Have phone scammers recorded "Yes" statements to fraudulently authorise payments?

Question

A number of sources claimed that phone scammers would trick people into saying "Yes" on the phone, record it, and use that to fraudulently authorise payments.

Here is a January 2017 Fortune magazine article:

Scammers are increasingly using this phrase to record the word “yes” from unsuspecting consumers. Later, the recording can be used as a voice signature to authorize charges on the victim’s utility or credit card account.

The article references an FCC Consumer Advisory:

The Federal Communications Commission is alerting consumers to be on the lookout for scam callers seeking to get victims to say the word “yes” during a call and later use a recording of the response to authorize unwanted charges on the victim's utility or credit card account.

The Better Business Bureau warned a couple of months earlier:

The Better Business Bureau is warning consumers about an old scam with a new twist. The “Can You Hear Me?” scam has long been used to coerce businesses into purchasing office supplies and directory ads they never actually ordered, but now it’s targeting individual consumers, as well.

For the last few days of January, more than half of the reports to BBB Scam Tracker have been about this one scam. Consumers say the calls are about vacation packages, cruises, warranties, and other big ticket items. So far, none have reported money loss, but it’s unclear how the scams will play out over time, or if the targets will be victimized at a later date.

This smells like an urban legend to me. Even if there were cases of phone campaigns started with "Can you hear me?", I can't see any evidence that the responses were recorded, or even that any utility or credit card charges can be authorised with a simple recording of someone saying "Yes".

Have there been any cases of phone scammers recording a customer saying "Yes" and then using that as part of a fraudulent charge against their credit card or utility bills?

[Note: Some articles refer to the practice as "cramming", but that is a broader term.]

Answer 1

While there are oodles of online references regarding this scam, they all appear to stem from an October 2016 alert by the Better Business Bureau of Western Pennsylvania. I've searched for people who claim to have been billed as a result of this scam; the results are dubious at best. I've also search for people who have been arrested for using this scam and found nothing. This could of course be my google-fu not being up to par.

There's one big problem with this supposed scam: It depends on companies using voice identification (not just voice recognition) as an authentication and approval technique. For this reason, Snopes calls this "unproven":

Primarily, we haven’t yet been able to identify any scenario under which a scammer could authorize charges in another person’s name simply by possessing a voice recording of that person saying “yes,” without also already possessing a good deal of personal and account information for that person, and without being able to reproduce any other form of verbal response from that person.

Moreover, even if such a scenario existed, it’s hard to imagine why scammers would need to utilize an actual audio recording of the victim’s repeating the word “yes” rather than simply providing that response themselves. As far as we know, phone companies, utilities, and credit card issuers don’t maintain databases of voice recordings of their customers and use them to perform real-time audio matching to verify identities during customer service calls.

Answer 2

Summary.

Inc21 is an example where customers were recorded saying "Yes" to one question, and had that used as authorization to bill them. (There is no evidence here that they used "Can you hear me?" as a technique to elicit such an answer.)

About Inc21

Inc21 was a Californian company that, under several different names, offered services such as web-site hosting, search engine advertising and Internet-based faxing, with charges appearing directly on customer's phone bills.

The company a number of different acts to scam and mislead customers. The owners were prosecuted and convicted in 2010.

In order to charge for their services, they were required to record the customers authorising the transactions, and then submit those recordings to an independent third-party verifier (TPV).

One of the scams Inc21 committed was doctoring those recordings, including using recordings of someone saying "Yes" to authorise a charge the customer never approved.

Judge's Findings

Judge William Haskell Alsup's decision in FTC v. Inc21. Com Corp., 745 F. Supp. 2d 975 (N.D. Cal. 2010) describes the crime:

After the TPV company reviewed these recordings, it would compile a list that would indicate whether each purported sale "passed" or "failed" (id. at 30). Whether a particular TPV recording would "fail" depended upon various rules set forth by defendants, such as whether the person on the phone was a minor, whether answers were inaudible, or whether the recording was "clearly manipulated with" meaning, whether the audio recording had been "spliced" so that "yes" answers would be provided to questions when no such answers were actually given (Yakubova Dep. 30-31, 49-50; Lutich Dep. 90). Other factors could also result in a TPV recording being "failed" (Lutich Dep. 91; Wolfe Decl. Att. EE, FTC Exh. 77). Whatever the reason, the TPV company would describe why each particular recording "failed" in daily reports provided to defendants (Wolfe Decl. Att. EE, FTC Exh. 76). Even for those TPV recordings that "passed," however, it was impossible for TPV reviewers to authenticate whether the voice on each recording corresponded to the customer being billed (Tran Dep. 84; Lutich Dep. 95-96).

Defendants employed "quite a few" TPV companies, some based in the United States and others overseas (Yakubova Dep. 27; Tran Dep. 27-29). From 2005 until around April 2007, defendants would allow their call centers to create TPV recordings on their own (Tran. Dep. 27). This made it easy for call centers to fabricate such recordings. As one former Inc21 employee recounted at her deposition when asked "on how many occasions" would "the TPVs that [she] listened to appear[] to have been manipulated," she responded: "50 percent of TPVs that I personally listened to" (Yakubova Dep. 31).

...

the record also contains numerous declarations from defendants' "customers" who after being allowed to listen to their TPV recordings stated that the recordings were inaccurate and had been manipulated

FTC Allegations

There is more information from the FTC's allegations from this case:

Inc21 considered the recording of a “yes” to each question sufficient confirmation of the person’s authorization.(25) Defendants’ contractors testify that the TPV recordings themselves were doctored. ... In fact, Inc21 received at least one daily report showing that 100% of its TPVs had failed.(31) Additionally, Inc21 itself admitted that the TPV recordings were falsified. In this very Court, Inc21 sued eleven of its call centers in the Philippines, alleging that in 2007 they had:

employed fraudulent techniques, including, but not limited to using digitized and recorded responses to the questions posed by the TPV. Inc21 learned that, in most instances, no customer was actually on the telephone line during the TPV process. Instead, the call center would connect to the TPV and simply play the digitized or recorded responses in such a way that the TPV review would classify the call as a valid sale.(32)

...

Defendants often used falsified TPV recordings as a basis for denying refund requests or fending off law enforcement investigations.(39) In fact, all the consumer declarants who listened to the TPVs relied upon by Defendants as proof of their authorization testify that the recordings did not accurately reflect their conversations and were likely falsified.(40) Barbara Winn, whose experience is typical, answered a call in April 2008 that she was led to believe related to the Yellow Pages.(41) She provided the caller her address and telephone number, but ended the call when she was asked to state her date of birth, a question she found suspicious.(42) The next month she discovered a charge for Jumpage Solutions on her phone bill and called to dispute the charge.(43) Defendants insisted she had agreed to purchase their service and played her the TPV recording.(44) Ms. Winn describes the recording as obviously spliced and manipulated because it had her saying “yes” to questions she had never been asked, and the response to the question about her birthday was garbled and inaudible.(45)

Victim's Reports

The 3 March 2010 NBCnews article Crooks "cram" phone bills with bogus charges includes a report from a victim that gives an explicit example of the word "Yes" being spliced in to a recording forge an authorisation:

Jennifer Perrigo got crammed. She works for a swimming pool contractor in Oakland Park, Fla. One day she got a call from someone who just wanted to confirm the company’s phone number and business address.

“All I said was yes, yes, yes,” Perrigo tells me.

The company's next phone bill had an unauthorized charge of $57.24 on it for a fax-by-computer service she never ordered. Perrigo called the vendor to complain. Not only was she treated rudely, she was played a tape that supposedly had her approving the charge.

“It was so obvious that it was edited,” Perrigo says. “The whole experience was horrible. It was absolutely disgusting and I was very angry.”

Answer 3

Not strictly related to authorizing charges on credit cards but indeed YES, the yes scam is very dangerous over the phone and daily used. I force myself not to say that magic word over the phone to an unknown number, trying to answer "It is correct", "It is me", "You are right", knowing the danger of that word.

With this answer, I will do my best to prove that this kind of scam has been perpetrated so far and is percieved as an actual threat by the social context I live in.

In Europe, and with specifics to Italian Market, you can sign a contract over the phone by recording the call. Because of this innovative possibility aimed at save time and paper, there is a relevant number of scams over electricity/pay-tv/phone contracts. This possibility is regulated by decree n. 21 of 21.02.2014 which translates an European regulation [citation needed] into local law. But the law provisions are very clear: a contract must be eventually concluded under a different medium.

The following scam I am going to describe is aimed at maximizing the commission fees that are paid by a utility company (e.g. phone, gas, pay-tv) to a sale agency for each contract brought to conclusion. The one who is most interested to the money is the salesperson, which earns a fee. The utility company gets new customers at the risk of being sued in the future, or, as I will illustrate, fined by the Antitrust authority. Normally the consumer whose yes is abused suffers an unwanted change of contract with likely disadvantageous fees/tariffs, which for telephone services will likely include one-time cessation and activation fees, modem rental, etc.

There is yet no firm evidence, with detail the Antitrust report I will be commenting later, that the utility companies are crime-partnering with the salesmen. The utility companies call themselves victims of the scam while they still generate revenue from new contract boosts.

Fraud scheme

TL;DR: the scam works by using social engineering to both obtain personal information you wouldn't find elsewhere and tricking the victim into wording yes.

The scheme is the following: the call centre starts by some general information, e.g. your name and phone number, and will call you to get additional personal information that is private using social engineering. During the phone call, the caller will trick the victim into pronouncing yes at any point ("Are you Mr...?", "Can you hear me")

Q: Am I speaking to Mr. Simpson?

A: Yes <== First and most damage is done here

Q: Hello, I am calling from the National Electrical Producer's administration office. There is an issue with a bill, may we check?

A: How can I help?

Q: Please take your last bill... (some chat) ... can you please read me the POD code? (read note)

A: EU0000000000000

Q: [Additional chat and a good time to obtain the IBAN number printed on the bill]

Now the scammer will say bye, hang the phone and take the recorded YES to construct an audio tape like this

Q: This is a voice-recorded contract, do you agree with this recording?

A: Yes

Q: Do you confirm your name to be Homer Simpson?

A: Yes

Q: Do you want to purchase an electricity contract with PowerCo?

A: Yes

Q: Do you confirm your POD number is EU0000000000000?

A: Yes

Q: Do you confirm today is 30 February 2018?

A: Yes

Q: Have you read and do you accept our terms and conditions, privacy policy etc?

A: Yes

After a few months, in time to forget about the call long ago, the inconscious customer will start being billed by PowerCo for his electricity, maybe at a higher rate. Homer Simpson will call in to demand what's going on, and when asked to show off a contract, PowerCo will provide the audio recording with the voice of Homer Simpson, asserting that voice-recorded contracts are valid contracts under current regulation, demanding payments and threatening debt collection.

The call centre obtains fees from PowerCo from each contract they complete.

Note: A POD code (which may be interpreted as Point Of Delivery) uniquely identifies a power metre. Can be used to establish or switch electricity contracts. Similar codes for gas (PDR) and telcos (migration code, ICCID).

References, from the Italian market:

• Truffa telefonica del SI: basta la registrazione vocale? - The YES scam phone: is vocal reconding enough?
• Truffe telefoniche: basta rispondere sì per cambiare contratto - Phone scams: a YES is enough to switch a contract
• Truffe sui contratti gas e luce: domande&risposte - Gas and light contract scams: Q&As (note that this comes from an electricity vendor)
• Truffa telefonica: basta un “Sì” e arriva il contratto non richiesto – Come difendersi - Phone scam: after a YES here you have an undesired contract - How to defend yourself (from a consumer association)
• Rispondi “si” e sei nei guai. La truffa del si telefonico. - After answering YES you are in trouble. The YES phone scam
• L'allarme della polizia: "Basta un sì per cambiare gestore" - Police alerts: "A YES is enough to change vendor"
• The YES scam from a debunking blog.
• Call center 'furbetti' - *Smart* call centres, a TV documentary aired in 2015, comment later

Commentary on evidence video by Le Iene

La truffa del sì - The YES scam video coverage on a case of electricity scam

The video was aired by Italian TV journalism/entertainment show "Le Iene" in 2017 on a national-wide channel. The show and its reporters are widely considered a reliable source of information as they brought to mainstream public a number of controverse cases, including a major drug scandal in the Italian parliament. For sake of balance I deem noteworthy to mention that the show was the major support of the Stamina Method media pressure in 2013, which was ultimately sentenced not having any scientific evidence.

The video starts with the case of a couple who ended up without electricity after failing to pay the bills to the utility company. The presenter claims that the ultimate cause of their problems is an audio recording of a phone call between the lady and Green Network with the caller having an East-European accent (likely Albanian) asking for the lady's consent to sign the contract with GN.

Excerpts from the recording 00:37:

Q: Are you the current holder of the contract?

A: Yes

Q: Are you vebally agreeing to Green Network Light and Gas contract?

A: Yes

Q: Do you have requested Green Network for a supply [of electricity], switching from your previous utility provider?

A: Yes

Q: Do you confirm your will to switch from the previous utility provider to Green Network Light and Gas?

A: Yes

The presenter then asks (00:54): "Did you notice something odd? The Yes by Mrs. Carla!" and the yeses are played back in short sequence. Presenter adds (01:03):

It happened they have made a copy & paste, and then clipped as only answer in a phone call in which Madame was asked for consent to change electricity provider. But Mrs. Carla never had that conversation

Mrs. Carla (1:15):

When they call in and ask, "Excuse me, is this the Simpsons?" [Redacted because I can't understand the family name] And then I answer YES

At 1:20 the audio recording is analysed by a forensic consultant (Paolo dal Checco) confirming that the recording was crafted by a single "yes" waveform.

Forensic at 1:24

I can confirm that the recording shows a number of yeses that have all been extracted from a single only YES

Presenter (continuing forensic sentence)

And that YES was copied, pasted and mixed to background noise, like if it was a true call, but mounting all the 12 yeses one after another, look what comes out.

At 1:42 the forensic's laptop shows the yeses and their waveforms. Audience can clearly hear that the yeses are the same sound.

I like to quote presenter's comment verbatim

Then, a YES is enough to be f****d up

The presenter explains that the family have been ignoring the bills from Green Network since the company started billing them for electricity. They did not simply recognize Green Network as their provider.

A familiar (Mr. Riccardo) called in to get the proof of consent, and they replied with their audio.

In the video, at 2:40, both Mr. Riccardo and the presenter claim that everyone can hear this is not a true audio, everyone except Green Network, which now is moved into the witness stand.

At 2:55 Green Network was interviewed and admitted that a number of scams was ongoing by a number of call centres, then claimed to have sued the scammer call centres.

Giovanni Barberis (General Director of Green Network, 3:05)

That is enough for me. We know that Since a few months we have been victims of rogue salesmen. We sued them, we cut business with them

At 3:50, the forensic is interviewed again, "In order to avoid being screwed up, what can one do?"

Avoid saying "YES" when somebody asks you to confirm your identity

The presenter advises the public how to answer a phone call from an unknown number without saying "YES"

Q: Good Morning, are you Mr. Nicolò De Vitis?

A: Who am I speaking with?

Q: Are you the owner of this number?

A: Tell me...

Understood? Never say YES

Commentary on video 10

In this video aired in 2015 on a major national TV channel from same network as the previous, the presenter starts with a claim:

And when some consumer claims to have misunderstood, quickly these companies show off perfect recordings in which everything [bullying prices/clauses] are clearly explained. Except that nobody recorded what was told earlier

The above means that not the entire phone call is permanently recorded, but only the contract part. It usually starts, by regulatory order, with "Do you confirm your will to record this phone call?"

So the presenter said to have "followed a sample family for many months" to discover the lies, recording the teleselling calls they received.

This video does not yet again directly prove that someone was stolen a yes answer into a new contract. In order to get such an evidence, one would need to record his calls earlier, but people so smart to record unknown calls especially for TV usage are generally smart enough not to provide sensitive information, so the loophole occurs. In general, I am afraid there will be little to no direct evidence that yes was extracted from a single call into a contract (comparing the first yes with the evidence claimed as contract by the company). But I would still like to go on with the video and show the lies worded by the telesellers

Call at 00:49

(Presenter) Yes, Hello?

(East-European accent Teleseller) Welcome sir, I am Andrea Rosani and I am calling you from The Central Office of Electricity and Gas to inform you that by this week your electricity fare will be discounted a lot. In order to charge you with new prices we must only confirm your technical data

P: I am sorry, The Central Office of Electricity and Gas?

T: Sir, I am calling you from The Price Lowerage Office

P: What is the company you are calling for?

T: It is [redacted by the show]

P: Ah, it's a company different than the one supplying electricity to me. I am sorry, I don't

What is shown in the above call are only the social engineering techniques that the telesellers are going to use. In the second call (1:56, 2:04) the teleseller asks for the POD number explicitly (it is clipped as a continuation of the first call, "Ok, let's run those technical verifications"). The presenter draws random numbers from a bingo tombola reel.

In the second part of the video, a representative of the not mentioned electricity company admits that there is an ongoing scam (word used) but claims it is the teleseller's fault, which happens to be a Chinese box. At 3:50 it is shown that a Roman utility company outsourced teleselling to a company based in Verona, which on their side re-outsourced phoning to an Albanian call centre.

The video ends with promise of continuation but I couldn't find the next video in which the presenter travels to Albania to interview the telesellers with hidden cameras.

Noteworthy

In general:

• A crafted record won't stand court in the end. It is not hard for people armed with Audacity or any amateur audio software to identify that the record has been crafted. But it will take a court case
• In the Italian market I mentioned, criminal and civilian cases are separate and sentences may be different, so while one court may be called for charging the call center of criminal actions, another court is due to void the contract. A civilian court case action takes time and money. This is not covered in the sources, it is how generally Italian justice works
• Luckily, there are a few legal provisions to avoid civilian court and save money. One is that the contract is legally binding only after paperwork, as cited in 2.
• The other provision is that regulatory authorities (AEEGSI, AGCOM, AGCM) allow consumers to submit cases for little or no money via extra-judicial settlement. And have sanctioned the electricity/gas/phone companies a number of times (Antitrust: 12, 13, 14)
• The call centres have all the time to cash their money for the contracts and disappear, or reopen with another business name. I am not yet finding the video from Striscia La Notizia.
• The scam works well with elder or unaware customers. If you find something is odd with your bills/contracts, you have all legal protections to claim the old contract after proving it was unwanted. But your old mother may not notice and continue to pay. Some old victims were not lucky, didn't pay and ended without electricity. This claim might be supported by the video I linked and similar cases covered by the media. In general, a lot of customers may be unaware of their rights and be easily scared by the threat of legal prosecution or debt collection actions.

Commentary on 14

Link is interesting at few points:

• At point 9, the Authority does not mention the "yes" scam but focuses on the fact that solicitation calls from salespeople (outbound teleselling) do not provide adequate information on the purpose of the call. This supports my example conversation where the scammer pretends that there is an issue with you bill.

• At points 31 to 35 Authority determines the revenue for the telesellers. Telesellers are rewarded based on the number of POD codes they make contracts for.

• From point 78 on, the Authority investigates whether Green Network was aware that a number of unintentional contracts was supplied by their sales network (not just teleselling)

• At point 91 the Authority sentences that actions put in place by GN to limit the occurrences of unwanted contracts were marginal

Green Network was sentenced (if the word is appropriate) guilty by the Antitrust authority for violation of consumer rights.

Incognitos

There are indeed a few missing points as highlighted by comments. I don't know if providing interpretation/speculation is worth

• Why crafting a record if it can't stand court? Indeed, those records will never stand court
• The above in other words: what stops scammers from using their own voice since utility companies do not check the vocal contracts thoroughly? Is their idea that customers will refrain from a court case if they hear their own original voice?
• Since law requires contracts to be finalized over paper or digital medium, why don't utility companies obey the law and send those paper contracts? Why do they stop at recorded phone calls?