Voicemail Hacking Leaves Ears Ringing

Voicemail can cost you. Just ask K.C. Hatcher, a San Francisco-based graphic artist.

AT&T wants her to pay $12,000 in long-distance charges rung up by a hacker who apparently changed Hatcher's voicemail message to accept third-party billed calls to Saudi Arabia and the Philippines.

"I am totally obsessing about this," said Hatcher, whose normal long-distance bill runs $35 a month. "I'm getting married in June. I want to buy a house, and I'm worried that this fraud is going to ruin my credit."

Such voicemail hacking is on the rise -- and phone customers are wrongly being held liable for it, according to San Francisco-based Consumer Action.

AT&T acknowledges that the scamming has become all too common and that people rarely know they have been had until company fraud investigators alert them to unusual activity on their phones. But AT&T, like some other long-distance providers, insists that consumers foot most of the bill.

"It is the responsibility of the customer to secure their voicemail system," said Gordon Diamond, a spokesman for AT&T in San Francisco.

Maureen Claridge, a San Francisco travel agent, doesn't see it that way but has been unable to persuade AT&T to let her off the hook. The company has sent her $8,000 long-distance bill -- generated by a voicemail hacker -- to a collection agent, Claridge said.

Linda Sherry of Consumer Action maintains that telephone companies are largely to blame.

Hackers take advantage of the voicemail offered by local phone companies -- including SBC Communications Inc., which provides the system Hatcher and Claridge use -- and long-distance companies' voice-activated operator services.

What a hacker does is break into a person's voicemail and record a message so that it will respond affirmatively to an automated operator that calls the person's home phone seeking approval for third-party billing of a long-distance call.

Sherry noted that at AT&T, the automated system always asks the same questions and waits a set interval for a response, making it fairly easy for a hacker to synchronize his fraudulent voicemail message.

"That AT&T would permit third-party phone charges based only on the authority of a recorded message is beyond belief," Sherry said. "Third-party billing should be allowed only when a real person answers the phone and is able to verify that they approve the charges."