Spoofing your bank’s phone number may be harder for scammers to pull off. But the fight is just beginning.
It is a scourge that can cost the victims concerned fortunes: fake bank advisor scams. The scenario is often the same. A scammer calls a potential victim, pretending to be their bank advisor, to invite them to validate financial transactions remotely. To give credibility to their speech, the scammers use personal information about the victim, gleaned from the internet, but also a formidable technique: spoofing.
Behind this barbaric name lies a technique that is as simple as it is unknown to many French people: the ability to usurp the telephone number of a third party – particularly a company, using specialized software. Thus, although the call may come from a scammer based on the other side of the world, it is indeed the telephone number of his bank that is displayed on the victim’s smartphone.
The result is damages of 380 million euros at the national level, according to the Bank of France’s Payment Security Observatory.
Number authentication mechanism
In an attempt to put an end to this phone number theft, the government passed a law in 2020, which, after several postponements, is due to come into force on October 1, 2024.
In concrete terms, telephone operators will then – in theory – be obliged to authenticate all numbers whose first digits correspond to those of professional numbers.
To make this authentication possible, professionals will then have to enter all the numbers they use in a database shared with operators. The tool is called the Number Authentication Mechanism (MAN).
Technically, the Number Authentication Mechanism could indeed block all unauthenticated numbers, and therefore the numbers of scammers. But in reality, the implementation of this tool on October 1 will be far from putting an end to fake bank advisor scams.
“The date of October 1st has been agreed by all operators, but we must be aware that this is only the beginning of the implementation of a new tool,” Romain Bonenfant, general director of the French Telecoms Federation (FFT), told Tech&Co.
And for good reason, the authentication process currently only works with voice over IP. In other words, calls that go over the internet. The tool will therefore not be able to work on calls to a traditional telephone line (copper).
Mobile difficulties
“We may have difficulties on mobile, even if phone calls use IP technologies (via the Internet, Editor’s note), due to the interconnection protocols between operators, which are not currently compatible with number authentication” adds Romain Bonenfant.
Another complex case: companies that delegate the use of their telephone number to a subcontractor, sometimes based abroad. For the time being, it is impossible for operators to carry out any authentication if the real number of a bank is used by a subcontractor.
In order not to deprive banks or insurance companies of their customer service, operators will be forced to “let calls go through” without using the MAN, the FFT concedes.
From October, the authentication tool will therefore be able to prove particularly effective in attempted fraud targeting landlines operating using internet boxes.
Furthermore, operators are now far from being the only intermediaries for telephone calls. With the multitude of messaging applications available, there are many entry points, this time without this authentication being applied.
“Nothing obliges Whatsapp, which operates from abroad, to carry out such authentication. We can therefore imagine a postponement of fraudulent calls” anticipates Alexandre Archambault, lawyer specializing in digital law, at Tech&Co.
Even with the law being enforced, scammers could continue to spoof your bank’s phone number while calling you through Whatsapp. At the risk, for some users unfamiliar with the different interfaces of calling applications on their mobile, of continuing to be scammed.
