DHS watchdog’s fraud hotline spoofed in ID theft scam

The inspector general’s office in the Department of Homeland Security is warning that identity thieves and fraudsters are spoofing caller ID systems to make it look as if victims are being called from the IG’s anonymous tipline.

“The perpetrators of the scam represent themselves as employees with ‘U.S. Immigration,'” the office states in a press release circulated Wednesday, and “demand to obtain or verify personally identifiable information from their victims through various tactics, including by telling individuals that they are the victims of identity theft.”

“Many of the scammers reportedly have pronounced accents,” states the press release.

The office said it wanted to remind the public that it “never uses its hotline number to make outgoing calls — the phone line is only used to receive information from the public.”

The hotline remains “perfectly safe” for reporting “fraud, waste, abuse, or mismanagement within DHS components or programs,” the statement concludes.

The office did not respond to requests for further information.

Because of the way caller ID works, it’s trivially easy to misrepresent a number when calling. Any phone customer with what’s called a Primary Rate Interface — essentially any customer using a PBX switchboard or equivalent technology — can choose which number to transmit as the caller ID. Numerous companies offer spoofing services for a small fee, allowing a caller to specify the number they wish to appear in the caller ID field of the recipients phone. “Spoofing technology is 100 percent legal in the United States,” reads the website for one such service, SpoofCard.

Since the passage of the Truth in Caller ID Act, in 2010 and the rules the Federal Communications Commission wrote to enforce it the following year, it has been illegal to use spoofing “with the intent to defraud, cause harm, or wrongly obtain anything of value,” according to the FCC. Illegal spoofers can face penalties of up to $10,000 for each violation.

But “if no harm is intended or caused, spoofing is not illegal,” the agency points out, adding that some people have good reasons to want to hide their phone number or name — “such as law enforcement agencies working on cases, victims of domestic abuse or doctors who wish to discuss private medical matters.”