7

To be specific the main problem is that I want to detect if the caller ID of the incoming cal I get is real or spoofed? Most VoIP servers now allow their clients to use any caller ID they want. Also, before the caller hears the ring no authentication is made by the operator (for example, Vodafone or O2) to check if the caller ID is valid or spoofed.

I found something an Android app called CallerDec that has ability to check if the caller ID is valid only if the caller (not attacker) has also installed CallerDec by a verification call.

But it is not enough and it won't work if the real caller hasn't installed that app. Many banks now allow full access to someone's account by just verifying the caller ID of the caller and the debit or credit card number associated with that caller ID. I am sure they must be aware of caller ID spoofing and have some special process for identifying spoofing.

There is a proprietary service TrustID available for business users that guarantee to detect if a caller ID is spoofed or real but as it is closed source we can't know how it works.

Improve this question
7
  • 3
    There are not much countermeasures against caller ID spoofing. Best countermeasure is not to rely on it and consider it an "untrusted data".
    – user1164108
    Commented Feb 8, 2015 at 18:08
  • Can you mention some of the countermeasures?
    – Ashish
    Commented Feb 8, 2015 at 18:14
  • Are you sure than banks verify caller ID and not simply the phone number itself?
    – schroeder ♦
    Commented Feb 8, 2015 at 22:13
  • @schroeder I didnt say all banks verify that. Some banks verify AccountNumber+call in PIN, some verify CardNumbe+ATM PIN+ExpiryDate. But there are some banks (eg. BOA) that only verifies caller ID of the user & card number. If the card no.entered by caller on the IVR is associated with the phone no. of the caller (means the caller ID) then the caller is given access to that account. But they must be using some technique/system to verify spoofed call cuz no bank would ever setup this kind of verification..
    – Ashish
    Commented Feb 9, 2015 at 0:38
  • 1
    CallerID and phone number are completely different things. Spoofing a phone number is going to be difficult because it is used to route the calls. CallerID is what is easily spoofed.
    – schroeder ♦
    Commented Feb 9, 2015 at 0:45

1 Answer 1

Reset to default
4

Although I have no firsthand experience, I've read of this being done by forwarding calls to a toll-free number, which then (by virtue of being toll-free) receives the true calling number through ANI (which is distinct from Caller ID and which supposedly cannot be spoofed) and finally forwards back to the original number.

For example, the TrapCall service mentioned here appears still to be in operation: http://www.nytimes.com/2009/03/15/us/15call.html

Improve this answer
2
  • This won't work if is a call from VoIP
    – Freedo
    Commented Feb 9, 2015 at 6:31
  • @freedom, is that true as a blanket statement, or might it depend on the VoIP provider's implementation? I've seen anecdotal evidence that it will not work with callers from some VoIP providers, but it seems like a clever provider might be able to look at the Caller ID supplied by a client for an outbound call. If the caller ID matches a DID associated with the same account, couldn't it send it out as the ANI? (I admit that I don't know anything about SS7.)
    – Scott Dudley
    Commented Feb 9, 2015 at 14:35

Not the answer you're looking for? Browse other questions tagged .