Dial-through fraudsters using VoIP to outwit detectives
At around 6.30 on a Friday evening in February the phones in the head office of Manchester-based tool distribution company, Joseph Gleave & Son, started to give an occasional ping. The company was under a sustained and well-orchestrated attack from fraudsters who were hacking into its phone system.
Over the weekend they ran up a bill of £2,100 in illegal overseas calls to 19 countries - including Afghanistan, Albania, Algeria, Ecuador, Egypt, Iran, Jordan, Lebanon, Morocco, Pakistan, Sudan, Serbia and the Republic of Yemen. The biggest single item was £71 on one call to Afghanistan, where local call termination charges are among the highest in the world.
The thieves made themselves more difficult to trace than in previous cases by using a combination of the internet and more sophisticated switching technology.
"Dial-through fraud" exploits a facility offered on many digital exchanges that lets company employees ring in to the switchboard and then by keying certain dialling codes get an outside line to anywhere in the world. Because it's meant for employees, the company picks up the bill for the outgoing call. But anyone who cracks the protection around those codes can make unlimited calls at the company's expense.
Greater Manchester Police closed the case after a quick and unsuccessful investigation. A spokesman said it had been told by BT that the calls could have originated from anywhere in the world.
Police suspect the deployment of a new combination of voice over internet protocol (VoIP) calls from overseas in combination with a so-called Sim box, which a local operative secretes somewhere in the UK; in this case, almost certainly not in Manchester.
To build a Sim box all the criminal needs is an internet connection - 1Mb allows for 60 concurrent calls - plus a router and a GSM gateway to regenerate the calls as mobile phone traffic.
The calls come in via VoIP and are then regenerated into normal voice calls and passed through any of up to 60 Sim cards - typically 15 for each of four main mobile networks, so as not to overload the local cell structure, explains Guy Van der Meeren, chief technical officer of Meucci Solutions, a Belgian company that offers a tracing service to network operators to detect Sim boxes. The VoIP call is thus regenerated as a mobile call to the company exchange being hacked.
The flat rate cost of the mobile-to-landline call is typically just a few pence, while the incoming VoIP call is free. But the unfortunate company whose system has been hacked is usually left with the bill for the expensive outgoing international leg, explains Adrian Harris, senior consultant at Neural Technologies.
Most Sim box operators do not break the law so openly. They buy Sim cards from network operators, put them into their boxes and take advantage of the zero tariff offered to subscribers on the same mobile networks. They sell their phone time to people who want to call into the country where the Sim box is located, or beyond. They can charge a lot - but by using low-subscription Sims, they make big profits.
"Before VoIP this kind of fraud required considerable investment, specialist skills and sophisticated equipment. Now, with VoIP, the equipment is readily available, low cost and easy to set up and then move when discovered," Harris says.
The incentives are huge and the market is expanding quickly. The standard tariff for a mobile-to-mobile phone call between the UK and many countries in Asia is around £1.30 per minute. But anyone making regular calls to these countries via a mobile phone can cut that to just a few pence per call by keying in the right prefix before making a call.
Look up "bypass operators" or "calling cards" on the internet and you will find an array of companies offering calls to the same destination routed over VoIP links for as little as 1p per minute.
BT says it does not want to discuss the specifics of the Joseph Gleave & Son case. "BT is not responsible for the security of a customer's PBX switch. This applies whether the switch is purchased or leased from BT, and whether BT installed the switch or not," said a spokesman.
BT's reasoning is that switch owners can change the settings. "BT offers a service called Call Alert which can help with the early detection of any possible dial-through fraud or misuse," said the spokesman.
For a quarterly fee, customers can set parameters - such as 'I never call Afghanistan', or 'I never make calls after 7pm' - and if calls are observed to Afghanistan BT would contact the customer.
According to a new report from the Association of Chief Police Officers, Telecommunications fraud amounted to £866m in the UK in 2004 or 2.4% of retail revenue. "This assumes the phone calls made would have been paid for at full price, which is an arguable but very far from proven assumption," says the report, while telecoms industry estimates reckon at least 5% of all international mobile phone calls are to Sim boxes. The problem isn't going away.