Brits warned as illegal robo-callers with offshored call centers fined half a million

The UK's data protection watchdog fined two Brit businesses with offshore call centers £550,000 (c $735,000) over illegal automated marketing calls. Both companies equipped their offshored call handlers with pre-recorded messages to select when targeting elderly and other vulnerable people in the UK. Andy Curry, head of …

[Phil O'Sophical]

Another insignificant punishment

Since they have proof that Matthew Terry did this deliberately he should not be allowed to hide behind the protections of limited companies. He should have been personally fined, required to pay compensation to every scammed customer, and banned from ever being a company director again on penalty of jail time. UK courts seem to have completely lost the plot on the concept of deterrence.

[Anonymous Coward]

Re: Another insignificant punishment

Force him to 'work' in a call centre, with a published freephone number that people can use to complain about his behaviour.

[Alan Brown]

Re: Another insignificant punishment

Limited companies don't protect directors. The "liminited liability" is ONLY for the shareholders

Directors and staff can AND SHOULD be held responsible for their unlawful decisions

The UK establishment is far too lax on white collar criminals

[Anonymous Coward]

Re: Another insignificant punishment

The UK establishment is far too lax on white collar criminals

Possible causes (not mutually exclusive):

1 - prisons are full

2 - loot sharing

3 - too many politicians would also go to jail

Cynical, moi? Nah..

[I could be a dog really]

Re: Another insignificant punishment

Prisons full should not be a reason for not giving some sort of appropriate punishment.

Personal fine, plus confiscation of proceeds of crime ought to do it. Could add a sizeable community service order.

There are options that would provide the "o s**t, that didn't work out for him" deterrent effect for others.

[Anonymous Coward]

Re: Another insignificant punishment

Since they have proof that Matthew Terry did this deliberately he should not be allowed ...

To walk free.

This is probably not the first offence and "half a million" is a pittance compared to the amount he has raked in and the damages caused.

So ...

Off with him to a nice comfortable cell in one of HM's to enjoy five years' porridge.

Or maybe more ...

.

[Excused Boots]

Re: Another insignificant punishment

Is use of ‘the stocks’ still on the Statute Book does anyone know?

[Rich 11]

Re: Another insignificant punishment

No, it's not, not since 1872. And anyway the pillory was more fun (but it's usage was also stopped, sometime around the beginning of the 19th century).

[Anonymous Coward]

Re: Another insignificant punishment

Thankfully IOS 26 call screening is a positive shift in the Fri t/no man’s land here.

[Tessier-Ashpool]

Re: Another insignificant punishment

Yup, it’s going to send scammers crazy. When a robot voice asks them to state their name and purpose for the call, they will most likely head for the hills.

[Fonant]

Ongoing. Bastards.

Had several calls yesterday from a "free loft insulation" company, with oddly Indian-sounding accents and mannerisms. Since they used my fake identity (Fred Smith) and address (a multi-million house in Sandbanks, Poole) I went along with them.

Then a few hours later, a call from an English person from a mobile number, arranging the visit. He insisted that BOTH I and my wife ("joint owners of the house") HAD to be present when the inspector came for the survey. I queried this quite hard, his only explanation was "in case she has any questions". He got my number "from the database" apparently (so not an Indian scam call centre?).

Clearly they wanted to "inspect" and say that essential changes to the insulation needed to be made: then, with both home owners present, they could get signatures to make the work appear completely consensual and legal. It wouldn't surprise me if the "repairs" included lots of spray foam, this instantly ruining the roof and devaluing the property.

I hope they enjoy trying to visit "my" mansion in Dorset!

[Anonymous Coward]

Re: Ongoing. Bastards.

I usually say I've just moved and give them the address of the local Police Station. I hope they turn up when someone is actually there (unfortunately not a common occurrence, even in fairly large towns!)

I've not had a "you were out when we called" message from any of them yet :-)

[David Hicklin]

Re: Ongoing. Bastards.

> the local Police Station

Good luck doing that with the one in our time - it is closed to public visits !

[Doctor Syntax]

Re: Ongoing. Bastards.

Unfortunately that wouldn't work with something strictly address based - like smart meters.

[I ain't Spartacus]

Re: Ongoing. Bastards.

Fonant,

Both partners having to be there is a thing that a lot of high-pressure sales companies do. Stuff like double glazing - which is at least legit, even if sold with not very legit tactics.

Partly it's to get buy-in from both - and so you can see who's got objections and try to persuade them.

The other reason is that many/most people absolutely hate saying no. They just don't like to do it face to face, as it feels too confrontational. My Mum, for example, even when talking to people she knows are scammers (Indian call centre pretending to be Microsoft types) - won't say no unless they're rude to her. That breaks the social obligation. She'll say that she doen't do computers and she'll ask her son about it. Because, I presume, that feels more polite.

Socially, it's much easier to say, "my husband wouldn't like it" or even just, "I have to run this by the wife first" and then give a safe no by email / phone when the nasty salesman has gone.

I don't mind it. Even though I don't like verbal confrontation. I think it's the fact that I fell into engineering sales - and so I've dealt with professional buyers and I'm used to taking a polite no without offense, so it doesn't feel personal to me to say no to someone else. Or it could just be my cold, black, withered heart...

[anthonyhegedus]

Re: Ongoing. Bastards.

I had an experience like that with a genuine solar panel company I found online. The guy said that my wife and I must BOTH be there when he comes to do his sales pitch. That put me off. And when I asked him to explain that, he said that it was “for compliance”. It just didn’t sound very convincing.

[werdsmith]

Re: Ongoing. Bastards.

Yes, it’s for your compliance.

[Doctor Syntax]

Re: Ongoing. Bastards.

"Partly it's to get buy-in from both - and so you can see who's got objections and try to persuade them."

I suspect it's so that they can get the easier to persuade on their side and then gang up on the hold out.

[ITMA]

Re: Ongoing. Bastards.

Every so often I get a spurt of such calls about "loft insulation" or "roof mounted solar panels".

Apparently my address shows my property is eligible. :)

I'd love to know where they bought their data from, 'cos if they're not just making it up (proably are) then they've been had.

But it is fun listening to their voice as they reaslise they've just wasted their time (negatively affecting their call stats) when I explain "I'm in a second floor flat in a block with several floors above".

What loft can this insulation go in?

Upon which roof can I mount these solar panels of which they speak?

LOL

[Doctor Syntax]

"We urge the public to take note of our tips to spot these robo calls so they can tell us when they've received one,"

How? There seem to be a series of different reporting sites with different criteria, none of which seem to deal with attempted fraud. The site for reporting scam calls is only interested if the caller has been defrauded, otherwise it just redirects to a page of advice.

Marketi survey call reporting is, I believe, managed by the marketing industry and they seem to give themselves a free pass even for TPS registered lines.

ICO need to knock heads together and arrange a single portal, hand out the reports to the appropriate organisations and ensure that between them those organisations handle all situations.

[Alan Brown]

The problem is that the ICO is happy to farm things out to industry associations which masquerade as regulators

"We investigated ourselves and found that we've done nothing wrong"

It's very much a case of APPEARING to have a regulation and enforcement structure, whilst straightjacketing it into near-paralysis - and this is deliberate, not accidental

[Mr Tinkle]

Exactly this.

It begs the question of just whose pocket is the ICO in when they can't stop this nonsense going on. In these days of digital communications why can't traffic analysis simply turn it off at source? Or drop a live link through to a team of people, sorry, person who can listen in on what's going on before bringing the axe down.

Why can't the scam reporting centres feedback to the telecoms people and cut them off? Maybe it's something to do with money being generated for the telecoms people?

Maybe it's like the revenue from cigarettes being more than it costs the NHS to treat people with lung cancer?

At least the ICO's website is fast and simple to bang scam call details into. But is enough being done with it? The volume of scam calls suggests not.

Sometimes I think it's difficult to know who to vote for. But then I think....no it's not - I'll vote for anyone that does common sense things, and isn't a wimp when it comes to defence.

......but that leaves me in the quandary again with difficult choices.

Well, A1 will save us (bless you Bob Mortimer :) )

I've got to go...I've got somebody coming round to fit me a new boiler, and then spray the entire loft and boiler with foam, just to keep it all warm.

[Anonymous Coward]

Do people still use the phone ?

I mean why the fuck did I waste my time at Uni in the 80s working on RFCs for email ?

For some reason I rarely get spam calls. The last was a robovoice telling me that I had to add them to Whatsapp or something (when I do get calls I rarely pay attention) for a job application for something.

I have to answer witheld/private calls as the 1,001 NHS organisations (and that's in Brum alone) are very shy.

[Caver_Dave]

Re: Do people still use the phone ?

And Police and Councils, etc. Despite many times being told that they should just report the CLI of the main switchboard.

[Mr Tinkle]

Re: Do people still use the phone ?

Yes indeed. I tried for years to get my GP to report the CLI on their numbers and they couldn't even direct me to people who understood the question. Then, all of a sudden it appeared. Probably due to a fault in the system.

And another thing that really gets on my tits is getting surveys and other correspondence from the NHS etc that uses 3rd party domains. Lots of sources are telling people to check the domain before interacting and loads of other places are sending out messages and requests for interaction from domains you've never seen before.

And when you try to explain all this to the elderly, using subdomains only compounds the problem.

It would seem that most system designers never use the systems they create.

[I could be a dog really]

Re: Do people still use the phone ?

The thing against providing CLI is simple - it gives away information that the recipient might not want others in the house to know. By the time you get to mine, and SWMBO's age, then you generally don't care about others knowing (for example) the doctor called - but in many households, that could be a problem.

[Wulyum]

Re: Do people still use the phone ?

Interesting point.

Could it be turned on its head? By that I mean could the caller use the CLI to give the receiving household a secret message?

Eg STD clinic tells 17yo Alice in person that if they call it will be from a special number. If it's good news it'll be from 0321... And if it's bad news from 0391...

The whole number, one time use and unique, is only shared with Alice.

Or something along those lines. In neither case is it a valid number so isn't in any directory and won't take incoming calls.

Alice's mum, dad and siblings cannot learn anything from the number. But she by looking at it can assess importance and call back on the clinic's real number and deal with the situation.

[Anonymous Coward]

Re: Do people still use the phone ?

Er yes, people still use phones - especially the older people these scammers targeted What a dumb question

[Anonymous Coward]

My advice for some time now

If you don’t know the caller or the number.

DO NOT ANSWER OR REPLY.

White list all your friends, doctors, dentists, trusted business, etc.

Disregard everything else.

[Alan Brown]

Re: My advice for some time now

That advice doesn't always work. Scammers have been spoofing caller-ID for decades and there have been multiple cases of harvesting addressbooks in order to spoof a known contact

[PCScreenOnly]

Re: My advice for some time now

Another failing by ofcom

[I ain't Spartacus]

Re: My advice for some time now

That advice also doesn't work because the NHS, in particular, tend to withhold their number. Lots of doctors surgeries do it, but also people like the distric nurse will always do it, becuase they're phoning you from their work mobiles - and don't want you to have that number. So if you've got a relative, or yourself, receiving care at home - then you'll need to answer withheld numbers.

Plus spoofing is also a thing. Although that's less likely to matter unless the call is specifically targetting you, or they're spoofing a bank or credit card company.

[Anonymous Coward]

Re: My advice for some time now

Then they can leave a message telling me when they will call back, and whether the number will be withheld. That way I'll know that the call is probably genuine.

[RMclan]

Re: My advice for some time now

For a long while, Lloyds Bank were the opposite.

I would regularly get marketing calls from someone at my Lloyds Bank branch where they would phone me from a mobile number (which I didn't recognise so didn't answer), leave a message saying "This is <forename> from Lloyds Bank, please call me back on <mobile number>".

I never called back on the mobile number, occasionally I would call the branch (using a number I found on the website), ask if they had a <forename> working there and then blast them for such poor security practices.

Then they removed the local branch telephone numbers and they just have a single contact number for all branches now.

Thankfully I haven't had a marketing phonecall from Lloyds for a number of years.

[robinsonb5]

Re: My advice for some time now

...then they removed the branch.

[John Brown (no body)]

Re: My advice for some time now

Next step is to remove the root :-)

[Mr Tinkle]

Re: My advice for some time now

And I find it irritating that Lloyds changed their telephone banking service to start asking questions before authentication happens.

Let's establish authenticity first before having a chat eh?

[Wulyum]

Re: My advice for some time now

If a banking organisation rings asking for identification details I NEVER give them. I ask them for a case reference number or other unique information for what they want to discuss then I ring back on their main published number and progress it from there.

[I ain't Spartacus]

Re: My advice for some time now

Then they can leave a message telling me when they will call back, and whether the number will be withheld. That way I'll know that the call is probably genuine.

That's what they should do. But they probably won't.

I believe GP surgeries have been told to stop withholding their number - and mine have indeed now done that. There's no excuse for hiding it. But with mobile staff, who don't want you to have that number - its for them to talk to their own teams and to make outgoing calls only - they won't give you a direct numbe to call and they don't always leave messages.

[John Brown (no body)]

Re: My advice for some time now

"There's no excuse for hiding it."

Yes, they had no excuse other than poorly set up systems. If they can hide the CLID automatically from all outgoing calls, then they can just as easily make the system auto-present the main reception number. The same applies to the rest of the NHS, who seem to be the biggest offenders of "withheld caller ID"

[Anonymous Coward]

Re: My advice for some time now

If they leave a message, fine. Assess it.

If they don’t, then Google the number and if it’s feasible call back.

It comes down to expectations.

If you’re waiting for a hospital call back then expect it.

If the call is random and you don’t know who it is, leave it.

Again, repeat the process above.

[werdsmith]

Re: My advice for some time now

I wonder how many people don’t know they have a call screen facility on their smartphone?

I’ve found it extremely effective.

It will answer the call of unknown callers and ask them to give their details and reason for call. Then alert you and display the details. You can choose to ignore.

[David Hicklin]

Re: My advice for some time now

If the call is genuine then they will start leaving a message at which point we can pick up the call or they leave the main general number to call back on

[David Hicklin]

Re: My advice for some time now

We do that here, the number of strange numbers that go to voicemail and they never ever leave a message - often just silence if anything

Know good numbers will appear by name and none have been spoofed (yet!)

[Neil Barnes]

from those made by predatory marketeers.

Any call where someone is trying to sell me something is by definition predatory.

Noting Spartacus' point above: it used to be that hunting groups were used to move a lot of internal numbers to a handful of external lines, simply for cost reasons. Is that still a thing?

(I do note that both my German and UK mobile providers will deliver a reverse lookup when I am called; depending how easy it is to spoof that, it seems a sensible idea. Not answering any call I don't recognise is still my default option).

[NXM]

My mum was targeted by this filth

She was savvy and didn't get scammed, but the calls wouldn't stop. Having redirected the line after her death, I suspected these were recorded speil: same friendly Australian accent, same approach, and they wouldn't respond to questions. Boil these scammers arses.

[Alan Edwards]

Not enough

A half-million fine is a cost of doing business, not a fine.

The fine should be *per call made*, starting at £1000, going up from there by the amount of biters they got.

[Missing Semicolon]

Caller Id

All you have to do is make the organisation accepting the fake caller id responsible for any losses. Suddenly the impossible will become possible,and caller id will be properly verified.

[Anonymous Coward]

Re: Caller Id

It's not possible to verify it, that's the point.

Each operator receiving a call from another network has no way to verify the attached CLI - they can either accept it, or block it.

Things were simpler when CLI was introduced. We only really had BT, and they would flag other-network calls as either unknown or international.

As most calls were BT-to-BT this worked well enough, though it says annoying that my calls via Mercury were always received as unknown

[Richard 12]

Re: Caller Id

The OP's point is that if they became liable, they'll fix that. They'd likely start by passing liability up the chain via contractual means.

It is not a difficult problem, but as they have no reason to bother, they don't.

[Anonymous Coward]

Re: Caller Id

They cannot verify it because they do not care to try or impose the rules that should apply.

No other major systems, used globally, would allow miscreants to use/abuse the system with no fightback !!!

Do Television/Radio allow people to masquerade as legitimate stations with no action.

All major global systems are policed and defend their position in the world by fighting fraud, it impacts their standing in the world and ultimately their bottom-line.

Caller-ID fraud does not impact the telecoms companies and actually makes them money from the huge number of calls made each & every day.

Bottom line is that they do not care !!!

:)

[Anonymous Coward]

Re: Caller Id

OK, How?

A traditional phone call is a switched circuit - the receiver doesn't need any routing information, they just send their reply "back up" the incoming connection.

As such, when a network receives a call from another network, it need know nothing of the originator to route the call. CLI isn't part of the networking, it's a "nice" way of adding descriptive information for the humans receiving the call.

As such, as I said in my previous post, the receiving network has no way of verifying this information - it can either accept it, or reject it. With all the different networks around these days, rejecting off-network CLI would make it virtually unusable - in fact, if BT refused CLI from other networks, they'd probably be done for anti-competitive measures as it will be the case of "Don't use a different provider. No-one will know who you are any more)

Now, the only way I can see it being done is for the big operators (BT/talk-talk/sky/virgin/Vodafone/three/ee) etc. to come into a legal agreement to accept CLI from each other, and NO-ONE else.

An exception could be made for business PBXs' such as doctors surgeries etc. where a lookup table at their provider only accepts CLI information from them that matches a registered phone number they own with that provider.

Calls from abroad would have to always be marked "international" - there's no practical way to bring international companies into the scheme.

I suppose smaller phone companies could be made to go through a compliance audit to join the scheme.

Ok, we are assuming the operators in the scheme don't perform any spoofing themselves, but that's fair a assumption if they can be shown to have mechanisms in place to stop rogue employees fiddling.

Hmmmm. I guess it's doable after all!

[I could be a dog really]

Re: Caller Id

It WAS doable in the past, they just CBA to do it.

All it would have required would be contractual clauses along the lines of "we'll accept calls from you, you have to assure yourself that any CLI is genuine - and if it turns out otherwise, you compensate us and/or you find yourself blocked". That shifts the onus - other telecoms companies either clean up their act or find their customers get a recording along the lines of "Sorry, but your call to the UK number is blocked because your telecoms company is a bunch of sheisters" (or more polite words top that effect.)

20 years ago, that would have worked as the companies involved would have been big enough for it to matter.

.

Now it's a lost cause. Every man and his dog can operate some sort of IP based phone setup. While it might possibly work if all the big businesses applied similar rules, I suspect there's just too many players now for it to work. With a previous work hat on, we were a reseller for one of the early IP telephony providers in the UK. If one of our customers wanted custom CLI, then the process was that they had to show us documentation to show they legitimately "owned" the number, and we'd approve that with the provider (via their portal.) Of course, our own telephony was as a "customer" of our reseller account - so we could have done pretty well anything unless they has some other checks in place (don't know, we never tried anything naughty.)

[Anonymous Coward]

Re: Caller Id

Agree.

The key point is that BT and all the other major Telecoms companies COULD solve the problem if they wanted to.

Unfortunately, they make a lot of money out of the huge number of calls made and would rather keep the money than defend their customers from scam callers.

The fake Caller ID problem is a software problem, they allow the software used to be hacked to change the Caller ID.

A genuine push to update the software to NOT be hackable and to ensure that all copies of the software were licensed to a real company/person would also help.

The Telecoms companies totally control the system so they should be able to lockdown the system from this fraud.

Again they cannot be bothered to do this as it would cost them money/time.

To mirror a well known slogan .... "Because you're not worth it !!!!"

:)

[Jellied Eel]

Re: Caller Id

The fake Caller ID problem is a software problem, they allow the software used to be hacked to change the Caller ID.

Yes and no. The standards allow caller ID or presentation numbers to be defined, given or take some national legislation and implementations. So I could get a number block of say, 0207 555 0000-999, present any number from within that assigned range and block any number from outside that range. But if it's a spammer hanging off a SIP trunk behind a couple of transit providers in different countries, there's no way to determine if the presentation number is valid, or not. BT actually does a reasonable stab at this, but only if they've had spammers reported or the traffic profile's tripped their fraud/abuse detection systems.

Then there's the CMA and 'legitimate' call centre operators who might be doing telemarketing campaigns for different clients and want to use their presentation numbers. Which is a bit of a Bill Hicks thing and I used to no-bid those because a) I hate telemarketing and b) call centres often don't generate that much revenue vs the ballache and can mess up the stats for call completion & abandonments which can attract Ofcom fines. Biggest problem is still really SIP being pretty insecure and made it a lot easier for spammers to enter this market vs the traditional way of having to get C7/SS7 trunks.

[Anonymous Coward]

Re: Caller Id

Sorry for late reply.

Good info ... BUT ... the sticking point is that you and BT know what the problem is, as you have defined in your comment.

Surely it is possible to have a global directory of Presentation numbers & the transit providers they WILL be routed through.

The routing information gives BT someone to 'aim' at if Presentation numbers are being abused.

My understanding of the issue is that calls from Fake/'borrowed' Presentation numbers are allowed to be routed through the telephone network with no means to 100% VERIFY the authenticity of the call. SIP allows this because you can route whatever you can get away with in the software.

WHY NOT BLOCK CALLS THAT HAVE DUBIOUS PRESENTATION NUMBERS THAT ARE ROUTING FROM UNEXPECTED LOCATIONS. [Hence register idea similar to DNS]

It is a little disingenuous to say 'no way to determine' if you allow dubious Presentation numbers to be routed from a transit provider that they SHOULD not be coming from.

You COULD know what is dubious IF you invested some time in making the whole system more secure by NOT allowing random routing of random Presentation numbers.

You mentioned SIP which can be used/abused to make calls that are not from a 'valid' source yet 'present' as something else.

This is what I meant when saying it being a software issue ... just like anything that connects to the internet ... SIP Gateways can be 'hacked' to 'play' with the calls and what they appear as to the receiving systems.

PABX software can be hacked to 'play' with the calls that are sent/received via a SIP gateway/interface or VOIP in general.

IF you search the interWebs you can find mention of very 'naughty' hacked software that runs on these types devices that can do myriad illegal things. [More than likely something else available on the 'Dark Web']

I am aware of this, I have no background in Telecomms yet it has crossed my path, so I am sure the likes of BT/AT&T etc will be aware.

If the methods/protocols are weak or less secure than is needed they can be improved ... BUT the will and the funds to do so needs to be available & requires ALL Telecom providers to work together.

Saying sorry but doing little to stop it is cheaper !!!

Hence we still have 'scam calls' and have to live with the consequences daily !!!

:)

[Anonymous Coward]

Funnily enough, I had a call from "Jo" an "energy advisor" on my landline just this morning - whatever the ICO did has clearly not made the slightest difference

[Ivan Headache]

In August I received a call from a 0330 number that started "hello, is that Ivan?' Then a pause and it continued with "This is Dave. I'm calling from......"

I hung up. I was driving down the A1 at the time.

Over the next hour I received four more identical calls, all with my name ion the introduction.

I blocked the number.

Next day, more similar calls from a different 0330 or 0333 number. and so it went on for several days.

Block the number and it calls again from a different number.

Several people I have mentioned this to have reported exactly the same thing happening to them. 0330 and 0333 numbers.

Since the start of September I haven't received any more. Neither has my brother, who was also getting several a day.

[Excused Boots]

My technique is that when I get a call from an obviously spoofed number (claims to be from Penzance when the speakers accent would suggest Mumbai), I simply keep quiet, don’t hang up, don’t answer, don’t say anything, let them start their spiel of ‘Hello is that Mr. Mxxxxxx, (managing to completely mangle my surname)’. Just keep quiet. If they terminate the call (so as to move on to another victim), after a while your number will get taken off of the database at ‘Scammers ‘R’ Us’ central, as being a waste of their time - well, for a while!

[David Hicklin]

There is a reason why mobile phone storage has to keep on getting bigger - it is to store the ever increasing number of blocked phone numbers !!

[The commentard formerly known as Mister_C]

Update. Jo is still working, despite being told to f''' off several times.

[Albert Coates]

Top tip

Keep a referee's whistle by the phone. (Duke) Nuke'em.