Luxembourg regulator scrambles to counter ping call scams

Luxembourg's telecom regulator has acknowledged a growing scourge of 'ping call' scams, but lacks the legal authority to block calls from identified fraudsters, the justice minister said.

Scammers use computer systems to place thousands of random calls

Ping call scammers use computer systems to place thousands of random calls each day that ring just once or twice, giving phone customers little time to answer. When recipients return the missed call, that number is a premium line that surreptitiously adds several euros per minute in service charges to the victim's telephone bill.

According to the LSAP MP Mars Di Bartolomeo, regulators in France and Germany have the legal authority to require telephone operators to block calls from and payments to identified fraudsters. Luxembourg's regulation on spam calls does not have similar provisions, the justice minister, Elisabeth Margue, told Di Bartolomeo in response to a written parliamentary question on 27 March.

At the moment, the Luxembourg Regulatory Institute (ILR) 'offers mediation' through an impartial mediator who 'is tasked with helping the parties find an amicable solution to their dispute,' Margue stated. 'The mediation process is voluntary, free and quick. This process allows consumers to contest amounts unduly charged as a result of ping calls.' 'The ILR is currently reviewing the relevant regulation in collaboration with market participants, in order to take into account technological developments,' Margue said.

A spokesperson for the ILR told the Luxembourg Times that 'we will launch a consultation regarding a few changes to the existing regulation after the public holiday' but declined to comment further.

Difficult to Track How Prevalent Ping Calls Are in Luxembourg

The ILR spokesperson said 'we do not have any data available' on the number of ping calls, total number of scam calls of all types, and number of telecom customer mediation cases involving ping calls and other types of fraud and misrepresentation.

Spokespeople for Post and Orange said the firms did not release statistics on the number of ping calls detected in Luxembourg. Proximus, which operates the Tango network, did not respond to Luxembourg Times requests for comment.

Post, Orange and Proximus collectively have 98% of Luxembourg's mobile market and 87% of its landline market, according to the most recent figures available from the ILR.

'Such scenarios are highly complex, and in the hacker landscape, patterns change very frequently,' a spokesperson for Post, the largest telecom operator in the Grand Duchy, told the Luxembourg Times. 'This makes it impossible to provide reliable and comparable figures over a medium or long-term period. These calls are often randomly generated, originate from abroad, are short-lived, and therefore do not allow for meaningful annual consolidation over several years.'

Customer complaints about scam calls and spam calls 'are recorded within a broader category linked to fraudulent activities,' the Post spokesperson said. 'Over the past years, the number of these requests recorded annually [out of the total number logged] has remained in the double-digit range. This level is considered very limited when set against the overall volume of requests handled each year and does not indicate a widespread or growing phenomenon.'

Measures to Protect Customers from Scammers

Any technical solution that is implemented carries the 'risk of blocking legitimate' international calls and the 'risk of potentially discriminating against mobile wi-fi calls made abroad,' Margue said. Under the present rules, telephone operators 'are free to provide their customers with voice spam filtering tools, in compliance with data protection regulations,' Margue said.

The government is not considering the creation of a single portal for reporting telecoms fraud, she stated. 'Because hackers continuously adapt their methods, Post technical experts monitor traffic permanently and react on a daily basis to new attack patterns,' its spokesperson stated. 'Most scam attempts originate from abroad,' the Post spokesperson said, adding that on its own network, 'Post blocks incoming calls from foreign networks that display a Luxembourg fixed-line number belonging to Post, when these calls enter the Post network directly from abroad. This prevents fraudsters from exploiting trust in national numbers.'

When a call into the Grand Duchy originating from a foreign phone network falsely displays a Luxembourg mobile number, the local 'mobile number is deliberately hidden and displayed as 'anonymous', in order to warn customers that the displayed number may be misleading and that caution is advised,' the Post spokesperson said.

Both safety measures may not function correctly when mobile customers are roaming, because the calls only pass through international networks and not Post's, the spokesperson noted.

To Avoid Being Hit by Ping Calls, Scam Calls and Spam Calls

A spokesperson for Post said that phone customers are 'encouraged not to answer calls from unknown numbers, not to call back missed calls from unfamiliar numbers [and] not to respond to SMS messages from unknown senders.' 'These scam attempts are generally not targeted attacks,' the Post spokesperson explained. 'Fraudsters typically use randomly generated numbers, meaning that any number can be affected. Customer numbers used for outgoing scam calls have not necessary been hacked or [involved in a] data breach.'