The Industrialized Scam: How Sinch and Microsoft Teams Power the Global Fraud Trade
When the facade of a PayPal, Microsoft, or banking “support” number graces a smartphone screen, few perceive the intricate machinery beneath: a vast, industrialized trade of telephonic identities to bad actors. A poignant investigation by the Demurrage collective reveals that the relentless tide of fraudulent calls and “callback” schemes in the United States is underpinned by major telecommunications platforms, notably Microsoft Teams and the Swedish titan Sinch, which presides over the American VoIP carrier Inteliquent.
In December 2025, Demurrage—distinguished for its forensic scrutiny of telecom malfeasance—promulgated a comprehensive sequel to its 2024 expose. The earlier report highlighted how numbers within the Onvoy network, an Inteliquent subsidiary, were weaponized in fraudulent technical support gambits targeting Spectrum and Xfinity customers. Those operations were traced to Pakistani call centers, characterized by anemic oversight, perfunctory grievance systems, and a profound lack of accountability from Sinch.
The latest findings suggest a stagnation in progress. Demurrage contends that fraudsters effortlessly procure VoIP numbers through Sinch’s infrastructure, circumventing KYC (Know Your Customer) protocols with impunity. These assets facilitate “callback” stratagems, wherein a victim receives a deceptive missive—via email, SMS, or pop-up—and is coerced into initiating a call to the provided number. Researchers posit that these inbound maneuvers have surpassed traditional outbound dialing as the primary conduit for fraudulent interaction.
A significant portion of the inquiry is dedicated to Microsoft Teams. Following the sunsetting of Skype in 2025, the service has become a sanctuary for illicit activity. Demurrage discovered that numerous numbers utilized in fraud are anchored in Microsoft Teams, though they are frequently masqueraded in databases as Onvoy or Neutral Tandem, complicating identification. The collective verified this through distinctive automated greetings and test sequences. Despite formal complaints lodged via Sinch’s digital portals, neither Microsoft nor Sinch has provided substantive feedback regarding the resolution of these incidents.
The investigators offer a scathing critique of both corporations for their opacity and communication failures. Sinch has reportedly dismantled direct consumer engagement channels in favor of an archaic reporting form, while Microsoft remains silent on the status of sequestered numbers. In contrast, the report lauds Lumen for its proactive stance, noting they temporarily suspend reported numbers immediately and maintain a dialogue with the complainant until the matter is finalized.
At the heart of this parasitic ecosystem are the “marks”—reseller intermediaries who furnish fraudsters with pre-verified VoIP accounts and numbers. Operating through encrypted messaging apps and clandestine social media groups, these vendors command a premium for facilitating the bypass of KYC mandates. Consequently, call centers in India and Pakistan need not navigate regulatory hurdles; they simply acquire “turnkey” accounts.
Demurrage concludes that the regulation of these resellers and their supply chains must become a cornerstone of U.S. anti-fraud policy. Implementing more stringent controls and elevating the cost of VoIP acquisition would fundamentally undermine the economic viability of these schemes. This perspective is echoed by Tom Walker, a veteran fraud expert formerly of AT&T and T-Mobile. In a recent submission to the FCC, Walker emphasized that the preponderance of financial devastation is tethered not to spoofing or robocalls, but to VoIP-based callback schemes. His data suggests that a staggering 74% of grievances involve a mere 23 providers specializing in DID (Direct Inward Dialing) VoIP numbers, despite their controlling only 19% of the total numbering resource.
The 163-page report from Demurrage provides an exhaustive catalog of Sinch and Microsoft Teams numbers implicated in recent fraud. The authors maintain that the crisis is systemic, born of a vacuum in oversight regarding the VoIP market. The final verdict is sobering: while U.S. authorities remain preoccupied with tracing international ingress and combating spoofing, fraudsters utilize domestic numbers with ease. Until order is restored within the nation’s own telecommunications infrastructure, the citizenry will remain perilously exposed.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.