Why Is Nothing Done About Phone Number Spoofing as "Suspicious Transaction" Scam Continues?

Spoofing is the ability of malicious persons to not only hide the true phone number they are calling from but abuse caller ID to have the inbound call show up as "Chase Manhattan Bank" or "MasterCard" or anything they choose. It has been going on since 2004 but scams targeting seniors became so common that in 2019 AARP declared 'You can't trust caller ID anymore.'

An 80YO friend and neighbor was scammed out of $30K two weeks ago. Here is how it happens:

You get a call that appears to be the fraud department of your bank or brokerage account. The caller ID says "Chase Bank" and shows a phone number that is Chase.

If you answer, a live person on the other end will speak to you in a calm and professional tone. They will have some accurate info on your bank account and they will tell you that your account has been flagged for suspicious activity. May ask "Did you authorize a payment or transfer for $xxx?" No.

Of course we have all been warned about scams like this but the caller ID, the calm voice and the bank info make it seem legit. They aren't rushing you or pressuring; they are "helping". Most people are still wary at this point but here is where the scam really ensnares you:

While you are on this call or even if you hang up on them, another call will come in. Different person, caller ID may say "Chase Fraud Protection". This person may say they are a supervisor. They may say that the other call is/was a scam and you need to secure your account. Somewhere between the two (or more) callers they will ask you to type some kind of number into your phone. That number will include *72 -- that is actually a code that forwards your incoming calls.

Now they are receiving any communications that your bank's system tries to send to you. They are in between you and your bank and they are quickly setting up an outbound wire transfer. The bank's system will text you a numeric code. The scammers will have you read them that code "for verification". If you do that the wire will go through.

My friend who had this happen wound up authorizing two transfers at $15K each from a Schwab account. He says that after the first scam call, he called the phone number which is on his account statements or the phone number on the legit website for Schwab -- this is exactly what is recommended. Eg. Hang up on the scammers and make an outbound call to a phone number which is confirmed as legit on your statements, back of your card or legit website. He did this but wound up still talking to the scammers. If he is remembering this correctly, that is spooky because it suggests that the scammers had some ability to grab his outgoing call or they were able to make it seem like he had hung up on their call when in fact they had disabled that (?) eg they just listen to him dial the other number but it doesn't really go anywhere because he is still on one of the calls with them and then they play the ringing sound effect and "answer" as if his call has gone through.

Schwab has so far refused to unwind the transactions. In trying to help him and figure out how this all was done, I found out it is very common and the banks rarely unwind the transfers! How is it that acceptable? The banks' position is that you participated in the fraud by reading back or typing in the confirmation code, an action which they warn you over and over not to do.

The core problem, and not just within bank scams, is that our phone system has been compromised for 22 years! Why isn't Verizon, et al liable for negligence or accessory? They are operating a phone system which enables not just these kinds of spoofing attacks but also harassment, violations of restraining orders, and a variety of crimes in which callers can become unblockable such as the "Line of credit has been approved for your small business" predatory lending scam. They are allowing bad actors to ignore the Federal "Do Not Call" system.

NYS AG Letitia James has filed suit against CitiBank. Hoping for improvements: