IRSF is a fascinating topic.

As it was explained to me (anyone feel free to correct me if I'm wrong), a shady/criminal organization takes control of a piece of the phone network. They pick a range a phone numbers for a country that is usually expensive to call, maybe a range of numbers that doesn't actually exist in that country, and they use the phone network to "advertise" a slightly cheaper route to connect phone calls to those numbers. Instead if it costing $1, it costs $0.80.

When someone makes a call to those numbers, they charge the cheaper rate, and then don't actually connect them to a real phone. Every time a call is made, they just get money.

The "S" is for "shared". They offer other organizations "for every call you generate to this range of numbers, we give you a cut". Let's call it 20 cents.

Now picture how many organizations are vulnerable to this. Every "call me back when a customer service rep is available". Every "call me to let me type in a code to verify I'm human". Every "leave a number our sales team can reach you at". They're all being attacked by these sorts of things constantly.

The cost to get a bot to trick the system into making a phone call is much smaller than the revenue generated. As long as that is true, the attacker wins.

For consumers at least, it's the law in the EU. Every phone network has either a pricing document or a webpage where you can type a number and it tells you the price, and if you were charged something that isn't that price, I guess you could demand a refund, and escalate to a court if the refund wasn't forthcoming.

Note that these documents frequently list some numbers at ridiculously high prices (eg. €25 per minute), presumably to deter such fraud.

I think the problem with that is that these schemes rely on the phone network being ridiculously insecure. The scammers send a surprise bill to your telco, then they pass it along to you.

It wouldn't surprise me if the list only applies to consumer plans, or (as you say) high-balls stuff in certain countries.

I wonder what would happen if the telco would say "we wont pay the bill, since we believe it is fraudulent". They wont "lose much" if some fraudulent telco from third world cuts them - the numbers dont work anyway. And what can the scammers do? Try to sue an US telecom? If they reveal their true names, then the embassy knows where to send the "operators" who will solve the case for good.

There is normally a long chain of intermediate telco operators between the fraudsters and the US operator. Some of those intermediate operators are large and have a lot of legit calls. Each operator adds their profit margin on and passes the bill to the next. So no operator has any incentive to police this stuff, because they all profit from it.

It does make me wonder why they don't just switch to pre-paid sim cards (or the contractually equivalent thing that doesn't involve cell phones).

Good luck collecting your scam cash from my personal line! The phone company doesn't have a mechanism to pass the cost on to me, so I'm guessing the telcos already figure out how to block this at the network level.

Has anyone tried calling some of the bad actor numbers from a burner phone?