, especially because several companies can carry a call before it reaches its destination.