Author name: Kris Guyer

Robocallers posing as employees of the Federal Communications Commission made the mistake of trying to scam real employees of the FCC, the FCC announced yesterday. “On the night of February 6, 2024, and continuing into the morning of February 7, 2024, over a dozen FCC staff and some of their family members reported receiving calls on their personal and work telephone numbers,” the FCC said.

The calls used an artificial voice that said, “Hello [first name of recipient] you are receiving an automated call from the Federal Communications Commission notifying you the Fraud Prevention Team would like to speak with you. If you are available to speak now please press one. If you prefer to schedule a call back please press two.”

You may not be surprised to learn that the FCC does not have any “Fraud Prevention Team” like the one mentioned in the robocalls, and especially not one that demands Google gift cards in lieu of jail time.

“The FCC’s Enforcement Bureau believes the purpose of the calls was to threaten, intimidate, and defraud,” the agency said. “One recipient of an imposter call reported that they were ultimately connected to someone who ‘demand[ed] that [they] pay the FCC $1,000 in Google gift cards to avoid jail time for [their] crimes against the state.'”

The FCC said it does not “publish or otherwise share staff personal phone numbers” and that it “remains unclear how these individuals were targeted.” Obviously, robocallers posing as FCC employees probably wouldn’t intentionally place scam calls to real FCC employees. But FCC employees are just as likely to get robocalls as anyone else. This set of schemers apparently only made about 1,800 calls before their calling accounts were terminated.

The FCC described the scheme yesterday when it announced a proposed fine of $4,492,500 against Telnyx, the voice service provider accused of carrying the robocalls. The FCC alleges that Telnyx violated “Know Your Customer (KYC)” rules by providing access to calling services without verifying the customers’ identities. When contacted by Ars today, Telnyx denied the FCC’s allegations and said it will contest the proposed fine.

The “MarioCop” accounts

The robocalling scheme lasted two days. On February 6, 2024, Telnyx accepted two new customers calling themselves Christian Mitchell and Henry Walker, who provided street addresses in Toronto and email addresses with the domain name “mariocop123.com.” The robocallers apparently used fake identities and paid for Telnyx service in Bitcoin.

The Telnyx customers who placed the robocalls are referred to as “MarioCop accounts” in the FCC’s Notice of Apparent Liability for Forfeiture (NAL) issued against Telnyx. Telnyx flagged one of the accounts in the course of its “routine examination of new users” and terminated the account on February 7 after determining the calls violated its terms and conditions and acceptable use policy. Telnyx also reported the account to the FCC.

Telnyx is based in Chicago. It offers a service that lets callers “build a custom AI voice bot” and a voice API that “makes it simple to make, receive and control voice calls with code.” Telnyx is also a VoIP provider that says it “holds carrier status in 30+ countries around the world” and offers “local calling in over 80 countries and PSTN [Public Switched Telephone Network] replacement in 45+ markets.”

The FCC subpoenaed Telnyx for information about the calls, and the resulting records showed that one MarioCop account placed 1,029 calls between February 6 and February 7. The other account placed 768 calls on February 6.

The FCC also subpoenaed Telnyx for information that might identify the callers and “determined that the very limited identifying information Telnyx collected from its customers was false.” They used physical addresses in Canada, including one that turned out to be a Sheraton hotel, and IP addresses from Scotland and England.

“The @mariocop123.com domain is not associated with any known business; a website using the same domain was created in February 2024 and remains undeveloped,” the FCC said. The FCC notes that both MarioCop accounts may have been operated by the same person.

FCC: Telcos must know their customers

Telnyx “accepted the names and physical addresses at face value, without any further requests for corroboration or independent verification,” the FCC forfeiture order said. Neither applicant provided a telephone number.

The FCC alleged that Telnyx didn’t do enough “to discern whether the limited amount of identifying information its customer provided was legitimate and it overlooked obvious discrepancies in the information it collected… Becoming Telynyx’s customer and gaining access to outbound calling services that allowed origination of hundreds of calls (more than 1,000 calls from the First MarioCop Account) was as simple as making up a fake name and address and acquiring a non-free email address.”

The FCC notice continued:

Our rules require Telnyx to know its customers. Yet it did not know who the MarioCop Account holders were. We therefore conclude that Telnyx apparently violated section 64.1200(n)(4) of our rules by allowing the First MarioCop Account and the Second MarioCop Account access to outbound calling services without actually knowing the true identities of the account holders. By extension, we believe we could likely find that Telnyx apparently violated our rules with regards to every customer it onboarded using the same process as it did for the MarioCop Accounts. We decline to do so here absent further investigation.

Telnyx will have an opportunity to respond to the allegations and argue that it shouldn’t be fined. In some cases, the FCC and the telecom reach a settlement for a lower amount.

Telnyx CEO David Casem told Ars today that “Telnyx is surprised by the FCC’s mistaken decision to issue a Notice of Apparent Liability stating an intent to impose monetary penalties. The Notice of Apparent Liability is factually mistaken, and Telnyx denies its allegations. Telnyx has done everything and more than the FCC has required for Know-Your-Customer (‘KYC’) and customer due diligence procedures.”

We also sent a message to the email addresses used by the MarioCop accounts and will update this article in the unlikely event that we receive a response.

Telnyx defends response, citing quick shutdown

Casem said the FCC hasn’t previously demanded “perfection” in stopping illegal traffic. “Since bad actors continuously find ways to avoid detection, the FCC has historically expected providers to take reasonable steps to detect and block them,” he told Ars. “Yet the FCC now seeks to impose substantial monetary penalties on Telnyx for limited unlawful calling activity that Telnyx not only did not originate but swiftly blocked within a matter of hours.”

Casem said that “there has been no allegation of subsequent recurring activity” and urged the FCC to “reconsider what can only be viewed as an improper effort to impose an unprecedented zero-tolerance requirement on providers through enforcement action, in the absence of any defined rules informing providers what is expected of them.”

FCC Chairman Brendan Carr said in yesterday’s announcement that he is pleased with the “bipartisan vote in favor of this nearly $4.5 million proposed fine” and that it “continues the FCC’s longstanding work to stop bad actors.”

Anna Gomez, a Democratic member of the FCC, said that Carr’s office accepted her request for a change designed to encourage telecoms to report potential violations to the FCC. “It is important that service providers work quickly and closely with the FCC to identify and stop illegal traffic before it makes its way to consumers. I value self-reporting from industry actors on potential violations of our rules, and I am grateful the Office of Chairman Carr accepted our edits to this NAL to encourage self-reporting,” Gomez said.

There was a dissenting vote from Republican Commissioner Nathan Simington, but not because of the facts specific to this case. Because of a recent Supreme Court ruling limiting the power of federal agencies, Simington has vowed to vote against any fine imposed by the commission until its legal powers are clear.

“While the conduct described in this NAL is particularly egregious and certainly worth enforcement action, I continue to believe that the Supreme Court’s decision in Jarkesy prevents me from voting, at this time, to approve this or any item purporting to impose a fine,” Simington said.