On 25 June 2019, the US Federal Trade Commission (FTC) announced a major crackdown on illegal robocalls, dubbed Operation Call it Quits.
The Commission’s efforts include 94 actions targeting operations nationwide that have made more than 1 billion calls to scam consumers. The plan includes new information to educate consumers, and the FTC is working with the Federal Communications Commission (FCC) and service providers to develop technology-based solutions to combat the growing problem of robocalling and caller ID spoofing.
But consumers aren’t the only ones suffering from the endless stream of telephony “spam.” Robocallers and scammers have businesses in their sights too, and the FTC is also taking steps to protect commercial organisations. In May 2019, the FTC was successful in suing 11 defendants operating under the company name, Pointbreak Media for falsely claiming to represent Google. The defendants were charged for telling business owners that Google would list them as “permanently closed” unless they paid a fee, as well as for falsely promising keywords for prominent placement in search results, and for using remotely created checks to debit business’ accounts.
Spoofing businesses
These calls go beyond being annoying and trying to milk small businesses out of money. In verticals such as healthcare or finance, these scammers have more malicious objectives, seeking to gain access to highly confidential information.
During an April 2019 US House of Representatives Energy & Commerce subcommittee meeting, entitled “Legislating to Stop the Onslaught of Annoying Robocalls,” Dave Summit, a Fellow for the Institute for Critical Infrastructure Technology and the chief information security officer for H. Lee Moffitt Cancer Center and Research Institute gave testimony providing real examples of the threats businesses face from these callers.
Robocallers are spoofing medical organisation names and numbers, using a cyber-attack practice termed “social engineering,” using familiar numbers and human interaction to trick people into deviating from standard security practices. Employees receive calls with their own medical centre’s number that they believe to be legitimate, and may treat the call as such, until (and unless) they catch-on that the call is a phishing attempt.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataMr Summit cited more than 6,600 inbound spam calls in a 90-day period that presented an internal Moffitt number. In addition to putting employees at risk of disclosing sensitive information, these calls prevent employees from dealing with legitimate issues. He identified “spear phishing” as another common occurrence, in which criminals spoof numbers from a presumably reputable source, such as the US Department of Justice (DoJ), and try to reach physicians to get information that can be used to illegally procure prescription drugs. Over a 30-day period, 300 calls into Moffitt originated from the Washington DC area: more than half were phishing scams to obtain confidential information.
In 1991, the Telephone Consumer Protection Act (TCPA) was signed into law by President George HW Bush to restrict telemarketing calls and the use of automatic telephone dialling systems and artificial, or prerecorded, voice messages, but one thing most Americans can actually agree on today is that the TCPA has had minimal effect in reducing robocalls, and that, in fact, the frequency of these calls is increasing. More recently, the US Congress, the FTC, and the FCC are accelerating efforts to reign-in this activity.
Traced Act
In addition to a number of bills under consideration in the House of Representatives, the US Senate in May 2019 passed the Traced (Telephone Robocall Abuse Criminal Enforcement and Deterrence) Act, which includes a fine of at least US$10,000 per call for illegal calls and requires service providers to implement Stir/Shaken (Secure Telephony Identity Revisited/Secure Handling of Asserted information using toKENs), a call authentication framework to block caller ID spoofing. Ensuring that fake calls are blocked but legitimate calls are completed will be a complex, sensitive issue, particularly for businesses legitimately contacting customers.
Fines and judgements sound good on paper, but the challenge is enforcement. There are tens of thousands of individuals and companies, that which have found that telemarketing for legitimate companies or illegally obtaining money and information from consumers and businesses is highly lucrative. As with the TCPA, some companies may find loopholes in the language of Traced as well as other government regulations and take their cases to court where they may succeed. Some of these companies are overseas, making it difficult to prosecute, or they are small pop-up-type shops with no assets that just shut down and reopen under another name. There is no foolproof way to fix this problem. Regulatory actions plus changes in service provider networks may help, but businesses will be mostly on their own to protect employees and sensitive information from nefarious callers.
