In 1972, New York Telephone called to advise me that it was adding calls to my bill that had been made by someone in the house who had tried to bill them to a fake number. You could do this then: give the operator a third number for billing. The guilty short-term housemate got mad: why hadn’t I refused the charges? Really, he’d been stupid: if you’re going to do that sort of thing, you do it from a phone booth, not from your house.
Phone fraud, like so many other things, is different now.
A week or two back, the support people at my ISP, a small networking company, emailed: it seemed like my IP phone box had been hacked, because it had made £322 worth of calls on Sunday morning, and could I scan all my devices for malware, then change all passwords, and confirm when I’d done it?
Sunday. I spent all Sunday fretting because my broadband was down. Unless it was briefly up without my knowing it, how could anyone exploit my network to make calls, even if they had laid the groundwork at an earlier time?
I asked the ISP – small company, real people – if they could compare the call logs with the times my broadband was down.
They could. They did. The broadband was indeed down. Plus: my box has only one channel and the calls used eight. Eight simultaneous half-hourish calls to – I now know – Diego Garcia, the most expensive country on the ISP’s price list.
It is thus that I learned about hacking into operational support systems in telephony.
But first, some background. In 2007, British Telecom announced it would spend the following decade converting its traditional public switched telephone network to Internet Protocol. At its most basic, it’s a shift from analog to digital. The process has taken longer than expected, and the final stage of turning off the old PSTN is now scheduled for January 2027. That in turn means ending POTS – the “plain old telephone service” landlines that many of us grew up with and most of us are abandoning at speed for mobile and VOIP, as a handy chart at Get VOIP explains.
This same move has of course happened elsewhere and brings the same issue everywhere: some people still depend on old POTS landlines. The telcos explain that the old networks are aging and need to be updated. Yet two problems keep resurfacing: many remote areas remain unconnected to newer digital networks, and VOIP phones don’t work in a power outage, where traditional POTS did. With the British government telling us all to stock food, water, and flashlights enough to survive a three-day outage in case of war or bad weather, getting rid of these phones seems backwards.
About three years ago, my ISP advised me that I would soon have to switch my phone line to SOGEA – Single Order Generic Ethernet Access – as my area was now being converted to digital. This is how I ended up with a broadband connection with a small Cisco phone box hanging off it, into which I could plug my old set of DECT landline phones that helpfully ring all over the house instead of only wherever my mobile phone happens to be (often, forgotten in a coat pocket). This is the phone box to which those £322 worth of calls were attributed.
But – as already noted – it seemed impossible that the calls actually went through my box. So, then…what? An eminent security expert of my acquaintance suggests the most likely is that someone hacked into an operational support system and changed a line in some database that associates the line to my house and my phone number for the purpose of reselling stolen phone calls. Even VOIP calls have *some* cost, and some countries, primarily in the developing world, still set high prices for incoming international calls. Hence the £322: eight simultaneous half-hour calls to Diego Garcia at £3.80 a minute, plus 20% VAT.
We’ve done some things to improve security and limit potential losses. But blocking international calls to all but the handful of countries I actually call is not available. Blocking *all* international calls isn’t a great idea. Unplugging the phone box except when I want to use it would work, but defeats the point of keeping the 35-year-old number I reliably hear ring.
More to the point, how often is this happening? The UK government has just concluded a call for evidence on telephony fraud, including “soft switches”. At TNS Call Guardian, John Harabunda cites the 2025 report from the Communications Fraud Control Assocation, which puts global losses to telecommunications fraud at $41.82 billion.
Fraudsters pick weekends, when the small businesses who more typically have this type of system are out. The irony is that if my broadband hadn’t been down that day I would have struggled much more to convince the ISP it wasn’t my line making the calls. I’m still not sure how this story ends: I’m not a customer of the ISP’s upstream suppliers.
It’s clear, however, that there are underappreciated risks associated with today’s VOIP “landlines” that did not exist with real landlines, many of them not under our control: the Internet of Other People’s Things.
Illustrations: Diego Garcia (via Wikimedia).
Wendy M. Grossman is an award-winning journalist. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. She is a contributing editor for the Plutopia News Network podcast. Follow on Mastodon or Bluesky.
