A spoofed phone number can turn an ordinary call into a convincing scam. On the screen we see the number of a loved one, bank or familiar institution, but this is no guarantee of the caller's identity. And with the development of artificial intelligence, fraudsters also have new opportunities to imitate voices and strengthen the trust of their potential victims. How do spoofing attacks work, how far can the protection implemented by mobile operators go and what should we do when we receive a suspicious call? Hristina Burdasheva, Senior Director of Legal and Regulatory Policy at A1, tells FACT in A1.
- Ms. Burdasheva, what actually happens behind the phone screen when we receive a call from a number belonging to a relative, a bank or another familiar institution, and in reality the call comes from a fraudster? How does a spoofing attack work?
- In a spoofing attack, the dialed number is manipulated. Fraudsters pose as banks, couriers and operators, displaying a Bulgarian number on the user's phone screen. They can also imitate a specific number that we know, including that of a relative. When someone calls us, official information about the caller's number is transmitted between networks along with the call. Fraudsters manipulate this information. If the substitution is not detected, the phone displays the fake number, even though the call comes from another source. The goal is to gain our trust even before we have picked up the phone. Then they use various stories - for example, about a problem with a bank account or the need for urgent action - to trick us into providing information or transferring money.
- Why is it so difficult for the user to understand that the number is spoofed - is there a technical way for a person to determine for themselves that the person on the other side is not the real owner of the number?
- It is difficult because on the screen the call looks normal. We see a familiar number, and if it is saved in our contacts, the name of the person in question may also appear. There is not necessarily a visible sign of the substitution. It is like a letter with someone else's name in the “sender“ column. The inscription on the envelope does not prove who wrote it. Similarly, the number on the screen by itself does not verify who is speaking.
The user does not see the network information about the origin and route of the call. Therefore, based only on what is displayed on the phone, he cannot reliably determine the substitution. Spam detection applications can warn of a risk, but they do not verify the identity of the caller. The lack of a warning is also not a guarantee. It is important to clarify that the replacement itself does not mean a hacked phone or a breach in the bank's systems. The number information has been manipulated.
- You are already able to block certain spoofing calls when it is determined that the number is “stolen“ and is from the company's network. How big is the problem with numbers that come from other operators or from abroad?
- First, by “stolen“ here we understand an imitated number, and not necessarily control over it has been taken away. And we must distinguish the displayed number from the place where the call comes from. A fraudulent call can start outside Bulgaria via internet telephony. The fraudster sets a foreign number to appear on the recipient's screen, and the call goes through one or more intermediaries. Finally, it reaches Bulgaria via an international line - just like legitimate calls from abroad.
If the substitution is not detected along the way, the spoofed number reaches the customer. In our network, we see which network we receive the call from, but it may only be the last link in the chain. This does not always reveal the original source. With a number from the A1 network, we have more information to check and, if substitution is detected, we can block the call. However, with a number from another operator, coordination with them is necessary. The Bulgarian number on the screen does not necessarily mean a call from Bulgaria, but international origin in itself does not prove fraud.
We do not have data to accurately assess the scale of the problem. The scheme itself allows for mass dialing and can affect people of different ages. Fraudsters change both their stories and the organizations they represent, depending on what they expect to gain trust.
- Where is the line between what an operator can technically stop and what it cannot stop due to the international nature of the traffic and the applicable rules?
- The limit is what we can reliably recognize as a fraudulent call. At A1, we monitor international lines and stop calls where we find that the displayed Bulgarian number clearly does not correspond to the origin of the call. However, the mere fact that a call comes from abroad does not make it fraudulent.
Protection is not a filter that we set up once and leave it to work. Fraudsters change their methods, which is why we regularly update the recognition rules. This is constant work and does not mean that we can guarantee the stopping of every fraudulent call. The international nature of traffic also requires broader interaction. We exchange information with the regulator, with other operators in Bulgaria and with foreign operators about new schemes and sources of fraudulent traffic. In this way, we supplement the information we have in our own network.
I would not point to a specific regulatory restriction as a reason for not stopping a given call without examining the relevant case. We also pay serious attention to user awareness. Technical measures are one layer of protection, and the ability to recognize a suspicious request is another. That is why we help people know what to watch out for and how to protect themselves from the consequences.
- The Communications Regulatory Commission (CRC) and the three mobile operators are working on a mechanism that should cover all registered Bulgarian numbers. What specifically needs to be changed in the networks so that it can be determined that the number is spoofed even during an incoming call?
- It is important to clarify the scope: the discussed solution is aimed at certain calls on international connectivity, in which numbers from the networks of national mobile operators are imitated. It should not be understood as a guarantee of recognizing every possible substitution of a Bulgarian number.
After the meetings with the CRC, the three operators reached an agreement on the general principle of work. Talks are continuing on the specific technical details of the implementation. The mechanism can be explained with an example. Our subscriber receives a call with a displayed number from the network of another Bulgarian operator. However, it does not come via the direct connection between the two networks. It is precisely such cases that the general solution will cover, in order to maximally limit known spoofing schemes on international connectivity.
This will complement the measures that A1 already applies for numbers from its own network. Before the final implementation, the solution will be presented and discussed with the CRC.
There is also a limit that we must clearly indicate. The solution is aimed at existing and known fraudulent schemes. In the future, their development may require the exchange of operational and technical information between the three operators, which is currently not provided for or permitted by the current legislation. Legislative changes would be necessary for such an exchange. This is a separate issue from the implementation of the discussed solution.
- In your opinion, such a mechanism could work by the end of 2026, if there is unanimity. What could hinder this deadline – technical limitations, regulation or the need for coordination between operators?
- It is difficult to commit to a specific deadline in advance, because it depends on several elements – finalization of the general technical concept, coordination with the Bulgarian Competition and Consumer Commission, changes in the networks and coordination between the three operators.
The technical solution itself is only part of the issue. It is important that the mechanism is accurate enough to stop fraudulent calls without blocking legitimate international calls. There should also be clear rules for information exchange and the responsibilities of each participant.
Therefore, it is more correct to say that we are working for the fastest possible implementation, but the final deadline will depend on the technical and regulatory completion of the process. Meanwhile, A1 continues to implement its own measures to identify and block spoofing calls when we have sufficient reliable data about them.
- Is it possible that spoofing attacks will become even more dangerous with the development of artificial intelligence - for example, a fraudster could use AI to clone the voice of a loved one while simultaneously spoofing the phone number?
- Yes, artificial intelligence can make these scams more convincing. Voice cloning is already used in schemes where a fraudster impersonates a loved one in distress. The two techniques can complement each other. The spoofed number creates trust before we pick up, and the imitated voice can reinforce it during the call. We get two apparent confirmations of identity - one on the screen and one in the handset.
A recording can be used for voice imitation, including from a publicly shared video. This does not mean that every imitation is perfect. But when the voice resembles that of a loved one and the story is about an urgent need for help, the impact can be strong. At such a moment, anxiety can overtake judgment. AI enhances the persuasiveness of the familiar scenario - a person acting under the influence of emotion before checking what is happening.
- What should a person do if they receive a call from a loved one's number, but the conversation suddenly turns to a request for money, bank details, codes or other sensitive information? What advice would you give to users?
- My first advice is to end the conversation without fulfilling the request. Do not transfer money and do not communicate passwords, PINs or verification codes. A sudden request for money or sensitive information should be a signal that motivates you to stop the call and check.
If the caller claims to be a relative, call them yourself on the number you already know. If they don't answer, contact another person who can confirm the situation. When calling on behalf of an institution, dial the official number from their website or, for a bank, from the back of your bank card. Under no circumstances should you use a number dictated in a suspicious call. Also pay attention to instilling a sense of urgency. “Your account will be blocked“, “You must pay immediately“, “Don't close“ - such pressure can push you to act before you have considered the request. Give yourself time to check.
If you have already provided bank details, codes or made a transfer, contact the bank immediately through an official channel. They can assess what protective measures are possible. Keep all available information about the call and file a police report. A quick response is important, but it does not guarantee a refund. Report suspicious calls to your operator as well as to the institution the scammers are impersonating. The rule is simple: hang up, check, and only then act.
- What is the most dangerous behavior of a user when spoofing – to trust the number listed, to follow the caller's instructions, or to underestimate the fact that the scammer already knows certain personal details about him?
- These behaviors are related. The number attracts attention, personal details strengthen trust, and following the instructions can lead to real harm. The most dangerous moment is when the apparent credibility becomes a sufficient reason to do something that we would otherwise question. The feeling is especially misleading: “If he knows this about me, then he is who he claims to be“. Knowing a name, address, or other correct detail does not prove identity. And it does not entitle the person on the other end to receive further information.
An example of this is a scenario in which the caller correctly states our address, and then makes an unusual request. The address is correct, but it does not follow that the story is also correct. One correct detail can lend credibility to the entire conversation. Therefore, we must also assess the request itself. Is there a reasonable basis for it? Does it correspond to our relationship with this person or institution? The correct facts for us do not make every subsequent instruction reliable.
At A1, we take the risk and the consequences for the people affected seriously. Along with our work on network protection, we also pay attention to educating users — to understand how fraudulent trust is built and to recognize suspicious requests. We want them to have more support at a time when someone is trying to exploit their trust or anxiety.
--------------------------------------------------
Kristina Burdasheva is Senior Director “Legal and Regulatory Policy“ and a member of the A1 Leadership Team. She has over 20 years of professional experience in the field of law, personal data protection and corporate governance. Her expertise also covers current regulatory challenges related to digital transformation, cybersecurity and artificial intelligence.
She joined A1 in 2019 and has been in her current position since 2020. Previously, she held leadership positions in international companies in the oil and fast-moving consumer goods (FMCG) sectors.
Master of Laws. Her professional development includes mentoring and coaching training, as well as a strategic partnership program at INSEAD, France.