Telcos that have registered their contact details with the US Robocall Mitigation Database (RMD) are being systematically spammed with fake demands to trace calls. The emails look authentic to the untrained eye and they exploit the widely-publicized 24-hour deadline for compliance with US regulations to create a sense of urgency. Recipients are directed to click a link to a ‘secure portal’ so they can communicate sensitive data to the USTelecom Industry Traceback Group (ITG), the privately-funded and politically-connected consortium that has monopolized the process for distracting attention from the extent to which large US telcos profit from crime assisting enquiries into the origin of illegal calls received by Americans. The link actually takes victims to a Github repository for software that, if installed, would permit remote access to the victim’s computer. The full text of a typical email is reproduced at the end of this article.
The best advice to any telecoms professional receiving an email that purports to be from the USTelecom Industry Traceback Group is to behave as if they received a surprise demand for sensitive information from their bank or any unexpected email that tells them they must click a link immediately. Do not reply to the message. Do not click any links. Verify the message by calling the ITG and asking them if it is real. Call them using a number obtained from an independent source; do not trust any phone numbers within the message. That is the advice our industry gives to consumers to help them reduce the effectiveness of scams. We should follow our own advice.
I would offer to share the ITG telephone number for general enquiries but I cannot find it published anywhere. They do, however, have a contact form on their website. If they take too long to reply to messages sent to their contact form then the fault is with them, not you. It is very easy to set 24-hour deadlines for compliance when they are imposed on other people. If the US government wants to outsource responsibility for law enforcement to a private sector body, and imposes a deadline for everybody to assist that private sector body, then it is beholden on that private sector body to provide the resources needed to authenticate their demands for sensitive data in a timely manner. It is better to make the ITG wait for traceback data than to risk hackers gaining entry to your systems by pretending to be the ITG.
The database which is the cornerstone of the US strategy for reducing robocalls has always been a case study in terrible security hygiene. Since the introduction of the RMD in 2021, the US Federal Communications Commission (FCC) has insisted that American and foreign telcos which terminate calls in the USA should provide email addresses, telephone numbers and names of telco staff which were then openly published as a database which anybody can freely download from the FCC’s website. Commsrisk has been charting the explosive growth of the RMD, which contains entries for 11,527 entities at the time of writing. Even a superficial check reveals many of these entries are bogus, out of date or otherwise flawed. The vetting of the contents of this database has been inept. But garbage data does not create risk for garbage businesses. The real risk was that open publication would lead to good data provided by honest telcos being exploited by bad actors that work for organized crime syndicates or hostile nations. Instead of being a tool that reduces crime, the RMD is equally effective at punishing compliant telcos for their honesty by making it easier for bad actors to spam them. And that is exactly what is happening with the rash of emails sent by hackers impersonating the USTelecom Industry Traceback Group to the addresses documented in the RMD.
Other spam sent to email addresses registered with the RMD reveals more of the rotten underbelly to the American strategy for tackling networked crime. This spam includes offers to set up new corporate entities in the USA, to submit regulatory filings to the FCC, to deliver STIR/SHAKEN compliance, and to author the robocall mitigation plans that telcos need to provide. Propositions like this might as well be called Enabling Crime as a Service (ECaaS). A business which chooses to create a new legal front before outsourcing the performance of so many anti-crime obligations is more likely to be crooked than not. A sensible government would investigate who is providing a service of this type, and who is using a service of this type. Sadly, common sense is not often associated with the US government.
Keep reading if you want to see the text of a typical email impersonating the USTelecom Industry Traceback Group, or the kind of emails sent to RMD contacts which offer to create new front companies — Limited Liability Companies (LLCs) — within the USA. And always remember the golden rule: verify the source of any communication before you trust it.
Text from email impersonating the USTelecom Industry Traceback Group
Subject: Traceback Request for Traceback [number redacted]
INDUSTRY TRACEBACK GROUP
To Whom It May Concern:
As part of a traceback conducted by the Industry Traceback Group (ITG), your network has been identified in the call path for voice traffic that has been deemed suspicious and potentially illegal. In order to help identify the parties responsible for originating the traffic and mitigating it the ITG requests that you identify the source of this suspected fraudulent, abusive or unlawful network traffic in the ITG’s Secure Traceback Portal (STP).
More information about the Industry Traceback Group and the traceback process is available at [no link provided in the text of the email]
Responding to This Request
Your response to this inquiry should be submitted via the Industry Traceback Group’s Secure Traceback Portal (STP). The STP includes information on any traceback request involving your network, including call detail information of suspicious calls. For confidentiality and security purposes, information must be provided only through the ITG’s Secure Traceback Portal and not via email.
1. The source of the call and the identity of the upstream voice service provider(s) that sent the traffic into your network. If one of your end users originated the traffic, the identity of that end user.
1. The source of the call and the identity of the upstream voice service provider(s) that sent the traffic into your network. If one of your end users originated the traffic, the identity of that end user. [repetition of this paragraph as per the original message]
2. If, in investigating the call, the end user originating the traffic claims that the traffic complies with applicable U.S. laws and regulations, provide the identity of the end user, a description of the traffic, and the basis of the claim that the traffic complies with U.S. laws and regulations in the portal’s comments section.
3. Any actions and mitigation steps you have taken on your network to ensure compliance with applicable U.S. laws and regulations and to prevent the suspected illegal calls from continuing to reach U.S. subscribers.
The Industry Traceback Group believes that every voice service provider has a responsibility to help stop illegal robocalls. Therefore, to the extent that this traceback identifies the originator of these suspicious robocalls, the Industry Traceback Group urges that mitigation efforts be taken at that source. For illegal calls that go unmitigated, the ITG may (1) provide information to downstream voice service providers to advise them that suspected illegal calls on your network continue to be allowed notwithstanding the identification of such calls via the traceback process; and/or (2) advise the appropriate law enforcement agencies of such information so that they can take appropriate action, should they elect to do so.
For help or questions, email [email protected].
Submit your response via the ITG’s Secure Traceback Portal:
Traceback: https://portal.tracebacks.org/email-redirect?location=%2Fhops%2Fhop%2F195945&userId=15834&token=3179aa10-8662-49a3-803c-4c005f8794e2 [the hyperlink in the email points to a different URL than this apparent address]
(This URL is a private login; do not share or forward this email.)
Call Details for Traceback [number redacted] 0 seconds ago
Campaign: [name redacted]
Date/Time: [redacted]
To: +1 [number redacted]
From: +1 [number redacted]Live calls to recipients impersonating a financial institution for fraudulent means.
Basis for Traceback:
- Evidence of fraud in call content
- Evidence of Brand Impersonation
- Evidence of spoofing
Affirmative Obligation to Respond to Tracebacks. All providers of voice service — including originating, transit, and gateway providers — must respond to all traceback requests from the Commission, civil law enforcement, criminal law enforcement, or the industry traceback consortium within 24 hours. 47 CFR § 64.1200(n)(1) ; see also 47 CFR § 64.6305(d)(2)(iii) .
This email was sent from a notification-only address that does not accept incoming email. Please do not reply to this message — send inquiries to [email protected] .
The Industry Traceback Group | Terms | Privacy Policy | Support
Text from email sent to RMD contacts offering to establish front companies
Subject: STIR/SHAKEN Certification Services
We provide complete end-to-end assistance for obtaining STIR/SHAKEN Certification, including:
✅ US LLC Formation
✅ FCC Registration (FRN)
✅ DC Registered Agent
✅ 499 Filer ID (USAC)
✅ Robocall Mitigation Plan (RMP)
✅ RMDB Listing
✅ NECA Company Code (OCN)
✅ SPC Token
✅ STIR/SHAKEN CertificateContact [name redacted]
📞 Call/WhatsApp: +1 [number redacted]
