Phone numbers spoofed to steal RS pins

[pal2002]

The hackers just get more and more creative...

How can a phone company actually get spoofed by fake caller id's...lol

 

 

http://www.theherald.com.au/news/local/news/general/police-investigate-fake-calls-to-telstra-customers/2526773.aspx

 

Police have become involved in an investigation into how dozens of Telstra customers with numbers starting with 4963 were wrongly billed for calls to an internet gaming site.

Telstra’s billing and security divisions have been investigating how several hundred calls to 1900 910 080 were made during a two-week period last month.

 

The calls, billed at a rate of $13.97, were made to buy tokens to play the online game Runescape.

 

‘‘Our investigation is continuing and we have now briefed police,’’ Telstra’s Hunter Region manager Chris Cusack said yesterday.

 

‘‘We are also in the process of contacting all affected customers.’’

 

Telstra is also working with the company that provides online PIN numbers to play Runescape, Surfpin, and the site’s manager, Cloudtel.

 

The telco has refused to release details of its investigation into the incident.

 

It is still not known if the fake calls, which have generally occurred late at night, originated within Australia.

 

A telecommunications engineer previously told the Newcastle Herald it was likely the calls were made using Caller ID spoofing technology, which uses an internet-based server to make telephone calls with false numbers.

 

Caller ID spoofing is the world’s fastest-growing form of telecommunications fraud on landlines and mobile services.

 

An Australian Communications Consumer Action Network spokeswoman urged customers who suspected they had been wrongly billed for calls to contact their telco.

[Danqazmlp]

Sounds unfortunate that Jagex have been caught in this. By the looks of it, there is nothing they could have done. I just hope the problem is rectified with the owners of those numbers who have been wrongly charged.

[Neko Boi]

Oh for gods sake Telstra.... Pull your shit together. >.<

 

If you're going to be the dominative phone company in Aus, at least do a better job then the rest.

[Randox]

I think it was surfpin who got spoofed, not the phone company. Surfpin probably just uses the caller id to know who to send the bill too, which unfortunately relies on the originating phone to be honest about its number. The easiest way I can think of to fix it would be to have surfpin text a pin back to the number listed in the caller id, and then have to use that pin to make the purchase. That way if you spoof a number, the confirmation pin goes back to the legitimate phone. To get around it, you would need to actually clone a phone, which is considerably harder to do, especially on a large scale.

 

Alternatively, for things like landlines you would actually need to just have to set it up so you make the purchase, and then when you hang up surfpin calls you back so you can verify it that way.

[Omali]

I think it was surfpin who got spoofed, not the phone company. Surfpin probably just uses the caller id to know who to send the bill too, which unfortunately relies on the originating phone to be honest about its number. The easiest way I can think of to fix it would be to have surfpin text a pin back to the number listed in the caller id, and then have to use that pin to make the purchase. That way if you spoof a number, the confirmation pin goes back to the legitimate phone. To get around it, you would need to actually clone a phone, which is considerably harder to do, especially on a large scale.

 

Alternatively, for things like landlines you would actually need to just have to set it up so you make the purchase, and then when you hang up surfpin calls you back so you can verify it that way.

 

Wait, they don't? I bought my membership over the phone once many years ago for RuneScape and I remember putting in my phone number on the website and getting an automated call with the pin. They don't do that anymore?

[Baffler]

I think it was surfpin who got spoofed, not the phone company. Surfpin probably just uses the caller id to know who to send the bill too, which unfortunately relies on the originating phone to be honest about its number. The easiest way I can think of to fix it would be to have surfpin text a pin back to the number listed in the caller id, and then have to use that pin to make the purchase. That way if you spoof a number, the confirmation pin goes back to the legitimate phone. To get around it, you would need to actually clone a phone, which is considerably harder to do, especially on a large scale.

 

Alternatively, for things like landlines you would actually need to just have to set it up so you make the purchase, and then when you hang up surfpin calls you back so you can verify it that way.

 

Wait, they don't? I bought my membership over the phone once many years ago for RuneScape and I remember putting in my phone number on the website and getting an automated call with the pin. They don't do that anymore?

 

I believe the way it works (paying by phone) is you put in the phone number, then it gives you the number to call. That's how it worked for me ages ago.

[Randox]

I honestly don't know how it works, since I have never used that service, so I am just guessing based on what they did in the article. Spoofing only works when you call them. To actually intercept a call to another phone, you would either need to tap into the land line for land line phones, or for cells, you need to clone them.

[Bluud]

Yeah you write your number in, then it gives you a number to call and then it tells you pin when u ring that number

[tripsis]

The last time I paid by phone was probably 2005.. but when I did it, I just called a number and was charged that way. They never called me.

[vandennn]

either that or the kid isnt telling his parents that hes wasting money on an online game and they think theyre getting falsely billed :wink:

[Baffler]

either that or the kid isnt telling his parents that hes wasting money on an online game and they think theyre getting falsely billed :wink:

 

The article makes it pretty clear that it isn't just some kid lying. The article only mentions dozens of numbers starting with 49 since that's the area code for Newcastle and the article was written for the newspaper in that area (has been picked up by other newspapers too). There are earlier articles dating back to the start of the month that cover the same thing.

[vandennn]

either that or the kid isnt telling his parents that hes wasting money on an online game and they think theyre getting falsely billed :wink:

 

The article makes it pretty clear that it isn't just some kid lying. The article only mentions dozens of numbers starting with 49 since that's the area code for Newcastle and the article was written for the newspaper in that area (has been picked up by other newspapers too). There are earlier articles dating back to the start of the month that cover the same thing.

 

 

yikes! looks like i need a distraction :rolleyes:

 

 

:thumbsup:

[Sy_Accursed]

I wonder if this even *really* belongs in General Discussion rather than off-topic.

I mean sure the scammer's happened to buy RS pins but it's not exactly RS related. It's all to do with the scammers, surfpin and the telecoms company. No real direct involvement for runescape or impact to runescape as a game.

[Jonanananas]

Did they buy spins or membership? Someone from down under who's familiar with prices?