atcomsystems.ca/forum Forums Wiring - Telecom Carriers - Trunks & Services Telecom Service & Providers Phantom Calls

I apologize for the length of this post in advance, but we have a serious conundrum. We have a customer on trixbox Pro with a new installation including new telephone lines. There are 7 POTS lines to the system and 1 dedicated fax line. Since they have moved into the new location there have been a series of “phantom calls” to outside numbers leaving the CID for the company. Following is a log of the calls. Some of the new lines for this customer were reclaimed from other businesses including a marketing firm.

I’ve worked with Tech Support on this and the trixbox shows NO RECORD of these numbers ever being dialed in the CDR or in the TB logs. The telephone carrier investigated and says they have NO RECORD of these calls being initiated from the customer. The customer is understandably irate and pointing fingers at us.

Some ideas that have been discussed are CID spoofing or crossed lines, but has anyone come across this before? Any ideas on where to look and how to proceed? Thank you!

System went live 2/2/09:
1. Reported on 2/5/09. Time of the calls is unknown. They are receiving calls about twice a day at the time of reporting. Incoming Caller ID is “HRP 877-xxxx” which is line 5 in the hunt. Number dialed is 773-xxxx. (Numbers are removed to protect the innocent. )

2. Reported 2/5/09. No details for time of day, frequency or incoming Caller ID other than that the caller says that he is receiving the phone calls when HRP is closed. Recording is available if needed. Number dialed is 752-xxxx.

3. Reported 2/11/09. No details for time of day, frequency or incoming Caller ID. Caller sound quite elderly and getting further information from her was not possible. Number dialed is 272-xxxx.

4. Reported on 2/17/09. No details for time of day, frequency or incoming Caller ID. Number dialed is 883-xxxx. This is different in that instead of silence, the caller receives a message telling them to call the customer.

5. Reported on 2/18/09. According to the complainant, he is receiving multiple calls per day. He was able to confirm that he received the latest call at 5:12 PM. Number dialed is 883-xxxx. According to our cutomer:
Several minutes prior to this all phones in the office rang and when I picked up I heard the end of a robot call “… press 1 to leave a number” and then it hung up on me. This may have been the same event or just a coincidence.

6. Reported on 2/18/09. No details for time of day. Caller said the power company called them trying to call our cutomer to sell them natural gas.

Since some of the new numbers were recovered from a marketing firm, it might be possible that the firm contracted business out to another firm and the 2nd firm is using the first firm's numbers (which now belong to your customer) to this day.

(I hope my thoughts make sense).

That does make sense... and it is certainly worth looking into. The only question that still raises with me is that the NAME of the new customer is coming through with the number, not the name of the marketing firm. If a business partner were sending out CID, I would imagine they would use name and number. I admit to knowing just the basics of how this all works. If someone spoofs only number, does the phone company fill in name?

I'll follow up on this possibility though. Thanks, dexman!

This is one of those problems that drive technicians crazy.

Here is a very general summary of what happens:

The names of people/companies that telephone numbers are assigned to are stored in databases.

When a call is placed, a lookup is done and the name associated with the originating telephone number (if available) is passed along to the person on receiving end via Caller ID/Call Waiting ID.

With ISDN service you can generate your own originating telephone numbers and pass them along to the network via the "D" channel. The databases have no way to tell if the call came from the actual line or from a "spoofer". It sees an originating telephone number, attaches and name and passes it along.

"The telephone carrier investigated and says they have NO RECORD of these calls being initiated from the customer."


There is the kicker. I could see the customer blaming you if the TB showed no CDR action but the carrier did... if the TB and carrier show no call originating from that site then I'd bet Dexman has nailed it. If they are coming from the hunt group lines and not the mainline I'd have the carrier change the hunt group numbers to different directory numbers.

Bill's suggestion about branch offices is another option worth investigating.

Thanks a ton guys. I think I'll do a combination of all of this. I'll see if we can follow-up with the previous company and also have the hunt numbers changed. So far, nothing seems to have come from the main number.

I'll follow-up as soon as I know anything. This place is the best! :thumb:

Were the called numbers getting the calls prior to 2/2/09?
It may be difficult to do but I think the best place to start is in the CO of the called numbers (the CO where the call was terminated) to see if they can trace the calls back to the point of origination or at least the trunk the calls came in on.
The Problem is there may be umpteen CO's involved and it may be difficult to get anyone to spend any time on the issue specifically if there is not an open trouble ticket from their company.

Have any of the people that are receiving the calls reported a trouble to their service provider?

My thought is the original owners of the numbers have sold their telephone system which was DID/PRI based. Once reinstalled, some of the DNs still are outputing the old CID (since PRI allows you to send your own CID info).

All very good ideas, and we're chasing down the previous owners of the lines. Two interesting tid bits transpired overnight:

1. Telco has confirmed now that at least one of the phone numbers dialed DID come from their lines.

2. The company shares a closet with other businesses in the building whose tenants have been popping the door open with a screwdriver to get in.

We have a technician going over today to check that closet while we also work with the telco on the reclaimed lines.

I'll let you know what we find!