TELECOM Digest Wed, 13 Mar 91 22:12:00 CST Volume 11 : Issue 200 Inside This Issue: Moderator: Patrick A. Townson Houston Chronicle Cellular Fraud Story [Joe Abernathy] ---------------------------------------------------------------------- Date: Wed, 13 Mar 91 02:42:30 CST From: Joe Abernathy Subject: Houston Chronicle Cellular Fraud Story [Moderator's Note: Although I do not normally accept copyrighted material with distribution restrictions placed on it for use in the Digest, this exception is being made at the request of Mr. Abernathy who has graciously given me the exclusive republication rights to his article on the net. I hope you enjoy reading this special report. PAT] ***** PLEASE NOTE RESTRICTIONS ***** Permission is hereby granted for one-time redistribution in the TELECOM Digest / comp.dcom.telecom newsgroup on Usenet and associated mailing lists or BBS' which normally re-distribute TELECOM Digest. All other uses, including paper and electronic distribution or storage on any electronic medium, are strictly prohibited with the exception of the TELECOM Digest / comp.dcom.telecom archives at lcs.mit.edu. Republication information can be obtained from Joe Abernathy at (800) 735-3820, edtjda@chron.com. Do not reprint / republish this article without explicit permission from Mr. Abernathy and the {Houston Chronicle}. This notice must remain intact with this issue of the Digest. ***** PLEASE NOTE RESTRICTIONS ***** Criminals dialing for dollars Long-distance theft taking heavy toll on cellular industry {Houston Chronicle}, Page 1A, 3/3/91 By JOE ABERNATHY Copyright 1991, Houston Chronicle Stolen long-distance service is costing the cellular telephone industry millions of dollars a month and is emerging as the main line of communications for drug traffickers and organized crime. Law enforcement authorities and cellular telephone company investigators are waging a furious technological battle against the theft. It's not the actual losses the industry is incurring, it's the people who are using these altered phones that attracts federal law enforcement to the scene,'' said Earl Devaney, special agent in charge of the Secret Service fraud division in Washington. They are usually drug dealers, people selling arms.'' A recent bust lends an example. Working with a Houston-based investigative firm, Devaney's agency tracked an enterprise allegedly moving arms into Israel and drugs into the United States, with cellular phones providing the communications link. But the problem has a much wider base. The perpetrators also include foreign students or temporary workers, who may innocently or otherwise chance across an offer for inexpensive international long-distance service. We just had a case where some people came to town and set up three-way conference calling between Houston, Iraq and Kuwait,'' said the chief financial officer of one cellular service provider. That fraud can total up to $30,000 in 24 hours.'' Wire services have reported that profiteers in the war region, where basic services are in a shambles, lately have been charging $5,000 a month for the rental of cellular phones, plus air time. Credit and subscription fraud -- phones activated with stolen personal information -- are half of the problem faced by the industry, but what has everyone scrambling is the tumbler phone,'' so called for its ability to tumble illicitly through the electronic serial numbers that allow cellular phones to go on the air. It allows the user to have use of the phone essentially without a bill,'' Devaney said. It also makes it extremely hard for law enforcement to intercept these calls as we would do under court order with a landline phone. So it offers the potential user of the phone a certain amount of anonymity and cuts down on his or her overhead.'' Tumbler phones, available on the black market for $1,500 or less, have been taking the underworld of Houston and other large cities by storm. They take the phone bill out of telemarketing, take the trace out of bookmaking and drug dealing. Each one in use can cost a cellular service provider hundreds of thousands of dollars. It's becoming very fashionable, if you're a criminal of any size, to have one of these phones,'' Devaney said. If you don't have a beeper and a phone, you're not really a first-class crook.'' In the hands of someone armed with the latest technological skills and information, tumbler phones represent the perfect crime. They can't be stopped or traced. The industry is fighting back as if for its life. Yet the response is scattershot, with some entrepreneurial cellular companies leaving security lax for the sake of quick profits. Spokesmen declined to reveal what percentage of cellular revenue is consumed by fraud, although some observers estimate it at 15 percent to 20 percent. During 1990, the industry earned more than four billion dollars from more than five million customers. The Secret Service, which is taking on a new role in the fight against electronic financial fraud on the basis of powers granted in the 1980s, is the first police agency to respond to this high-tech crime wave. The FBI became involved in the recent Houston-Iraq case. Most local police, although aware of cellular phones' popularity, are not yet briefed on the massive fraud that is taking place. If some of these high-tech units in these metropolitan police departments would get involved in this kind of fraud, I think they would help themselves catch some of the people they've been looking at in their drug investigations,'' said Devaney, who hopes to develop a partnership between the cellular industry and federal and local law enforcement. It would give them an alternative for getting these people off the streets.'' Thomas Lentini, spokesman for the Drug Enforcement Administration in Houston, said: There's not a case goes by that we don't see several cellular telephones. Communications is very important in the drug trade, and it's basically instant communications.'' One problem is that the state of the art advances so quickly that it's difficult for officials to keep pace. While the industry stops one leak, technically skilled criminals are chipping away elsewhere. Several companies are in a race to offer switching equipment capable of defeating tumbler fraud. GTE, which is experimenting with such things as credit card cellular phones in rental cars and in-flight cellular calls, plans to be the first, hoping to perfect the technology later this year. A spokesman for an industry association said, however, that its impact won't be widely felt until the middle to late 1990s. Until it arrives, it's like war. And like war, the citizens are being asked to endure hardships. One such hardship is call blocking. For years a quiet practice of the long-distance companies, it is now becoming a mainstay of the cellular industry. Certain calls placed to or from locations generating bills that frequently don't get paid simply don't go through. A recent example involved a college student who couldn't call a friend in Israel during an Iraqi bombing. Another case involved a woman who couldn't call her family in Israel using a calling card from work. And entire nations in the economic morass of Eastern Europe and in Central America and South America are blocked. (Such blocking is legal under current FCC tariffs.) Many of the cellular companies are now imposing systemwide call blocking. GTE Mobilnet, which along with Houston Cellular provides service to customers in the Houston metropolitan area, requires that all international calls be placed through an operator, using a major credit card. Houston Cellular allows direct dialing everywhere, but only to those customers with good credit ratings. Another type of call blocking involves roaming agreements, which allow cellular users to place calls from outside the area of their host companies under agreement with other companies. When these agree ments are suspended, as is now happening, travelers are denied use of their phones. Such steps were triggered by the unique nature of cellular communications. In order that any number of callers might share the airwaves, each phone an nounces itself to the cellular network with a unique electronic serial number (ESN). The local switching equipment can't tell whether an ESN from another city is phony or stolen, so the call is completed as a matter of good faith toward the customer. We had estimates of electronic serial number fraud totaling about $38 million in the third quarter of 1990,'' said Eric Hill, a fraud specialist at the Cellular Telecommunications Industry Association in Washington. We've seen a reduction down to about $23 million in the fourth quarter, but that's only due to the fact that many cellular carriers were suspending roamer agreements with each other and requiring roaming calls to be made through operators.'' So at the inconvenience of the customers, we've seen a reduction in fraud, but that's not the direction the industry wants to go.'' Call blocking is often just an inconvenience in the United States, where traditional phone service is reliable and widely available. To those doing business in the international market, however, it can mean the difference between success and failure. Essentially, cellular phones are attractive to peoqple in Europe and Asia because the actual phone system is archaic,'' Devaney said. They aren't luxury items. They're necessary to do business.'' When a call is placed, it rides the airwaves to the nearest cell site,'' a distance of one to four miles in Houston, depending on population density. The cell site makes note of the ESN associated with a call, then routes the call into the broader phone network. Once in the broader network, a call might next go through the jurisdictions of one or more regional carriers, and one or more long distance or foreign carriers. The originating cellular company eventually will pay each of these companies for the service used, regardless of whether it is itself able to collect from a customer for the call. The subscriber is of course liable to us, but we're the customer of the long-distance carrier,'' said the chief financial officer whose firm was victimized by the Houston-Persian Gulf phone theft operation. We estimate that about 20 percent of all roamer revenue goes down the fraud drain,'' said Hill of the CTIA. Fraud is presenting a number of faces to the industry, and indirectly, to its customers. Tumbler phones are normal cellular phones that have been modified with a specially programmed computer chip to use either a phony electronic serial number or that of a paying customer. The modified phones can tumble'' through numbers, placing per haps just one call on someone's bill before moving on to the next victim or the next phony serial number. Another side to the problem is credit and subscription fraud. Little more than a thorn to traditional phone service providers, it is crippling in the young and fractious world of cellular phones. It's a growth industry, with very little fraud prevention in mind,'' Devaney said. Most of the people involved in the cellular industry are entrepreneurial in nature. They're risk-takers, and that doesn't always go hand in hand with security.'' Using fairly straightforward means, crooks can get a phone activated using the name and Social Security number of a law-abiding citizen. This phone will then be good for one month to three months of service, depending on the cellular company's accounting procedures. A lot of times, the bad guys will have someone planted in the cellular company, too,'' enhancing the opportunities to get phones activated illicitly, said Michael Guidry of the Houston-based security firm Guidry & Associates. A crook won't always stop with one phone. In an increasingly popular scam referred to as a call sell'' or phone shop'' operation, any number of phones may be used. For a cost averaging $25 per 15 minutes, these enterprises let customers place anonymous calls throughout the world. Each phone obtained using stolen personal information can generate up to $270,000 in revenue before the accountants catch it, Guidry said. If it is instead a tumbler phone, revenue is open-ended, since its calls can't be readily traced. Large-scale abuse also is carried out by crime rings, such as one that the Secret Service, working with Guidry's firm, recently busted. Allegedly engaged in making arms shipments to Israel and drug shipments to the United States, this ring embraced five levels of organization and over 20 storefronts concentrated in Los Angeles and New York. You're looking at organized crime at its finest,'' said Guidry, who is regarded by some law enforce ment officials as the top security expert on cellular fraud. Firms such as his replace a missing link between cellular companies, most of which have no internal security teams, and law enforcement. Fraud is the industry's problem, but when solving fraud also solves crimes involving drugs and guns, the police get interested. Although disputed by industry spokesmen, some investigators even fear that a high volume of criminal use could be helping to shape the cellular industry. Organized crime spurs technology development, and telecommunications fraud is connected with it,'' said Langford Anderson of the Communications Fraud Control Association, a clearinghouse for fraud main tained by the telephone industry. We think organized crime is responsible for certain developments within the cellular industry.'' Regardless of how strong that connection is now, it has the potential to grow rapidly, much as the cellular industry is itself rapidly evolving. Cellular companies are expanding, they're going overseas, and they're facing a lot of fraud problems unless they get a handle on it now,'' said Devaney of the Secret Service. If they go into that with their eyes closed, the criminals will take advantage of it. Where there's opportunity for industry growth, there's opportunity for criminals. I'm looking for the industry to join us in this battle. We're engaging high-tech criminals on a daily basis in the federal government now, and the challenge to the Secret Service, the FBI and other agencies is to at least be able to stay even with high-tech criminals. We depend very heavily on the industries that are being victimized to help us,'' he said. We've had a great deal of success with the credit card companies and hard line (phone companies) such as AT&T, and we're hopeful we'll find similar success in the cellular industry.'' A Houston cellular executive predicted that such cooperation, along with the aging process, would solve today's concerns. The problem really is that once we stop the tumblers, they'll find another way,'' he said. Because it's such a new industry, people try and find new ways to defraud you every day of the week.'' -------------- [Moderator's Note: My sincere thanks to Joe Abernathy and the {Houston Chronicle} for permission to bring you this special report. In the next issue of the Digest (V11 #201) this topic will continue with a follow up article discussing recent actions by the Secret Service. PAT] ------------------------------ End of TELECOM Digest V11 #200 ****************************** Date: Wed, 13 Mar 91 21:16 CDT From: Arun Baheti Subject: Secret Service Foils Cellular Phone Fraud [Moderator's Note: Mr. Baheti passed along this article which I am presenting as part of the two part series on cellular fraud. The last issue of the Digest (#200) presented a story by Joe Abernathy. PAT] {New York Newsday}, March 7, 1991, By Joshua Quittner The US Secret Service said one of its agents cracked the code of counterfeit computer chips to block a kind of cellular telephone fraud responsible for an estimated $100 million a year in unbillable long-distance calls. During the past two months, the service has quietly distributed a free software "patch" that blocks unauthorized long-distance calls at cellular telephone switches. The patch is being heralded in New York City, where more phone service is stolen than anywhere else in the country. The first day the patch was put into use in Los Angeles, more than 5,000 illegal cellular calls were blocked, a Secret Service spokesman said yesterday. [...] The counterfeit chip used by phone cheats exploits a weakness in the cellular telephone system that allows a caller's first call to be completed before the billing status is verified ... A legitimate mobile phone has a silicon chip that generates an identification number. When a call is made, that number is relayed to the carrier, along with the caller's phone number, and the two numbers are compared to establish billing. However "depending on where you're roaming and how busy the cellular network across the country is, you can make a phone call before that procedure is completed." [Norman Black, Cellular Telephone Industry Association] To exploit that weakness, underground engineers designed a counterfeit chip that generates a different, phoney identification number on each call, tricking [the cellular telephone exchange] into thinking each call is the first. One illegally rigged phone, confiscated by police in New York City last year, was turned over to the Secret Service, which investigates, among other things, telecommunications fraud. Like a hacker -- a phone computer cheat -- the agent broke into the chip, read the microcode, decoded the algorithm at its core, then wrote a program that would help carriers detect its peculiar pattern. Dave Boll, who heads the Secret Service's Fraud Division in Washington, said that cellular telephones equipped with the counterfeit chips "sell for as much as $5,000 each". And he estimated that such phones are used to make $100 million in unbillable calls each year. [The article goes on, to talk about the call-stealing problem being the worst in NYC and how the unbillable calls tied up the network for the paying customers].