According to figures from the Royal Malaysia Police (PDRM) and the Ministry of Home Affairs, Malaysians lost RM2.97 billion to scams over a recent two-year period. Telecommunications-related fraud—specifically impersonation scams, fake enforcement calls, and financial phishing—accounts for a massive portion of these losses.
Yet despite these figures, most users still rely on static, device-level contact blockers.
Here is how modern voice fraud operates at the network level, why traditional mobile blocking apps are obsolete, and how crowdsourced caller intelligence offers a far more effective defense.
The Architecture of Modern Phone Fraud
Modern scam syndicates do not use prepaid SIM cards in local phones to manual-dial targets. They run enterprise-grade Voice over IP (VoIP) setups operating through Session Initiation Protocol (SIP) trunking.
1. VoIP Spoofing & SIP Trunk Abuse
Historically, a phone number was hardwired to a physical line or SIM card. Today, using SIP trunking, an attacker can modify the Calling Line Identification (CLI) metadata sent to local telecom operators.
When a scammer initiates a call, their software manually writes the string of digits displayed in the incoming caller ID header. This allows them to project numbers matching local police stations, the Inland Revenue Board (LHDN), or official bank customer service hotlines. Because legacy telecom networks pass CLI headers through without secondary origin verification, your phone displays whatever digits the incoming packet contains.
2. Data Harvesting & Authority Bias
Attackers target individuals using leaked databases containing full names, MyKad numbers, addresses, and banking preferences.
When a scammer calls using a spoofed CLI and recites private credentials back to the target, it triggers immediate authority bias. Once trust is established, the caller uses scripted psychological pressure—threatening imminent arrest or frozen accounts—to force quick action.
Why Static Phone Blockers Are Obsolete
Built-in OS spam filters and traditional phone blocker apps suffer from core architectural limitations:
Metric / Feature | Static Blocker Apps | Real-Time Crowdsourced Engines |
Data Sync | Slow (periodic DB downloads) | Instant cloud synchronization |
Spoofed CLI Handling | High false-positives (blocks real bank lines) | Pattern matching via contextual user reports |
Device Impact | High battery usage, intrusive contact access | Web-accessible, zero app footprint |
Context | Binary ("Spam" vs "Not Spam") | Granular user notes and fraud categories |
The Burner Number Cycle: Scammers rotate hundreds of virtual numbers daily. By the time a number reaches a static blocklist, the syndicate has already moved on to a new block.
False Positives on Real Infrastructure: When scammers spoof official bank hotlines, auto-blockers blacklist the bank's actual numbers. Users then miss legitimate fraud alerts from their bank.
Privacy Trade-offs: Many third-party apps require continuous access to your contact list, SMS logs, and location. Uploading private contact books to third-party servers creates an unnecessary privacy risk.
The Role of Crowdsourced Intelligence
To counter dynamic VoIP attacks, caller verification needs real-time updating.
Web-based crowdsourced lookup engines, such as SiapaCall.my, shift the defense model from static local files to live community telemetry:
When a new scam campaign starts targeting a bank's customers at 9:00 AM, community reports begin populating the database within minutes. By the time subsequent targets receive calls from that batch, a quick browser lookup reveals live warning flags and context from previous recipients.
Practical Defense Checklist for Consumers
A complete defense against modern telecommunication fraud requires a multi-layered approach:
Verify Before Returning Calls: Run unknown incoming numbers through SiapaCall.my before calling back or trusting a caller's claims.
Cross-Check Financial Accounts: Run unknown seller bank account numbers or phone numbers through PDRM’s official Semak Mule portal before making any bank transfers.
Zero Trust on OTP/TAC Codes: One-Time Passwords (OTP) and Transaction Authorization Codes (TAC) are private authentication keys. No bank or government officer will ever ask for an OTP over the phone.
Emergency Escalation (NSRC 997): If a fraudulent transfer occurs, immediately call the National Scam Response Centre at 997. Reporting within 1 to 2 hours gives authorities and banks the best chance to freeze recipient accounts before funds leave the financial network.
Leave a comment