using regex in call id blacklist (how do you deal with these pesky scam callcenters?)

[ITSDJE]

Hello Forum,

We are reciving telephone scam calls from a foreign callcenter, that is using spoofed caller ids. So far this callcenter was just using a single range of caller ids beginning with 04. As we usally do not recive calls from this range it did not hurt to simply block it competly using wildcards (asterisk).

Lately however we are reciving calls from almost every range of national caller ids leaving us with no way of blocking these calls without blocking a huge amount of legitimate callers.

It would be great if I could just use an regex here since the spoofed caller ids all have the same length of 10 digits, which is rather uncommon and using an regex here would minimize the amount of legitimate callers being blocked.

On the other hand maybe there are better methods for dealing with this issue I am not aware of. Our SIP-provider tells us he has no means of identifying these calls and blocking them.

Help, ideas or pointers to the right direction would be greatly appreciated.

 

[Alphabetic]

Firstly ask your SIP provider if they have a solution.

Then I would look at having your inbound routing hit an IVR as this may weed out some spam calls.

 

[ChrisC_3CX]

You could also potentially utilize the Caller ID reformatting feature on the SIP Trunk level. For instance, if incoming numbers with length of 10 digits and up are always scam calls, you could add an incoming caller ID reformatting rule to match all numbers with length of 10 digits and above:


All numbers less than 10 will fail to match this rule and therefore be allowed to go through unchanged, all numbers with digit length 10 and above will match this rule and therefore be formatted to "block". You can then add a Number Blacklist entry to match the caller id "block".

More on Caller ID reformatting here: https://www.3cx.com/docs/cid-reformatting/

Hope this helps.

 

[ITSDJE]

Thanks a lot to both of you.

As I said before our SIP-provider will not help. Routing everything through an IVR is not what we would like to do.

But using inbound CID-rules might actually work. I will give it a try. Luckily the call center seems to have given up for now.

 

[leejor]

Unfortunatly, if the numbers are constantly changing, and some legitimate numbers may use the same format/number length, then you risk blocking valid calls. While you are reluctant to use an IVR, requiring callers to make a selection, thus blocking robo-calls, if the caller ID method doesn't work, it may be something to consider.

An IVR message does not have to be long, and can give the appearance of providing usefull information to callers, rather than being an obstacle.

 

[ITSDJE]

Yes you are right there is still a chance of blocking legitimate numbers but we are using the CID-rules only temporary when a callcenter is targetting us. In my country it is rather uncommon that a caller ID is exact 10 digits long. Local numbers are usally shorter. Numbers from different Regions are usually longer.

As long as we are able to mitigate the callcenter problem using CID-rules an IVR is out of queastion. We have international callers too. An IVR would need to be in different languages. We use an IVR on more general reception numbers, but if a caller is using a direct dial-in number which isnt' even public (I know you can guess them easily) we don't want no IVR

 

[ChrisC_3CX]

Well do keep in mind that the Caller ID reformatting method I provided earlier will catch all 10 digit numbers and above. Since you need to allow longer numbers and only block exactly 10 digit numbers, you could add a second rule(with 11 dots) to first catch all numbers that are 11 digits and above as seen below:




Make sure that the order is as shown above, so that, all calls with 11 digits and above will be matched with the first rule which will leave the caller ID as is.

Of course if you have 10 digit Caller Ids coming in for legitimate calls, you will be blocking them as well.

 

[ITSDJE]

> Of course if you have 10 digit Caller Ids coming in for legitimate calls, you will be blocking them as well.

Yes I am aware of this and it is okay as we use these rules only temporary. I just queried our 3CX database and verified that legit 10 digit CIDs are rare enough to justify that they are temporary blocked as well.

I hope one day there will be some kind of CID authentication for the SIP protocol. Like what we have with mail where SPF, DKIM and DMARC do a decent yet not perfect job.