My understanding is that all calls on the voice networks are unauthenticated, the network can’t validate if a number calling is legitimate or spoofed.

In Australia, this problem exists too.

Surely these large telcos can band together and add an auth layer, I’d happily reject unauthenticated calls to me.

Why isn't this a problem at all in Europe? I've lived in Switzerland, where I would get 1-2 calls per month trying to sell me some insurance. Now I live in Romania and I don't get any calls like this. And I haven't heard friends complaining about it either.

Most of the EU countries have an opt-in policy: no unsolicited calls are permitted unless the company calling you has your permission.

But that's not the case in e.g. Belgium, where I live. Belgium has a do-not-call register.

Last week, I made a tool to automatically add phone numbers to that list (the do-not-call website API was unprotected,and all I did was automate what anyone could do manually via the website) so that we'd arrive at a de facto opt-in situation, but at 700K numbers the do-not-call website went into maintenance :)

Might have something to do with disposable income disparity. Language barriers also play a role.

They can but they are loosing profits as internet services swallow their market share. They won't do anything that expensive until they legally have to. The best way to fix this is to complain to your government.

The tools exist https://en.m.wikipedia.org/wiki/STIR/SHAKEN

The protocol exists, and is in use in a number of places. [0]

Whilst it isn't widely deployed yet, it is being rolled out across several nations currently - albeit very slowly.

Telstra is rolling it out as well [1], but they've coupled it to their 5G efforts.

[0] https://en.m.wikipedia.org/wiki/STIR/SHAKEN

[1] https://www.linkedin.com/pulse/tackling-changing-face-our-cu...

Hopefully phone UIs can start showing the check mark with more prominence (and information - it should say ‘not spoofed’ instead of ‘verified number’) since it seems the big 3 US carriers have implemented it.

T-Mobile in the US has implemented it pretty extensively AFAIK and I rarely get spam calls these days.

I actually think the majority of robocalls are from call centers with access to blocks of phone numbers they shuffle around.

I wouldn't even be surprised if phone companies got kick backs in some way too. Very few people are willing to change their cell number to protest.

I get ones with my number but the last 4 digits different - this worked the first few times I got them in 2019 but they’re definitely spoofed and I imagine they have a higher success rate than using real numbers.

It's convenient for them to use spoofed numbers now, but it's not strictly necessary. They'll revert back to using large pools of real numbers soon after auth is enforced.

But then you'd at least know which calls you can most likely ignore based upon whether they're in your contact or not. As of now, I've received more than a few calls from random contacts that turned out to be spoofed car warranty expiration warnings.

Newsflash scammers -- I drive a '98 Tacoma. That warranty has been gone for years now.

It's less technology and more operations research. Dumping large volumes of unwanted calls into the US market can be monetized and scaled, and the response from US industry/regulators/law-enforcement is anemic enough that being fraudulent and illegal doesn't put a damper on things.

It's not really technology so much as investment; i.e. the initial wave of robocalls generate enough income that scam operators can afford to invest in more call centers, phone numbers, infrastructure, etc. Just like a real sales division in a real sales company would.

Everything is a numbers game. Taking revenue from phone companies allowing this to happen is the only way to squash it.

Phone companies at least in the US are taking initiatives to screen spam callers, but there is only so much you can do when there are untrusted actors on the network. Truly ending robocalls would require a global treaty encompassing both hemispheres, and probably the creation of some new UN agency responsible for registering network endpoints (like ICANN). As it stands you can just move to another country that lets you hook up to their infrastructure if you are ever kicked out of your current base of operations. Given that there are still countries where you can e.g. host content that is illegal in the US or other countries, it seems unlikely such a treaty would ever make it into international law.

Originally it wasn't a thing to be able to transfer phone numbers between companies if you wanted to switch providers.

The industry pushed back hard saying it was too complicated, would cost them too much in development time, etc. Govt. still pushed and got it through, and now we have more control over our numbers.

If they're fined significantly for forwarding spam, then you bet they'll try to find a way to stop it.

Untrusted / unauthenticated does not mean not traceable. You don't need an international agreement to tell companies in your country "you're responsible for not forwarding spam calls, but you also don't have to accept calls from peers with bad spam ratio". Telcos know where the spam comes from either directly or indirectly. They just don't have a good enough incentive to drop partners.

Spam calls are simply not a problem in many countries outside the USA, so it must be possible to tackle the problem without a global treaty.

As of some years ago, Asterix, but I wouldn't be surprised if there's more specialized software nowadays.

Singling out Asterisk here is not a great example. Autocallers are pretty simple to implement over VoIP anyway. But even with POTS before call centres existed - they just required more expense up front.

VOIP