State of Voice Security - 2022

The public switched telephone network, (PSTN) that interconnects various customers and businesses through their mobile devices, business phones and contact centers continues to get more hostile. Our enterprise and government voice security customers received more robocalls, spam, fraud and abuse on average in 2021 than any year in our 20+ years of data.

In 2022 it is increasingly easy to cheaply, anonymously, and safely deliver millions or even billions of robocalls calls intended to try and harvest information and find weak spots for attack. For that reason robocalls continue to rise (both legal and illegal forms) even in the face of more aggressive FCC enforcement. Robocall-enabled attacks, and scams continue to rise and will do so for the foreseeable future.

Despite increased focus from the FCC, and legislators, and a host of state and local laws passed attempting to diminish the trend, it continues to be very easy for hackers and abusers to spoof phone numbers. In 2022 when a voice network or contact center receives a call, they can’t trust the information on the caller ID and they can’t trust the person who is calling in. And that’s one reason why fraud and various other types of attacks and threats continue to rise.

Telephony Denial of Service (TDoS) is a flood of inbound calls that can saturate some element of a contact center or enterprise voice network, preventing legitimate calls from getting through.

In February 2021, the FBI released a security announcement warning of potential TDoS attacks. In it, FBI investigators noted that there is a high probability that Telephony Denial of Service (TDoS) attacks are going to flood emergency 911 centers with the intention of taking them offline. TDoS attacks pose a genuine threat to public safety, especially if used in conjunction with a physical attack, by preventing callers from being able to request service.

Vishing means ‘voice phishing,’ an attack in which threat actors use phone calls instead of emails. Their goal: to try to trick the person on the other end into allowing access to their accounts. Vishers may try to convince enterprise employees to visit a website designed to steal their credentials thus giving attackers all they need to move deeper into the victim’s network.

On Jan 14, 2021, the FBI warned that cyber criminals are using Voice over Internet Protocol (VoIP) platforms to launch vishing attacks against enterprise employees worldwide. In one example hackers located an employee through a company’s chatroom, the FBI said. Then, they used a fake VPN login page to steal their credentials. The attackers authenticated themselves as the employee. Using this false persona, they found another employee who could implement usertitle and e-mail changes. Next, they used a chatroom messaging service to steal that person’s details, too.

In November 2021 the popular online stock-trading app Robinhood fell victim to a cleverly executed Vishing attack in November 2021 when a Robinhood rep unwittingly handed over keys to the personal information of about 7 million customers in what's now believed to be the biggest retail brokerage cyber-breaches of all time.

Toll Free Traffic Pumping, also know as "access stimulation" or "call pumping", is a sophisticated form of toll call fraud in which 1-800 numbers are flooded with bogus calls. Those calls generate revenue for the fraudster who has created a fake telephone company and is now billing your toll call provider for carrier fees for a portion of each call.

In the last year we've seen a rise in requests from customers looking for relief from Toll-Free Traffic Pumping, and the reason is that an increase in overall phone traffic during the pandemic has also led to a situation where toll-fraud is harder to detect and potentially more lucrative for the bad actors.

One of the biggest disadvantages to KBA (knowledge-based-authentication) is that often times the fraudsters know the personal information of their victim better than the victim does themself. The data that powers KBA is bought and sold on the dark web where hackers harvest it. There’s also additional ways of getting this information through social engineering or in many cases, simply scraping social media.

It is important to note that KBA takes time even when it goes well. In the best case scenario, if a contact center has a customer answer three questions and the customer answers quickly and correctly, the process still takes 30 seconds. If it’s not done perfectly and it takes more time, then that component of the transaction is even larger. So, if the overall contact center call length is three minutes and you’ve wasted 30 seconds or a minute on KBA. That’s very, very expensive for the contact center. It’s also annoying for the customer.

With robocall and caller ID-spoofing technology and tools enabling larger, more frequent, and more sophisticated attacks, the time to implement automated authentication on your voice network and call centers is now. We predict that KBA will finally begin a more robust decline in 2021 and be phased out in favor of better automated authentication solutions, ones that can leverage and extend the protections promised by STIR / SHAKEN and at a more affordable and scalable model than supported by voice biometrics and related solutions.