CBS New York Investigates "spoofing" scams after nurse loses life savings
NEW YORK -- It's getting harder to trust caller ID. Scammers can now use apps to show up as a trusted number, including the number for your bank.
It's called "spoofing," and CBS New York investigative reporter Tim McNicholas is asking what tech companies are doing to stop it.
Through 12 years of nursing and through the horrors of a pandemic, Avalon Grimes kept going.
"And cared for patients, and held patients' hands, and cried with patients," Grimes said.
But on a recent rainy day, she told CBS New York how her life's savings were washed away with one call.
"When I spoke with the police department they told me it's something called 'spoofing.' They can use an app and they can mimic and number, and the number that showed up, the whole name that you would normally see when you would call Chase, that number showed up," Grimes said.
Indeed, her T-Mobile records show the number that called her is the same international Chase number on the back of her credit card. The caller said he'd detected fraud and convinced Grimes to transfer her money to another account.
It's a scam tactic that's becoming more popular. It even happened to TV star Andy Cohen.
"The phone rings, again the caller ID says it's from my bank, I pick it up. They say this is X fraud alert," Cohen said.
"There shouldn't be any sort of apps or any sort of ways to fake a number to make someone believe that it is a particular company," Grimes said.
But on Apple's app store, CBS New York found multiple apps that let you spoof numbers, including one prank-calling app that let us spoof that same Chase Bank number for free. It even showed Chase Bank on the caller ID on one attempt.
Ayman Abdallah, the developer, said the app is intended for entertainment and some numbers for banks, schools and public safety agencies are banned from the app.
"Yes, that should not be allowed. Definitely, we'll take responsibility and making sure to also ban international toll numbers," Abdallah said.
But Abdallah claims scammers don't use his app, and he says wireless carriers should do more to prevent spoofing.
"All these carriers need to collaborate together and also change these systems, but the question is why? Why do they leave it open?" Abdallah said.
"If they did that, though, wouldn't that be the end of your app?" McNicholas asked.
"Sadly, yes, and, honestly, I would rather prefer these systems upgrade and fix these issues," Abdallah said.
T-Mobile did not respond to CBS New York's questions, but AT&T and Verizon both said they're already working hard to block spoof calls through various initiatives.
AT&T said:
Illegally spoofed calls often originate on phone service providers who do not properly follow national call authentication standards. We block billions of these calls each year as fraud or label them as suspected spam. We continue to improve our detection methods to stop them, and we appreciate that regulators and prosecutors are aggressively pursuing violators.
- The FCC is taking enforcement action against those who are not following the standard, called STIR/SHAKEN. You can read a good summary here. AT&T was a leader in developing the standard.
- AT&T has taken a leadership role in the Industry Traceback Group, which tracks fraud and spam calls to the source. This leads directly to enforcement actions like the FCC's record penalty against an auto warranty robocaller, and the FTC joining 50 state attorneys general in Operations Stop Scam Calls.
- We recently shared our patented technology to detect and block illegal spoofing with other mobile providers.
- We block all the fraud calls we can find. And we label suspected spam calls so you can choose to answer or not.
- Our customers can fine-tune their robocall settings if they download the AT&T ActiveArmor app. For instance, you can block all suspected spam calls, or send every call to voicemail if it's not from one of your contacts.
Added Verizon:
Currently, it's not illegal to spoof another person's phone number in many cases, but we believe it should be, and we support federal legislation that would go after the spammers that are making these calls.
That said, we are constantly working with government agencies, industry counterparts and others in efforts to block these bad actors from spoofing and related activities.
Part of our ongoing commitment to protect customers from unwanted calls, Verizon's Call Filter app tackles this issue proactively with Neighborhood Filter, allowing customers to silence and send neighborhood spoofing calls to voicemail, along with those in any other area codes and prefix combinations that could be suspect.
But regardless of a customer's phone carrier, many of the tactics used by scammers are employed to gauge a customer's vulnerability. Scammers want to know how receptive you are to revealing information so that they target the right people. Each of the tips mentioned below will help you protect your personal information and avoid being the target of caller ID spoofing:
Don't answer calls from unknown numbers. If you do, hang up immediately.
Don't hit any buttons. If the caller asks you to, hang up immediately.
Don't answer any questions, especially ones regarding your personal information.
Never reveal personal information, such as your Social Security number, mother's maiden name, passwords, or credit card numbers.
Don't assume they are who they say they are. If you receive a call from somebody representing a company or a government agency, hang up and call back the phone number on the company or agency's website. This will help verify the caller.
Don't put your trust into the caller until you can assure they are who they say they are.
Don't panic. Social engineers will see this as vulnerability and try harder in their attempts to manipulate you into revealing personal information.
Set a password for your voicemail account. A scammer could hack into your voicemail if it is not properly secured with a password.
Notifying the FCC, the FTC, or even your local police department may ultimately be your best bet at protecting your personal information. Other best practices for stopping unwanted calls include filtering calls and blocking spam numbers. Filtering or blocking a number is different for iOS users and Android users, but both essentially involve pulling up your settings, and then selecting some sort of "block contact" option.
Meanwhile, the Federal Trade Commission says business impersonations were one of the top scams in the country last year -- up there with phony investments, romance scams, and online shopping ruses.
"AI makes it much easier for scammers to spoof identities. They can even spoof someone's voice," said Claire Rosenzweig of the Better Business Bureau.
Rosenzweig recommends hanging up on that suspicious caller and then, "Take a moment, take a breath, step back and contact the source. If they're saying that it's a utility company or a government entity, you call the source. You go to them 'Have you been trying to reach me?'" Rosenzweig said.
Apple says it has rigorous systems to root out scam apps or fraud, and it removed two apps CBS New York showed it because its policies don't allow apps that enable anonymous calls or prank calls.
And Chase is warning customers it will never call someone and ask them to recite a security code texted to their phone.
That's something the scammer asked Grimes to do to facilitate the transfer.
"I worked very hard to save. I'm a single mom," Grimes said.
Now Chase says it is working with the bank the scammer used to try to get the funds back. But the scammer likely already withdrew the money, which means Grimes is back to square one in her quest to save up for a new home.
If you have a story you'd like Tim to look into, send your tip to the CBS New York Investigative Team. You can email them at cbs2investigates@cbs.com, or call them at 646-939-6095.
