Ringing in Our Fears 2024

The FCC describes phone companies as voice service, intermediate or gateway. Companies can fall in more than one category. Voice service companies have live customers and are used to either make or receive calls. Their lines carry voices. About 85% of companies in the FCC database are voice providers. Most of the rest are intermediate providers, which aren’t the first or last stop for phone calls. Rather they connect other networks to route calls. A small number of phone companies are both voice and intermediate providers.  A chunk of those are what’s known as gateways, which are U.S.-based intermediate providers that receive calls from foreign companies and forward them to another U.S.-based provider. 

Major voice providers were required in 2021 to comply with the industry-standard caller ID authentication technology (called STIR/SHAKEN), including foreign companies that use U.S. phone numbers to send phone traffic into the United States. Intermediate providers, smaller providers and gateway providers were phased in over the next two years. Certain companies have filed for extensions. Meanwhile, the FCC is evaluating how old-fashioned phone lines, which don’t operate on an internet-based system, can appropriately combat spam/scam robocalls.

Compliance was anemic in the first year but it’s gradually improved every year. As of Oct. 1, 2024, 66% of companies have completely or partially implemented anti-robocall technology. Broken down, it’s 47% complete, 19% partial. 

When you look only at voice providers that you use to make or receive calls, it’s better: More than 71% have completely or partially implemented anti-robocall technology. (About 51% have completed; about 21% have partially implemented.)

No one expected unwanted robocalls would disappear overnight. Still, the FCC has had to continue to increase pressure on phone companies and, at the same time, start combatting the more recent threat: robotexts.

Telemarketing calls — whether pre-recorded or artificial voice — without advanced written consent.

Telemarketing calls — whether pre-recorded, autodialed or artificial voice — without advanced written consent.
OR
Non-telemarketing pre-recorded or autodialed calls without your verbal or written consent.

Autodialed commercial texts without advanced written consent.
OR
Autodialed non-commercial texts without advanced verbal consent.

Note: You always retain the right to revoke consent that you gave to a company or organization at any time, whether it involves calls or texts.

One of the big asterisks to consumer protection law: political robocalls and robotexts. Here’s what to know about autodialed calls and texts:

• Political robocalls to cellphones require consent in advance. 
• Political robotexts require consent in advance. 
• Texts sent manually, not relying on an autodialer, can be sent without consent in advance.
• Political calls with pre-recorded messages require consent in advance.
• Political robocalls to home landlines are permitted without advanced consent, but can’t exceed three calls in a 30-day period.
• If political calls have been authorized but contain artificial or pre-recorded messages, the phone number of the caller must be stated, the person or entity making the call must be clearly identified at the beginning and the business name of any identity must be stated at the beginning. 
• Even if consent has been granted, it can be revoked instantly, by asking someone not to call again or by replying “STOP” to a text.
• Political calls and texts are exempt from compliance with the national Do Not Call list. But they must follow the other rules.

PDF – What’s Legal and What’s Not

In May 2024, the FCC started squeezing phone companies even more. Companies are already prohibited from allowing calls on their lines from voice providers or U.S.-based gateway providers that aren’t in the Robocall Mitigation Database. Now, they’re prohibited from allowing traffic from any provider not listed in the database. This is aimed at foreign-based providers.

It’s not clear how many companies that may box out. It’s reasonable, though, to assume that many companies that are violating the law because they haven’t even bothered to register with the FCC database may also be transmitting scam calls.

In March 2023, the FCC adopted its first rules about scam robotexts. But these rules are just scratching the surface.

They require phone companies to block texts that seem to be coming from phone numbers that are “unlikely to transmit text messages.” These include numbers that aren’t valid or aren’t allocated to anyone.

Blocking is also required for numbers that are never used to send texts, according to those who actually control the number. Bad guys may hijack numbers that belong to banks, government offices and others to make it seem their texts are coming from those offices. But if those numbers aren’t used to send legitimate texts, phone companies must block the texts.

In September 2024, the FCC announced plans to expand its call blocking rules. The new rules will require all phone providers block numbers on a “reasonable do-not-originate” list, meaning phone numbers that don’t make outbound calls. Previously, the blocking rule applied only to U.S.-based intermediate providers that receive calls foreign phone companies.

In December 2023, the FCC codified that after someone puts their phone number on the Do Not Call Registry, that means it’s also illegal for marketing texts to be sent to that number without expressed permission.

The March 2023 announcement also said the FCC wants input on additional “regulatory actions” it can consider to protect consumers from fraudulent robotexts.

“Robotexts pose a unique threat to consumers,” the FCC said. “Unlike robocalls, scam text messages are hard to ignore or hang-up on and are nearly always read by the recipient – often immediately.” In contrast, many of us routinely don’t answer phone calls from numbers we don’t recognize or aren’t expecting.

In September 2024, the FCC proposed new rules focused on robocalls generated by Artificial Intelligence. The rule would aim to better protect consumers by better defining AI-generated calls, mandating that callers disclose the use of Artificial Intelligence and supporting technology to alert consumers to AI robocalls. The tension: protecting positive uses of AI that benefit phone customers with disabilities.

“Bad actors are already using AI technology in robocalls to mislead consumers and misinform the public,” FCC Chairwoman Jessica Rosenworcel said in a statement. “That’s why we want to put in place rules that empower consumers to avoid this junk and make informed decisions.”

In December 2023, the FCC approved new rules allowing the regulator to “red flag” numbers that cellphone companies would be required to block texts from those numbers.

In December 2023, the FCC urged cellphone companies to prohibit email-to-text messages to customers unless they’ve specifically opted in. Scam and other illegal robotexts can be sent more easily from email addresses, using the email version of a cellphone number. These texts are “a major source of unwanted and illegal text messages,” the FCC said.

In December 2023, the FCC cracked down on what it called the “lead generator loophole.” The new rules spell out that it’s absolutely illegal for comparison shopping websites and sales lead generators to contact consumers through robocalls or robotexts unless they have the consumer’s expressed consent for each marketer or seller.

Previously companies often made marketing robocalls and sent out marketing robotexts based on a single consent given to one company that was then shared with the marketer’s friends or partners.

The FCC recently approved changes to the Telephone Consumer Protect Act. “to make it simpler for consumers to revoke consent to unwanted robocalls and robotexts while requiring that callers and texters honor these requests in a timely manner.” The new rules take effect April 11, 2025.

Primarily, the rules say consumers can revoke consent to calls and texts “in any reasonable manner,” — including saying or texting words such as stop, quit, end, revoke, opt out, cancel or unsubscribe.

Further, callers must comply with Do Not Call and revocation requests within 10 days. Texters are allowed to send one text message within five minutes of a request to confirm the request.

Also in the March 2023 rules, all cellphone companies must have a person or office that can be contacted by text senders when they have questions about blocked texts.

The actual volume for 2024 is unclear because Robokiller, the source relied on for years by the FCC, FTC and major media, was sold earlier this year. The new owner continues to say the average every month in 2024 is 19.2 billion.

Camila Saraiva Fernandez, a spokeswoman with the new owner, said the company is considering when it may resume that monthly research. Other major researchers release only annual totals after year-end.

Spam and scam robocalls affected an estimated 56 million adults in the United States in 2023.

Scam robocalls and robotexts are more than annoying; they’re costly. The amount of money lost to scam calls has exploded, from $9 billion a year in 2018 to $25 billion a year in 2023.

A huge evolving concern: Scammers are shifting away from massive push-one-button efforts – to call or text tens of thousands of people at one time with scary messages – to a more targeted approach.

In years past, scammers would send an avalanche of messages claiming to be from Citibank or Amazon or eBay, hoping some percentage of recipients would be actual customers who’d be more likely to act.

Instead, scammers are now moving toward more targeted calls and texts, with help from AI and massive data breaches that have exposed so much of our personal information. Con artists are more likely today to know who our relatives are, whether we recently had back surgery or have a birthday coming up next month. Those kernels of information make scammers more credible.

Social engineering and AI make scams easier to pull off, according to Truecaller, a Swedish company founded in 2009 that tracks scams and offers call and text blocking services. It predicts more “precision-targeted, deeply contextually relevant and persuasive spearfishing campaigns.”

“These surgical strikes have the potential to be much more effective – even at lower volumes, than the brute force mass out-dialing techniques of the past,” Truecaller wrote in its March 2024 report. It also noted that cellphones could be targeted because of the election and related issues.

The most common types of messages tell you:

• An account of yours has suspicious activity or failed log-in attempts.
• The attached invoice for hundreds of dollars was paid and here’s the link.
• There’s an issue with a delivery from the Postal Service, FedEx or UPS.
• A company is giving you an expensive product free; here’s a coupon.
• There’s some urgent problem, such as with an Amazon account.
• Your personal or financial information needs to be confirmed.
• You owe a payment; here’s the link.
• You qualify for some big discount on a student loan repayment.
• You’re eligible for some government refund or a big prize.
• We want to offer you an easy, high-paying job: data entry or mystery shopping.
• Look at this celebrity endorsing this investment. (It’s actually a deepfake using fake videos, photos, or audio recordings.)

In any of these cases, even clicking a link and not voluntarily providing information can be harmful. It may infect your phone or computer with a virus or malware that can compromise your information later.

The con artists usually impersonate a known entity such as the Internal Revenue Service, Medicare, one of the large banks or a major company. Some of the companies most commonly impersonated: Best Buy/Geek Squad, Amazon, PayPal, Microsoft and Publishers Clearing House and Amazon.

It’s important to remember the growing problem: Scammers aren’t necessarily targeting us randomly. This has been made possible in part by the barrage of data breaches, including the recent one involving National Public Data.

The scammers indeed know something about us. Or a lot about us. That makes it much easier for bad guys to con us.

In November 2022, the FCC removed Global UC Inc., an international long-distance provider, from the list of phone companies allowed to operate “for failing to meet the FCC’s requirements for protecting consumers against scam robocalls and malicious caller ID spoofing,” the FCC said. “We determined that Global’s certification did not include a robocall mitigation plan that described any specific reasonable steps it was taking to avoid the origination of illegal robocall traffic.”

The order “requires all … providers to cease accepting the company’s traffic.” But nearly a year later, Global UC corrected the problems, entered a compliance plan with the FCC and was reinstated in October 2023.

The FCC has taken additional actions, including cutting off certain phone companies from getting their call traffic on other companies’ lines:

1. In February 2024, the FCC removed 12 companies that failed to correct certification issues or didn’t convince the FCC that they shouldn’t be removed. Four are domestic voice providers and eight are are foreign voice service providers.
2. Also in February 2024, the FCC removed the certification of TELECLUB, a foreign voice service provider; its filing didn’t meet FCC requirements.
3. In March 2024, the FCC removed the certification of BPO Innovate because it failed to respond to traceback requests from the Industry Traceback Group, which works with the FCC to trace and identify the actual source of illegal robocalls, and its filing didn’t adequately explain what it’s doing to avoid originating illegal robocalls.
4. The FCC has warned multiple other companies in 2022 and 2023 that they could be removed for non-compliance.

The FCC points to other enforcement actions and progress, including:

1. Blocking robocall scam crime rings, leading to a 99% decline in auto warranty scam robocalls, an 88% drop in one month in student loan scam robocalls and stopping predatory mortgage robocalls.
2. Working with the phone industry to trace illegal robocalls to find out which companies allowed them.
3. Forming robocall investigation partnerships with 49 states, as well as the District of Columbia, Guam and other countries. Only Nebraska didn’t sign on earlier in 2024. This paves the way for the FCC’s enforcement bureau and states to work together to examine complaints, investigate crime rings involving robocalls and spoofed calls and build cases against suspected criminals.

Consumers can be defrauded in all types of ways. Among the most damaging: When a person is duped into thinking a call or text is from their bank and they must act now, or is tricked into believing they need to provide a code to someone who found their lost pet or wants to buy their car. Scammers use two-factor authentication codes to hack into accounts and steal money in seconds, often through person-to-person payment services such as Zelle, and through wire transfers if a scammer gets access to a bank account.

We didn’t see the volume and size of fraud we see now until instant payments were possible. Instant payments mean instant fraud. The money stolen rarely can be recovered.

Banks must do more to protect people, starting with three easy-to-understand policies:

1. Put guardrails on Zelle. Require Zelle to be an opt-in service with a 24- or 48-hour delay to be active. Banks can and do make Zelle opt-in for teenagers; they should do the same for everyone. Many bank customers whose accounts are raided because of Zelle have never used Zelle and didn’t even know their account could send a payment through Zelle. But Zelle can be used in a scam in mere seconds.
2. Limit money sent to first-time recipients. Zelle was founded just seven years ago, in 2017. What did we do before that? We didn’t send money instantly from our bank accounts to someone who could disappear in minutes. We survived just fine before instant payments. Other person-to-person payment services carry risks as well, but not like Zelle, because there’s a middleman or protection under credit card laws. P2P payments can be convenient, but there must be reasonable limits.What if payments to someone you’ve never sent money to before were limited to $100 and you couldn’t send more money for 48 hours? We bet fraud through Zelle would plunge. Most people who are scammed through Zelle realize it in a few minutes or hours.
3. Do more to recognize and question unusual withdrawals and transactions. If a customer has never done a wire transfer before, and suddenly there’s one requested online for $10,000, banks should confirm it with the customer with a phone call or by requiring an in-person branch visit.If a customer has never withdrawn more than $300 in cash at one time before, and suddenly they show up and want to withdraw $5,000 in cash, banks should ask some questions. Banks can’t prohibit customers from withdrawing money on deposit, but they also aren’t prohibited from gently asking questions that could reveal a scam. Scams are thwarted every week by bank employees who take the initiative to ask what’s behind a large withdrawal request.

In August, the Protecting Consumers from Payment Scams Act was introduced in Congress by Sens. Richard Blumenthal and Elizabeth Warren and Rep. Maxine Waters. The bill proposes updating the Electronic Fund Transfer Act (EFTA,) which protects consumer bank transactions such as ATM and ACH transactions, point-of-sale purchases and phone-authorized recurring payments, but not some electronic or wire transfers.

In a stunning hearing in July, the Senate Permanent Subcommittee of Investigations (PSI) revealed that its investigation showed that banks reimbursed fewer than 40% of Zelle fraud victims in 2023. This is despite a new Zelle policy to make victims whole. The hearing included high-level executives from Zelle and three of the largest U.S. banks, JPMorgan Chase, Bank of America and Wells Fargo.

One of the big findings: The three banks reimbursed only 38% of fraud victims in 2023, down from 62% in 2019. That amounted to more than $100 million worth of transactions each year for 2021, 2022 and 2023.

The Protecting Consumers from Payment Scams Act would offer robust protections for transactions through Zelle and other person-to-person services.

The FCC needs to crack down more on phone providers that flout the law. Congress passed a law that said companies must install robocall- fighting technology on the digital and internet parts of their networks or have another robocall mitigation plan on file. As of Oct. 1, 2024, only 66% of companies have completely or partially implemented anti-robocall strategies. The FCC has started blocking offenders from being allowed to transmit calls, but that’s amounted to fewer than 20 companies so far. The FCC and state regulators need to step up enforcement.

The public and government officials need more information about the entities that are making and allowing illegal robocalls. The industry’s Traceback Group (ITG) tracks thousands of tracebacks each year to discover where illegal calls originate and who along the way allowed the calls on their lines. The information is kept mostly private and released on a limited basis to regulators.

Republican-sponsored bills have been introduced in Congress in recent years with multiple bi-partisan co-sponsors that would open up this information to the public by protecting the ITG and phone companies from liability if they share information about illegal calls. Neither the House bill nor Senate bill moved out of committee. These bills or something like them need to be adopted soon.

Most phone companies need to do more to protect their customers. Companies are allowed to block suspected scam calls from ever reaching consumers, as long as they give customers a chance to opt back in. Companies are also allowed to label calls as possible scams or spam. And they’re allowed to display a checkmark next to a phone number, indicating the call is coming from the number displayed. This is occurring more than in years past, but still, too few companies offer these protections for their customers.

More companies also should give customers the power to block or filter suspicious calls or calls with no Caller ID or texts from unknown numbers if they want. Many companies don’t offer this or, if they do, they don’t make their customers aware of it.

The FCC continues to refine its rules to try to squash unwanted robocalls. For example, the FCC in March announced new rules to require all providers, regardless whether they’ve installed STIR/SHAKEN, to take “reasonable steps to mitigate illegal robocall traffic” and detail what they’re doing in the FCC’s Robocall Mitigation Database. The FCC must follow through with its promises to protect us.

The FCC needs to pass more rules to combat robotexts, requiring phone companies to block obviously illegal text messages. The FCC took baby steps this spring and has more proposed rules on the table. The rules require mobile wireless carriers to block texts originating from invalid, unallocated, or unused numbers. Texts from these numbers are most likely to be illegal, the FCC says.

The rules affect only 10-digit numbers and toll-free numbers, not “short code” messages. Short code messages are generally five- or six-digit numbers often used by companies to reach people who’ve opted in to receive texts about bank transactions, prescriptions ready for pickup, suspicious account log-ins, etc. Because there’s no phone number attached to the messages, you can’t really determine who sent them. (Pro tip: Create a named contact for entities you expect to receive texts from periodically. That way, you’ll know they’re legit.)

Other rules proposed would affect short code numbers, texts to numbers on the Do Not Call Registry and texts from marketers who didn’t get permission directly but tried to piggyback on consent given to a partner. Our phone numbers could be getting provided by lead generators and data brokers, the FCC says.

All of the laws in the world don’t guarantee illegal practices will stop. People who like to defraud people, which is obviously illegal, often don’t care about breaking other laws. So we all need to remain vigilant and do whatever we can to help educate our friends and loved ones about the dangers of illegal robocalls and robotexts.