Phone Scams and Fake Caller ID: How to Spot Them, and How the PBX Helps

What it actually is

A phone scam is a call meant to get you to do something you wouldn't do if you knew who was really talking: give out a password or code, transfer money, approve a payment, or share a customer's details. It doesn't take any special technical knowledge. A phone, a convincing story and time pressure are enough.

The tool that makes these scams work is fake caller ID. The number shown on the display is sent by the caller, and it can be a number that isn't theirs. So the display shows the number of the bank, the health fund or a familiar supplier — and the person answering already trusts the call before a word has been said.

Why a number on the display is not proof

Caller ID was built at a time when only phone companies could send calls into the network, and the number was assumed to be reliable. Today any system connected to the phone network can send a number of its choosing. Some carriers check and restrict this, but there is no way to know, from the display alone, that the number is real.

So the first rule: a familiar number on the display does not prove who is talking. It only tells you what the caller wanted you to see.

What it looks like in practice

• "This is the bank" — a polite representative tells you about a suspicious transaction in your account and asks for the code that was sent to you "to cancel it". That code is exactly what he needs to carry out the transaction.
• "A supplier updating account details" — someone calls the accounts department of a business or nonprofit and says that a regular supplier's bank account number has changed. The next payment goes to the caller's account.
• "Technical support" — someone introduces himself as a technician from the phone or computer company and asks for the control panel password, or for you to install software that gives him remote control.
• "The manager is on the road" — a call to the treasurer in the manager's name, with an urgent request to transfer an amount today, because "there's no time to explain".

Signs that you should stop

Almost every phone scam attempt uses the same few tricks. If you know them, you'll recognize the call in time:

• Urgency. "Now", "within ten minutes", "or the account will be blocked". Time pressure is meant to keep you from checking.
• A request for a code or password. A real bank, phone company or supplier does not ask on a call for a code that was sent to you. Ever.
• A change in payment details. Any request by phone to change a supplier's bank account is a reason for an extra check.
• Secrecy. "Don't tell anyone", "this stays between us". Someone who asks for secrecy doesn't want you to consult anyone.
• Software to install. A request to install something "so we can help you" is a request to give access to your computer.

The simple rule: hang up and call back

The safest way to check a suspicious call is not to argue and not to try to catch the caller in a mistake. Simply hang up, and call back a number you know from another source: the official website, the invoice, your contacts. Not the number the caller gave you.

If the call was real, you'll reach the same party and finish the matter. If not, you've saved a lot of money. In an organization it's worth making this a written procedure: every request to change payment details, or for an urgent money transfer, is checked with a call back to a known number, or with a second person.

When your number is the one being faked

Sometimes strangers call you and say "I got a call from you". Someone may have displayed your business's number on their calls. It's frustrating, but usually it doesn't mean anything in your PBX was affected: the faking is done in the caller's system, not on your end.

What do you do? Check the call history in the control panel to see whether a call really went out from you to that number. If not, you can explain to the person who contacted you that the call didn't come from you. And if in doubt, contact us and we'll check together.

What the PBX can do

The PBX can't know what is said on a call, and there is no way to filter out "a convincing story". But it can greatly reduce the number of unwanted calls that reach people, and give you quick tools to block them:

• Personal block. A number that called with a scam attempt, or a whole prefix you don't expect calls from, you block on your side in the call filtering service. The block applies to incoming and outgoing calls, so an employee won't call that number back by mistake either.
• Spam filtering. Outside callers who behave like spam are blocked automatically by spam filtering, even when they switch numbers.
• Mark as spam. You mark the number of an advertisement, survey or recorded message as spam: it is blocked on your side right away and sent for review by the service manager, who decides whether to block it for all subscribers.
• Caller-based routing. Without the filtering service, on the Numbers screen you can set a specific number to go to a different destination — a message, voicemail or any other destination — and not to your employees.
• Blocked calls. On this card in the call filtering screen you see what was blocked in the last seven days and why, and you can release a number that was blocked by mistake.

Protection from within: who can even give out what

A phone scam succeeds when the person answering knows something they shouldn't give out. So part of the protection is not letting everyone know everything:

• Each person in the organization has their own user in the control panel, with permissions only for what they need. A secretary who has no access to invoices can't "help" a caller with payment details.
• Search in the control panel does not show PIN codes or passwords. Even the person searching doesn't see them.
• Logging in to the dashboard is bound to the device, and in the Connected devices panel you see every device that logged in with the user and disconnect it. Anyone who gave out a password over the phone changes it right away, and checks there that there is no unfamiliar device.

A one-page procedure for the team

Technical tools help, but most of the protection comes down to habits. A short procedure posted by the workstation makes a big difference:

1. A code sent to you is yours alone. Don't read out a verification code, password or PIN to anyone on the phone, not even to someone who says they're from the phone company, the bank or the Kesher team.
2. A change in payment details is checked twice. With a call back to a known number, and with another person in the organization.
3. An urgent transfer waits for approval. Even if the manager is "on the road". A real manager will understand.
4. Don't install software because someone asked on the phone. If you really need technical help, you make the call, to a number you know.
5. Report right away. Whoever got a suspicious call tells the person in charge, and the number is blocked in call filtering.

And what about calls from Kesher

The name of a well-known company is exactly what someone calling with a scam wants to display, and that's true for us too. If someone calls in Kesher's name and asks for a password, a code or a payment in an unusual way, hang up and call us at 077-921-9000. We'll be glad to check, and even more glad to hear about the attempt, so we can warn other customers.

Example: a yeshiva's treasurer

A yeshiva's treasurer gets a call. On the display: the number of the regular food supplier. "We changed banks, please update the account before tomorrow's payment." The treasurer says he'll call them back, hangs up, and calls the number on the supplier's invoice. Nobody there knows anything about a change of bank.

The treasurer adds the number that called to his personal block list and tells the manager. Total cost: two minutes.

Gave out a detail by mistake? What to do right away

It happens to careful people too. What matters is to act quickly, and in order:

1. Money or credit card details — call the bank or credit card company right away, at the number on the card or on the official website.
2. Control panel password — change it right away. Then open the Connected devices panel, check that there is no device there you don't recognize, and click Sign out everywhere. Changing your password through password reset also ends all previous sessions.
3. Verification code — notify whoever sent it, and check whether an action you didn't request was carried out.
4. The caller's number — add it to your personal block list, and tell the team so nobody else answers it.
5. Let us know — if it involves a Kesher account, we'll go over the call history and the settings with you.

Who is most at risk

People calling with a scam look for whoever answers fastest and checks least: a new employee, a volunteer, a secretary at a busy moment, an older person. In yeshivas and boarding schools, young bochurim also get calls promising prizes and raffles.

So the training shouldn't be only for management. A minute of explanation for everyone who answers the phone in the organization — "don't give out codes, hang up and call back" — is worth more than any system. And on the bochurim's lines, call filtering against the Rabbinical Committee list, plus personal blocks of numbers that have already called with offers like these, is an extra layer that works even when no one is watching.