Spoofing services are pivotal in financial scams, particularly involving fake bank advisors. A report by Intrinsec highlights how scammers, known as “hello scammers,” use these services to impersonate banks and steal sensitive information. The SIP protocol’s vulnerabilities facilitate this deceit. The investigation into “Rise Spoofer,” a Telegram channel offering spoofing infrastructure, reveals advanced features and tactics used by fraudsters. The channel’s abrupt shutdown in September 2023 raises questions about the potential for rebranding among similar service providers.
The Role of Spoofing Services in Financial Scams
Spoofing services play a crucial role as technical intermediaries in scams that involve fraudulent bank advisors. Cybersecurity experts from the French firm Intrinsec have recently released a comprehensive report, spanning approximately thirty pages, detailing the operators of spoofing services and their significant impact on security breaches through phone number impersonation.
Scammers, often referred to as “hello scammers,” impersonate victims’ banks to extract sensitive validation codes, which ultimately allows them to access the victims’ finances. To execute these scams effectively, fraudsters rely on specialized services that enable them to spoof legitimate bank phone numbers.
According to Intrinsec’s analysis, the vulnerability is primarily linked to the SIP protocol, or “Session Initiation Protocol,” which permits individuals to display any desired number during calls. Additionally, the complexity of interconnecting modern and legacy networks exacerbates the challenges in monitoring these fraudulent activities.
Insights on “Rise Spoofer” and Its Operations
In their investigation, Intrinsec examined the rise and fall of “Rise Spoofer,” a Telegram channel that began offering its services in August 2022. This platform facilitated the rental of a ready-to-use spoofing infrastructure that allowed users to impersonate phone numbers through voice and SMS spoofing.
Beyond basic spoofing capabilities, “Rise Spoofer” provided advanced features such as call holding, pre-recorded voice scripts, and the ability to track dialed numbers. They even shared strategies with users on how to navigate blocks imposed by telecommunications operators, claiming that their system could seamlessly switch routes to maintain functionality.
Furthermore, “Rise Spoofer” released a guide advocating the use of Zolper, a free softphone application that permits calling from computers using SIP accounts obtainable through Telegram. Such tools, while legal, are often exploited by scammers to facilitate their illicit operations.
However, the saga of “Rise Spoofer” took a sharp turn in September 2023 when the channel abruptly announced its shutdown. The closure followed accusations against a rival service, “Chez Reverse,” of being fraudulent and intercepting client calls. In retaliation, “Chez Reverse” publicly disclosed the identities of “Rise Spoofer’s” operators.
Experts from Intrinsec speculate that “Rise Spoofer” may attempt to rebrand and resume operations under a different name, as there is little differentiation among various spoofing service providers, many of whom employ similar tools and techniques. The lifespan of these infrastructures tends to be short-lived, especially given clients’ fears of exit scams, where providers suddenly vanish after taking payments without delivering services—a common concern in the world of online fraud.