Fraudulent calls / network security problem

[visioncraft]

Until recently, I was a very satisfied customer of freephoneline.ca

True, I found it difficult initially to get my SIP phone set up (an Aastra 6731i), but eventually after months of experimentation, all was working well. I posted the results so other users could benefit.

The voice quality was great with my phone. Everything worked as it should.

So, I thought, why not buy a long-distance credit? This company deserves my support....

But then, strange things started to happen. Calls to Africa, Asia, and other places started showing up on my call logs. Calls I never made.

I complained. We reset my SIP password (well, that took some time, too....) and I thought all was back to normal, but no!

More unauthorised calls to strange places. I immediately complained. The response? My account was flagged as "fraudulent". I was accused of using the phone for a business (though most of my calls were to my own phone line!) - something quite untrue, this phone is in my residence. On top of that, I had given my phone number out to academic contacts at conferences.... and I was told that no refund would be issued to me for my SIP password.

All stranger than fiction, but true. I'm just an ordinary person - a PhD student with an international reputation in the field of ecological education - but I am treated as a criminal of some sort by Freephone. Why? I have no idea - but I suspect a major network security problem at freephoneline.ca

All this saddens me, because I was a real freephoneline.ca booster, recommending it to friends and relatives. I just hope that this situation can be rectified and that justice will be done.

[Jake]

Wow, that all seems very strange. It sounds either like an account mix up, or your account details have been leaked somehow.

I'm a bit curious as to how they came to conclusion that you were using it as a business account. Looking in your call logs do you see calls to lots of businesses in there? or just your normal calls and the strange overseas calls?

You were probably right to post it here, but I would also get back on the phone and try and get put through to someone higher than the first people you talk to at support.

Good luck, and let us know how you get on.

[FONGO_steve]

I also second Jake's suggestion on calling us to sort this out - unfortunately there's nothing we will be able to assist with over the forums due to the nature of this issue.

The main point here is that your account was used to place a lot of calls to known fraudulent international destinations. This did set off some alarms and forced us to suspend calling on the account.

If it was not your making these calls, then your account does appear to have been compromised, possibly as many as two different times as you state.

Do you use public wifi, or have your own wifi that may potentially be insecure?

We have the utmost highest levels of security on our end, so for your individual account to be compromised would mean that someone was able to attain your account credentials somewhere between you and us.

For further correspondence on this issue please call into our contact center and speak with one of the supervisors who will be able to address this further. As previously mentioned, we will not be getting any any specifics on this in our web forum.

[visioncraft]

I have contacted your offices several times and this is why I resorted to the forums.

My IP phone connects over a Bell Fibe internet router via a wired connection. I do have wifi enabled on my network, but I use both password protection AND Mac address filtering, so this should be a very secure connection.

I did enable port forwarding at one point when I had problem making calls. I could disable this - but with my phone now deactivated, this is not really even an option. Could this cause a security breech of any kind?

I must admit that this whole situation strikes me, too, as very strange. I am deeply mystified. AND deeply frustrated that my account has been flagged and my number suspended!

[visioncraft]

By the way, regarding call logs, my calls were only to a retreat house in Guelph (my wife calling me when I was away for several days), a friend in Saskatchewan, my parents in BC, and local calls in Toronto - on average probably one-three calls per day. (Plus the few fraudulent calls after buying the credit.) Not exactly heavy usage! And in both cases, after spotting the fraudulent calls (because my long-distance credit dropped below $3), I reported it immediately. So, I report fraud, and then got accused of it myself!!!

[FONGO_steve]

By the way, regarding call logs, my calls were only to a retreat house in Guelph (my wife calling me when I was away for several days), a friend in Saskatchewan, my parents in BC, and local calls in Toronto - on average probably one-three calls per day. (Plus the few fraudulent calls after buying the credit.) Not exactly heavy usage! And in both cases, after spotting the fraudulent calls (because my long-distance credit dropped below $3), I reported it immediately. So, I report fraud, and then got accused of it myself!!!

Hi visioncraft,
We aren't accusing you yourself - but due to the nature of how this keeps happening, even after a SIP password change, we are forced to take precautionary measures to protect ourselves in this situation. I have forwarded this whole thread and situation on to a group of our supervisors in the appropriate departments, so someone should be following up with you shortly.

I work on our development team, not directly in our support center, so I'm only able to take things so far from my position. If you feel you aren't receiving a timely response from them in the next day, then please feel free to follow-up with me via private message and I'll get a contact for you to reach.

Thanks

[visioncraft]

Many thanks, Steve. I sent a message to you via the support e-mail.

Here is the reply I received from freephoneline.ca:

----------

Dear Customer,

At this time this account can't be re-activated, as all signs point to this number being used for business purposes, and as stated in our terms and conditions this service is to be used strictly for residential use only.

I have spoken to my manager on this and have been advised that there is no way that a refund of any kind can be issued.


Freephoneline support

-----

All this, despite only very limited calls on the line.

I am only posting this all here because private e-mail's got me nowhere, alas!

[callopsitte_himself]

I don't want to sound bitchy but this situation does sound questionable.
My wife works in a bankand her position has her deal a lot with fraud. The number of people trying to make fraud is very impressive and the ways to do it are also very creative. It also, 95% of the times, implies people over sea.

Secondly those people most of the time claim to be highly educated with some title as doctors. They even get it written in their customer profile but there is no way of verifying it and if it can be verified it turns out they are not what they say they are. So why mentionning here, visioncraft, that you're a phd student? Should it give you more credibility?

Also the internet is a gold pot of information. If you google about VoIP security you'd learn that it is highly secure and more than traditional phones.

There is also the fact you say your network is securely encrypted + use MAC address and that even after changing your fpl password you still get your account hacked. WOW! I understand shit can happen but twice under all these security precautions?!

So for me 1+1 adds up.

[bridonca]

I don't want to sound bitchy but this situation does sound questionable.
My wife works in a bankand her position has her deal a lot with fraud. The number of people trying to make fraud is very impressive and the ways to do it are also very creative. It also, 95% of the times, implies people over sea.

Secondly those people most of the time claim to be highly educated with some title as doctors. They even get it written in their customer profile but there is no way of verifying it and if it can be verified it turns out they are not what they say they are. So why mentionning here, visioncraft, that you're a phd student? Should it give you more credibility?

Also the internet is a gold pot of information. If you google about VoIP security you'd learn that it is highly secure and more than traditional phones.

There is also the fact you say your network is securely encrypted + use MAC address and that even after changing your fpl password you still get your account hacked. WOW! I understand shit can happen but twice under all these security precautions?!

So for me 1+1 adds up.

All he needs is a undiscovered keylogger on his machine, and bye bye security.

[Jake]

From what we know, fraud seems a strange word to use.

If he has been caught with his hand in the cookie jar and is actually using the number for a business account, wouldn't he just accept it and move on? It must be pretty obvious what a business account is and what is not.

The only other thing in question here is the calls to overseas numbers. I'm going to take a stab and say that these are premium rate numbers as nothing else seems to make sense as to why they would be called. If fraud was involved here, wouldn't he just be better off sending the money over instead of buying a calling card to call the numbers? Unless of course he is buying thousands in vouchers and claiming it wasn't him. If this was the case, then again it would look pretty obvious and not worth fighting.

So I don't think fraud is the right word to use, especially if it is being done through the vouchers as I can only assume it would be for 'relatively' small amounts and not worth bothering with. To me (as Bridonca mentioned) I think there is an information leak somewhere; either on the PC or maybe someone else. He mentions he is a student, so it probably isn't a son messing around with the phone - but maybe a brother, or a younger sibling hitting random buttons on the phone? Talking of which, could it be that these numbers are being dialed in error?

I think something is going on, and it is probably a security breach somewhere; probably on his side.

[callopsitte_himself]

bridonca wrote:

All he needs is a undiscovered keylogger on his machine, and bye bye security.

How can someone get the keystrokes with a keylogger if if he doesn't have to strike the keys for his password if they're put in his ATA?

Jake wrote:

If he has been caught with his hand in the cookie jar and is actually using the number for a business account, wouldn't he just accept it and move on?

And:

If fraud was involved here, wouldn't he just be better off sending the money over instead of buying a calling card to call the numbers?

You'd be surprised to learn about even small amounts of fraud and what people would say just to "prove" their supposed innocence. Somewhat of a narcissic challenge.

As for sending money instead maybe he does not have the money but just need to be in touch with people over sea.

It's a fact that we, as Canadians, are too credulous.

Just to make things clear, I'm not accusing him as I don't know him and cannot in anyway find out what really happened. I'm just looking at the problem from a different angle.

[FONGO_steve]

I'm going to lock this thread up before it steers too far off topic - our staff will ensure the original poster is taken care of.