Case study: 365 days of phone spam data shows just how bad it’s getting

There’s an idiom in the gardening world that has always amused me: “A weed is just a plant in the wrong place at the wrong time”. The same can be said, in some ways, about phone spam… right? While there was a time when most of us would likely have picked up any phone call we received, in 2018, picking up a call from unknown numbers could be hazardous to your financial health.

This past year, my phone spam got so bad that I experienced what I call “Spampocalypse”— a month where I received so many spam calls that I was finally forced to take my head out of the sand and try to find viable solutions to my growing phone spam problem.

While I did find a minor solution through a spam blocking app, the entire situation led me to wonder two things about phone spam:

• Is it just me?
• Can I actually block all fake calls coming into my phone?

To answer both of those questions, I did some research both in my own call history and online to determine just how big an issue I (and others) have with phone spam, and whether there is anything we can truly do to stop the invasion occurring on our phones.

Is phone spam really a problem?

Just as with weeds, not every unknown number is a spam caller or a scammer. Sometimes, people just get the wrong number. Sometimes, a legitimate business is returning a call you made a few days earlier. Sometimes, your alma mater is zeroing in on you as someone who might just give to the alumni association (ok, that one could probably be considered spam).

The problem is, we could “sometimes” all day long without proving anything. Many of us feel like spam is getting worse, but most of us lack the actual evidence to prove it, or so we assume. The depth of the spam problem is likely sitting in your phone’s call history right now. While most of us feel like phone spam is getting worse, both the hard evidence to prove it and viable solutions to the solve problem have been slow coming.

It’s not a complete dead zone out there for evidence, however. An increasing number of software developers, analysts, and government agencies are taking notice and pushing out what data they do have on the issue.

Truecaller (a spam-blocking app software company) recently published both survey and internal data that show the extent of the problem. According to Truecaller, consumers receive an average of 23 spam calls per month, up from 18.8 in 2017.

Additionally, in an email exchange with Truecaller’s Director of Communications, Kim Fai Kok (more details at the end), we learned that Truecaller now detects over 2 billion spam calls per month.

The company also found that people between the ages of 18-34 were the most likely to fall prey to phone scams (24 percent of males, 14 percent of females). Their survey discovered that college grads were almost twice as likely to be scam victims over those without a college degree and that parents with children under 18 are also more likely to be scammed.

Truecaller’s number show mobile phones are the primary target for phone scams, with 72 percent of scams taking place over mobile phones. The company’s data also revealed the most common type of scams that consumers report receiving, including:

• Free vacation (58 percent)
• Credit card debt (51 percent)
• IRS (35 percent)
• Loans (33 percent)
• Political calls (23 percent)
• Bank problems (18 percent)
• Nigerian Prince (10 percent)

Unfortunately, it appears that many of the people who were successfully scammed chose to install a spam blocking app only after they were scammed. On the bright side, it appears most of us (72 percent) ignore unknown numbers or attempt to block or report them (40 percent).

Truecaller and other spam blocking app companies aren’t the only ones paying attention.

The FCC reports receiving 200,000 complaints about robocalls in each year since 2016. The Commission writes on its website that robocall complaints account for 60 percent of all complaints it receives. The FCC also notes that according to private analyses, Americans received some 2.4 billion robocalls in 2016. That number was likely higher in 2017, and will probably be even worse in 2018.

The growing threat is mostly because no functional technology or cooperations between tech companies and phone service operators exist that can actually stem the tide.

For US residents, we’re regularly told to add our numbers to the National Do Not Call Registry. The Registry only exists as a threat against legitimate businesses making unwanted calls, however. It does nothing to abate the growing number of spam calls originating from outside of the country using spoofed Voice over Internet Protocol (VoIP) numbers. The same is true elsewhere in the world.

The best we seem to be able to do at this time is mitigate the issue through spam blocking apps. Following my run-in with “Spampocalypse” in May 2018, that is exactly the solution I turned to.

But there was a fringe benefit to installing the app: more data. And lots of it.

Sam’s phone spam and scam data: It’s no laughing matter

I count myself among those millions of Americans, Canadians, and UK residents who all feel like phone spam is getting worse. I’ve felt like my spam problem was getting worse for the past few years, and Google Trends data for the past 5 years appears to back me up.

According to Google Trends search data, the volume of US searches for the term “phone spam” has more than tripled since 2013. In fact, it’s effectively doubled since 2017, with a huge volume increase since the start of 2018.

From my own experience, this makes intuitive sense. And after receiving 20 spam calls on one irritating day in May, I eventually installed the Truecaller spam blocker on my phone to help mitigate the situation.

(Aside: I chose Truecaller because it was a name I recognized from previous research I’d done on smishing or SMS phishing. I ended up ignoring another popular app, RoboKiller, because the last time I’d looked into the app for my previous research the company only offered their solution for iOS devices. Robokiller has since developed an Android app that you can install from the Google Play Store.)

This got me wondering: Was that fateful day in May just a fluke, or was my spam issue really getting worse?

Call history data

Truecaller and other spam blocking apps, including RoboKiller and Call Control, are effective at blocking many incoming calls but are also notably limited in their functionality. They won’t completely stop calls from coming in. Instead, they use your phone’s data connection to check against user-reported and public caller ID databases, as well as through unique algorithms and machine learning solutions that detect spam-like behavior.

According to Reddit user /u/ThisBej, RoboKiller also includes a robot answering feature that will answer and speak to scam callers. Should the call go on long enough, the service automatically records the call and lets you play it back for your own amusement. RoboKiller occasionally posts these scam recordings on their blog, as well, with user permission.

From there, the app can let you know within seconds whether a number has been labeled as spam, is a real business, or has some other registered name, as well as how many spam reports have been registered against that number.

You can also choose to add any number to your block list so that these apps will drop the call immediately upon it calling your phone, although Call Control states that it will create a block list for you automatically. Most of the top-tier spam blocking apps now offer some feature that allows you to block detected spam numbers without manually adding blocks lists, however.

From what I’ve researched, any of the major spam blocking apps can do a good job—even if an imperfect one—of helping you block spam. For its part, the FTC awarded Robokiller with a $25,000 prize in 2015 for the effectiveness of its app.

There a good number of trustworthy apps available for both iOS and Android, although Truecaller, Robokiller, and Call Control might be among the most trustworthy options. The Google Play Store, in particular, is filled with numerous suspicious apps you should probably just avoid altogether for security reasons.

After installing Truecaller, I found a somewhat useful feature I didn’t realize it possessed. Not only can the app give you information about calls as they come in, it can also scan numbers in your phone’s call history and shoot out details on those numbers as well.

Using this information, I was able to transcribe an entire 365 days of call data from my phone, including numbers, dates, times of day, caller ID, number of community-generated spam reports, and the number of times each number called. The data was telling, to say the least, but also should add some much-needed information to the on-going study into the phone spam problem, as well as help validate those who also feel their phone spam problem is getting worse.

The big picture: Spam all day, (almost) every day

Let’s start with the basics. Over the 365 day period for which I recorded data from my phone’s call history (August 23, 2017, through August 22, 2018), I received 876 phone calls.

That’s an average of about 2.4 phone calls received per day.

Not bad. (Actually, very bad, but you get the idea.)

Like many people my age and younger (so-called “Millennials”, as it were), I tend to spend more of my time texting or using messaging apps than I do actually making phone calls. But here’s where things get interesting.

Of the 876 calls I received during those 365 days, over 82 percent were either identifiable or suspected spam.

In fact, during the “Spampocalypse” of May 2018, I received 152 spam and/or scam calls. That’s just one fewer than the number of trusted calls I received during the whole 365 days of recorded call history.

Phone spam trends: Interesting takeaways and comparisons

My phone history data revealed some interesting trends that held true throughout the course of the 365-day period.

For example, I expected to see less spam calls on the weekends, and this held true when analyzed the data:

For the most part, I found there was little difference between the volume of calls for each day of the week Monday through Friday.

But what about the time of day? Almost no surprises there either:

With the exception of “Slo David”, most of my spam callers play it smart, intentionally pinpointing key hours of the day.

Who’s calling and from where?

As noted earlier, spam blockers are not a perfect solution to the phone spam problem. Truecaller, in particular, did a good job of identifying numbers that were likely spam. But because it relies on user-reported reports as a big part of its process, if a number calls that is either brand new or lacks reports, you may not get caller identification for it, and it may not be labeled as spam by learning algorithms designed to detect spam-like behavior.

Additionally, many numbers are just labeled “spam” or “scam”, without anything more specific than that. As a result, the two most common IDs for me were either “None” (self-identified by me as they did not have a caller ID from Truecaller) or “Spam” (as identified by the Truecaller app). In all, there were over 172 different unique IDs (not unique numbers, since so many were classified under the either “None” or “Spam”) that called my phone during that 365-day period, 147 of which were spam callers.

And in case you’re wondering, my friend “Slo David” only called once. In all, there were 235 unique numbers that actually called, 205 of which were spam numbers.

Some of the more unique ID’d names include:

• Big Face
• Fake
• Rob Scam
• Embassy of the People’s Republic of China (Chinese Embassy of Chancery)
• New One
• Back
• Me (sneaky!)

What I also found was that many of the names ID’d by Truecaller were clearly fake. It may be that some of the scam callers are purposefully registering names in the Truecaller spam database to make it more likely that people will pick up. This is actually somewhat devious, as an unsuspecting consumer might see a legitimate name pop up that hasn’t be registered as spam and assume it’s a number in his or her phone book. However, Truecaller makes it clear when a number is ID’d from your phone book, and when it’s been identified from their database. Nevertheless, it’s clear there are certainly flaws in the system that are being exploited.

For example, Truecaller ID’d very honest looking names, such as “Jason Milton”, “John Richardson”, “Lee Hughes”, without them also registering as spam. There were plenty of obviously failed attempts, however. Some numbers that were never marked as spam or scams by Truecaller but came up with a unique ID had rather obvious fake names, such as “Veronica 9209 Lanham Severn Rd., Lanham, Md”  and “Silvana Santinelli” (the name of a pianist, apparently).

Area code trends

With somewhat stunning regularity, the most common area code popping up on my phone was “240”. This confirmed something that I read while researching, and what I already believed to be true but that needed some added data for support: Neighbor Scams, or NPA-NXX Spoofing.

I also have good reason to believe most, if not all, calls I get from the “240” area code are all spam.

First, I don’t have any other friends or family that have the 240 area code. None of my trusted calls ever originate from a 240 area code. While I do have a few numbers in my contacts list with those area codes, those are old numbers for individuals I never actually talk to and haven’t talked to in years. Secondly, I no longer live anywhere near the 240 area code.

The spam callers, of course, don’t know this (or they didn’t until now, anyway). Any time I received calls from that area code, and especially with the “461” local exchange number, I knew it was spam. This is why it was easy for me to label most of my calls with or without a caller ID from Truecaller as spam. The majority of the numbers I received with no caller ID in Truecaller’s system were from the 240 area code and most likely Neighbor Scams, as were almost all of the numbers with a unique name generating from that area code, but without a “spam” label from Truecaller.

It’s certainly possible that some of those numbers were real people who just so happened to get the wrong number. The likelihood of that is small, however, especially when one considers I received over 300 hundred calls bearing the 240 area code or roughly a third of all calls I received during the 365-day period.

Is there a growing spam problem? Yes—for me, and probably most others

The biggest hurdle to understanding the phone spam problem has typically been the fact that data is hard to collect. In order to get a true understanding of the problem, we’d need to be able to scrape everyone’s call history and match it against databases like those available from Truecaller or Robokiller. Your mobile phone company probably already has such a capability, but there are obvious privacy and security risks and liabilities to that.

Still, it’s likely that phone spam blocking app makers, including Truecaller and Robokiller, have pretty solid data on what the spam call issue looks like right now.

Even without their data, however, there are some ways to bring my own phone spam data just a bit out of the realm of anecdotal evidence.

When my call history and spam volume is compared to Google Trends search data for “phone spam”, this happens:

There are certainly data limitations here (one year of data may not be enough to identify a trend, for example) but this at least hints to the idea that my phone spam problem over the 365 days examined was not isolated to just me. Even as my spam calling problems increased, others may have seen their spam increasing around the same time. This is not entirely unreasonable to assume, even with the data limitations and the notable downward trend following the “Spampocalypse”.

The phone spam problem: What we know

It’s not hard to find headlines detailing the current phone spam problem plaguing people across the US, UK, Canada, and in many other parts of the world. This past July, US authorities broke up a major, multinational IRS phone scam ring that had managed to scrape millions of dollars out of unwary victims.

Thankfully, I only received 4 calls that were verifiable IRS scams during the tested period, and all such calls (which came from the same number) came during the 2018 tax season. But IRS spam calls are not the ones most consumers deal with on a daily basis. Projecting my own experience and phone data forward, it’s likely NPA-NXX spoofing is the biggest problem, at least in the US.

Is there a solution to phone spam?

Simply put, not really. There are multiple ways you can help mitigate the phone spam issue, but there’s no solution on the market (yet) that will completely stop calls from coming to your phone. The best you can currently hope for is to block them at the point they make contact with your phone and before they register the first ring.

A few recommendations for consumers:

Install a call blocker

It won’t stop calls, but you can at least minimize the damage. Interestingly, my phone spam decreased after I installed the call blocker, but I don’t think these two things are actually related. As suggested earlier, Truecaller or RoboKiller are well-designed and trustworthy options, but you will want to avoid the many suspect apps available on the Google Play Store.

Join the Do Not Call Registry

This is of really limited use, but if you’re not on the Do Not Call Registry (US only), add your number to it. You might help mitigate a very small percentage of your phone spam, but the DNCR only helps mitigate sales calls.

Businesses can easily get around the Registry rules as well. For example, non-profits can still make donation calls or calls that are in effect sales calls even if they masquerading as though they’re for non-profit purposes. I still get a lot of calls from the Fraternal Order of Police seeking donations, for example. The organization is fully legitimate and I have no ill will against them, but I consider those to be unwanted spam calls even though they’re not scams.

Report suspected spam numbers

You could probably spend all day entering numbers here, but the FTC has a page for reporting spam and scam callers. You can file a complaint here, but don’t expect it to actually do much for you. The FTC has a very hard time stopping spoofed numbers, which seem to be comprising the majority of spam calls these days.

Change your number

Perhaps more of a last-ditch effort, but changing your number could be a potential solution. Just note, however, that you may be inheriting someone else’s phone spam when you get a new number. Phone companies tend to recycle numbers, so your “new” number may be someone else’s “old” number. If that number was submitted to every sketchy site on the web or stolen in data breaches, you might just be transferring from one spammed number to another one.

Use a Google Voice number for online sites and services

This gem comes from Reddit users /u/MortimerAdler. Google Voice is a free VoIP service that lets you sign up for and use an IP voice calling service. The unique number you get from Google Voice can be forwarded to any device, or you can choose not to have those messages forwarded at all. This is a good workaround to keep your real number private when signing up for websites that require a phone number.

Additional tips for dealing with phone spam

Data breaches are likely a huge reason why so many of us are getting spam calls. A quick check on the website Have I Been Pwned should show you some of the breaches you’ve been impacted by and the type of data you’ve lost to them.

Every email address I’ve ever used that I can remember has been part of multiple data breaches, many of which gathered phone numbers entered into those sites as well. Seeing as I’ve had the same mobile phone number for over a decade, there were no surprises here for me. I’ve lost my number to data breaches big and small, from Target to Equifax to my own workplace as a former teacher in Maryland.

When you do receive spam calls, it’s best not to pick up. This may only encourage the spam callers to keep calling back. Many will stop calling if they don’t receive a successful pickup. Others will keep your number on their list even if they don’t get a successful pickup. Even still, avoid interaction when you can.

That said, enjoy this video of a man who chose to get back at the scam callers and got one scammer to confess.

Truecaller on the growing phone spam problem

Given I found Truecaller’s app to be an essential tool for my research, I reached out to the company after I completed a draft of this article and shared some of my data with the company. Truecaller’s Kim Fai Kok (Director of Communications) got back to me fairly quickly with some interesting, additional data to share (discussed earlier) and some great insight on the issue.

Sam: How does Truecaller work to identify spam calls?

Kim: There are several different ways that Truecaller works. Through our proprietary technology and advanced spam algorithms that apply machine learning (e.g. threshold of reports, analyzing abnormal call patterns, common connections, and frequency of calls) we are able to identify what is spam and not.

Another important factor is the Truecaller community that consists of hundreds of millions of users that are helping each other to report spam and fraudulent calls on a daily basis. The stronger the community is, the smarter the service becomes. Through this network effect, Truecaller has become one of the most popular and downloaded communication apps in the world.

Sam: Can Truecaller stop spam calls completely, or only identify and block them?

Kim: Yes, in the Android version of Truecaller you have multiple blocking features that also allow you to fully stop all incoming spam calls. We also have advanced features like ‘block a number series’ that can help users block out entire country codes or even the spoofing scams where numbers begin with similar number series as your own.

Sam: What does Truecaller do with user data, such as phone numbers? (Privacy assurances, essentially.)

We use data to help our community identify scammers and unknown calls, but we also use that information to add security. For instance, users cannot get a number from Truecaller unless the owner gives permission. By default, non-public numbers are shown as ‘private.’ A contact request must be sent to the number owner in order for any exchange of information to take place. This means that the number owner has full control of who can receive their number.

Truecaller features are permission-based and are disabled by default, and the users can choose whether to participate in this community or not. We know that in today’s world, privacy is a top concern. That is why we make sure we have clear principles we follow and allow our users to decide how their information is shown or shared.

To learn more about which permission is needed to have the best experience with Truecaller, please visit [the Truecaller support site here].

Sam: How many spam calls do Truecaller identify on a daily basis? Weekly? Monthly? Yearly?

Kim: Truecaller detects over 2 billion spam calls on a monthly basis.

Sam: What does Truecaller believe can be done to completely stop spam calls? In particular, are there any viable solutions to stop VoIP-based spoofed numbers and NPA-NXX spoofing?

It’s evident that spam calling is a big global problem. By just looking at the numbers we can see that it is only increasing, especially with the advancement in technology, allowing fraudsters to make thousands of calls at once. We believe this is only the tip of the iceberg. What we’ve learned is, this is something we need to collaborate more on with other eco-system players, e.g. operators. At the end of the day, they are the gateway who enable these calls to get through so we believe the more we can collaborate, the sooner we can solve this problem.