AT&T and T-Mobile fight Caller ID spoofing with number verification system

AT&T and T-Mobile announced a joint anti-robocall initiative today, but they didn’t promise any new call-blocking capabilities for their customers.

The carriers made a big deal of the partnership, saying in an announcement that they “put differences aside to fight unwanted robocalls for customers.” Specifically, the companies said they are now using the new SHAKEN/STIR technology to determine whether Caller ID numbers are being spoofed in calls made between the two carriers.

Theoretically, carriers could use this Caller ID authentication technology to automatically block calls that fail the authentication test. But that’s not what’s happening now. For example, AT&T told Ars that it’s using Caller ID authentication as one data point in its anti-robocall algorithm but that it isn’t blocking calls solely based on whether they aren’t authenticated.

When a call is made between the AT&T and T-Mobile networks, a cell phone user may see a notification that the incoming call has been authenticated, meaning that it really is coming from the number listed in the Caller ID field. But calls from phones that fail the test, possibly because the Caller ID is being spoofed, will still ring customers’ phones and may not come with a warning.

AT&T and T-Mobile both offer free blocking services, but they both also charge $4 a month extra for their most thorough blocking services. No changes to the free or paid plans were announced today.

“While authentication won’t solve the problem of unwanted robocalls by itself, it is a key step toward giving customers greater confidence and control over the calls they answer,” AT&T and T-Mobile said in their announcement.

The SHAKEN/STIR framework uses “digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure,” telecom software provider TransNexus explains. “In simple terms, each telephone service provider obtains their digital certificate from a certificate authority who is trusted by other telephone service providers. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.”

Because of this, SHAKEN and STIR will work best when it’s adopted by all major phone providers, and the Federal Communications Commission has been urging carriers to deploy it quickly. AT&T and Comcast announced that they completed a successful cross-network test of SHAKEN/STIR in March.

Verizon said it began deployment of SHAKEN/STIR in March, and Sprint has said it will do the same.

Wider industry adoption needed

T-Mobile already marks some calls as potential scams on a phone’s incoming call screen using previously implemented technology. But calls that fail the new Caller ID verification test will not come with warnings unless there’s another reason to suspect that it’s a scam, T-Mobile told Ars. Most calls today aren’t subjected to the SHAKEN/STIR test, T-Mobile said. Even after the major US carriers implement SHAKEN/STIR, international calls and calls from small carriers might not be verified, the company said.

“This tech is still in early days—the true consumer benefit is in the future, when most of your calls are Caller Verified and you notice the ones that aren’t with suspicion,” T-Mobile said.

AT&T told us that a call’s SHAKEN/STIR status is another data point added to the other analysis it does to determine whether to block a call or issue warnings. Most legitimate calls today are not verified through SHAKEN/STIR, so a call’s unverified status isn’t enough on its own to trigger a block, AT&T said.

The free version of AT&T’s Call Protect service automatically blocks calls that AT&T categorizes as “fraud.” AT&T Call Protect also provides warnings for suspected “spam” calls but lets them ring your phone unless you buy the premium version for $4 a month and choose to automatically block them. AT&T says it categorizes calls as spam if they appear to be nuisance calls but aren’t necessarily trying to defraud people.

The new SHAKEN/STIR data is being fed into Call Protect, which was already using other data analytics and reports from customers to evaluate calls.

T-Mobile offers free robocall blocking but charges $4 a month for “Name ID.” The paid service lets you block calls from specific callers or from entire categories, “including telemarketers, numbers that have been tagged as nuisance calls, political calls, survey calls and more,” T-Mobile says. Name ID is included for no extra cost in the $15-per-month T-Mobile One Plus add-on and T-Mobile’s premium “Magenta Plus” plan but is a separate $4 charge for other customers.

https://arstechnica.com/?p=1551459