atcomsystems.ca/forum Forums Wiring - Telecom Carriers - Trunks & Services Telecom Service & Providers Phantom Calls

I apologize for the length of this post in advance, but we have a serious conundrum. We have a customer on trixbox Pro with a new installation including new telephone lines. There are 7 POTS lines to the system and 1 dedicated fax line. Since they have moved into the new location there have been a series of “phantom calls” to outside numbers leaving the CID for the company. Following is a log of the calls. Some of the new lines for this customer were reclaimed from other businesses including a marketing firm.

I’ve worked with Tech Support on this and the trixbox shows NO RECORD of these numbers ever being dialed in the CDR or in the TB logs. The telephone carrier investigated and says they have NO RECORD of these calls being initiated from the customer. The customer is understandably irate and pointing fingers at us.

Some ideas that have been discussed are CID spoofing or crossed lines, but has anyone come across this before? Any ideas on where to look and how to proceed? Thank you!

System went live 2/2/09:
1. Reported on 2/5/09. Time of the calls is unknown. They are receiving calls about twice a day at the time of reporting. Incoming Caller ID is “HRP 877-xxxx” which is line 5 in the hunt. Number dialed is 773-xxxx. (Numbers are removed to protect the innocent. )

2. Reported 2/5/09. No details for time of day, frequency or incoming Caller ID other than that the caller says that he is receiving the phone calls when HRP is closed. Recording is available if needed. Number dialed is 752-xxxx.

3. Reported 2/11/09. No details for time of day, frequency or incoming Caller ID. Caller sound quite elderly and getting further information from her was not possible. Number dialed is 272-xxxx.

4. Reported on 2/17/09. No details for time of day, frequency or incoming Caller ID. Number dialed is 883-xxxx. This is different in that instead of silence, the caller receives a message telling them to call the customer.

5. Reported on 2/18/09. According to the complainant, he is receiving multiple calls per day. He was able to confirm that he received the latest call at 5:12 PM. Number dialed is 883-xxxx. According to our cutomer:
Several minutes prior to this all phones in the office rang and when I picked up I heard the end of a robot call “… press 1 to leave a number” and then it hung up on me. This may have been the same event or just a coincidence.

6. Reported on 2/18/09. No details for time of day. Caller said the power company called them trying to call our cutomer to sell them natural gas.

Since some of the new numbers were recovered from a marketing firm, it might be possible that the firm contracted business out to another firm and the 2nd firm is using the first firm's numbers (which now belong to your customer) to this day.

(I hope my thoughts make sense).

That does make sense... and it is certainly worth looking into. The only question that still raises with me is that the NAME of the new customer is coming through with the number, not the name of the marketing firm. If a business partner were sending out CID, I would imagine they would use name and number. I admit to knowing just the basics of how this all works. If someone spoofs only number, does the phone company fill in name?

I'll follow up on this possibility though. Thanks, dexman!

This is one of those problems that drive technicians crazy.

Here is a very general summary of what happens:

The names of people/companies that telephone numbers are assigned to are stored in databases.

When a call is placed, a lookup is done and the name associated with the originating telephone number (if available) is passed along to the person on receiving end via Caller ID/Call Waiting ID.

With ISDN service you can generate your own originating telephone numbers and pass them along to the network via the "D" channel. The databases have no way to tell if the call came from the actual line or from a "spoofer". It sees an originating telephone number, attaches and name and passes it along.

"The telephone carrier investigated and says they have NO RECORD of these calls being initiated from the customer."


There is the kicker. I could see the customer blaming you if the TB showed no CDR action but the carrier did... if the TB and carrier show no call originating from that site then I'd bet Dexman has nailed it. If they are coming from the hunt group lines and not the mainline I'd have the carrier change the hunt group numbers to different directory numbers.

Bill's suggestion about branch offices is another option worth investigating.

Thanks a ton guys. I think I'll do a combination of all of this. I'll see if we can follow-up with the previous company and also have the hunt numbers changed. So far, nothing seems to have come from the main number.

I'll follow-up as soon as I know anything. This place is the best! :thumb:

Were the called numbers getting the calls prior to 2/2/09?
It may be difficult to do but I think the best place to start is in the CO of the called numbers (the CO where the call was terminated) to see if they can trace the calls back to the point of origination or at least the trunk the calls came in on.
The Problem is there may be umpteen CO's involved and it may be difficult to get anyone to spend any time on the issue specifically if there is not an open trouble ticket from their company.

Have any of the people that are receiving the calls reported a trouble to their service provider?

My thought is the original owners of the numbers have sold their telephone system which was DID/PRI based. Once reinstalled, some of the DNs still are outputing the old CID (since PRI allows you to send your own CID info).

All very good ideas, and we're chasing down the previous owners of the lines. Two interesting tid bits transpired overnight:

1. Telco has confirmed now that at least one of the phone numbers dialed DID come from their lines.

2. The company shares a closet with other businesses in the building whose tenants have been popping the door open with a screwdriver to get in.

We have a technician going over today to check that closet while we also work with the telco on the reclaimed lines.

I'll let you know what we find!

Ok guys. Here’s the unbelievable solution after extensive research and teeth pulling to get specifics from the customer on the phantom calls. We had telco block outgoing caller ID so that “phantom” calls could not possibly be leaving the CID information for our customer (let’s call them ABC). However, ABC continued to get calls from various people telling them to stop calling. All these callers gave the CID for line 5 in their hunt group.

Today we had a breakthrough. One person finally gave us the FULL caller ID of the number they were calling back. For this example, let’s say it was 877-123-4567. Line 5 on the hunt group is 877-1234. SOOO… people were calling back an 877 number, but NOT DIALING THE ONE. Telco was, of course, sending the call after the first 7 digits dialed since 877 is a local exchange around here.

ABC is having the number changed on line 5 of their hunt group and this craziness should be at an end. So many, many hours put into finding such a simple solution… Thank you all for your assistance!!

Wow, Stacey. That one is a mind bender for sure. It is amazing how something so simple can cause so much trouble. I've encountered equally-crazy situations in the past and they are never easy to find until you find them. Kind of like misplacing your car keys when they were on the kitchen table the whole time.

Thanks for sharing the outcome. That's a truly interesting story.

Thanks for sharing the solution. 877 for a prefix doesn't seem too smart to begin with, I'm suprised the local Telco doesn't get more complaints. Seems like they could set something in their switch that if more than 7 digits are dialed without a 1 it would go to reorder or a recording of improper dialing. One or our CO guys might know if that's possible.

To quote Homer Simpson "DOH!" :scratch:

Bill, I am sure that the 877 office code was in place long before the 877 toll-free area code came about. I feel for Stacey and her bunch because I'm sure that throughout this process, the telco was likely reciting "Must be......" Well you know the rest.

Didn't even think of that Ed, I'm sure you're right. Still seems they could fix the problem through switch translations to me. With all the 877 numbers out there it can't be an uncommon problem in that prefix.

Bill -

Remember Lily Tomlin "We're the Phone Company, we don't have to care."

I'm with you guys, if you got stuck with a CO that had 866 or 877 I would think that you'd address it, but....

Glad to hear that it's been fixed. A real brain teaser.

Sam

Great story and very useful information for the future! Glad you got that figured out eventually too. Do they plan on initiating a recording or implementing any new measures to avoid this in the future?

Ed like my old repairforeman used to say all troubles are simple after you find them.

Telco plans on doing absolutely nothing to adjust the underlying problem. Ed, you're correct that the 877 prefix was around long before the 877 toll free. We stopped counting how many man hours we threw at this problem. It is simply such a relief to be able to put this one to bed.

That's one of those things you'll never forget Stacey. Too bad the phone company won't own the problem as they should.

We had one once, years ago at a Bank with a 120 line PBX, 20 CO Trunks. Customer calls in Monday morning from the pay phone - furious! Every call they make outgoing gets a wrong number. Internal calls work fine. Test the trunks from the demarc - they're fine. You can dial with a butt set and get through every time.

Must be the PBX - but how?

Turns out the customer wanted tone dialing and the CO (at that time) only offered rotary. So we gave the customer tone to pule conversion. All was well for the first year.

Over the weekend telco converted the exchange and programmed the customer (probably defaulted the whole exchange) for mixed tone/pulse dialing. The customer had all tone dial sets. Dial "9", get an outside line. Start dialing 555-1234. By the time you've got the 555 out the outpulsers have repeated the 555 so now you've dialed 555-5551. Or something similar.

Drove us nuts till we figured it out. The Bank wanted to sue for lost revenue. Telco refused to see it as their problem.

But they did come back later and bill the Bank the extra tariff for tone dialing trunks.

Sam