AI robocall scams rise as small carriers lag on anti-spoofing rules

A federal effort to curb robocall scams is falling short as many smaller telecommunications providers fail to fully implement authentication technology, even as artificial intelligence helps fraudsters launch more sophisticated attacks, according to research published Tuesday.

Since the TRACED Act was passed in 2019, major telecommunications firms have started checking networks and authenticating caller ID on most calls, according to the report from Transaction Network Services (TNS), a provider of infrastructure-as-a-service tools. The law requires providers to implement what’s known as STIR/SHAKEN, a digital signature system allowing phone networks to check the veracity of caller ID in order to block scammers.

However, most lower-tier communications service providers (CSPs) are not complying with the TRACED Act, according to the report. These firms only use the cryptographic authentication signatures required by STIR/SHAKEN 20% of the time, compared to 85% of the time for larger firms.

The discrepancy “reflects the real cost and infrastructure barriers many smaller CSPs face as they work toward full IP migration,” according to the report.

“As AI fuels increasingly sophisticated and scalable robocall attacks, fraudsters continue to exploit weaknesses throughout the ecosystem, undermining trust and enabling even highly authenticated calls to be spoofed, impersonated or unwanted,” TNS said.

The report is based on data from more than 1.9 billion “daily call events” and nearly 300 million subscribers, TNS said, adding that it “finds the voice landscape to be mature in some areas, vulnerable in others, and altogether under growing pressure from bad actors leveraging artificial intelligence.”