It is a problem U.S. phone users deal with every day. Your phone rings and displays a number that appears to be from a legitimate source.
Scammers, often calling from overseas, use “call spoofing” (defined as anytime you receive a call and the number it displays on your phone is not the number of the person calling) to make it look like the call is coming from the same area or from a legitimate place like the IRS or the Social Security Administration. According to some estimates, consumers lose billions a year when they fall for these scams, and there’s agreement both in Washington and in the telecom industry on the need to make it stop.
YouMail, which makes robocall-blocking software, estimates that 5.7 billion robocalls were made just in the month of October and at least 40% of those calls involved spoofing of some sort.
The Pallone-Thune TRACED Act, a recently introduced bipartisan bill to combat robocalls, mandates that all telephone carriers implement standards – known as SHAKEN/STIR – in coming years to limit call spoofing, which can also be referred to as call masking. The bill includes other provisions designed to empower government agencies to take more action against robocall scammers.
The new standards could help consumers, but what will it mean for businesses and organizations that use call masking for legitimate purposes?
For example, Uber does it. When you talk on the phone with your Uber or Lyft driver, you aren’t seeing the driver’s actual number. In fact, neither the driver nor the passenger has access to the other’s real contact information.
Other organizations use the practice, too, including domestic violence shelters. The medical profession also uses call spoofing: an on-call doctor might make calls from their personal phone but the patient sees a “spoofed” number, which rings the main hospital number for follow-ups.
Twilio, which provides communications tools for apps, has posted about hiding phone numbers as a way to create “frictionless conversation.” Masked phone numbers is something they provide for a range of companies, including Uber, Lyft, Airbnb, Doordash, Instacart, and more.
The company has outlined a few advantages to masked phone numbers. Protecting buyer and seller identities ensures safety, and it keeps “business transactions on-platform by preventing buyers and sellers from engaging in private communications,” Twilio says.
What is set to change with spoofed calls in 2020
The large telephone carriers are already adopting the SHAKEN/STIR standards and expect to be done by 2020, whether or not Congress acts.
In a statement, Twilio told Yahoo Finance that it supports the legislation. “We believe that the implementation of SHAKEN/STIR could dramatically change the robocall landscape in the next 12-18 months,” Twilio said, adding that it “is working across the ecosystem to ensure its calls, including masked calls, are verified and that wanted communications are safeguarded.”
Businesses will still want to use call masking, and “the STIR/SHAKEN framework easily accommodates that,” says Richard Shockey, chairman of the board at the SIP Forum, an industry association.
Under the new standards, Shockey says, companies like Uber will continue to be able to mask numbers, but the number a customer sees “has to be a number in some way, shape, or form associated with Uber.”
In Uber’s case, a system already appears at least partly in place. After a recent conversation Yahoo Finance had with an Uber driver in Washington, DC, the number that came up when the driver called was later called back. An automated message played indicating the displayed number was, in fact, an Uber customer service line.
Uber and Lyft did not respond to requests for comment on this story.
The question is whether smaller organizations will be able to comply.
Deirdre Menard, the CEO of Lucidtech, a company that consults on fraudulent robocalls, notes that “when a new women's shelter pops up who isn't aware” of the process for setting up call masking and registering a number, she says, “how do they become aware of this?”
Sen. John Thune is the Senate Republican Whip and one of the leaders in Congress on the issue (his name is on the bill). He acknowledges that certain legitimate calls will need to be masked going forward. A spokesperson for the senator says he "believes the legislation gives the FCC appropriate discretion to permit such calls."
One thing might actually improve when businesses spoof calls
Shockey sees the bigger story for consumers coming in 2020 with what he calls rich call data.
Basically, a company would have more control over what shows up on your phone screen when they call. Here’s how Shockey describes it in the context of Uber: “If it is actually an Uber driver calling you, it's Uber's logo on the phone, it's an Uber associated number.”
Menard, who focuses on what the bad actors might do next, is less sanguine. "I think that's going to be our next problem area, believe it or not," she says. Rich call data would require a database of organizations with their information to be displayed. "What if I'm a bad actor and I subscribe to one of these services, and I'm configuring my caller information and my logo to be something I'm not," she says. "The vetting is going to be really burdensome."
The bill’s proponents in Washington are hoping the legislation makes its way to President Trump’s desk before the end of the year.
Ben Werschkul is a producer for Yahoo Finance in Washington DC.