Wednesday, February 6, 2008

Be Aware of Caller ID Spoofing

The wireless operator's caller ID service embeds your phone number in every phone call and every network connection you make from your phone. A common assumption is that caller ID is always accurate, since it is controlled by the wireless operator. In fact, some services even use caller ID as their primary authentication mechanism. For instance, by default, T-Mobile's voice mail allows you to check messages without a password if you are calling from your T-Mobile mobile phone. Some web sites automatically sign into your account if you make an HTTP request from a phone number registered to your account. In many cases, your caller ID has become part of your identity.

However, in reality, caller ID is not completely secure. An experienced phone hacker can manipulate the network and change the caller ID to any number she wantsthis is called caller ID spoofing. Some callback services, such as Star38 (http://www.star38.com/) and Camophone (http://www.camophone.com/), allow anyone to spoof caller ID for as little as five cents per call.

You should call your service providers and request to set passwords for all mobile phonerelated network services. T-Mobile now allows customers to set an optional password on their voice mail account.

Remember that you cannot always trust the caller's identity based on the caller ID. For instance, if you get a call with the caller ID indicating "Bank of America," it does not necessarily mean that the call is indeed from a Bank of America representative. You certainly should not disclose your bank account information based on the caller ID. In this case, you should offer to call the representative back using a published number for Bank of America.

No comments: