The rise of internet calling is what created both problems in the first place, according to Josh Bercu, executive director of the Industry Traceback Group at the trade association USTelecom. "It's become cheap and easy for you and me to call anyone around the country and around the world," he said. "Well, guess what? It's also cheap and easy for the bad guys to blow up our phones, call us from anywhere in the world."

That shift eliminated the old physical trust of wired networks. "If I'm providing service to the bank, I know they're the bank. I'm literally laying wire to the bank," Bercu said. "That all changed with the advent of internet calling platforms where I can say I'm a bank, and I might not be a bank."

The limits of STIR/SHAKEN

Much of the conversation centered on STIR/SHAKEN (Secure Telephone Identity Revisited and Signature-based Handling of Asserted Information Using toKENs), the call authentication protocol that both experts said was oversold. "Starshaken was never meant to be a silver bullet," said Joel Bernstein, vice president and head of U.S. public policy and government affairs at Somos. "This is a way we get to some level of understanding, and it's only in conjunction with other things."

Bernstein argued the industry needs to move toward a system he called right-to-use, which attaches cryptographic tokens to individual callers. "When I call, I have a cryptographic token that says, this is Joel Bernstein. Joel's been vetted," he said, describing a bank recognizing both the caller and itself as legitimate.

Even so, authentication has not solved the problem, Bercu said, because bad actors now obtain legitimate numbers. "Some bad callers now get access to numbers. So they can get the authentication. They have the right to use the number. They're still making bad calls."

Part of the challenge stems from a philosophical reversal in how carriers operate, Bernstein noted, recalling the Tom Wheeler-era FCC. "Competition, competition, competition. We want everybody in," he said. "Well, that opened the door to the bad guys. Now we're realizing, maybe it wasn't. [It] all started off great, but now it's been poisoned."

Calls, texts and emails

Moderator Drew Clark, CEO of Broadband Breakfast, offered a contrast between how well spam has been contained in email and how much harder it is to tackle spam phone calls over the telephone network. Private algorithms sucked up much of the email problem, but that model translates imperfectly, Bercu said, because visibility is fragmented across the ecosystem.

"Whether you're using the old [Short] Message Service, SMS or RCS [Rich Communication Services], who has visibility to that can be different, whether it's the operating system or the carrier," he said. "That adds to the complexity of the ecosystem, which frankly is why we all need to be partnering together across the different industries."

Carriers can read network signals but not the substance of a call, said John Nelson, counsel at the telecom law firm Davis Wright Tremaine. "A network provider can be great at looking through their call analytics, seeing how quickly someone is calling from a number," he said. "But you can't necessarily get into the actual content of the call."

That gap, Nelson argued, is why vetting matters. "Know your customer. I think that's extremely important on the back end, doing vetting of those individuals to understand the purpose of their calls," he said.

Reporting helps too, Bernstein said, urging consumers to flag every message. "That creates that group intelligence that we need," he said. "It is groupthink. You have to do this together. Otherwise it won't be taken care of."

What consumers should do

The economics keep the incentives strong. Loss to scams is rising roughly 25% a year, Bercu said, pointing to overseas operations. "Southeast Asian scam compounds. You have human traffic labor there. You have organized crime," he said. "Their whole market is the entire globe and every dollar that everyone has."

There has been meaningful enforcement progress, he added, crediting a federal executive order targeting transnational criminal organizations. "The local field agents are more likely to take the scam case and build a case now because they think the prosecutors will pick it up."

Panelists were critical of a Broadband Breakfast Member’s online proposal to hold carriers liable for phishing losses. Such rules encourage overblocking, Nelson warned. "You risk swinging the pendulum far too far in the other direction," he said, adding that fault is diffuse. "It's more than just the carrier at the end of the day."

For consumers, panelists suggested reporting spam and slowing down before responding to scammy calls or messages. 

"Take a breath, take a pause," Bercu said. "If something feels off, say you'll call back."

Bernstein agreed, citing his father's experience as a scam victim. "You have to be vigilant about this  step of the way," he said. "If it seems a little off, take a breath."