Fake Caller ID Schemes: Information on Federal Agencies' Efforts to Enforce Laws, Educate the Public, and Support Technical Initiatives
Released: 2019-12-18T00:00:00

Letter

Background

According to FCC, caller ID services became commonplace due to technology developed in the 1980s, and caller ID information transmitted with the call could generally be trusted by the call recipient. However, FCC found as voice service providers migrated to Internet Protocol (IP) networks, these technologies lessened the overall accuracy and reliability of the information presented to the call recipient. Caller ID allows the recipient of an incoming call to determine the telephone number of the caller and, in some cases, the name. This information helps the recipient make informed decisions about which calls to accept or ignore. While the number and name displayed on the caller ID may be associated with the caller, a caller can also deliberately falsify or “spoof” the information transmitted to the caller ID display to disguise the source of the call. Under the current telephone system, this information, true or false, is conveyed to the call recipient unless the caller requests that such information not be conveyed.

Caller ID spoofing is widespread. Many instances of spoofing are legal. For example, spoofing is legally used by professionals such as doctors who want to use their cell phones to return calls to patients but choose to transmit their office number instead. Spoofing also often accompanies robocalls—an automated telephone call which delivers a recorded message. Certain types of robocalls are illegal, such as robocalls for sales pitches unless companies have consumers’ express written permission to call. In addition, telemarketers may not call home or mobile numbers that consumers have registered in the National Do Not Call Registry, which was established through legislation and is maintained by FTC—and they must transmit their telephone number and, if possible, their name, to the call recipient’s caller ID.

According to FCC, advancements in technology have made it inexpensive and easy to make robocalls. As telecommunications systems have transitioned from traditional wireline services, to IP networks, the cost of making phone calls has dramatically decreased. IP-based voice services use existing internet connections to send phone calls, which may be cheaper than long distance phone charges associated with traditional phone service. Autodialers can be programmed to dial a long list of phone numbers in order to deliver millions of calls in a short period of time. These dialing systems, coupled with IP-based voice services, such as Voice over Internet Protocol (VoIP), enable telemarketers and scammers to make high volumes of calls from anywhere in the world.

IP-based voice services have also made it inexpensive and easy to spoof caller IDs. According to an industry stakeholder, historically, the router systems used to spoof calls were physical devices located on site, which could be prohibitively expensive. However, software that is available for free can now be downloaded to enable a computer to function as a router. According to stakeholders, telemarketers and scammers can, with minimal cost, configure a router to display either a single spoofed number or a constantly changing set of numbers, making it appear as though calls originated in the United States even if they did not. (See fig. 1.)

FCC, FTC, and DOJ each enforce different rules or laws related to caller ID spoofing.

FCC enforces rules prohibiting anyone from causing the transmission of misleading or inaccurate caller ID information with the intent to defraud, cause harm, or wrongfully obtain anything of value. FCC also enforces rules requiring telemarketers to transmit caller ID information.

FTC protects consumers against unfair or deceptive business acts or practices. FTC, similar to FCC, enforces rules requiring telemarketers to transmit their telephone number, and when available, the name of the telemarketer to a consumer’s caller ID service.

DOJ enforces federal fraud statutes under which fines or imprisonment can be imposed against anyone who uses interstate telecommunications as part of a fraud scheme. DOJ can also take civil enforcement actions on FTC’s behalf.

FCC and FTC each manage consumer complaint databases where consumers can file complaints about unwanted calls, robocalls, and violations of the Do Not Call Registry.

In addition to government efforts, the telecommunications industry, including voice service providers and third party companies, have taken steps to counteract illegal spoofing. For example, some of these companies have developed or deployed applications (i.e., software programs, often referred to as apps) to defend against robocalls and other unwanted calls. This includes call blocking devices for landline telephones and various mobile applications that can label and block robocalls and other unwanted calls based on call patterns, consumer complaints or other means. While some carriers provide these services free, others may charge a fee. In addition, some carriers also work with analytics providers to analyze traffic on their networks. Beginning in 2017, FCC authorized voice service providers to block certain categories of unwanted calls before they reach consumers’ phones. Recently, FCC clarified that service providers can also, as a default, block calls identified as likely unwanted based on the provider’s reasonable analysis of call data unless consumers opt out of this service.

Caller ID Spoofing Is Used in a Variety of Financial Fraud and Other Schemes, and Consumer Complaints Suggest a Substantial Increase in Its Use

Caller ID Spoofing Schemes Seek to Obtain Money or Valuable Financial and Personal Information, Generate Telemarketing Leads, or Harass

Scammers use caller ID spoofing to facilitate a variety of financial fraud and other schemes, often in combination with robocalling. Based on our analysis of FCC, FTC, and DOJ enforcement cases and alerts from federal and state government agencies, as well as interviews with stakeholders, we identified three types of caller ID spoofing schemes.

To Obtain Money or Information: Scammers have used caller ID spoofing to trick consumers into providing their financial or personal information or sending money such as via a debit or gift card. These scammers may spoof a name and phone number that looks familiar and trustworthy, such as that of a government agency, a company you do business with, or local number. Scams include telling call recipients they may be arrested or they owe money. For example, spoofed robocalls have been used as part of a wide-reaching scam in which callers spoofed IRS phone numbers and impersonated IRS staff to trick people into sending the scammers money for supposed unpaid taxes. IRS reported that from October 2013 through March 2019, the agency was contacted more than 2.4 million times by taxpayers who reported such calls, and more than 15,453 taxpayers reported losing about $75.1 million. (See fig. 2.)

To Generate Telemarketing Leads: Unscrupulous telemarketers have used spoofing as part of an attempt to sell goods or services. In this scheme, consumers may receive a pre-recorded robocall with a sales pitch and be instructed to “press 1” to indicate interest, at which point the call recipient is transferred to a live operator. In one such scheme, more than 96-million spoofed robocalls were made over a 3- month period. These calls included pre-recorded messages falsely claiming to be from Hilton and other well-known travel companies; once consumers were transferred, live operators attempted to sell vacations not affiliated with the brands presented during the prerecorded message.

To Harass: People have used spoofing to harass others. In some of these cases, people have used spoofing to cause another person’s caller ID to display a familiar or trusted phone number. In one case, an individual apparently placed 31 spoofed calls as part of a personal campaign to harass and stalk another person. These spoofed numbers appeared to be from the victim’s child’s school, among others. Spoofing is also one of several techniques used to place false calls to emergency response centers to elicit a police response to an address where no emergency exists. Callers have used spoofing to make it appear as if their call originated at or near the reported address. This practice, known as swatting, has resulted in death. For example, in one swatting case, a man was shot and killed by police who believed he was holding others at the address hostage.

Available Data Suggest That Caller ID Spoofing Is a Growing Issue

FCC and FTC consumer complaint data both show dramatic increases in recent years in the number of unwanted call complaints that specifically mention the term spoofing. According to our analysis of FCC and FTC complaint data, from 2015 through 2018, complaints to FCC that specifically referred to spoofing more than doubled and those received by FTC increased by more than four times. (See fig. 3).

Several industry stakeholders we spoke with noted a growing trend in one particular type of spoofing, neighbor spoofing. Neighbor spoofing occurs when the caller ID is manipulated to display a phone number matching the area code and prefix (the first six digits) of the consumer’s phone number. Consumers may be more inclined to answer these calls because they appear to be local—perhaps from someone they know. Among FCC’s complaints that included both the caller’s and the call recipient’s phone numbers, the percentage that were indicative of 6-digit neighbor spoofing increased from 10 percent in 2015 to 15 percent in 2018; for similar FTC complaints, the percentage increased from 2 percent in 2015 to 16 percent in 2018; and a call blocking provider told us that its percentage of neighbor-spoofed robocalls increased from 2 percent in January 2016 to 23 percent in December 2018.

One analytics provider told us there has been a shift recently from spoofing the first six digits to spoofing the first four and five, which the provider believed to be a reflection of scammers adjusting their methods as more people become aware of the original six-digit form of neighbor spoofing. From 2015 to 2018, FCC and FTC data show substantial increases in complaints indicative of four and five digit neighbor spoofing, with FCC complaints nearly doubling and FTC complaints increasing more than 10 times during this time period.

FCC and prior GAO work have described several limitations with using complaint data as a means of measuring the extent of unwanted calls. For example, complaints might increase following consumer outreach regarding how to file a complaint or after news media coverage of a particular scam. In addition, not all consumers who experience problems file complaints, and not all complaints are necessarily legitimate or categorized appropriately. Further, a consumer could submit a complaint more than once, or to more than one agency, potentially resulting in duplicate submissions. Finally, while some consumers may use the term “spoof” when describing the complaint, others may not, either because they do not know they have been spoofed or are not familiar with the term. According to our analysis of FCC data, in 2018, 66 percent of all complaints that were indicative of neighbor spoofing did not include the term “spoof” in the complaint description. Nonetheless, FCC, FTC, and DOJ officials told us they use this complaint data to identify specific trends in types of scams that may help the agencies’ enforcement and public education efforts, which we discuss later in this report.

Although we could not find industry data that estimated the total number of spoofed calls, available industry data suggest that the volume of unwanted calls and robocalls (of which illegally spoofed calls are a subset) has increased over the past several years. Using call patterns on their own networks or other means, voice service providers, call blocking applications and analytics providers track data on unwanted calls and robocalls. According to one company, these companies may have limited ability to detect or isolate spoofed calls, in part, because scammers may frequently change the numbers they use. In addition, stakeholders told us, because each of these companies analyzes their specific user base and may use different methods to identify and label robocalls and other unwanted calls, the number of unwanted calls each company estimated may be substantially different. For example, while one analytics company estimated 26.3 billion robocalls nationwide in 2018, another company estimated the number at nearly 48 billion. Similarly, one company estimated a 46 percent increase in robocalls from 2017 to 2018, while another estimated a 57 percent increase for the same time period. Despite these differences, all analytics and call blocking companies we interviewed reported that their estimates of the number of unwanted calls and robocalls have increased in recent years.

Because there is no comprehensive data source on unwanted calls, robocalls, or spoofed calls, it is not possible to reliably estimate national trends. FCC has taken steps to seek input from industry and other stakeholders on how to better measure the extent of the unwanted call and spoofing problem. In a November 2017 Further Notice of Proposed Rulemaking, FCC sought comment on, among other things, what information should be collected to evaluate the effectiveness of efforts to combat these calls and whether FCC should adopt a reporting obligation for providers. FCC received numerous comments from voice service providers, their associations, and other stakeholders in response to this notice. One commenter expressed concern that a reporting obligation would be burdensome to providers or of little benefit to FCC, and other commenters stated the agency should instead continue to monitor trends in consumer complaints. More recently, in a June 2019 Declaratory Ruling, FCC adopted a recommendation from 2017 to prepare two reports—one in 2020 and a second in 2021—to measure the effectiveness of efforts to combat illegal robocalls. The ruling explicitly delegates authority to FCC staff to collect any and all relevant information and data from voice service providers necessary to complete these reports and states that the report should include authoritative data about the number of illegal robocalls.

Agencies Consider Risk of Harm to Public and Generally Follow Key Collaboration Practices in Their Enforcement Efforts, but Face Significant Challenges Agencies Reported Taking Risk-Based Approach to Prioritizing Spoofing- Related Investigations and Enforcement Actions, but Collecting Evidence Can Be Difficult

FCC, FTC, and DOJ officials all said that their agencies must prioritize which illegal spoofing activity to investigate and take enforcement action against because they do not have sufficient resources to pursue all such activities. FCC and FTC officials stated that while they review complaint data and other information, it would not be practical to open investigations related to every complaint. According to officials at all three agencies, given their limited resources, the agencies prioritize investigations based on the level of harm being perpetrated and the likelihood of being able to effectively bring an enforcement case. Such prioritization is consistent with standards for internal control in the federal government. Those standards call for agencies to estimate the significance of risks to achieving agency objectives—in this case objectives related to protecting the public from harm—and to use those estimates as a basis for responding to the risks. More specifically: In a 2015 letter to several members of Congress, the Chairman of the FCC stated that the agency is more likely to pursue enforcement action when a problem appears to be pervasive, represents a trend, involves an agency priority, affects many consumers, reflects particularly egregious abuse, or presents a security or safety concern. Focusing specifically on investigations and enforcement action related to caller ID spoofing, FCC officials told us that the agency’s three highest priorities are events that (1) threaten public safety; (2) involve very large numbers of spoofed calls; or (3) involve malicious scams or threats.

FTC’s strategic plan for fiscal years 2018 to 2022 calls for the agency to target its enforcement efforts on those areas that cause the greatest amount of consumer harm. In line with this objective, FTC officials told us that the agency decides which consumer complaints to investigate based on the level of harm being perpetrated, as well as the likelihood of being able to effectively bring an enforcement case.

DOJ’s Justice Manual states that serious violations of federal law must be prosecuted. DOJ officials told us that for fraud schemes that employ caller ID spoofing, the agency is more likely to charge a violation of one of the fraud statutes, such as mail fraud, wire fraud, computer fraud, or conspiracy, as well as the money laundering and identity theft statutes. Specifically with regard to wire and mail fraud cases, the Justice Manual states that serious consideration should be given to the prosecution of any scheme which in its nature is directed to defrauding a class of persons or the general public with a substantial pattern of conduct.

FCC and FTC officials stated that there are significant challenges related to investigating spoofing cases that can affect which investigations they choose to pursue and limit the number of enforcement cases they are able to bring. For example, FTC officials stated that the use of VoIP technology enables fraudsters to easily change both their physical locations and the numbers they spoof, making it harder for FTC and other law enforcement agencies to track them down. An industry stakeholder said that the use of VoIP technology makes it difficult to determine even whether the call originated domestically or from overseas. Moreover, FCC officials stated that when spoofed calls originate wholly from a foreign jurisdiction, a lack of foreign cooperation can make it exceptionally difficult to follow a trail back to either the service provider that originated the call or the person or company making the calls. The officials explained that foreign cooperation may be lacking when the calls come from countries with which the United States does not have strong diplomatic relationships. The officials stated that because of this challenge, they are less likely to bring an enforcement case when calls originate wholly from a foreign jurisdiction, due to the low likelihood of successfully resolving such cases and the heightened use of limited staff resources required by such cases.

Regardless of these challenges, FCC and FTC officials stated that their agencies have taken steps to improve their ability to investigate cases based overseas. For example, both agencies cited their outreach to the Indian government and the U.S.-India Business Council as well as their participation in the Unsolicited Communications Enforcement Network, a global network of law enforcement authorities and regulatory agencies that works to combat unsolicited communications.

FCC, FTC, and DOJ Identified 62 Spoofing or Caller-ID-Blocking-Related Enforcement Cases Brought since 2006

FCC, FTC, and DOJ officials identified 62 enforcement cases that they said involved spoofing or blocking of caller ID information, though DOJ officials stated that their list of enforcement cases was not comprehensive because DOJ’s enforcement database does not include an indicator for whether spoofing was employed as part of a fraud scheme. (For a description of these 62 cases, see app. II.) As noted below, these 62 cases are not representative of all of the cases the agencies have brought related to illegal robocalling.

FCC officials provided us information on six cases—each of which the officials said involved spoofing or a caller’s blocking of their caller ID information—that the agency brought from April 2011 to September 2018. For example, one case involved a company that used spoofed robocalls to target elderly and low-income individuals to generate sales of health insurance coverage. The company’s high numbers of robocalls also disrupted an emergency medical paging service. FCC issued fines in five of these cases, and one pending case includes a proposed fine. FCC officials told us that since January 2004, the agency has initiated approximately 20 additional enforcement cases and has issued approximately 1,000 warnings, all for robocalling or Do-Not-Call violations under the Telephone Consumer Protection Act of 1991.

FTC officials provided us information on 31 cases—each of which the officials said involved spoofing—that FTC brought—or that DOJ brought on FTC’s behalf—from April 2006 to June 2019. Examples of cases include several involving numerous calls to numbers on the National Do Not Call Registry and an incident in which a company impersonated government officials and help centers to make a sales pitch with false and misleading claims about an English-language learning course to Spanish-speaking U.S. consumers. Monetary judgments were issued in all but one of these cases. FTC officials told us that as of November 2019 the agency had brought 147 enforcement cases against Do Not Call and robocall violators. FTC officials also stated that FTC obtains injunctive relief in their Do Not Call, robocall, and spoofing cases, including court orders prohibiting the defendants from engaging in similar conduct, and in some cases, banning defendants from any telemarketing activity. Further, they stated the injunctive relief also includes reporting and compliance requirements to help FTC monitor defendants. FTC officials told us that the agency has obtained injunctive relief in all of its completed spoofing cases and that these injunctions provide strong deterrence and help stop illegal spoofing.

DOJ officials provided us information on 25 cases—each of which the officials said involved spoofing—that the agency brought from May 2010 to August 2018. Several of these cases involved companies or individuals that used spoofing as part of a scheme to swindle money from people. For example, in one case, defendants used spoofing as part of a scheme to defraud and extort money from victims who were falsely told they had failed to accept and pay for products they had never ordered. Twenty cases had judgments that included prison time; 18 cases had monetary judgements.

FCC and FTC have collected far less than has been assessed in fines or monetary judgements, but officials at both agencies stated that the amounts they have collected still serve both punitive and deterrent purposes. Specifically, FCC officials stated that thus far, FCC has collected $25,970 of the approximately $205 million in fines it assessed. This mostly represents full payment of a $25,000 fine FCC issued in January 2017, but FCC has yet to collect any portion of the more recent fines it has issued: a fine of $120 million it issued in May 2018 and a fine of approximately $82 million it issued in September 2018. FCC has referred both of these cases to DOJ for collection action. FCC officials noted that these large fines may not represent the amount that the defendants are able to pay, and that even payment of a fairly small fraction of a large fine could be enough to put a scammer out of business and serve as a substantial deterrent.

FTC officials said that FTC has obtained a total of about $363 million in monetary judgments in its 31 spoofing cases. The officials said that many of these judgements were partially suspended based on the defendants’ ability to pay determined by a defendant’s net worth and assets. Further, the officials said if the defendant misrepresents his or her financial position, the entire judgment can become due under a clause that is part of the judgement. The officials said that as of August 14, 2019, FTC had collected about $31 million in its spoofing cases, and that this amount represents all or substantially all of the unsuspended judgments in those cases.

Officials with DOJ’s Consumer Protection Branch said that the branch views monetary judgments as one piece of the deterrence equation for caller-ID-spoofing offenses. The officials stated that the low amounts collected suggest that other preventative measures, such as injunctive relief and imprisonment, must be employed to deter continued unlawful activity.

FCC, FTC, and Others Have Proposed Various Legal Changes to Strengthen Enforcement against Illegal Spoofing and Robocalling

FCC and FTC both favor some changes to law to enhance the effectiveness of their enforcement efforts. Specifically: In May 2019, FTC officials testified that the agency’s enforcement efforts are hindered by a statutory provision that prohibits the agency from taking action against telecommunications carriers, to the extent they are engaged in common carriage activities. FTC further testified that it would like this provision removed so that the agency could take enforcement action against carriers engaged in illegal telemarketing activities.

In 2018, an FCC official publicly stated that a longer statute of limitations for enforcement of the Telephone Consumer Protection Act of 1991 would improve the agency’s enforcement efforts against knowing and willful violators of the act. Currently, that act has a 1-year statute of limitations, while the Truth in Caller ID Act of 2009 has a 2-year statute of limitations. FCC officials told us that harmonizing the two acts’ statutes of limitations to 2 years would help FCC’s enforcement efforts since spoofing often occurs with robocalling and the agency often uses the two statutes in tandem.

A February 2019 FCC staff report on robocalls notes that FCC’s enforcement efforts can be hindered by the requirement that in many instances FCC must warn a party of apparent robocalling violations and can only proceed with a monetary penalty if the party subsequently commits the same type of violation, a requirement in the Communications Act that applies to the Telephone Consumer Protection Act of 1991. According to the report, this requirement enables a warned offender to incorporate under a new name to evade further detection and begin illegal activity anew. In contrast, the report notes, the Truth in Caller ID Act of 2009 allows FCC to directly issue a proposed monetary penalty without first issuing a warning. Similar to the statutes of limitations just discussed, FCC officials told us that since spoofing often occurs with robocalling and the agency often uses the two statutes in tandem, their enforcement efforts would benefit from the elimination of this statutory requirement.

In 2019, bills were introduced in Congress that, if passed, would implement the changes in law that FCC and FTC have recommended and could potentially help address other challenges faced by FCC and FTC. For example, in July 2019, a bill was introduced in the Senate that would remove the provision prohibiting FTC from taking action against common carriers. Also in 2019, two different bills were introduced, one in the House and one in the Senate, that would, among other things, address issues with harmonization of the FCC statute of limitations and eliminate the FCC pre-penalty warning requirement with respect to illegal robocalling. In addition, one of these bills, the Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (TRACED Act), would require DOJ, in consultation with FCC, to assemble an interagency working group to study and report to Congress on how to enhance enforcement against robocalls by examining issues like the types of laws, policies, or constraints that could be inhibiting enforcement of the Truth in Caller ID Act of 2009. The interagency working group would also be tasked with identifying existing and potential international policies and programs that could encourage and improve coordination between countries. We have reported in past work that collaborative mechanisms such as interagency working groups can help the federal government achieve many of the meaningful results it seeks to achieve, and that such mechanisms all benefit from certain key features, which raise issues to consider when implementing these mechanisms. As of November 2019, no federal legislation had been enacted on these issues.

Agencies’ Efforts to Collaborate on Enforcement Efforts Generally Align with Key Practices

We found that FCC’s and FTC’s efforts to collaborate on spoofing investigations and enforcement actions align with seven key practices we have previously identified to enhance and sustain interagency collaboration. FCC and FTC officials explained that their close collaboration helps ensure that they share relevant information and avoid duplicating efforts. In addition, we found that DOJ’s collaboration with FCC and FTC aligns with five of the seven key practices. Although we did not find evidence that DOJ had taken steps in line with the other two key practices, officials at all three agencies stated that DOJ’s collaborative efforts were appropriate given its broader jurisdiction and wider focus.

More specifically, we found that all three agencies have incorporated five key practices. Our prior work has found that one way agencies can incorporate three of these practices — (1) defining and articulating a common outcome, (2) establishing mutually reinforcing or joint strategies, and (3) agreeing on roles and responsibilities—is through a memorandum of understanding. In 2003, FCC and FTC agreed to a memorandum of understanding that calls for the agencies to cooperate and coordinate to implement consistent, comprehensive, efficient, and non-redundant enforcement of federal telemarketing statutes and rules. The memorandum also calls for the agencies to meet quarterly to discuss matters of mutual interest, share consumer complaints, and engage in joint enforcement actions when necessary. Consistent with the memorandum, FTC officials told us that FTC and FCC hold quarterly meetings to discuss how they are targeting robocalls and spoofing investigations and enforcement cases to avoid duplication. FTC and FCC officials stated that in addition, their collaboration with DOJ is enhanced through the participation of all three agencies in a monthly conference call hosted by the National Association of Attorneys General to coordinate efforts to combat illegal robocalls across the government.

Although DOJ officials told us that DOJ does not have a memorandum of understanding with FCC or FTC regarding spoofing or robocall-related enforcement, officials we interviewed at all three agencies identified collaborative efforts that DOJ engages in that are consistent with the three key practices cited above. FCC and DOJ officials stated they are developing procedures to share information on a particular enforcement case, and that these procedures could be used on other cases as needed in the future. In addition, officials from all three agencies stated that DOJ’s participation in the monthly conference calls and additional informal outreach as needed was sufficient to ensure effective collaboration.

With regard to the fourth and fifth key practices (4) identifying and addressing needs by leveraging resources, and (5) establishing compatible policies, procedures, and other means to operate across agency boundaries, FCC and FTC officials described regularly sharing information from their complaint databases, which is in line with these practices. FTC officials stated they regularly review FCC’s complaint information to help their enforcement efforts. Moreover, FTC has established policies and procedures whereby DOJ and FCC and other law enforcement entities have access to FTC’s complaint database, and FCC and DOJ officials stated that they frequently analyze FTC’s complaint database to inform their investigative decisions. Furthermore, DOJ officials stated that DOJ recently contributed funds to FTC to enhance capabilities to analyze the database. FCC and FTC have also leveraged resources by co-hosting a public event in 2018 on reducing robocalls and spoofing that included discussions of recent policy changes and enforcement actions to stop illegal robocalls.

We found that FCC and FTC follow two additional key practices for collaborating on spoofing-related investigations and enforcement actions that DOJ does not: (1) developing mechanisms to monitor, evaluate, and report the results of collaborative efforts, and (2) reinforcing agency accountability for collaborative efforts through agency plans and reports. For example, FCC and FTC collaborated on a robocall report published by FCC in 2019 that discussed both agencies’ enforcement actions related to robocalls and spoofing, and each discussed their collaborative efforts related to robocalls in key agency documents related to accountability and performance. DOJ officials stated that they would be unlikely to have such materials specifically related to spoofing given the agency’s focus on fraud itself rather than spoofing or robocalling, which it views as a means to fraud. DOJ officials stated that DOJ’s general commitment to interagency collaboration is emphasized in its fiscal year 2020 budget submission to Congress and many press releases related to its enforcement cases. We reviewed DOJ’s budget submission and several DOJ press releases and found that they mention collaboration between DOJ and other agencies.

FCC and FTC Have Robust Consumer Education Efforts That Follow Key Practices for Consumer Education and Interagency Collaboration

FCC and FTC use a number of methods to educate consumers on ways to protect themselves against spoofed and other unwanted calls. According to FCC documentation, the agency has made combatting illegal robocalls and caller ID spoofing its top consumer protection priority and uses consumer education as a means to address this priority. Similarly, according to FTC’s chairman, consumer education is a critical element of FTC’s efforts to fulfill its consumer protection mission. The methods that FCC and FTC use—both independently and collaboratively—to educate consumers on ways to combat caller ID spoofing and unwanted calls include the following.

Posting online consumer alerts, videos, blog posts, and other informative materials: Both FTC and FCC post information and warnings about caller ID spoofing scams on their websites. FTC, for example, developed Pass It On, a print- and web-based campaign to educate seniors about various types of scams that target seniors, including spoofing. FCC launched an animated video initiative on how to avoid spoofing scams and also posted a consumer alert about neighbor spoofing scams. The alert explains that scammers use such spoofing to increase the likelihood that consumers pick up the phone and provides tips such as to not answer calls from unknown numbers and to not provide any personal information to such callers. Additionally, FCC and FTC post other information, including tip cards and graphics such as those illustrated in figure 4.

Visiting vulnerable communities: FCC has conducted speaking tours, such as tours through rural Appalachia and the Pacific Northwest in 2018 to educate communities about spoofing, and to build partnerships to help improve the effectiveness of future outreach efforts. Similarly, FTC has hosted briefings in underserved communities with law enforcement, consumers, and community advocates to place more attention on consumer protection issues such as spoofing and other types of fraud.

We found that FCC’s and FTC’s consumer education efforts related to spoofing and other unwanted calls aligned with nine key practices for consumer education that we identified in our prior work (see table 1). For example, FCC and FTC have developed consistent and clear consumer education messages related to spoofing and unwanted calls: specifically, consumers: should not answer unknown calls; should not push any numbers if directed to do so; and should hang up immediately once it is clear that the caller is unknown.

In addition, FCC and FTC officials have worked with credible messengers to help disseminate consumer education messages, including to potentially vulnerable populations. For example, since 2017, FCC has worked with the National Asian American Coalition to train grassroots volunteers to engage local community members and distribute educational tip cards printed by FCC in languages such as Mandarin Chinese, Korean, Vietnamese, and Tagalog. In addition, FTC has collaborated with AARP to develop three videos for Asian American and Pacific Islander communities on robocall, IRS, and Medicare scams.

In addition, we found that, similar to their enforcement efforts, FTC and FCC’s efforts to collaborate on public education in this area are consistent with the seven key collaboration practices we discussed earlier in this report. For example, FCC and FTC agreed to a second memorandum of understanding in 2015 that states that the agencies will collaborate with each other on consumer and industry outreach and education efforts, as appropriate. FCC and FTC also collaborate with other entities, including federal, local, and private entities, to educate consumers on ways to combat spoofing. For example, FCC officials told us that beginning in October 2018, they collaborated with Department of Veterans Affairs officials to send out three joint emails (from November 2018 through March 2019) to veterans and veterans’ organizations on ways to protect themselves against illegal robocalls, including spoofed calls. These officials also noted that each email reached approximately 5.5 million targeted recipients.

Industry-Led Technical Effort to Reduce Spoofing Is Moving Forward, with FCC’s Support in Line with Federal Guidance Some Providers Are Deploying a Caller ID Verification System with a December 2019 Implementation Target

According to officials with industry groups, voice service providers, and FCC, the voice service provider industry has taken key steps towards successfully putting in place a caller ID verification system throughout much of the IP-based U.S. telephone network by the end of 2019. As discussed previously, the system is commonly referred to as STIR/SHAKEN or SHAKEN/STIR. According to the Alliance for Telecommunications Industry Solutions (ATIS), which spearheaded this industry-led effort along with the Session Initiation Protocol (SIP) Forum, the system is intended to enable voice service providers to verify that a caller has a right to use the caller ID transmitted with the call. Under the system, the voice service provider that first initiates the call onto the network (originating service provider) generates a digital signature that attaches to the phone call indicating that the caller has this right. This occurs only when the originating provider knows this information and is considered the highest level of verification, referred to by the industry as “attestation.” The signature is transmitted along with the call as it is routed from one service provider to another. The terminating service provider, which passes the call onto the call recipient, can verify that the signature was not tampered with before sending the call to the call recipient (see fig. 5).

According to an FCC Notice of Proposed Rulemaking, as of June 2019, several major providers had deployed or were in the process of deploying the system on their own networks, and a few had started exchanging signed calls with a second provider. In addition, ATIS has announced a number of key steps taken to fully implement the system’s framework. For example, in September 2018, ATIS launched the system’s governance authority, whose board consists of representatives from a variety of U.S. voice service providers and relevant industry associations, and which, according to ATIS, is overseeing the system to ensure that it is effective and secure. In August 2019, ATIS issued a press release stating that the governance authority board had determined the requirements service providers must meet in order to get certificates to digitally sign calls and had contracted a private firm tasked with ensuring that only authorized service providers get these certificates. According to an industry official who worked on this effort, once most U.S. carriers deploy the system and are sharing information across their networks, the technical experts who developed the standards will be able to see how it works and improve and enhance the system through additional technical developments.

Because it is not always possible for the originating service provider to determine whether the caller has a right to use the phone number that will be displayed, in addition to the top level of verification, the system was designed with a middle level and a lowest level of verification. The originating service provider digitally signs the call with the middle level of attestation when the provider has an established relationship with the caller but does not know whether the caller has the right to use the phone number it will display. According to ATIS officials, the originating service provider may use this level of attestation, for example, when a call comes from a corporate call center, which displays all outbound calls as originating from a central number or set of numbers. The originating service provider signs the call with the lowest level of attestation when it is responsible for originating the call onto its network but it does not have a relationship with the caller (such as when the call comes in from another country). When using either the middle or lowest level of attestation, the provider cannot determine if the call is spoofed. However, according to ATIS officials, the information that provided the basis for the attestation level is still likely to be helpful. For example, this information may better position the terminating service provider or call blocking and analytics apps to determine, in combination with other data the terminating service provider or such apps may have analyzed, whether to block or warn the consumer about the call.

According to officials from several carrier associations or voice service providers, the new system should substantially improve the industry’s ability to combat spoofing and block unwanted calls by providing carriers with immediate verification information. These stakeholders, as well as FCC officials, also stated that enabling voice service providers to instantly identify the provider that initiated the call onto the network—through the digital signature attached to the call— could help facilitate federal investigations by accomplishing in an instant what can now take significant time and effort as the call must be traced back from provider to provider. One stakeholder who played a key role in the development of the system stated that as some U.S. service providers deploy this system and more calls are able to be verified, it is likely to incentivize other U.S. providers to deploy verification systems so that their calls will not stand out as unverified. This stakeholder said that the hope is that other countries, including those with many legitimate call centers that send calls to the United States, such as India, will also implement verification systems that eventually can be integrated with the U.S. system. And as more calls are able to be verified, the stakeholder explained that the system will become more valuable and useful.

An ATIS representative and other stakeholders identified other examples of ongoing technical challenges and open issues: Information provided to consumers: The industry has not reached agreement about what, if any, information should be presented to call recipients to inform them that the call has or has not been verified. Stakeholders we spoke with noted that it is important to educate consumers on the limitations of any such information. For example, although a call may be verified, the provider cannot guarantee that the caller is not trying to defraud the call recipient—just that the caller is not using a spoofed phone number to do so. Further, if a provider is unable to verify the caller ID information, it does not necessarily mean the call is fraudulent or the caller has malicious intent. For these reasons, several industry stakeholders we spoke with emphasized that the information provided by this system can be most useful when combined with other methods service providers use to analyze call traffic to identify unwanted or illegal calls.

IP-only system: Several stakeholders also emphasized that the system only works for calls carried entirely over IP networks, not those using traditional wireline networks. One industry group representing smaller providers that may use traditional wireline networks expressed concerns that its members may need more time to deploy the caller ID verification system because of the resources needed to transition to an IP network. This issue was discussed by industry stakeholders at FCC’s July 2019 summit on the caller ID verification system. One industry stakeholder stated that when calls that begin on a traditional wireline network are uploaded to an IP network, the originating service provider on that IP network will sign the call with the lowest level of verification, and that that information, in combination with analytics, will help providers to know whether these calls can be trusted.

Verification of certain calls: As of June 2019, ATIS and industry stakeholders were also working to determine how to ensure that calls from 911 operators or video relay service calls for deaf and hard of hearing users are not blocked if providers are unable to verify the caller is authorized to use the phone number.

FCC Has Actively Encouraged Deployment of the Caller ID Verification System and Been Engaged with Its Development

Since 2013, FCC has taken several steps to encourage the industry’s caller ID verification initiative. In doing so, FCC’s efforts have aligned with federal guidance for agency participation in private-sector standards activities to help address national priorities. That guidance states that federal engagement in standards activities should aim to produce timely, effective standards that address legitimate regulatory, procurement, and policy objectives. The guidance also states that the federal government should assume an active role where necessary to ensure a rapid, coherent response to national challenges. Key steps FCC took to initiate and accelerate industry efforts—in line with the OMB guidance to produce timely and effective standards— are summarized below.

In March 2013, FCC’s Chief Technology Officer presented a vision of developing a caller ID verification system to combat spoofing at an Internet Engineering Task Force meeting, later referred to as a “call to action” by a technology stakeholder who played a key role in developing this system.

In July 2016, FCC’s Chairman issued a call to action for providers to accelerate their efforts to develop this system. FCC also called for responses detailing provider efforts.

In December 2017, FCC directed one of its advisory bodies to, among other things, define criteria for selecting the system’s governance authority and recommend milestones for system deployment. Consistent with the guidance that federal engagement should aim to produce timely, effective standards, FCC’s Chairman urged service providers and standards groups to accelerate the development and deployment of these technical standards.

In November 2018, the FCC Chairman sent letters to 14 U.S. providers and publicly demanded that that they adopt the caller ID verification system by the end of 2019. While the demand did not legally require providers to deploy the system, the Chairman stated that if industry’s progress lagged in 2019, FCC would take action to ensure widespread deployment. This demand and warning represent preliminary steps consistent with the guidance’s call for the federal government to assume an active role where necessary to ensure a rapid, coherent response to national challenges.

In June 2019, FCC issued a notice of proposed rulemaking that would require all providers to implement the technical system if major providers fail to do so by the end of 2019. The notice also requested comments on how FCC should determine whether it is necessary to mandate implementation of the technical system and how to evaluate whether major voice service providers have met the FCC’s end of 2019 deadline for implementation.

According to FCC officials and consistent with the federal guidance, FCC has engaged with ATIS, providers, and relevant technical stakeholders throughout their caller ID verification efforts. For example, FCC officials attended key meetings, and an FCC official submitted technical suggestions on standards development related to the caller ID verification system. ATIS representatives told us that FCC’s engagement in these technical efforts was helpful, as FCC was able to ask questions and prompt those working on the standards to consider some of the broader issues that various stakeholders would be concerned about and needed to be addressed.

Furthermore, FCC is considering how, if at all, its role should evolve in the future. Notably, FCC’s June 2019 notice also requested comments on what role FCC should have in the governance of the caller ID verification system, how to encourage carriers that maintain some portion of their network on legacy technology to implement elements of the system, and how FCC and industry can best leverage this system to combat illegal calls originating outside of the United States. FCC also directed staff to develop two reports over the next 2 years that, among other things, provide information on the state of deployment of this caller ID verification system. FCC officials stated that their efforts related to these issues encompass more than what is in the proposed regulations, as FCC will continue to monitor the work of the governance authority, the progress of service providers’ implementation of the system, and industry’s efforts to improve the effectiveness of the system and address remaining technical issues. Moreover, at FCC’s July 2019 summit on the caller ID verification system, FCC’s Chairman stated that FCC is prepared to issue rules in 2020 mandating that major providers implement the caller ID verification system if these major providers do not meet the 2019 deadline.

Agency Comments

We provided a draft of this report to FCC, FTC, and DOJ for review and comment. Each agency provided technical and editorial comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Chairman of the FCC, the Chairman of the FTC, the Attorney General, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff any have questions about this report, please contact me at (202) 512-2834 or VonahA@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: List of Stakeholders GAO Interviewed

Appendix II: Summary of Federal Agencies’ Enforcement Actions Involving Telephone Calls that Allegedly Used Spoofed Caller ID

Appendix II: Summary of Federal Agencies’ Enforcement Actions Involving Telephone Calls that Allegedly Used Spoofed Caller ID alleged conduct. We selectively mention spoofing in this column to provide additional context for some of these cases.

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact:

Andrew Von Ah, (202) 512-2834 or VonahA@gao.gov.

Staff Acknowledgments:

In addition to the individual named above, other key contributors to this report were Alwynne Wilbur, Assistant Director; David Goldstein, Analyst- in-Charge; Mark Canter; Joshua Cicala; Jennifer Clayborne; Kristen Farole; Jeffery Haywood; Gina Hoover; Delwen Jones; Jenna Lada; Hannah Laufe; Harold Podell; Cheryl Peterson; and Malika Rice.