Tom Walker spent 20 years leading fraud investigations on behalf of AT&T and T‑Mobile US. He gathered the evidence for complicated fraud cases so law enforcement could put serious criminals on trial. So when Walker says the US Federal Communications Commission (FCC) has been trying to hide its consumer protection failings then you know he did the research that justifies his assertions.
On January 15, 2025 I filed a Freedom of Information Act (FOIA) request for FCC documents showing the number of referrals made in 2024 to the Attorney General pursuant to Section 11 of the TRACED Act.
When it was signed by Donald Trump in 2019, Section 11 of the TRACED Act created a legal obligation for the FCC to report to the US Congress on the number of robocall crimes referred by the FCC to the country’s head prosecutor. In case you were wondering, the total number of such referrals made during 2024 was: one. Just one robocall crime was referred by the FCC, the country’s comms regulator, to the country’s head prosector, during an entire year. That is not even an unusually low number for the FCC. The only reason we are now discussing the number of referrals that occurred during 2024 is because the FCC chose to wait 354 days after the end of 2024 before they issued their report on 2024’s statistics to Congress. Perhaps you did not notice that the report was issued on December 23, 2025? You might have been distracted by festivities that always coincide with the late December publication of the FCC’s mandatory annual report on robocall crimes.
If there was any doubt about whether the FCC was intentionally trying to hide its consumer protection performance statistics from Congress and the American people, that doubt was removed when, nine months after I filed this appeal, the FCC finally published the number of referrals made in 2024 pursuant to Section 11 of the TRACED Act and then, the very same day, the FCC’s Counsel’s Office responded to my appeal saying publication of this information fulfilled my FOIA request.
These quotes are taken from a filing that Walker submitted to the FCC a week after its report to Congress. But let us be clear that any journalist, any fraud professional could have identified that the FCC is deliberately hiding its incompetence at tackling robocall crime. All the necessary information is ultimately in the public domain, even if we have to research where to look for it and must wait an especially long time to see it. The FCC relies on journalists and the comms industry being too lazy or too sycophantic to check facts and call out the regulator’s bullshit.
Americans should be grateful for Tom Walker. He fights a lonely uphill battle against powerful interests that want illegal communications to continue because there are so many ways for legal businesses to profit from them. They profit by winning lucrative anti-scam contracts from the FCC, or by persuading the FCC to mandate the purchase of flawed anti-scam tech by telcos. They profit from all the scam traffic that continues to be conveyed by networks all the way to the victim’s phone. And they profit by scaring consumers into spending even more money on apps that are supposed to filter scam traffic at the phone. What other industry increases its profits by supplying a bad product all the way to your doorstep? Would you pay twice for a car that was not safe to drive, once to take it from the dealership, then again for essential repairs when you arrive home? Would you pay twice for a bottle of water from the supermarket, the first time at the checkout, then again for the purification tablets you use at home because the water was unsafe to drink?
Walker deserves an award for his contribution to crimefighting, although I believe he has no chance of influencing policy. Nobody in power is listening to him. I certainly have no intention of kissing the arses and greasing the egos of all the people who need to be convinced that the current US strategy has been a disaster. When it comes to networked crimes, the US is so corrupted by bad politics and greedy businesses that there is no realistic prospect of it being saved. My only goal in covering these stories is to warn other countries not to believe the bullshit radiating from the USA. Much of the propaganda produced by the FCC and its cronies is designed to influence the policies adopted by foreign governments and regulators. It is telling that the document that the FCC least wants people to read is also the document that contains the official statistics telling the US government what the FCC accomplished. Foreign regulators and foreign governments should familiarize themselves with the data that the FCC reports to its own government. They should not believe the disinformation about American success that greedy stooges have been peddling all around Europe and the Middle East.
Some professionals will have already stopped reading this article because their business models depend on never admitting the truth. They would rather have opinion polls about our feelings than hard data about crime and the effectiveness of techniques used to counter crime. However, I get the sense that a growing number of Americans are noticing how much the rhetoric produced by the FCC and the US comms sector deviates from their lived experience of scams. There is a wing of the industry that keeps arguing the US anti-scam strategy is working because the number of complaints about unwanted calls keeps falling. That is more disinformation. Here is the graph. Like Tom Walker, we prefer hard facts to empty words, and that is why Commsrisk maintains a rolling graph of complaints about unwanted calls made to the Federal Trade Commission (FTC) by Americans. You will notice that the number of complaints about robocalls doubled from December 2024 to September 2025. The reason it fell to zero during October 2025 was because of the US government shutdown, when they stopped recording complaints from the public. Has there ever been a more appropriate metaphor for institutional dysfunction?
The FCC and its cronies are not just deceiving the public about the failure to prosecute scammers. They also deceive the public about the effectiveness of the national strategy for tracing bad calls to their origin. They have to. STIR/SHAKEN failed. The green ticks displayed by STIR/SHAKEN on phone handsets do not prove that a call can be trusted, despite the FCC repeatedly insisting they do. Another member of the public learns STIR/SHAKEN cannot be trusted every time they answer a scam call which displays a green tick. So the FCC and its cronies have to save face by insisting they only adopted STIR/SHAKEN to trace calls, as if everybody should forget about the green ticks they were shown. The contradiction is shameless: why implement an expensive technology and pretend that it shows an incoming call is safe, if you always believed the purpose was to trace lots of calls which were connected but unsafe? The hypocrisy is unavoidable because employees of dysfunctional institutions have to keep doing the wrong things to protect their own careers. They cannot admit the need to reverse past mistakes. They cannot copy the effective anti-scam methods adopted by peers in other countries. So they have to pretend that traceback was the goal for STIR/SHAKEN all along. This leads us to the traceback report that was also sent by the FCC and its cronies in the USTelecom Industry Traceback Group for Congressional oversight on December 23. Here is an excerpt from the report. If the writing is too small to read then click on the image to see a larger version.
If you clicked on the image, you may now be wondering why I suggested you look at it. I wanted to familiarize you with a page chosen at random from the 88-page report sent to Congress. And now you may be asking why anybody would expect you to be able to interpret the contents of this badly-formatted, totally unstructured report. That is exactly my point. Even the kind of professional that reads Commsrisk would find this report completely useless without access to other information. However, the report was sent to politicians to help them oversee the effectiveness of a supposedly important component of the US strategy for tackling scams. The reason this traceback report is useless is because the authors want it to be useless. I dare you to read the whole thing if you still refuse to believe how useless this report really is.
Now consider that the man who oversees the creation of this traceback report is paid a quarter of a million dollars per year, by an association funded by US telcos, to demonstrate how well they are supporting the government’s objective of protecting Americans from scams. He sends it to the FCC, his former employer, and they send it to Congress. They do it because they know the politicians are not going to spend Christmas trying to make sense of badly formatted tables of data. And they know the vast majority of journalists will blindly repeat the claims made in press releases issued by the FCC and its cronies, instead of checking those claims against the raw data shared with Congress.
The extent to which these people consciously choose to mislead the public is demonstrated by how they issue barely intelligible ‘transparency’ reports… until somebody makes the effort to read them. Walker’s submission to the FCC addressed the hiding of traceback data too.
As described above on February 3, 2022, Senators John Thune and Edward Markey wrote former Commission Chair Jessica Rosenworcel asking for information concerning providers that were more frequently identified as the originators of traced calls. Specifically, they asked the FCC to “increase transparency around ongoing efforts to trace illegal robocalls” in order to “provide experts, enforcing entities, Congress, and consumers with a clear picture of the current robocall threat landscape.” In response, the FCC subsequently published seven consecutive quarterly Traceback Transparency Reports. However, when it became apparently (sic) these reports showed the FCC frequently did not take action to stop potential bad actors revealed by traceback, the FCC ceased publication of these reports after 2024.
I am not American, but Commsrisk did what Senators John Thune and Edward Markey wanted. We analyzed the quarterly traceback reports they asked for, despite them being so badly written that even a telco insider would struggle to interpret them, never mind a consumer or a politician. And we published the data in a much more accessible format so everybody else would find it easier to scrutinize them. The experience gained by automating the analysis of this data later fed into the development of the Commsrisk Global Fraud Dashboard. There is a need to take poorly structured data and to rationalize its presentation so policymakers can make better decisions. Headlines taken from the articles that analyzed the quarterly traceback reports can speak for themselves.
- The Robocall Transparency Report They Do Not Want You to Read
- Twilio, Vonage and Verizon Feature Prominently in Latest US Scam Call Traceback Report
- Over 40% of American Scam Calls Traced to AT&T, Verizon and T‑Mobile US
The reports revealed a significant and prolonged rise in the number of illegal calls traced to the big US mobile network operators (MNOs). This coincided with amateur scam investigators telling me about increased simbox usage by scammers in the USA. There was later an enormous simbox bust in New York City, which was peculiarly reported as if law enforcement believed the simboxes were meant to be used for a bizarre denial-of-service attack, instead of being used for crimes normally associated with simboxes. USTelecom, the association which runs the US traceback process, is politically and financially connected to those mobile operators. I wrote an article whose title asked a legitimate question about the Industry Traceback Group’s independence when they present their findings to the FCC.
Will Big US MNOs Ever Be Punished for Scam Calls Traced to Them?
This elicited a very particular response. Dario Betti, CEO of the Mobile Ecosystem Forum (MEF), told me to change the title because of instructions he had received from a US MNO. I refused. Soon after, MEF stopped publishing Commsrisk content on its website and I stopped working for MEF. I have no truck with empty industry shills like Betti when thousands of people fall victims to preventable crimes every day. The subject of that particular article later proved to be the final quarterly report issued by the USTelecom Industry Traceback Group. If this does not demonstrate the US comms industry has captured its regulator, is using the regulator to consciously mislead government about scam traffic, and is denying opportunities for independent scrutiny, then what would?
Commsrisk was the only publication consistently reporting on the contents of the quarterly traceback reports. The boss of the Industry Traceback Group, Josh Bercu, made it clear that he knew about Commsrisk’s reporting when I publicly confronted him at an NICC industry meeting held in London during December 2024. Bercu told that audience that there was no obligation to produce these reports, despite Senators Thune and Markey telling the former FCC Chair that they wanted to “increase transparency around ongoing efforts to trace illegal robocalls” so that experts and consumers, among other people, could form a clearer picture of the threat landscape. It is very obvious how little some industry insiders will tolerate data being seen by anyone who might independently assess what that threat landscape looks like.
But Tom Walker is a diligent investigator. Killing the quarterly transparency reports was not enough to stop him. He spent his Christmas checking the annual traceback report for 2024, despite it being almost a year out of date, and he used his insider knowledge to form his own interpretation of the data. His conclusion is so straightforward that it should appall any American that still retains some faith in government agencies and big corporations. Put simply, if half a billion dollars was spent on STIR/SHAKEN just because it slightly improves the tracing of calls, then maybe somebody should investigate the calls being traced.
The FCC should investigate scam calls traced by industry
As detailed in examples above, traceback has proven to be the single most effective means of reducing illegal robocalls. The reason why illegal robocalls have not been reduced more than they already have been is because the FCC only investigates and takes action on a tiny percentage of tracebacks.
I disagree with Walker’s reasoning, but I reproduce what he wrote because he is sincere in his beliefs. It seems peculiar to me to argue traceback is the ‘single most effective means of reducing illegal robocalls’ when you also know that illegal robocalls are not being reduced because so few tracebacks result in any meaningful action. But we should not quibble about how to frame the data. Walker’s underlying point is clear: the data shows that tracebacks rarely result in action against criminals because somebody has to do some work after the call is traced. That work is not being done.
Investigations that do not result in enforcement actions are not necessarily known to the public. The FCC might therefore expect the benefit of the doubt that there were legitimate reasons why action was not taken against any particular identified potential bad actor. However, examination of Traceback Transparency Report data shows numerous cases where cause to take enforcement actions appear to be prima facie. Specifically, there were 49 voice service providers that received more than five traceback requests between April 2023 and December 2024 and reportedly did not respond to at least 85% of them. On average, it took the FCC two years to remove 31 of these providers from the RMD [Robocall Mitigation Database]. 18 are still in good standing.
The American public has given the benefit of the doubt to the FCC and its cronies. Foreign regulators and government agencies should not be so foolish. I agree with Walker that traceback can be a good way to tackle crime but only if there is a serious intention to do something with the traceback data collected. It seems to me that, as with STIR/SHAKEN, there is far more lobbying for spending on technology than for spending on the processes needed to take advantage of that technology. This is because the private sector pockets the one-off revenues from selling the technology, while nobody wants to carry the ongoing cost of actually taking criminals to court. Processes are run by people, and nobody wants to employ those people, especially when a job requires skill and training, and hence will command a salary commensurate with those skills and that training.
The FCC wants people to pretend fraud is often too complicated to tackle, and will only be defeated if they receive a lot more help from the private sector and foreign governments. They do not want to pay for investigators, they cannot get anyone else to pay for investigators, American prosecutors rarely investigate crimes of this type, so the question of who will pay for real investigative work just gets pushed around during endlessly fuzzy conversations about ‘collaboration’. Collaboration has become synonymous with empty talk from people who mostly want to take credit for somebody else’s work. Walker shows what one determined investigator can uncover on his own. Some of his examples skewer the lie that a lack of collaboration is preventing the US regulator from taking more action.
In the case of Chase Tech, LLC, the FCC removed it from the RMD nine months after it appeared as non-responsive in traceback reports and ten months after I reported that the person listed as the contact for Chase Tech was a victim of identity theft. The FCC made no mention in its order removing Chase Tech from the RMD that Chase Tech’s robocall mitigation plan was a medical journal article entitled, “Frequency of Risk Factors and Complications in Abdominal Hysterectomy and Laparoscopic Hysterectomy.”
What is the point of insisting US and foreign telcos must submit documents to a vast FCC database if nobody in the FCC even reads the covers of those documents? Sadly, the purpose is obvious to anyone who thinks clearly about the FCC’s methods. They have taken the goal of scam reduction and turned it into an empty public relations exercise. The FCC and its cronies need to appear to be doing something despite accomplishing nothing. Their choices are guided by politics more than data.
The FCC recently threatened to ban China’s biggest telcos on the basis that their RMD submissions are inadequate. China Mobile, China Telecom and China Unicom all received the same threat on the same day. The FCC behaves as if it has only just identified flaws in the robocall mitigation plans of three of the biggest telcos on the planet, which are already subject to China’s consumer protection laws, despite the FCC failing to identify hundreds of other deficient plans within the same database. This highly politicized regulator cannot be trusted to enforce its rules in a fair and impartial manner. STIR/SHAKEN, traceback and the Robocall Mitigation Database all complement a strategy that allows a US government agency to arbitrarily impose international trade sanctions under the pretext of protecting Americans from foreign scammers. Few individuals in the comms industry are willing to say anything about this abuse of power because they know those powers might be turned against them too.
Arbitrary power is necessary when covering for the failings of an organization that has routinely treated STIR/SHAKEN — technology and governance protocols to reduce the spoofing of CLIs — as synonymous with a comprehensive anti-scam strategy. The FCC needs to cover for an entire industry that exaggerated the efficacy of STIR/SHAKEN. As Walker explains…
It is likely outbound spoofed calls have never been the primary driver of financial loss from telecom-initiated fraud. Spoofed calls may have only been the primary driver of unwanted call complaints between 2017, when Mexican vacation package and timeshare scam groups began using neighbor spoofed calls, and 2019, when Indian scam groups transitioned from impersonating the IRS to spoofing phone numbers of various Federal, State, and local government agencies.
To the best of my knowledge, the FCC has never commissioned a study to determine what percentage of illegal robocalls are spoofed. If it did, I have not found a public record of any such study. As such, I examined 1.77 million FTC Do Not Call complaints published between October 2024 and July 2025. If most robocalls were being spoofed, distribution of providers that owned phone numbers subject to complaints would be proportionate to the percentage of all available numbers they control. Yet I discovered that 74% of complaints listed calling party phone numbers assigned to just 23 telecom providers that primarily sell Direct Inward Dial (DID) VoIP numbers to end-users and resellers. These 23 providers appear to control 19% of assigned number ranges.
Walker’s assessment that lax controls over the supply of DID VoIP numbers is a more important enabler of scams than CLI spoofing is supported by a separate group of investigators who sit outside of telecoms industry cliques. Demurrage is an activist collective that has previously sent me weighty reports detailing their investigations into the use of phone networks to scam Americans. A new investigation they conducted into VoIP numbers supplied by Sinch on behalf of Microsoft Teams corroborates Walker’s conclusions. A member of Demurrage’s collective told me directly that they consider spoofed robocalls to be a minor contributor to the scam ecosystem relative to the misuse of DID VoIP numbers, while expressing frustration that US authorities remain fixated on CLI spoofing. The contents of Demurrage’s investigation into VoIP number abuse by resellers and scammers will be published on Commsrisk soon.
The temptation to hide data is strong when institutions make bad decisions but do not wish to admit the need to change policy. That the FCC is systematically covering up its own policy mistakes will not be news to many long-standing readers of Commsrisk. The central thrust of this article is identical to that of an article published by Commsrisk in January 2025.
FCC Withheld Data from 2024 Robocall Report to US Government
It was last year that the FCC, then under Democrat control, decided to exclude data pertaining to the previous 11 months from their annual robocall reports to Congress. In a typical exhibition of bipartisan alignment on how to fight networked crime, the Republicans have maintained the same policy of delaying the release of data until it is no longer interesting to journalists. The number of robocall crime referrals from the FCC to the US Attorney General has been pitifully low under both Republican and Democrat administrations. There continues to be broad bipartisan political support for the current US strategy for tackling scams because both main parties are complicit in its failure. Sadly, American journalism is at such a low ebb, and political division is so entrenched, that only eccentrics like Walker and me will publish hard facts about institutional dysfunction being covered up by both of the USA’s main political parties.
I have not yet covered the most significant failing in the strategy to protect Americans from scam communications. There is a tendency to assume the amount of money stolen correlates to the number of scam communications. That is fundamentally misguided. It encourages an unhelpful focus on reducing the number of scam communications instead of prioritizing the disruption of the most effective scams. US decision-makers are fixated on the number of complaints about unwanted calls so they target highly repetitive robocalls made in bulk, even though live conversations with scammers will likely have a greater chance of fooling victims. ‘Experts’ mislead others when they discuss trends in the total number of complaints about all kinds of phone call, without separately analyzing the trends for live calls versus robocalls.
The Global Fraud Dashboard graph comparing UK and US complaints for live and automated calls vividly illustrates the importance of the distinction. The number of complaints made by Americans about live calls has barely changed in 6 years. So when policymakers insist their anti-scam strategy is working it is because they are only measuring fluctuations in the number of complaints about robocalls. Looking at the complaints figures from the UK in isolation, there has not been much reduction in the number of complaints about live calls either. However, since June 2021 Brits have consistently submitted more complaints about live calls than automated calls. This is the reverse of the situation in the USA, where the number of complaints about automated calls has always been higher than the number of complaints about live calls. It means two fundamental errors are driving US policy in the wrong direction.
- The current policy chases a reduction in the headline number of complaints without any thought about the communications that lead to the biggest fraud losses.
- Communications which are most likely to result in losses are not affected by the prevention and detection methods adopted so far, but instead of researching other techniques that could reduce these types of communications, effort is being poured into extending existing methods.
The data is consistent with my interpretation. The figures presented by Walker in his FCC submission also reveal the dissonance between reducing the number of complaints about unwanted communications and actually reducing the amounts lost to scams. As Walker observes…
…outbound phone calls themselves are no longer the primary driver of consumer harm from telecom-initiated fraud. As described above, unwanted calls declined 62% between July 2021 and December 2023… [y]et reports to the FTC of dollar loss from fraud initiated by telephone increased 91% between December 2023 and September 2025.
Walker helpfully illustrated his point with a graph.
That is an effective graph. We will have to copy and automate it for the Global Fraud Dashboard. Policymakers outside of the USA need better impartial data about the methods which do and do not succeed at reducing networked crime, and this is an excellent illustration of how data, if presented correctly, can cut through bullshit. We will be launching a crowdfunding campaign in the hopes of financing a massive expansion of the dashboard this year. However, I digress. Walker’s graph shows why the scale of crime cannot be reduced by adopting narrow piecemeal tactics that only seek to impede certain kinds of communications. An effective policy needs to address all the ways that fraudsters communicate with victims, so resources can be directed towards activities that are most effective at disrupting crime.
Walker makes a solid argument for devoting a lot more American funding to skilled investigators like himself. Sadly, the US approach has excluded people with practical knowledge of fraud investigations from the formation of anti-crime policies. It costs money to employ people. Fancy tech systems can also cost a lot of money but that cost is temporary and it generates much larger profits for the companies selling the tech. Sadly, there are US government agencies and crony capitalists who want the same mistakes to be repeated worldwide. If policymakers really want to tackle crime, they should speak to investigators who have already tackled crime, not to technologists and lobbyists who lack the skills, knowledge or motivation to determine the most effective ways to reduce crime.
Americans are lucky that Walker is fighting on their behalf. I worry about other countries where crooked regulators purchase the tech solutions pushed by the highest briber. Only a stubborn and principled individual would have the courage to openly chastise a failing regulator when most of their peers will sing that regulator’s praises. At the heart of the American anti-scam ‘collaboration’ is a group of entities that never want to talk about how disastrously poor the FCC has been at protecting consumers from scams compared to regulators in other countries. They want a bad strategy because it benefits their businesses.
Somos, iconectiv, the USTelecom Industry Traceback Group and the CFCA all contribute to a dysfunctional milieu that gaslights the American public about how well American institutions are performing. Any competent anti-fraud professional should be screaming with frustration about the inept tactics being used to tackle scams spread over phone networks. But many find it easier and more profitable to simply repeat the crap in the FCC’s press releases, especially if they run a billion-dollar business that depends on the lucrative contracts that the FCC awards, or an industry association that depends on the sponsorship of businesses like Somos and iconectiv.
20 years of gathering hard evidence has given Tom Walker the muscles and backbone to persist with gathering evidence of the failures endemic to the US anti-scam strategy. The world needs more people like him. The way to get more people like Tom Walker is to create more jobs for fraud investigators, to train more people to be fraud investigators, and to give credit to existing fraud investigators for the work they do. We should treat with suspicion any anti-fraud policy that does not place the highest priority on finding and recruiting the right people to fight fraud.
Tom Walker’s FCC filing is here. The FCC’s December 23, 2025 report to Congress about the work it did in 2024 can be found here. The associated traceback report is buried here, hidden using a name that makes it impossible for the public to guess the contents without opening the file first. Click here for the PDF version or here to download the traceback data as an XLSX spreadsheet.
