Telcos that have registered their contact details with the US Robocall Mitigation Database (RMD) are being systematically spammed with fake demands to trace calls. The emails look authentic to the untrained eye and they exploit the widely-publicized 24-hour deadline for compliance with US regulations to create a sense of urgency. Recipients are directed to click a link to a ‘secure portal’ so they can communicate sensitive data to the USTelecom Industry Traceback Group (ITG), the privately-funded and politically-connected consortium that has monopolized the process for distracting attention from the extent to which large US telcos profit from crime assisting enquiries into the origin of illegal calls received by Americans. The link actually takes victims to a Github repository for software that, if installed, would permit remote access to the victim’s computer. The full text of a typical email is reproduced at the end of this article.
The best advice to any telecoms professional receiving an email that purports to be from the USTelecom Industry Traceback Group is to behave as if they received a surprise demand for sensitive information from their bank or any unexpected email that tells them they must click a link immediately. Do not reply to the message. Do not click any links. Verify the message by calling the ITG and asking them if it is real. Call them using a number obtained from an independent source; do not trust any phone numbers within the message. That is the advice our industry gives to consumers to help them reduce the effectiveness of scams. We should follow our own advice.
I would offer to share the ITG telephone number for general enquiries but I cannot find it published anywhere. They do, however, have a contact form on their website. If they take too long to reply to messages sent to their contact form then the fault is with them, not you. It is very easy to set 24-hour deadlines for compliance when they are imposed on other people. If the US government wants to outsource responsibility for law enforcement to a private sector body, and imposes a deadline for everybody to assist that private sector body, then it is beholden on that private sector body to provide the resources needed to authenticate their demands for sensitive data in a timely manner. It is better to make the ITG wait for traceback data than to risk hackers gaining entry to your systems by pretending to be the ITG.
The database which is the cornerstone of the US strategy for reducing robocalls has always been a case study in terrible security hygiene. Since the introduction of the RMD in 2021, the US Federal Communications Commission (FCC) has insisted that American and foreign telcos which terminate calls in the USA should provide email addresses, telephone numbers and names of telco staff which were then openly published as a database which anybody can freely download from the FCC’s website. Commsrisk has been charting the explosive growth of the RMD, which contains entries for 11,527 entities at the time of writing. Even a superficial check reveals many of these entries are bogus, out of date or otherwise flawed. The vetting of the contents of this database has been inept. But garbage data does not create risk for garbage businesses. The real risk was that open publication would lead to good data provided by honest telcos being exploited by bad actors that work for organized crime syndicates or hostile nations. Instead of being a tool that reduces crime, the RMD is equally effective at punishing compliant telcos for their honesty by making it easier for bad actors to spam them. And that is exactly what is happening with the rash of emails sent by hackers impersonating the USTelecom Industry Traceback Group to the addresses documented in the RMD.
Other spam sent to email addresses registered with the RMD reveals more of the rotten underbelly to the American strategy for tackling networked crime. This spam includes offers to set up new corporate entities in the USA, to submit regulatory filings to the FCC, to deliver STIR/SHAKEN compliance, and to author the robocall mitigation plans that telcos need to provide. Propositions like this might as well be called Enabling Crime as a Service (ECaaS). A business which chooses to create a new legal front before outsourcing the performance of so many anti-crime obligations is more likely to be crooked than not. A sensible government would investigate who is providing a service of this type, and who is using a service of this type. Sadly, common sense is not often associated with the US government.
Keep reading if you want to see the text of a typical email impersonating the USTelecom Industry Traceback Group, or the kind of emails sent to RMD contacts which offer to create new front companies — Limited Liability Companies (LLCs) — within the USA. And always remember the golden rule: verify the source of any communication before you trust it.
