Page 22 - Winter 2019 2020 FINAL_Neat

Page 22_Layout 1 15/01/2020 15:41 Page 1

says Sharif. ‘We’re now in the realms of
22
your voice being personal information, and
it’s valuable. Voice recognition is increas-
ingly being used for phone banking, and AI
systems are becoming better and better at
mimicking human voices.
‘So, when you’re spoofed and just
hear a recorded message, scammers
could just be aiming to record your voice
recordings to get your voice on tape.’ Per-
haps most worryingly is the fact that much
of the number spoofing that takes place will never be punished.
‘This is a borderless crime,’ says Sharif. ‘A lot of scammers have call centres set up in
India and China. Scamming someone in the UK for £1,000 isn’t enough to send the UK police
over – the problem is too big and too widespread. Conversely, Sharif says that if the criminals
are based in the UK and spoofing UK phone numbers, the authorities are more likely to inves-
tigate if you report the call. Number spoofing isn’t necessarily illegal, and it has some legitimate
uses. For example, your credit card company could call you and go straight to your voicemail.
It doesn’t want you to be charged for calling it back, so it displays a Freephone number on your
caller display – even though that’s not the number it’s dialling you from.
Find out more: listen to this HMRC scam voicemail A new scheme to tackle spoof calls
Earlier this year, Ofcom launched a scheme called ‘do not originate’, which is aimed at protecting
phone numbers from some of the most spoofed organisations such as banks, HMRC and in-
surers. Put simply, ‘do not originate’ applies to numbers from which no outbound calls are ever
made. So if a bank prints a customer service number on the back of its debit cards, but never
actually dials customers from that number, it could enrol that number in ‘do not originate’.
The scheme is an instruction to phone networks. It informs them that no legitimate out-
bound calls are ever made from the number, and therefore calls appearing to be from this num-
ber should always be blocked. Here’s how do-not-originate works: ‘Do not originate’ was first
adopted by HMRC back in April. Prior to the scheme’s introduction, criminals had repeatedly
impersonated the taxman, contacting victims and threatening them with fines and jail terms if
they failed to pay fictional tax bills (you can listen to real audio recordings of those calls here).
HMRC told us the scheme had been hugely effective since being implemented: ‘In the first
month of the new controls, reports of spoofed calls fell by 25% compared with the previous
month. By month two this had reduced by a further 23%.’ Not all banks are protecting their phone
numbers The ‘do not originate’ scheme was developed in partnership with UK Finance, the bank-
ing industry association, so we were keen to find out how many banks and building societies
had enrolled their numbers.
We asked UK Finance which of its members had signed up, but it told us to approach
banks individually, and expressed concern that ‘listing which firms have yet to implement will
only play to the fraudsters’. We believe that banks that don’t adopt ‘do not originate’ are respon-
sible for playing to the fraudsters. However, we have chosen not to name the banks that have
either failed to implement it, or failed to reply to
our query. We do know that Allied Irish Bank, First
Trust, CYBG and Virgin Money, Barclays and
Metro Bank have all submitted numbers to the ‘do
not originate’ scheme.
‘Do not originate’ isn’t a silver bullet. For ex-
ample, fraudsters can simply spoof numbers very
similar to the legitimate ones. However, the reduc-
tion in spoofed calls cited by HMRC suggests that
‘do not originate’ is highly effective.