Robocalls continue to plague consumers, but what does the life of a phone scammer look like? Jonathan Nelson, Product Manager in the Reputation Service Unit at Hiya shares a glimpse of the work undertaken by their state of the art unit dedicated to detecting and monitoring spam numbers.

Phone Reputation Service engines constantly evaluate phone number behaviour to sniff out spammers and scammers. The service runs in real time, observing traffic patterns and collecting reports from users provided directly or via partnerships, as well as from public sources such as the FCC Consumer Complaints database.

In all, a new high-volume scammer coming online is detected within about 15 minutes of their first scam call.

This service runs fairly consistently with approximately 100,000 spammers being tracked within the +1 dialing code (which includes the United States, Canada, and much of the Caribbean). During the five months prior to the holidays, the total active spam number count fluctuated by about 10%. (The holiday season is excluded from analysis because every year, the spammers and scammers take the holidays off just like the rest of us.)

Within this fluctuation, there is significant turnover within the numbers themselves. On average, approximately 5,000 numbers join the spam list every day, replacing roughly the same amount of phone numbers that have stopped being active. While there is a consistent amount of phone numbers being used for scam at any one time, the numbers themselves are constantly rotating in and out to help scammers avoid detection.

To get a better grasp on how these scam numbers behave and how long they remain active, let’s take a closer look at 13,000 phone numbers which arrived as new spammers over a three-day period. The goal is to explore the space of “turn and burn” scam numbers, which do a large and very brief batch of scam activity.

It’s worth repeating: Over 1 in 10 of every new spam number detected is a number that will only exist for, at most, a few days.

In fact, 72 of them aren’t even valid phone numbers. This almost certainly indicates “spoofing”, a scammer who hides their actual phone number in favor of a fake one. Phone numbers in the United States must abide by the rules of the “North American Numbering Plan”, which defines area codes and 10-digit phone numbers for the US, Canada, and over 20 other countries within the Caribbean.

It is estimated these numbers created over 80 million calls in three days. What were they doing? The best place to look is user reports. Every month, well over half a million reports are received from users who are looking to help inform and protect others receiving the same calls.

The ~1,500 turn-and-burn scammer numbers have together amassed nearly 15,000 comments against them. 92% of these reports arrived within a five-day window around the analyzed segment. Most of these numbers have little to no history before being used for the scam campaign. (User reports go back to early 2010).

To get an overall picture of the complaints, all the comments left against these numbers were fed into a word cloud. (above)

Unfortunately, the one statistic that cannot be measured is how many innocent people fall victim to these scams. Hopefully, spam blocking services can continue to provide some advance warning and make sure everyone stays suspicious of unexpected threats or unlikely offers.

The best way to bring an end to the influx of scam activity is to make sure it’s not profitable for the scammers.

Product Manager, Reputation Service, Hiya