NCLC & EPIC FCC Numbering Ex Parte (03/25/24)

March 25, 2024

Marlene Dortch

Secretary

Federal Communications Commission

445 12th Street, SW

Washington, D.C. 20554

Re: Notice of Ex Parte Presentation, WC Docket No. 13-97, 07-243, 20-67

Dear Ms. Dortch:

One March 21, 2024, the two undersigned attorneys from the National Consumer Law Center and the Electronic Privacy Information Center (EPIC) respectively, met with the following staff of the Wireline Competition Bureau: Ty Covey, Heather Hendrickson, Jodie May, Terri Natoli, Jordan Reth, Mason Shefa, and Raphael Sznajder. Most of the meeting was devoted to a discussion of the major points in our joint consumer and privacy group reply comments filed on December 22, 2023.[1] However, as we covered some additional material, this ex parte letter is intended to supplement the points made in our reply comments.

1. Callers rotating through numbers circumvent the goals of the TRACED Act as well as the efforts of the FCC and providers to block illegal calls.

We explained how callers making illegal scam and telemarketing calls use a system of rotating outbound numbers that allows them to circumvent the caller ID authentication protections of STIR/SHAKEN (S/S). The callers use the numbers to originate only a few calls from each number to avoid having the numbers identified as the source of illegal calls by downstream providers seeking to block or identify calls as scam, telemarketing, or spam calls. As the numbers used to make the calls are the same numbers that appear in the call detail records (CDRs) and on the recipient’s caller ID, the providers certifying the S/S status can apply an “A level” attestation. Yet, the caller IDs are meaningless to the call recipients, as they do not actually identify the callers and they rarely provide the recipients with a number that they can call back to request that calls stop.

The practice we are highlighting has these characteristics:

• A single caller making calls for the same campaign deliberately rotates through many different numbers for calls within the campaign;
  
  
• The numbers displayed on the caller ID for the calls are chosen to deceive the call recipients into believing that the caller is located in the same area as the recipient; and
  
  
• The called party is not able to reach the caller through the displayed number.

We have not been able to detect a single legitimate purpose for callers to cycle through a list of rotating numbers in this way.  Instead, we are positing that the entire purpose of using number rotation in this way is only to evade the goals of the TRACED Act, as well as several specific FCC regulations (identified in section 3 infra).

A primary goal of the TRACED Act was to facilitate the identification of callers to enable call recipients to know who is calling them.[2] Yet the practice of rotating through outbound dialing numbers completely obscures both the identity and the actual location of the caller. Similarly, the Commission has long sought to protect consumers from neighbor spoofing.[3] Yet using blocks of numbers that are deliberately chosen because they are local to the called parties is tantamount to neighbor spoofing. While STIR/SHAKEN can identify and prevent caller ID spoofing, the process is completely unable to detect when a number is being used in this number rotation method just to make the caller appear to be local to the call recipient.

To the called party, there is little difference between a number spoofed to appear local and an actual local number used in a temporary manner that does not reflect the caller’s actual location. In both instances, the number that appears on the consumer’s phone has no meaningful correlation with the caller that is calling them. Moreover, number rotation is specifically designed for the purpose of encouraging recipients to answer calls by deceiving them that the caller is located in the recipient’s area.

A few examples of public advertisements from VoIP providers promoting services to facilitate these deceptive practices are:

• “Call center automatically calls from a phone number to match the contact’s local area codes.”[4]
  
  
• “[E]ven if your business is located in Texas, you can display a Florida area code number.”[5]
  
  
• “Placing over 100 calls per day per phone number is one of the quickest ways a number gets flagged or blocked. Before dialing into an area code, make sure you have enough DIDs in that area code to ensure you are placing no more than 100 daily calls per number—and much fewer, whenever possible.”[6]
  
  
• “Intelligent ANI assignment to every dial maximizes your contact potential down to the prospect level.”[7]

This last provider also noted that: “swapping numbers used for outbound too frequently can and likely will cause called party frustration when they attempt to call you back to speak with an agent or to make a Do Not Call request…. In fact, regulators could consider this practice misleading or even deceptive…”[8]

Fraud is encouraged by an environment that permits a ratio of low investment by scammers and high payoff in consumer losses. In this instance, inexpensive number acquisition and rotation for placing millions of calls is the low investment.[9] The high payoff is hundreds or thousands of dollars from each defrauded consumer.[10] Since 2019, the Federal Trade Commission has reported the median loss from a scam phone call to be greater than or equal to $1,000.[11] Only a handful of calls out of millions need to result in consumer losses for the fraudsters to come out ahead. Moreover, as ZipDX explained in its reply comments, allowing this system of rotating numbers provides no economic incentive for resellers themselves to conserve numbers.[12]

• Enforcement actions by State Attorneys General illustrate how number rotation is used by illegal callers to evade detection and rule enforcement.

The litigation sponsored by the Anti-Robocall Multistate Litigation Task Force of 51 bipartisan State Attorneys General (AGs),[13] as well as three individual actions brought by State AGs,[14] illustrate that callers often cycle through outbound numbers in their scam call campaigns, rarely using the same number more than twice. This is indicative of the harm caused by rapid number rotation in outbound calling.

North Carolina action. In the North Carolina case, the Attorney General noted that a legitimate telemarketer would likely use a single telephone number, which it refers to as “automated number identification” (ANI), for each campaign. For example, a legitimate marketer seeking to track metrics for five campaigns sent to 100,000 subscribers total would use five ANIs, one for each of its campaigns. This would result in a Call-Per-ANI ratio of 20,000.00:1 (100,000 calls sent from five unique numbers).[15] However, the complaint noted that one of the defendants in North Carolina’s case sent more than 4.4 million calls, nearly every call from a distinct calling number, giving the campaign an average Calls-Per-ANI ratio of 1.08.[16]

Multistate action. In its multistate action, the Anti-Robocall Multistate Litigation Task Force noted that one scam campaign utilized more than 474 million different telephone numbers (which the complaint refers to as caller ID or direct inward dial service (DID) numbers) and that more than 72% of those DIDs were used to make just one phone call.[17] That means that more than 340 million numbers were each used to make a single call. Another campaign used more than 55.5 million different DIDs to place calls, more than 71% of which were used to make just one call.[18] A third campaign noted more than 78.9 million DIDs were used to place calls, more than 80% of which were used to only make one or two calls.[19] The complaint detailed multiple additional campaigns that followed a similar pattern.[20] One originating voice service provider facilitated one defendant’s acquisition of over 800,000 DIDs.[21] The multistate complaint noted that call detail records (CDRs) for legitimate traffic would have a significantly higher number of total calls than total number of unique calling phone numbers used (e.g. 100,000 total calls with only 5 total ANIs in the North Carolina legitimate telemarketer hypothetical example). Yet, the CDRs for illegal call traffic in the multistate action was closer to a 1:1 ratio (e.g. 100,000 total calls and approximately 100,000 total ANIs, except on the scale of millions of calls, sometimes hundreds of millions of calls).[22]

Vermont case. In the case brought by the Vermont Attorney General, the complaint noted that one of the defendants in its case used a calling source that generated new numbers for each one or two calls, with a calls-per-ANI ratio of 1.65, indicating that the calls were “obviously fraudulent.”[23]

Ohio case. In the case brought by the Ohio Attorney General, the complaint stated that one or more of the defendants purchased or leased massive quantities of unique telephone numbers, to increase the volume of numbers available to use for caller ID.[24] The Ohio complaint noted that the transmission of more than 510 million unique numbers for caller ID purposes evidenced a spoofing pattern.[25]

• While existing regulations prohibit this misconduct, the FCC should use TRACED Act authority to issue a new rule that unequivocally prohibits number rotation for outbound calls.
  
  

There are several existing FCC regulations that seem to prohibit the practice of using the rotation of numbers to mislead consumers about who is calling them, or to assist the callers in evading blocking or labeling calls by downstream providers.

Caller ID is required for all telemarketing calls. In the telemarketing context, 47 CFR § 64.1601(e) requires that telemarketers provide a caller ID. As the regulation explicitly states that the provided number must permit the individual to make a do-not-call request during regular business hours, the use of a temporary number that does not support inward dialing and is not available for the called party to reach the caller does not satisfy the requirement to provide a caller ID in telemarketing calls.[26]

Caller ID cannot be used to mislead call recipients. Under 47 CFR § 64.1604, every person is prohibited from causing “any caller identification service to transmit or display misleading or inaccurate caller identification” (emphasis added) with intent to defraud, cause harm, or wrongfully obtain anything of value. Deliberate use of number rotation using local numbers is misleading and inaccurate. The requirement that the caller’s purpose must be to defraud, etc., may make this regulation inapplicable to some uses, but it is clearly applicable to scam calls, and possibly to telemarketing calls.[27]

Voice service providers are required to use due diligence to ensure that their callers are not originating illegal traffic. When the number reseller is a voice service provider—as appears to be often the case—47 CFR § 64.1200(n)(4)[28] is applicable. That section requires providers to take “affirmative, effective measures” to prevent the use of their network to originate illegal calls, including “know your customer” requirements. Further, as terminating providers are explicitly encouraged to block calls based on “reasonable analytics”[29] that include “consideration of caller ID authentication information,”[30] allowing callers to evade these blocking efforts by rotating numbers undermines the Commission’s multiple efforts to eliminate unwanted calls.

Given this ample authority, the FCC should explicitly say that providers are prohibited from offering any service that obfuscates the real caller’s name, location, and telephone number, including but not limited to rotating through numbers for this purpose. Allowing the caller ID to display the name and telephone number of the seller rather than the telemarketer, as expressly permitted by 47 CFR § 1601(e)(1), should continue to be permitted.

If the Bureau determines that the above regulations, independently or collectively, are insufficient authority to prohibit use of rapid number rotation for outbound dialing, we urge the Commission to use its authority under the TRACED Act to issue a new rule that specifically prohibits the misuse of access to numbers. This request is aimed at preventing the harm of rapid number rotation on outbound calls; we would support exemptions for appropriate reasons if there are any (however, we have not been able to discover such a reason to date).[31]

• The Commission should use its auditing authority to curtail improper use of numbering resources.

We also encourage the Commission to resume and target its auditing of the use of numbers, per the North American Numbering Council’s recommendation last year: “[t]he FCC established a comprehensive audit program and codified its audit process. Estimated audit expenses are included in the NANPA budget, but no monies have been drawn against the audit budget line item in recent years.”[32] Indeed, although the process and budgeting for carrier audits are well-established, the line item has gone unused for over a decade.[33] The Maine Public Utilities Commission (PUC) agrees,[34] and further notes that such an audit is not likely to be affordable for an individual state utility commission—[35] which indicates that the Federal Communications Commission is the best-positioned regulator to conduct this oversight.

The Commission should focus its initial audits on carriers who have been identified by AGs, the Industry Traceback Group, state public utility commissions, or private contractors, as having potentially engaged in improper use of numbering resources, as we have described. Any reseller who is allowing misuse of numbers by its downstream customers such that their caller customers are rapidly rotating through different numbers, are displaying caller ID numbers that do not reflect the caller’s actual location, or are not permitting the called party to reach them by calling the displayed number back, should be subject to losing their authorization to access numbering resources.

The threat of revocation must be real for it to function effectively as an incentive. As such, we support the Commission’s proposal to revoke a reseller’s authorization to access numbering resources altogether,[36] especially where economic deterrents to misconduct are inadequate (i.e. would amount to “the cost of doing business”).[37]

We would be happy to engage in further conversation about this important subject, or to answer any questions. Thank you very much for your consideration of our concerns.

This disclosure is made pursuant to 47 C.F.R. § 1.1206.

Sincerely,

Chris Frascella                                                                         Margot Saunders

Counsel                                                                                   Senior Counsel

Electronic Privacy Information Center                                    National Consumer Law Center

1519 New Hampshire Ave, NW                                              1001 Connecticut Ave, NW

Washington, D.C. 20036                                                          Washington, D.C. 20036

[email protected]                                                                   [email protected]

www.epic.org                                                                           www.nclc.org

---

[1] In re Numbering Policies for Modern Communications, Telephone Number Requirements for IP-Enabled Service Providers, Implementation of TRACED Act Section 6(a)- Knowledge of Customers by Entities with Access to Numbering Resources, Reply Comments of NCLC, Consumer Action, Consumer Federation of America, EPIC, National Association of Consumer Advocates, National Consumers League, and U.S. PIRG, on Second Further Notice of Proposed Rulemaking in WC Dkt. Nos. 13-97, 07-243, 20-67 (filed Dec. 22, 2023), available at https://www.fcc.gov/ecfs/search/search-filings/filing/122235773414 [hereinafter “Joint Consumer Advocate Reply Comments”].

[2] Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, Pub. L. No. 116-105, § 4(b), 133 Stat. 3274 (2019).

[3] See, e.g., Fed. Commnc’ns Comm’n, Consumer Alert: Protect Yourself Against ‘Neighbor Spoofing’, Scam Callers Placing Phone Calls that Appear to be Local (Mar. 8, 2018), https://docs.fcc.gov/public/attachments/DOC-349632A1.pdf.

[4] https://callhub.io/platform/dynamic-caller-id/; see also Comments of NCLC and EPIC, In re Call Authentication Trust Anchor, WC Dkt. No 17-97, at 4 (June 5, 2023), https://www.fcc.gov/ecfs/search/search-filings/filing/10605050535175; Comment of Electronic Privacy Information Center and Consumer Action, WC Dockets 13-97, 07-243, 20-67, at 2 n. 7 (Nov. 29, 2023), available at https://www.fcc.gov/ecfs/document/1130061407794/1 [hereinafter “EPIC CA Comment”].

[5] https://www.unitedworldtelecom.com/learn/what-is-a-dynamic-caller-id-for-voip/ .

[6] https://www.convoso.com/blog/phone-number-marked-as-spam/ (Emphasis added).

[7] https://www.outboundani.com/services .

[8] https://www.outboundiq.com/post/no-more-number-swapping (quoting Ken Sponsler, SVP Practice Manager, CompliancePoint).

[9] We do not have cost figures for rapid number rotation services provided to callers by providers, but we analogize it to the economics of call transmission. By some estimates, robocallers can send one million calls for as little as $1,000 in call transmission costs. See, e.g., Comments of ZipDX LLC at 2, In re Advanced Methods To Target and Eliminate Unlawful Robocalls, Call Authentication Trust Anchor, Seventh Further Notice of Proposed Rulemaking in CG Docket No. 17-59, and Fifth Further Notice of Proposed Rulemaking in WC Docket No. 17-97 (Aug. 17, 2022), https://www.fcc.gov/ecfs/search/search-filings/filing/108182676204994.

[10] In our 2022 report, National Consumer Law Center & Electronic Privacy Information Center, Scam Robocalls: Telecom Providers Profit 9 (June 2022), available at https://www.nclc.org/wp-content/uploads/2022/09/Rpt_Scam_Robocalls.pdf, we estimated that on average more than $2BB is lost by consumers due to scam robocalls every month. More recent data suggests this exceeds $3BB monthly. See, e.g., Reply Comments of EPIC & NCLC, In re Advanced Methods to Target and Eliminate Unlawful Robocalls, Call Authentication Trust Anchor, WC Dkt. No. 17-97, CG Dkt. No. 17-59, at 4 n. 8 (Sept. 16, 2022), https://www.fcc.gov/ecfs/search/search-filings/filing/1091775446187; see also Comments of EPIC, NCLC, et al., In re Targeting and Eliminating Unlawful Text Messages, CG Dkt. No. 21-402 at 10 (Nov. 10, 2022), https://www.fcc.gov/ecfs/search/search-filings/filing/11110142720936 (noting that the source of the FCC’s $10.5 billion figure is from 2019 and the more recent 2022 report from the same source indicates $39.5 billion in estimated annual consumer losses).

[11] See FTC Consumer Sentinel Network, Fraud Reports by Contact Method, Reports and Amounts Lost by Contact Method, for Contact Method: Phone Call (last visited Mar. 22, 2024), https://public.tableau.com/app/profile/federal.trade.commission/viz/FraudReports/FraudFacts (reporting a median of $1,000 for 2019 (all Quarters), $1,200 for 2020 (all), $1,400 for 2021 (all), $1,400 for 2022 (all), and $1,480 for 2023 (all)).

[12] See Reply Comments of ZipDX LLC at 2 (Jan. 1, 2024), https://www.fcc.gov/ecfs/search/search-filings/filing/10102043100447.

[13] See, e.g., Press Release, Attorney General Mayes Sues Avid Telecom Over Illegal Robocalls (May 23, 2023), https://www.azag.gov/press-release/attorney-general-mayes-sues-avid-telecom-over-illegal-robocalls; Complaint and Demand for Jury Trial, State of Arizona ex rel. Mayes, et al. v. Michael D. Lansky, LLC, dba Avid Telecom, et al., Case No. 4:23-cv-00233 (D. Az. May 23, 2023) [hereinafter “Multistate Complaint”].

[14] See Complaint for Injunctive Relief and Civil Penalties, North Carolina ex rel. Stein v. Articul8, LLC & Paul K. Talbot, Case No. 1:22-cv-00058 (M.D.N.C. Jan. 25, 2022) [hereinafter “NC Complaint”]; Complaint, State of Vermont v. Bohnett, Case No. 5:22-cv-00069 (D. Vt. Mar. 18, 2022), available at https://ago.vermont.gov/sites/ago/files/wp-content/uploads/2022/03/TCA-VOIP-Complaint.pdf [hereinafter “VT Complaint”]; Complaint for Permanent Injunction, Damages and Other Equitable Relief, Ohio ex rel. Yost v. Aaron Michael Jones, Sumco Panama USA, et. al, Case No. 2:22-cv-02700 (S.D. Oh. July 7, 2022) [hereinafter “OH Complaint”].

[15] See NC Complaint at 16 ¶ 60.

[16] See id. at 18 ¶ 65 (“The average Calls-Per-ANI of [Defendant’s] calls was 1.08, which means that almost every one of the over 4.4 million calls answered came from a distinct—and likely illegally spoofed—calling number.”).

[17] See Multistate Complaint at 24 ¶ 88(a) (“More than 474.8 million different Caller ID or DID numbers were used to place those calls, over 72% of which were used to make just one telephone call. Among these calling numbers, over 58% matched the call recipient’s area code, with a small percentage of that matching both the area code and local exchange.”).

[18] See id. at 24 ¶ 88(b) (noting more than 55.5 million different DIDs used to place calls, more than 71% of which were used to make just one call, over 70% matching the called party’s area code).

[19] See id. at 25 ¶ 88(c) (noting more than 78.9 million different DIDs used to place calls, more than 80% of which were used to make only one or two calls, 30% of which matched the called party’s area code).

[20] See, e.g., id. at 25 ¶ 88(d); id. at 25-26 ¶ 88(e); id. at 26 ¶ 88(f).

[21] See id. at 78 ¶ 375 (“Modok set up a wholesale account for Sumco so that Modok would no longer appear to be the originating voice service provider for the Sumco robocall traffic. Reeves assisted with the account set up for Virtual Telecom and facilitated the acquisition of over 800,000 DID numbers for Sumco’s use.”).

[22] See id. at 23 ¶ 84 (“CDRs for legitimate traffic reflect that the total number of calls is significantly greater than the total number of unique calling phone numbers used. However, CDRs for illegal call traffic reflect close to a 1-1 ratio for the total number of calls to the total number of unique phone numbers.”).

[23] See VT Complaint at 28 ¶ 105(c) (“Lastly, the ratio of called numbers to CallerIDs displayed was exceedingly low. For every 1.65 calls dialed, a new CallerID was displayed. Again, given the broader context (of a high volume of short duration, likely “spoofed” calls), there is no benign explanation for this ratio. The calling source was generating new numbers for each 1 or 2 calls to avoid detection as fraudulent and being blocked by downstream VSPs. The robocalls were obviously fraudulent.”); id. at 28 ¶ 105(c), 31 ¶ 116(c).

[24] See OH Complaint at 18 ¶ 61; id. at 18 ¶ 62 (“Through simultaneous contracts with multiple VoIP service providers, Call Originator Defendants were able to purchase or lease the assignment of over 2 million unique phone numbers in just over one year to “refresh” their inventory of caller ID numbers…”).

[25] See id. at 17 ¶ 57.

[26] 47 CFR § 64.1601(e)(1). See also Letter of National Association of State Utility Consumer Advocates at 5 (Jan. 25, 2024), https://www.fcc.gov/ecfs/document/10125269227222/1 (noting that a telemarketer using a misleading caller ID conflicts with this provision of the CFR) [hereinafter “NASUCA Letter”].

[27] See Joint Consumer Advocate Reply Comments at 7; NASUCA Letter at 5 (noting that using a misleading caller ID seems to violate 47 USC § 227(e)(1)).

[28] Joint Consumer Advocate Reply Comments mistakenly referred to this as section (n)(3).

[29] 47 CFR § 64.1200(k)(3)(i).

[30] 47 CFR § 64.1200(k)(3)(ii).

[31] NASUCA and Maine Public Utilities Commission (ME PUC) also support this request for a prohibition, see NASUCA Letter at 2, 8; Reply Comment of Maine Public Utilities Commission at 4 (Dec. 28, 2023), https://www.fcc.gov/ecfs/search/search-filings/filing/1228119567049 [hereinafter “ME PUC Reply”].

[32] See North American Numbering Council, Report and Recommendation on the Feasibility of Individual Telephone Number (ITN) Pooling Trials and Alternative Means for Conserving Numbering Resources, 31 (Jan. 31, 2023), https://www.fcc.gov/files/finalnaowgnancitnapprovedreport02282023. Chris Frascella is currently a member of NANC’s Numbering Administration Oversight Working Group (NAOWG), but was a non-voting member of NANC and was not a member of any NANC Working Group when this report was developed and published.

[33] See EPIC CA Comment at 5.

[34] See ME PUC Reply at 3 (Maine PUC suggested that wholesalers do not know the status of their phone numbers, and that IVoIPs or CLECs initially authorized to receive numbers may have “no idea” of the type of activity in which their downstream customers are engaged. Note that ME PUC has considerable experience with vast quantities of numbers being requested for extremely rural areas, which seems suggestive of ill intent).

[35] See id. at 4-5.

[36] See Joint Consumer Advocate Reply Comments at 2. NASUCA and ME PUC support this as well, see NASUCA Letter at 2, 8; ME PUC Reply at 4.

[37] See EPIC CA Comment at 6.