‘Plus’ sign for incoming overseas calls may not weed out all scams but is good first step, say experts

SINGAPORE — A new measure that aims to help Singaporeans better detect spoof calls from overseas, by adding a "+" prefix to numbers coming from abroad, is a step in the right direction, telecommunications experts said.

However, it might not be enough to outsmart cheats who have access to cutting edge technology for scams, for they can develop new software to circumvent these measures.

WHAT IS NEW?

Dr Janil Puthucheary talked about the new method of detection on Tuesday (March 3) during the parliamentary debate on the budget of the Ministry of Communications and Information (MCI).

The Senior Minister of State for Communications and Information said that the initiative serves to block international scammers from “trying to spoof numbers to make them look like they are a local number and targeting our citizens”.

This will be done by introducing a requirement that all overseas numbers must have a “+” prefix on the caller identification (ID) display, and they will thus be identifiable by it.

The Info-communications Media Development Authority (IMDA) is working with telecommunications companies here to ensure that all network users have access to the function by April 15.

Only mobile devices with a caller display screen will be able to see the “+” prefix, so land lines with no display screens cannot display the symbol, for instance.

Scams that rely on spoof calls are a pertinent problem here.

Figures from the Singapore Police Force last year showed that more than S$21 million were lost to impersonation scams.

WILL IT WORK?

Most experts who have some experience in telecoms technology told TODAY that the new requirement will indeed reduce the number of scams from spoof calls, but they also said that it is not a foolproof method to screen international scammers.

Mr Oo Gin Lee, managing director of Gloo, a tech-focused public relations firm, said that while Singapore phone numbers usually begin with the numerals “6”, “8” or “9”, many other contact numbers also use “3” as a prefix.

For example, internet calls that connect to phones start with “3”, such as when a private-hire car driver calls a passenger via a ride-sharing mobile application.

Mr Oo thus doubts that international calls starting with “3” can be filtered out “because internet calls are borderless”.

Mr Sachin Mittal, head of telco research at DBS bank, said that even with a “+” prefix for international calls, there are a “million ways” for hackers to get around it.

For example, certain countries have for many years tried to block pornography sites appearing on web browsers, but hackers have consistently been able to breach these measures.

Even if hackers do not fiddle around with the software, a different problem may arise: Not all foreign calls are necessarily spoof calls.

Mr Mittal said that for consumers, a source of confusion will be differentiating between a call from an overseas call centre and a spoof call.

“A ‘plus’ sign (on the caller interface) can mean that a company has outsourced their operations to a country where labour is cheaper,” he explained.

Mr Travis Biehn, principal security consultant at Synopsys Software Integrity Group, said that most telephone scammers are “fairly unsophisticated” and the authorities may very well correctly tag 99.9 per cent of out-of-the-country calls with a “+” prefix.

However, the success of this initiative will still depend on how users choose to perceive and process such information.

He gave the example of user-access-control prompts on Windows computers that asks users if they are sure they want to access a site or programme, but these prompts “end up training people to just click ‘Accept’ or ‘Ok’”.

“Singaporeans will also likely learn to ignore the presence of a ‘+’,” Mr Biehn added.

Agreeing, Mr P Ramakrishna, chief executive officer of tech firm CIO Academy Asia, said that the issue of spoof calls is “not a technical, but a gullibility problem”.

“Phone scammers can use other platforms, such as WhatsApp, Telegram, Viber, WeChat, and so on,” he said.

“Telcos cannot block messages or calls on these social media platforms.”

WHAT WILL TELCOS DO?

The four telcos in Singapore — Singtel, StarHub, M1 and TPG Telecom — had told TODAY earlier that they welcome the initiative by IMDA to mitigate spoof calls, and they would be working closely with the authorities to address the issue.

M1 said on Wednesday that it will screen spoof calls by “analysis and identification of the call scenarios in our systems”.

After identifying an overseas call, the “+” sign prefix will be configured into the calling party’s identity and be displayed on phone screens.

“Local incoming calls will not display the ‘+’ sign prefix,” an M1 spokesperson said. 

The other telcos did not give details, but Mr Ramakrishna of CIO Academy Asia said that in general, telcos will alter their software programs in order to add a “+” prefix for incoming caller IDs.

“There are no infrastructure changes required,” he said.

“In any case, the changes are expected to take effect only from April 15, so the telcos have enough time to test their programs to ensure compliance.”

IS IT THE BEST SOLUTION FOR NOW?

In his speech on Tuesday, Dr Puthucheary said that the initiative would not be all the Government is doing to combat scams, and that it will continue to develop more measures to better protect its citizens.

“MCI will work closely with other agencies in the newly formed Inter-Ministry Committee on Scams announced by the Ministry of Home Affairs, to strengthen our collective efforts to tackle this problem,” he added.

Mr Aaron Zander, head of information technology at cyber-security firm HackerOne, said that the initiative acts as a “good first step”. 

“While we don’t want to assume all calls that meet the requirement to receive a “+” demarcation are scams, there still needs to be a quick way to identify that something is ‘off’,” he said.

“This is a simple, intuitive solution that works across a range of devices and apps.”

A spokesperson from Singtel told TODAY on Wednesday that the initiative will not eradicate spoof calls entirely.

However, “it will likely reduce the number (of scams from spoof calls) and importantly, alert and empower the public to protect themselves against phone scammers”, she said.