SECURECALL: A DTMF-BASED CHALLENGE–RESPONSE CALLER ID VERIFICATION SYSTEM FOR MITIGATING TELEPHONE FRAUD

Abstract

Caller ID spoofing underlies a large and growing share of telephone-based fraud (“vishing”) worldwide: authorised push payment (APP) fraud cost United Kingdom victims over £629 million in the first half of 2025 alone, a year-on-year rise exceeding 17% [2], while recorded cybercrime in Uzbekistan — overwhelmingly phone-based payment-card and bank-impersonation fraud — has grown roughly 68-fold over five years, with an estimated US$159 million stolen [3]. Carrier-level defences such as STIR/SHAKEN authenticate the network segment that carried a call rather than the caller's right to the displayed number, depend on a public-key infrastructure (PKI) that is difficult to deploy outside IP telephony, and leave SS7/PSTN legs largely unprotected [4]. This paper formalises and evaluates SecureCall, a PKI-free caller ID verification (CIV) system that authenticates callers through a dual-tone multi-frequency (DTMF) challenge–response exchange at the SIP/media-server layer, extending the architecture of Wang et al. [1] and a working Linphone/Asterisk prototype whose digit-handling logic passes a full (4/4) automated test suite. A verification decision function and a replay-protection invariant are defined over the challenge–response record, and system latency is decomposed consistently with the 4.7–29 second end-to-end delays and 10⁻⁴–10⁻⁶ forgery probabilities reported for CIV [1]. The analysis indicates that a software-only, PKI-free scheme of this kind is architecturally better suited to telecom environments, such as Uzbekistan's, that still mix IP, SS7 and card-payment rails.