Add On: Phone Numbers
Phone Number
Types of phone numbers
City numbers :
Phone numbers prefixed with an area code that identifies a city are city numbers. These codes will be prefixed to all the numbers from that city which makes them easy to recognize. These could belong to individuals, organizations, or shops in such cities.
National numbers :
Unlike city numbers, national numbers belong to a country. Some countries like Denmark, and Estonia does not have city codes, they have a common code for the country, which will be prefixed with the phone numbers.
Toll-free numbers :
These are mostly used for customer support and marketing. The caller will not be charged for making the call. These are used to solve customer queries, and aid and sell products.
Mobile numbers :
Numbers that belong to a SIM card and are usually used in cell phones are mobile numbers. These are usually used by individuals for communication via cell phones.
Voice over Internet Protocol (VoIP) :
This is a method used to deliver voice communications and media sessions over the Internet. This is also called IP telephony. The phone number will be used to receive messages, voice-over communications, and calls.
Universal international free phone numbers :
These are similar to toll-free numbers except they allow calling from any country, which is why they are also called universal toll-free numbers. These are usually used by businesspeople.
Types of crimes that use phone numbers
Phone phishing or vishing :
Vishing attackers use phone numbers to obtain confidential information from the victims. Attackers play the role of the victim’s bank, or government officials to convince the victim and to build trust. They ask for One-Time Passwords (OTPs), credit or debit card details, and other sensitive information which may put the victim at risk.
Some of the common vishing techniques are:
Wardialing :
The attacker uses software to make calls to specific area codes, upon answering urging the victim to provide card details, mailing details, bank account information, and even social security information informing that it is needed to confirm that the victim’s account is not sacrificed.
VoIP scams:
This is predominantly used by cybercrime criminals to hide their identity as it helps in creating fake numbers. The attacker can create fake phone numbers that resemble a local number thus creating a sense of trust. These calls appear to come from government departments, police, and local hospitals.
Caller ID spoofing:
Like VoIP, this allows the victim to spoof their phone number and thus appear as unknown or take the form of a legitimate caller.
Dumpster diving:
Digging through the dumpster behind the banks, office buildings, and random organizations will provide enough information to the attackers to target a vishing attack.
Smishing :
These are text scams where the scammers use malicious text messages with links that infect mobile phones with malware or steal personal information.
Common smishing techniques are:
Financial smishing :
Cybercriminals send text messages with a link that seems to be from banks and other financial institutions asking to change passwords or complete Know Your Customer (KYC) forms. On clicking the link, the victim is taken to a website that mirrors the original website which will be used to steal their personal information.
Free offer scam :
Text messages that tell the victim they have won a free reward, money or lottery are often an attempt to tempt the person click on the link and enter personal information.
Fake order confirmation or tracking :
Confirmation messages after placing an order are common. But, receiving an order confirmation message when no shopping has been done is unusual. This creates curiosity in a person’s mind which makes them fall for this particular type of smishing. When the person takes an action, the scammer will be granted access to all the information on their mobile.
Customer service smishing :
Attackers may use a text message that says that there is a security issue in the victim’s account that needs attention. Usually, a link is provided to enter personal information. When the victim enters and submits this information, they receive a recovery code. Once the victim uses the recovery code to grant permission, all their data will be at risk.
How can phone numbers help in an investigation?
The process of using a phone number in an investigation
Attribution and validation of the phone number :
Investigators use online tools such as the number analysis tool to check where it is from, its country, and the network provider. Then, they validate the number using numverify or neutrino to check if it’s a phone number that belongs to a real person. Home Location Register (HRL) lookups can also be used for validation. This will help in finding out if the number is roaming, and whether it is ported, meaning that it is transferred from one service provider to another.
Search of the phone number in the appropriate format in Google :
This will yield interesting results like the linked social media accounts. One can also search in yellow/white pages for the number using infobel on google.
Use of caller ID to investigate the number:
Caller ID identifiers can be used to find out about the number, its owner, the name of the person, and its location.
Use of leaked databases and classifieds:
People search engines, leaked databases from dark parts of the internet, and classifieds can also be used to gather information.
Use of applications:
Investigators can find the relevant apps by analyzing the country, or area the number belongs to and finding out the popularly used apps. Giving such apps to access contact information by saving the number to the investigator’s phone could reveal a picture, username, or location.