Fake Caller ID Schemes: Information on Federal Agencies' Efforts to Enforce Laws, Educate the Public, and Support Technical Initiatives

Unwanted phone calls, which may also involve spoofing, consistently rank among the top consumer complaints to FCC and FTC. In recent years, consumers have lost millions of dollars—and been deceived into providing financial or other sensitive information or purchasing falsely advertised products—due to schemes using these calls. FCC, FTC, and DOJ have efforts aimed at combatting the fraudulent use of caller ID spoofing.

Recently enacted federal legislation included a statutory provision for GAO to review federal efforts to combat the fraudulent use of caller ID spoofing. This report examines (1) what is known about caller ID spoofing schemes, including any recent trends; (2) federal agency enforcement and consumer education efforts; and (3) the status of industry efforts to develop technologies to combat spoofing, and FCC's role in these efforts.

To address these objectives, GAO reviewed consumer complaint data from FCC and FTC from 2015 through 2018; reviewed investigation and enforcement information from FCC, FTC, and DOJ; and interviewed agency officials and representatives from 23 nonfederal stakeholders, including industry associations, voice service providers, call blocking and analytics services, mobile phone manufacturers, consumer groups, and a standards body. GAO also reviewed relevant agency documentation and assessed agency efforts against key practices for consumer education and interagency collaboration identified in GAO reports.

Transmitting fake caller ID information with a phone call, also referred to as “spoofing,” is in many cases illegal—and is used in schemes to obtain money and personal information or generate telemarketing leads. Complaints submitted to the Federal Communications Commission (FCC) and the Federal Trade Commission (FTC), both of which work to protect consumers from spoofing, suggest that spoofing is a growing issue.

FCC, FTC, and the Department of Justice (DOJ) identified 62 enforcement cases they have brought since 2006 involving spoofing. Enforcement can be challenging, as it can be difficult to identify the source of spoofed calls, and scammers may be based overseas. Nevertheless, GAO found that the agencies prioritize their spoofing-related enforcement actions based in part on the level of harm perpetrated against the public and generally follow key practices identified by GAO for effective collaboration. Additionally, FCC and FTC have proposed changes to law to enhance the effectiveness of their enforcement efforts, such as a change that would allow FCC more time to bring certain enforcement actions. Furthermore, FCC's and FTC's consumer education efforts related to spoofing align with key practices for collaboration and consumer education. For example, FCC and FTC have developed consistent and clear messages related to spoofing.

Several major telecommunications carriers are taking key steps to put an industry-developed technical system in place designed to reduce spoofing by December 2019, which FCC has encouraged in line with federal guidance. This system is intended to enable carriers to verify whether a caller has a right to use the caller ID being transmitted with the call. Carriers can use this information to better determine whether to block or warn consumers about the incoming call. Stakeholders cautioned that the system cannot determine whether a caller has fraudulent intentions but only whether the caller is using a spoofed number. FCC has followed relevant federal guidance in participating in the development of this system by, for example, encouraging industry to accelerate deployment of the system, monitoring industry's progress, and providing input into the process.

Robocalls and other unwanted phone calls consistently rank among the  top consumer complaints to the Federal Communications Commission  (FCC) and the Federal Trade Commission (FTC). Many robocallers also  transmit false caller ID information with these calls, which then shows up  on a recipient’s caller ID display—a practice often referred to as  “spoofing.” By spoofing a phone number—such as the number of a  government agency or a reputable company—the caller is able to  disguise their true identity and may also be able to immediately establish  some level of credibility with the call recipient. In recent years, consumers  have lost millions of dollars—and been deceived into providing financial  or other sensitive information or purchasing falsely advertised products— due to such schemes.

Spoofing is illegal when done with the intent to defraud, cause harm, or  wrongfully obtain anything of value. In addition, with some exceptions, it  is an abusive telemarketing practice and a violation of FTC regulations for  telemarketers to spoof or block caller ID. FCC regulates  communications, and FTC protects consumers from unfair and deceptive  business practices. In addition, the Department of Justice (DOJ) enforces  federal consumer fraud statutes, among other laws, which may involve  spoofing. All three agencies may take enforcement actions against those  who use illegal spoofing in different kinds of schemes. In addition, in  2018, FCC, in coordination with FTC, was directed by statute to  undertake efforts to educate consumers about caller ID spoofing. FCC  has also worked with the telecommunications industry on a system to  enable telephone companies and other voice service providers to verify  caller ID information.

The RAY BAUM’S Act of 2018 included a provision for us to review  federal efforts to combat illegal spoofing. This report examines:  1.  what is known about caller ID spoofing schemes, including any recent  2.  FCC’s, FTC’s, and DOJ’s enforcement efforts to combat such  3.  FCC’s and FTC’s efforts to educate consumers about spoofing  4.  the status of industry efforts to develop technologies to combat  spoofing, and FCC’s role in these efforts.

To examine what is known about caller-ID-spoofing schemes and recent  trends, we obtained and analyzed FCC and FTC consumer complaint  data from January 2015 (when FCC launched a new portal for filing  complaints) to December 2018 (the most recent month for which both  agencies provided data), for the purpose of describing trends in consumer  complaints related to unwanted and spoofed calls. We also obtained data  from call blocking and analytics services to describe trends in unwanted  and spoofed calls. We assessed the reliability of both sets of data by  reviewing relevant documentation and conducting interviews with industry  officials. We determined that these data were sufficiently reliable for our  purposes. Additionally, we reviewed FCC and FTC documentation on  caller ID spoofing and robocalls, including public notices and fact sheets  and analyzed comments filed with FCC in response to relevant  proceedings.

To examine FCC’s, FTC’s, and DOJ’s enforcement efforts to combat  schemes involving the use of caller ID spoofing, we reviewed and  described enforcement cases brought by the agencies from April 2006 to  June 2019 that involved the use of caller ID spoofing or blocking (the time  period reflects the range of cases the agencies provided us). We also  compared these agencies’ efforts to collaborate on spoofing  investigations and enforcements actions with seven practices for  enhancing interagency collaboration that we identified in prior work.  Additionally, we assessed the agencies’ descriptions—obtained from  agency documents and interviews or written responses to questions—of  how they prioritize their enforcement efforts against federal standards for  internal control related to addressing risks.

To evaluate FCC’s and FTC’s efforts to educate consumers about  spoofing schemes, we interviewed agency officials, reviewed FCC and  FTC educational materials, and compared these agencies’ efforts to key  practices for consumer education that we identified in our prior work. We  also compared these agencies’ collaborative efforts to educate  consumers to the same key practices for enhancing collaboration  mentioned above.

To examine the status of industry efforts to develop technologies to  combat caller ID spoofing, and FCC’s role in these efforts, we reviewed  FCC and industry documentation and compared FCC’s efforts to federal  guidance on how federal agencies should engage in standards  activities.

To address all our objectives, we reviewed relevant statutes and  regulations, including the Telephone Consumer Protection Act of 1991  and its provisions related to the use of robocalls; the Telemarketing and  Consumer Fraud and Abuse Prevention Act, under which FTC issued  regulations prohibiting deceptive and other abusive telemarketing acts or  practices, including caller ID spoofing; as well as the Truth in Caller ID  Act of 2009. We interviewed agency officials from FCC, FTC, and DOJ.  We also interviewed 23 nonfederal stakeholders, including  representatives from industry associations, voice service providers, call  blocking and analytics services, consumer groups, mobile phone  manufacturers, and a standards body, as well as other knowledgeable  stakeholders (see app. I for a list of stakeholders we interviewed). We  identified these nonfederal stakeholders through our prior  telecommunications work, other telecommunications reports, and  recommendations from stakeholders we interviewed. While the views of  the stakeholders we interviewed cannot be generalized, they provide  valuable insight to our work. In addition, we interviewed officials from the  Department of Homeland Security, which has undertaken efforts to  address threats from caller ID spoofing, and the Department of the  Treasury Inspector General for Tax Administration about the role of caller  ID spoofing in scams involving the impersonation of the Internal Revenue  Service (IRS).

We conducted this performance audit from May 2018 to December 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

According to FCC, caller ID services became commonplace due to  technology developed in the 1980s, and caller ID information transmitted  with the call could generally be trusted by the call recipient. However,  FCC found as voice service providers migrated to Internet Protocol (IP)  networks, these technologies lessened the overall accuracy and reliability  of the information presented to the call recipient. Caller ID allows the  recipient of an incoming call to determine the telephone number of the  caller and, in some cases, the name. This information helps the recipient  make informed decisions about which calls to accept or ignore. While the  number and name displayed on the caller ID may be associated with the  caller, a caller can also deliberately falsify or “spoof” the information  transmitted to the caller ID display to disguise the source of the call.  Under the current telephone system, this information, true or false, is  conveyed to the call recipient unless the caller requests that such  information not be conveyed.

Caller ID spoofing is widespread. Many instances of spoofing are legal.  For example, spoofing is legally used by professionals such as doctors  who want to use their cell phones to return calls to patients but choose to  transmit their office number instead. Spoofing also often accompanies  robocalls—an automated telephone call which delivers a recorded  message. Certain types of robocalls are illegal, such as robocalls for  sales pitches unless companies have consumers’ express written  permission to call. In addition, telemarketers may not call home or  mobile numbers that consumers have registered in the National Do Not  Call Registry, which was established through legislation and is maintained  by FTC—and they must transmit their telephone number and, if possible,  their name, to the call recipient’s caller ID.

According to FCC, advancements in technology have made it inexpensive  and easy to make robocalls. As telecommunications systems have  transitioned from traditional wireline services, to IP networks, the cost of  making phone calls has dramatically decreased. IP-based voice  services use existing internet connections to send phone calls, which may  be cheaper than long distance phone charges associated with traditional  phone service. Autodialers can be programmed to dial a long list of phone  numbers in order to deliver millions of calls in a short period of time.  These dialing systems, coupled with IP-based voice services, such as  Voice over Internet Protocol (VoIP), enable telemarketers and  scammers to make high volumes of calls from anywhere in the world.

IP-based voice services have also made it inexpensive and easy to spoof  caller IDs. According to an industry stakeholder, historically, the router  systems used to spoof calls were physical devices located on site, which  could be prohibitively expensive. However, software that is available for  free can now be downloaded to enable a computer to function as a  router. According to stakeholders, telemarketers and scammers can,  with minimal cost, configure a router to display either a single spoofed  number or a constantly changing set of numbers, making it appear as  though calls originated in the United States even if they did not. (See fig.  1.)

FCC, FTC, and DOJ each enforce different rules or laws related to caller  ID spoofing.

FCC enforces rules prohibiting anyone from causing the transmission  of misleading or inaccurate caller ID information with the intent to  defraud, cause harm, or wrongfully obtain anything of value. FCC  also enforces rules requiring telemarketers to transmit caller ID  information.

FTC protects consumers against unfair or deceptive business acts or  practices. FTC, similar to FCC, enforces rules requiring  telemarketers to transmit their telephone number, and when available,  the name of the telemarketer to a consumer’s caller ID service.

DOJ enforces federal fraud statutes under which fines or  imprisonment can be imposed against anyone who uses interstate  telecommunications as part of a fraud scheme. DOJ can also take  civil enforcement actions on FTC’s behalf.

FCC and FTC each manage consumer complaint databases where  consumers can file complaints about unwanted calls, robocalls, and  violations of the Do Not Call Registry.

In addition to government efforts, the telecommunications industry,  including voice service providers and third party companies, have taken  steps to counteract illegal spoofing. For example, some of these  companies have developed or deployed applications (i.e., software  programs, often referred to as apps) to defend against robocalls and  other unwanted calls. This includes call blocking devices for landline  telephones and various mobile applications that can label and block  robocalls and other unwanted calls based on call patterns, consumer  complaints or other means. While some carriers provide these services  free, others may charge a fee. In addition, some carriers also work with  analytics providers to analyze traffic on their networks. Beginning in 2017,  FCC authorized voice service providers to block certain categories of  unwanted calls before they reach consumers’ phones. Recently, FCC  clarified that service providers can also, as a default, block calls identified  as likely unwanted based on the provider’s reasonable analysis of call  data unless consumers opt out of this service.

Caller ID Spoofing Is Used in a Variety of Financial Fraud and Other Schemes, and Consumer Complaints Suggest a Substantial Increase in Its Use

Caller ID Spoofing Schemes Seek to Obtain Money or Valuable Financial and Personal Information, Generate Telemarketing Leads, or Harass

Scammers use caller ID spoofing to facilitate a variety of financial fraud  and other schemes, often in combination with robocalling. Based on our  analysis of FCC, FTC, and DOJ enforcement cases and alerts from  federal and state government agencies, as well as interviews with  stakeholders, we identified three types of caller ID spoofing schemes.

To Obtain Money or Information: Scammers have used caller ID  spoofing to trick consumers into providing their financial or personal  information or sending money such as via a debit or gift card. These  scammers may spoof a name and phone number that looks familiar  and trustworthy, such as that of a government agency, a company  you do business with, or local number. Scams include telling call  recipients they may be arrested or they owe money. For example,  spoofed robocalls have been used as part of a wide-reaching scam in  which callers spoofed IRS phone numbers and impersonated IRS  staff to trick people into sending the scammers money for supposed  unpaid taxes. IRS reported that from October 2013 through March  2019, the agency was contacted more than 2.4 million times by  taxpayers who reported such calls, and more than 15,453 taxpayers  reported losing about $75.1 million. (See fig. 2.)

To Generate Telemarketing Leads: Unscrupulous telemarketers  have used spoofing as part of an attempt to sell goods or services. In  this scheme, consumers may receive a pre-recorded robocall with a  sales pitch and be instructed to “press 1” to indicate interest, at which  point the call recipient is transferred to a live operator. In one such  scheme, more than 96-million spoofed robocalls were made over a 3- month period. These calls included pre-recorded messages falsely  claiming to be from Hilton and other well-known travel companies;  once consumers were transferred, live operators attempted to sell  vacations not affiliated with the brands presented during the  prerecorded message.

To Harass: People have used spoofing to harass others. In some of  these cases, people have used spoofing to cause another person’s  caller ID to display a familiar or trusted phone number. In one case,  an individual apparently placed 31 spoofed calls as part of a personal  campaign to harass and stalk another person. These spoofed  numbers appeared to be from the victim’s child’s school, among  others. Spoofing is also one of several techniques used to place false  calls to emergency response centers to elicit a police response to an  address where no emergency exists. Callers have used spoofing to  make it appear as if their call originated at or near the reported  address. This practice, known as swatting, has resulted in death. For  example, in one swatting case, a man was shot and killed by police  who believed he was holding others at the address hostage.

Available Data Suggest That Caller ID Spoofing Is a Growing Issue

FCC and FTC consumer complaint data both show dramatic increases in  recent years in the number of unwanted call complaints that specifically  mention the term spoofing. According to our analysis of FCC and FTC  complaint data, from 2015 through 2018, complaints to FCC that  specifically referred to spoofing more than doubled and those received by  FTC increased by more than four times. (See fig. 3).

Several industry stakeholders we spoke with noted a growing trend in one  particular type of spoofing, neighbor spoofing. Neighbor spoofing occurs  when the caller ID is manipulated to display a phone number matching  the area code and prefix (the first six digits) of the consumer’s phone  number. Consumers may be more inclined to answer these calls because  they appear to be local—perhaps from someone they know. Among  FCC’s complaints that included both the caller’s and the call recipient’s  phone numbers, the percentage that were indicative of 6-digit neighbor  spoofing increased from 10 percent in 2015 to 15 percent in 2018; for  similar FTC complaints, the percentage increased from 2 percent in 2015  to 16 percent in 2018; and a call blocking provider told us that its  percentage of neighbor-spoofed robocalls increased from 2 percent in  January 2016 to 23 percent in December 2018.

One analytics provider told us there has been a shift recently from  spoofing the first six digits to spoofing the first four and five, which the  provider believed to be a reflection of scammers adjusting their methods  as more people become aware of the original six-digit form of neighbor  spoofing. From 2015 to 2018, FCC and FTC data show substantial  increases in complaints indicative of four and five digit neighbor spoofing,  with FCC complaints nearly doubling and FTC complaints increasing  more than 10 times during this time period.

FCC and prior GAO work have described several limitations with using  complaint data as a means of measuring the extent of unwanted calls.  For example, complaints might increase following consumer outreach  regarding how to file a complaint or after news media coverage of a  particular scam. In addition, not all consumers who experience problems  file complaints, and not all complaints are necessarily legitimate or  categorized appropriately. Further, a consumer could submit a complaint  more than once, or to more than one agency, potentially resulting in  duplicate submissions. Finally, while some consumers may use the term  “spoof” when describing the complaint, others may not, either because  they do not know they have been spoofed or are not familiar with the  term. According to our analysis of FCC data, in 2018, 66 percent of all  complaints that were indicative of neighbor spoofing did not include the  term “spoof” in the complaint description. Nonetheless, FCC, FTC, and  DOJ officials told us they use this complaint data to identify specific  trends in types of scams that may help the agencies’ enforcement and  public education efforts, which we discuss later in this report.

Although we could not find industry data that estimated the total number  of spoofed calls, available industry data suggest that the volume of  unwanted calls and robocalls (of which illegally spoofed calls are a  subset) has increased over the past several years. Using call patterns on  their own networks or other means, voice service providers, call blocking  applications and analytics providers track data on unwanted calls and  robocalls. According to one company, these companies may have  limited ability to detect or isolate spoofed calls, in part, because  scammers may frequently change the numbers they use. In addition,  stakeholders told us, because each of these companies analyzes their  specific user base and may use different methods to identify and label  robocalls and other unwanted calls, the number of unwanted calls each  company estimated may be substantially different. For example, while  one analytics company estimated 26.3 billion robocalls nationwide in  2018, another company estimated the number at nearly 48 billion.  Similarly, one company estimated a 46 percent increase in robocalls from  2017 to 2018, while another estimated a 57 percent increase for the same  time period. Despite these differences, all analytics and call blocking  companies we interviewed reported that their estimates of the number of  unwanted calls and robocalls have increased in recent years.

Because there is no comprehensive data source on unwanted calls,  robocalls, or spoofed calls, it is not possible to reliably estimate national  trends. FCC has taken steps to seek input from industry and other  stakeholders on how to better measure the extent of the unwanted call  and spoofing problem. In a November 2017 Further Notice of Proposed  Rulemaking, FCC sought comment on, among other things, what  information should be collected to evaluate the effectiveness of efforts to  combat these calls and whether FCC should adopt a reporting obligation  for providers. FCC received numerous comments from voice service  providers, their associations, and other stakeholders in response to this  notice. One commenter expressed concern that a reporting obligation  would be burdensome to providers or of little benefit to FCC, and other  commenters stated the agency should instead continue to monitor trends  in consumer complaints. More recently, in a June 2019 Declaratory  Ruling, FCC adopted a recommendation from 2017 to prepare two  reports—one in 2020 and a second in 2021—to measure the  effectiveness of efforts to combat illegal robocalls. The ruling explicitly  delegates authority to FCC staff to collect any and all relevant information  and data from voice service providers necessary to complete these  reports and states that the report should include authoritative data about  the number of illegal robocalls.

Agencies Consider Risk of Harm to Public and Generally Follow Key Collaboration Practices in Their Enforcement Efforts, but Face Significant Challenges Agencies Reported Taking Risk-Based Approach to Prioritizing Spoofing- Related Investigations and Enforcement Actions, but Collecting Evidence Can Be Difficult

FCC, FTC, and DOJ officials all said that their agencies must prioritize  which illegal spoofing activity to investigate and take enforcement action  against because they do not have sufficient resources to pursue all such  activities. FCC and FTC officials stated that while they review complaint  data and other information, it would not be practical to open investigations  related to every complaint. According to officials at all three agencies,  given their limited resources, the agencies prioritize investigations based  on the level of harm being perpetrated and the likelihood of being able to  effectively bring an enforcement case. Such prioritization is consistent  with standards for internal control in the federal government. Those  standards call for agencies to estimate the significance of risks to  achieving agency objectives—in this case objectives related to protecting  the public from harm—and to use those estimates as a basis for  responding to the risks. More specifically:  In a 2015 letter to several members of Congress, the Chairman of the  FCC stated that the agency is more likely to pursue enforcement  action when a problem appears to be pervasive, represents a trend,  involves an agency priority, affects many consumers, reflects  particularly egregious abuse, or presents a security or safety  concern. Focusing specifically on investigations and enforcement  action related to caller ID spoofing, FCC officials told us that the  agency’s three highest priorities are events that (1) threaten public  safety; (2) involve very large numbers of spoofed calls; or (3) involve  malicious scams or threats.

FTC’s strategic plan for fiscal years 2018 to 2022 calls for the agency  to target its enforcement efforts on those areas that cause the  greatest amount of consumer harm. In line with this objective, FTC  officials told us that the agency decides which consumer complaints to  investigate based on the level of harm being perpetrated, as well as  the likelihood of being able to effectively bring an enforcement case.

DOJ’s Justice Manual states that serious violations of federal law  must be prosecuted. DOJ officials told us that for fraud schemes  that employ caller ID spoofing, the agency is more likely to charge a  violation of one of the fraud statutes, such as mail fraud, wire fraud,  computer fraud, or conspiracy, as well as the money laundering and  identity theft statutes. Specifically with regard to wire and mail fraud  cases, the Justice Manual states that serious consideration should be  given to the prosecution of any scheme which in its nature is directed  to defrauding a class of persons or the general public with a  substantial pattern of conduct.

FCC and FTC officials stated that there are significant challenges related  to investigating spoofing cases that can affect which investigations they  choose to pursue and limit the number of enforcement cases they are  able to bring. For example, FTC officials stated that the use of VoIP  technology enables fraudsters to easily change both their physical  locations and the numbers they spoof, making it harder for FTC and other  law enforcement agencies to track them down. An industry stakeholder  said that the use of VoIP technology makes it difficult to determine even  whether the call originated domestically or from overseas. Moreover, FCC  officials stated that when spoofed calls originate wholly from a foreign  jurisdiction, a lack of foreign cooperation can make it exceptionally difficult  to follow a trail back to either the service provider that originated the call  or the person or company making the calls. The officials explained that  foreign cooperation may be lacking when the calls come from countries  with which the United States does not have strong diplomatic  relationships. The officials stated that because of this challenge, they are  less likely to bring an enforcement case when calls originate wholly from  a foreign jurisdiction, due to the low likelihood of successfully resolving  such cases and the heightened use of limited staff resources required by  such cases.

Regardless of these challenges, FCC and FTC officials stated that their  agencies have taken steps to improve their ability to investigate cases  based overseas. For example, both agencies cited their outreach to the  Indian government and the U.S.-India Business Council as well as their  participation in the Unsolicited Communications Enforcement Network, a  global network of law enforcement authorities and regulatory agencies  that works to combat unsolicited communications.

FCC, FTC, and DOJ Identified 62 Spoofing or Caller-ID-Blocking-Related Enforcement Cases Brought since 2006

FCC, FTC, and DOJ officials identified 62 enforcement cases that they  said involved spoofing or blocking of caller ID information, though DOJ  officials stated that their list of enforcement cases was not comprehensive  because DOJ’s enforcement database does not include an indicator for  whether spoofing was employed as part of a fraud scheme. (For a  description of these 62 cases, see app. II.) As noted below, these 62  cases are not representative of all of the cases the agencies have  brought related to illegal robocalling.

FCC officials provided us information on six cases—each of which the  officials said involved spoofing or a caller’s blocking of their caller ID  information—that the agency brought from April 2011 to September  2018. For example, one case involved a company that used spoofed  robocalls to target elderly and low-income individuals to generate  sales of health insurance coverage. The company’s high numbers of  robocalls also disrupted an emergency medical paging service. FCC  issued fines in five of these cases, and one pending case includes a  proposed fine. FCC officials told us that since January 2004, the  agency has initiated approximately 20 additional enforcement cases  and has issued approximately 1,000 warnings, all for robocalling or  Do-Not-Call violations under the Telephone Consumer Protection Act  of 1991.

FTC officials provided us information on 31 cases—each of which the  officials said involved spoofing—that FTC brought—or that DOJ  brought on FTC’s behalf—from April 2006 to June 2019. Examples  of cases include several involving numerous calls to numbers on the  National Do Not Call Registry and an incident in which a company  impersonated government officials and help centers to make a sales  pitch with false and misleading claims about an English-language  learning course to Spanish-speaking U.S. consumers. Monetary  judgments were issued in all but one of these cases. FTC officials told  us that as of November 2019 the agency had brought 147  enforcement cases against Do Not Call and robocall violators. FTC  officials also stated that FTC obtains injunctive relief in their Do Not  Call, robocall, and spoofing cases, including court orders prohibiting  the defendants from engaging in similar conduct, and in some cases,  banning defendants from any telemarketing activity. Further, they  stated the injunctive relief also includes reporting and compliance  requirements to help FTC monitor defendants. FTC officials told us  that the agency has obtained injunctive relief in all of its completed  spoofing cases and that these injunctions provide strong deterrence  and help stop illegal spoofing.

DOJ officials provided us information on 25 cases—each of which the  officials said involved spoofing—that the agency brought from May  2010 to August 2018. Several of these cases involved companies or  individuals that used spoofing as part of a scheme to swindle money  from people. For example, in one case, defendants used spoofing as  part of a scheme to defraud and extort money from victims who were  falsely told they had failed to accept and pay for products they had  never ordered. Twenty cases had judgments that included prison  time; 18 cases had monetary judgements.

FCC and FTC have collected far less than has been assessed in fines or  monetary judgements, but officials at both agencies stated that the  amounts they have collected still serve both punitive and deterrent  purposes. Specifically, FCC officials stated that thus far, FCC has  collected $25,970 of the approximately $205 million in fines it assessed.  This mostly represents full payment of a $25,000 fine FCC issued in  January 2017, but FCC has yet to collect any portion of the more recent  fines it has issued: a fine of $120 million it issued in May 2018 and a fine  of approximately $82 million it issued in September 2018. FCC has  referred both of these cases to DOJ for collection action. FCC officials  noted that these large fines may not represent the amount that the  defendants are able to pay, and that even payment of a fairly small  fraction of a large fine could be enough to put a scammer out of business  and serve as a substantial deterrent.

FTC officials said that FTC has obtained a total of about $363 million in  monetary judgments in its 31 spoofing cases. The officials said that many  of these judgements were partially suspended based on the defendants’  ability to pay determined by a defendant’s net worth and assets. Further,  the officials said if the defendant misrepresents his or her financial  position, the entire judgment can become due under a clause that is part  of the judgement. The officials said that as of August 14, 2019, FTC had  collected about $31 million in its spoofing cases, and that this amount  represents all or substantially all of the unsuspended judgments in those  cases.

Officials with DOJ’s Consumer Protection Branch said that the branch  views monetary judgments as one piece of the deterrence equation for  caller-ID-spoofing offenses. The officials stated that the low amounts  collected suggest that other preventative measures, such as injunctive  relief and imprisonment, must be employed to deter continued unlawful  activity.

FCC, FTC, and Others Have Proposed Various Legal Changes to Strengthen Enforcement against Illegal Spoofing and Robocalling

FCC and FTC both favor some changes to law to enhance the  effectiveness of their enforcement efforts. Specifically:  In May 2019, FTC officials testified that the agency’s enforcement  efforts are hindered by a statutory provision that prohibits the agency  from taking action against telecommunications carriers, to the extent  they are engaged in common carriage activities. FTC further  testified that it would like this provision removed so that the agency  could take enforcement action against carriers engaged in illegal  telemarketing activities.

In 2018, an FCC official publicly stated that a longer statute of  limitations for enforcement of the Telephone Consumer Protection Act  of 1991 would improve the agency’s enforcement efforts against  knowing and willful violators of the act. Currently, that act has a 1-year  statute of limitations, while the Truth in Caller ID Act of 2009 has a  2-year statute of limitations. FCC officials told us that harmonizing  the two acts’ statutes of limitations to 2 years would help FCC’s  enforcement efforts since spoofing often occurs with robocalling and  the agency often uses the two statutes in tandem.

A February 2019 FCC staff report on robocalls notes that FCC’s  enforcement efforts can be hindered by the requirement that in many  instances FCC must warn a party of apparent robocalling violations  and can only proceed with a monetary penalty if the party  subsequently commits the same type of violation, a requirement in  the Communications Act that applies to the Telephone Consumer  Protection Act of 1991. According to the report, this requirement  enables a warned offender to incorporate under a new name to evade  further detection and begin illegal activity anew. In contrast, the report  notes, the Truth in Caller ID Act of 2009 allows FCC to directly issue a  proposed monetary penalty without first issuing a warning. Similar to  the statutes of limitations just discussed, FCC officials told us that  since spoofing often occurs with robocalling and the agency often  uses the two statutes in tandem, their enforcement efforts would  benefit from the elimination of this statutory requirement.

In 2019, bills were introduced in Congress that, if passed, would  implement the changes in law that FCC and FTC have recommended and  could potentially help address other challenges faced by FCC and FTC.  For example, in July 2019, a bill was introduced in the Senate that would  remove the provision prohibiting FTC from taking action against common  carriers. Also in 2019, two different bills were introduced, one in the  House and one in the Senate, that would, among other things, address  issues with harmonization of the FCC statute of limitations and eliminate  the FCC pre-penalty warning requirement with respect to illegal  robocalling. In addition, one of these bills, the Telephone Robocall  Abuse Criminal Enforcement and Deterrence Act (TRACED Act), would  require DOJ, in consultation with FCC, to assemble an interagency  working group to study and report to Congress on how to enhance  enforcement against robocalls by examining issues like the types of laws,  policies, or constraints that could be inhibiting enforcement of the Truth in  Caller ID Act of 2009. The interagency working group would also be  tasked with identifying existing and potential international policies and  programs that could encourage and improve coordination between  countries. We have reported in past work that collaborative mechanisms  such as interagency working groups can help the federal government  achieve many of the meaningful results it seeks to achieve, and that such  mechanisms all benefit from certain key features, which raise issues to  consider when implementing these mechanisms. As of November 2019,  no federal legislation had been enacted on these issues.

Agencies’ Efforts to Collaborate on Enforcement Efforts Generally Align with Key Practices

We found that FCC’s and FTC’s efforts to collaborate on spoofing  investigations and enforcement actions align with seven key practices we  have previously identified to enhance and sustain interagency  collaboration. FCC and FTC officials explained that their close  collaboration helps ensure that they share relevant information and avoid  duplicating efforts. In addition, we found that DOJ’s collaboration with  FCC and FTC aligns with five of the seven key practices. Although we did  not find evidence that DOJ had taken steps in line with the other two key  practices, officials at all three agencies stated that DOJ’s collaborative  efforts were appropriate given its broader jurisdiction and wider focus.

More specifically, we found that all three agencies have incorporated five  key practices. Our prior work has found that one way agencies can  incorporate three of these practices — (1) defining and articulating a  common outcome, (2) establishing mutually reinforcing or joint strategies,  and (3) agreeing on roles and responsibilities—is through a memorandum  of understanding. In 2003, FCC and FTC agreed to a memorandum of  understanding that calls for the agencies to cooperate and coordinate to  implement consistent, comprehensive, efficient, and non-redundant  enforcement of federal telemarketing statutes and rules. The  memorandum also calls for the agencies to meet quarterly to discuss  matters of mutual interest, share consumer complaints, and engage in  joint enforcement actions when necessary. Consistent with the  memorandum, FTC officials told us that FTC and FCC hold quarterly  meetings to discuss how they are targeting robocalls and spoofing investigations and enforcement cases to avoid duplication. FTC and FCC  officials stated that in addition, their collaboration with DOJ is enhanced  through the participation of all three agencies in a monthly conference call  hosted by the National Association of Attorneys General to coordinate  efforts to combat illegal robocalls across the government.

Although DOJ officials told us that DOJ does not have a memorandum of  understanding with FCC or FTC regarding spoofing or robocall-related  enforcement, officials we interviewed at all three agencies identified  collaborative efforts that DOJ engages in that are consistent with the  three key practices cited above. FCC and DOJ officials stated they are  developing procedures to share information on a particular enforcement  case, and that these procedures could be used on other cases as needed  in the future. In addition, officials from all three agencies stated that  DOJ’s participation in the monthly conference calls and additional  informal outreach as needed was sufficient to ensure effective  collaboration.

With regard to the fourth and fifth key practices (4) identifying and  addressing needs by leveraging resources, and (5) establishing  compatible policies, procedures, and other means to operate across  agency boundaries, FCC and FTC officials described regularly sharing  information from their complaint databases, which is in line with these  practices. FTC officials stated they regularly review FCC’s complaint  information to help their enforcement efforts. Moreover, FTC has  established policies and procedures whereby DOJ and FCC and other  law enforcement entities have access to FTC’s complaint database, and  FCC and DOJ officials stated that they frequently analyze FTC’s  complaint database to inform their investigative decisions. Furthermore,  DOJ officials stated that DOJ recently contributed funds to FTC to  enhance capabilities to analyze the database. FCC and FTC have also  leveraged resources by co-hosting a public event in 2018 on reducing  robocalls and spoofing that included discussions of recent policy changes  and enforcement actions to stop illegal robocalls.

We found that FCC and FTC follow two additional key practices for  collaborating on spoofing-related investigations and enforcement actions  that DOJ does not: (1) developing mechanisms to monitor, evaluate, and  report the results of collaborative efforts, and (2) reinforcing agency  accountability for collaborative efforts through agency plans and reports.  For example, FCC and FTC collaborated on a robocall report published  by FCC in 2019 that discussed both agencies’ enforcement actions  related to robocalls and spoofing, and each discussed their collaborative  efforts related to robocalls in key agency documents related to  accountability and performance. DOJ officials stated that they would be  unlikely to have such materials specifically related to spoofing given the  agency’s focus on fraud itself rather than spoofing or robocalling, which it  views as a means to fraud. DOJ officials stated that DOJ’s general  commitment to interagency collaboration is emphasized in its fiscal year  2020 budget submission to Congress and many press releases related to  its enforcement cases. We reviewed DOJ’s budget submission and  several DOJ press releases and found that they mention collaboration  between DOJ and other agencies.

FCC and FTC Have Robust Consumer Education Efforts That Follow Key Practices for Consumer Education and Interagency Collaboration

FCC and FTC use a number of methods to educate consumers on ways  to protect themselves against spoofed and other unwanted calls.  According to FCC documentation, the agency has made combatting  illegal robocalls and caller ID spoofing its top consumer protection priority  and uses consumer education as a means to address this priority.  Similarly, according to FTC’s chairman, consumer education is a critical  element of FTC’s efforts to fulfill its consumer protection mission. The  methods that FCC and FTC use—both independently and  collaboratively—to educate consumers on ways to combat caller ID  spoofing and unwanted calls include the following.

Posting online consumer alerts, videos, blog posts, and other  informative materials: Both FTC and FCC post information and  warnings about caller ID spoofing scams on their websites. FTC, for  example, developed Pass It On, a print- and web-based campaign to  educate seniors about various types of scams that target seniors,  including spoofing. FCC launched an animated video initiative on how  to avoid spoofing scams and also posted a consumer alert about  neighbor spoofing scams. The alert explains that scammers use such  spoofing to increase the likelihood that consumers pick up the phone  and provides tips such as to not answer calls from unknown numbers  and to not provide any personal information to such callers.  Additionally, FCC and FTC post other information, including tip cards  and graphics such as those illustrated in figure 4.

Visiting vulnerable communities: FCC has conducted speaking  tours, such as tours through rural Appalachia and the Pacific  Northwest in 2018 to educate communities about spoofing, and to  build partnerships to help improve the effectiveness of future outreach  efforts. Similarly, FTC has hosted briefings in underserved  communities with law enforcement, consumers, and community  advocates to place more attention on consumer protection issues  such as spoofing and other types of fraud.

We found that FCC’s and FTC’s consumer education efforts related to  spoofing and other unwanted calls aligned with nine key practices for  consumer education that we identified in our prior work (see table 1).  For example, FCC and FTC have developed consistent and clear  consumer education messages related to spoofing and unwanted calls:  specifically, consumers:  should not answer unknown calls;  should not push any numbers if directed to do so; and  should hang up immediately once it is clear that the caller is unknown.

In addition, FCC and FTC officials have worked with credible messengers  to help disseminate consumer education messages, including to  potentially vulnerable populations. For example, since 2017, FCC has  worked with the National Asian American Coalition to train grassroots  volunteers to engage local community members and distribute  educational tip cards printed by FCC in languages such as Mandarin  Chinese, Korean, Vietnamese, and Tagalog. In addition, FTC has  collaborated with AARP to develop three videos for Asian American and  Pacific Islander communities on robocall, IRS, and Medicare scams.

In addition, we found that, similar to their enforcement efforts, FTC and  FCC’s efforts to collaborate on public education in this area are consistent  with the seven key collaboration practices we discussed earlier in this  report. For example, FCC and FTC agreed to a second memorandum of  understanding in 2015 that states that the agencies will collaborate with  each other on consumer and industry outreach and education efforts, as  appropriate. FCC and FTC also collaborate with other entities, including  federal, local, and private entities, to educate consumers on ways to  combat spoofing. For example, FCC officials told us that beginning in  October 2018, they collaborated with Department of Veterans Affairs  officials to send out three joint emails (from November 2018 through  March 2019) to veterans and veterans’ organizations on ways to protect  themselves against illegal robocalls, including spoofed calls. These  officials also noted that each email reached approximately 5.5 million  targeted recipients.

Industry-Led Technical Effort to Reduce Spoofing Is Moving Forward, with FCC’s Support in Line with Federal Guidance Some Providers Are Deploying a Caller ID Verification System with a December 2019 Implementation Target

According to officials with industry groups, voice service providers, and  FCC, the voice service provider industry has taken key steps towards  successfully putting in place a caller ID verification system throughout  much of the IP-based U.S. telephone network by the end of 2019. As  discussed previously, the system is commonly referred to as  STIR/SHAKEN or SHAKEN/STIR. According to the Alliance for  Telecommunications Industry Solutions (ATIS), which spearheaded this  industry-led effort along with the Session Initiation Protocol (SIP) Forum,  the system is intended to enable voice service providers to verify that a  caller has a right to use the caller ID transmitted with the call. Under the  system, the voice service provider that first initiates the call onto the  network (originating service provider) generates a digital signature that  attaches to the phone call indicating that the caller has this right. This  occurs only when the originating provider knows this information and is  considered the highest level of verification, referred to by the industry as  “attestation.” The signature is transmitted along with the call as it is  routed from one service provider to another. The terminating service  provider, which passes the call onto the call recipient, can verify that the  signature was not tampered with before sending the call to the call  recipient (see fig. 5).

According to an FCC Notice of Proposed Rulemaking, as of June 2019,  several major providers had deployed or were in the process of deploying  the system on their own networks, and a few had started exchanging  signed calls with a second provider. In addition, ATIS has announced a  number of key steps taken to fully implement the system’s framework. For  example, in September 2018, ATIS launched the system’s governance  authority, whose board consists of representatives from a variety of U.S.  voice service providers and relevant industry associations, and which,  according to ATIS, is overseeing the system to ensure that it is effective  and secure. In August 2019, ATIS issued a press release stating that the  governance authority board had determined the requirements service  providers must meet in order to get certificates to digitally sign calls and  had contracted a private firm tasked with ensuring that only authorized  service providers get these certificates. According to an industry official  who worked on this effort, once most U.S. carriers deploy the system and  are sharing information across their networks, the technical experts who  developed the standards will be able to see how it works and improve and  enhance the system through additional technical developments.

Because it is not always possible for the originating service provider to  determine whether the caller has a right to use the phone number that will  be displayed, in addition to the top level of verification, the system was  designed with a middle level and a lowest level of verification. The  originating service provider digitally signs the call with the middle level of  attestation when the provider has an established relationship with the  caller but does not know whether the caller has the right to use the phone  number it will display. According to ATIS officials, the originating service  provider may use this level of attestation, for example, when a call comes  from a corporate call center, which displays all outbound calls as  originating from a central number or set of numbers. The originating  service provider signs the call with the lowest level of attestation when it  is responsible for originating the call onto its network but it does not have  a relationship with the caller (such as when the call comes in from  another country). When using either the middle or lowest level of  attestation, the provider cannot determine if the call is spoofed. However,  according to ATIS officials, the information that provided the basis for the  attestation level is still likely to be helpful. For example, this information  may better position the terminating service provider or call blocking and  analytics apps to determine, in combination with other data the  terminating service provider or such apps may have analyzed, whether to  block or warn the consumer about the call.

According to officials from several carrier associations or voice service  providers, the new system should substantially improve the industry’s  ability to combat spoofing and block unwanted calls by providing carriers  with immediate verification information. These stakeholders, as well as  FCC officials, also stated that enabling voice service providers to instantly  identify the provider that initiated the call onto the network—through the  digital signature attached to the call— could help facilitate federal  investigations by accomplishing in an instant what can now take  significant time and effort as the call must be traced back from provider to  provider. One stakeholder who played a key role in the development of  the system stated that as some U.S. service providers deploy this system  and more calls are able to be verified, it is likely to incentivize other U.S.  providers to deploy verification systems so that their calls will not stand  out as unverified. This stakeholder said that the hope is that other  countries, including those with many legitimate call centers that send calls  to the United States, such as India, will also implement verification  systems that eventually can be integrated with the U.S. system. And as  more calls are able to be verified, the stakeholder explained that the  system will become more valuable and useful.

An ATIS representative and other stakeholders identified other examples  of ongoing technical challenges and open issues:  Information provided to consumers: The industry has not reached  agreement about what, if any, information should be presented to call  recipients to inform them that the call has or has not been verified.  Stakeholders we spoke with noted that it is important to educate  consumers on the limitations of any such information. For example,  although a call may be verified, the provider cannot guarantee that the  caller is not trying to defraud the call recipient—just that the caller is  not using a spoofed phone number to do so. Further, if a provider is  unable to verify the caller ID information, it does not necessarily mean  the call is fraudulent or the caller has malicious intent. For these  reasons, several industry stakeholders we spoke with emphasized  that the information provided by this system can be most useful when  combined with other methods service providers use to analyze call  traffic to identify unwanted or illegal calls.

IP-only system: Several stakeholders also emphasized that the  system only works for calls carried entirely over IP networks, not  those using traditional wireline networks. One industry group  representing smaller providers that may use traditional wireline  networks expressed concerns that its members may need more time  to deploy the caller ID verification system because of the resources  needed to transition to an IP network. This issue was discussed by  industry stakeholders at FCC’s July 2019 summit on the caller ID  verification system. One industry stakeholder stated that when calls  that begin on a traditional wireline network are uploaded to an IP  network, the originating service provider on that IP network will sign  the call with the lowest level of verification, and that that information,  in combination with analytics, will help providers to know whether  these calls can be trusted.

Verification of certain calls: As of June 2019, ATIS and industry  stakeholders were also working to determine how to ensure that calls  from 911 operators or video relay service calls for deaf and hard of  hearing users are not blocked if providers are unable to verify the  caller is authorized to use the phone number.

FCC Has Actively Encouraged Deployment of the Caller ID Verification System and Been Engaged with Its Development

Since 2013, FCC has taken several steps to encourage the industry’s  caller ID verification initiative. In doing so, FCC’s efforts have aligned with  federal guidance for agency participation in private-sector standards  activities to help address national priorities. That guidance states that  federal engagement in standards activities should aim to produce timely,  effective standards that address legitimate regulatory, procurement, and  policy objectives. The guidance also states that the federal government  should assume an active role where necessary to ensure a rapid,  coherent response to national challenges. Key steps FCC took to initiate  and accelerate industry efforts—in line with the OMB guidance to produce  timely and effective standards— are summarized below.

In March 2013, FCC’s Chief Technology Officer presented a vision of  developing a caller ID verification system to combat spoofing at an  Internet Engineering Task Force meeting, later referred to as a “call to  action” by a technology stakeholder who played a key role in  developing this system.

In July 2016, FCC’s Chairman issued a call to action for providers to  accelerate their efforts to develop this system. FCC also called for  responses detailing provider efforts.

In December 2017, FCC directed one of its advisory bodies to, among  other things, define criteria for selecting the system’s governance  authority and recommend milestones for system deployment.  Consistent with the guidance that federal engagement should aim to  produce timely, effective standards, FCC’s Chairman urged service  providers and standards groups to accelerate the development and  deployment of these technical standards.

In November 2018, the FCC Chairman sent letters to 14 U.S.  providers and publicly demanded that that they adopt the caller ID  verification system by the end of 2019. While the demand did not  legally require providers to deploy the system, the Chairman stated  that if industry’s progress lagged in 2019, FCC would take action to  ensure widespread deployment. This demand and warning represent  preliminary steps consistent with the guidance’s call for the federal  government to assume an active role where necessary to ensure a  rapid, coherent response to national challenges.

In June 2019, FCC issued a notice of proposed rulemaking that would  require all providers to implement the technical system if major  providers fail to do so by the end of 2019. The notice also requested  comments on how FCC should determine whether it is necessary to  mandate implementation of the technical system and how to evaluate  whether major voice service providers have met the FCC’s end of  2019 deadline for implementation.

According to FCC officials and consistent with the federal guidance, FCC  has engaged with ATIS, providers, and relevant technical stakeholders  throughout their caller ID verification efforts. For example, FCC officials  attended key meetings, and an FCC official submitted technical  suggestions on standards development related to the caller ID verification  system. ATIS representatives told us that FCC’s engagement in these  technical efforts was helpful, as FCC was able to ask questions and  prompt those working on the standards to consider some of the broader  issues that various stakeholders would be concerned about and needed  to be addressed.

Furthermore, FCC is considering how, if at all, its role should evolve in the  future. Notably, FCC’s June 2019 notice also requested comments on  what role FCC should have in the governance of the caller ID verification  system, how to encourage carriers that maintain some portion of their  network on legacy technology to implement elements of the system, and  how FCC and industry can best leverage this system to combat illegal  calls originating outside of the United States. FCC also directed staff to  develop two reports over the next 2 years that, among other things,  provide information on the state of deployment of this caller ID verification  system. FCC officials stated that their efforts related to these issues  encompass more than what is in the proposed regulations, as FCC will  continue to monitor the work of the governance authority, the progress of  service providers’ implementation of the system, and industry’s efforts to  improve the effectiveness of the system and address remaining technical  issues. Moreover, at FCC’s July 2019 summit on the caller ID verification  system, FCC’s Chairman stated that FCC is prepared to issue rules in  2020 mandating that major providers implement the caller ID verification  system if these major providers do not meet the 2019 deadline.

We provided a draft of this report to FCC, FTC, and DOJ for review and  comment. Each agency provided technical and editorial comments, which  we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Chairman of the FCC, the Chairman of the FTC, the  Attorney General, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff any have questions about this report, please contact  me at (202) 512-2834 or VonahA@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.

Appendix I: List of Stakeholders GAO Interviewed

Appendix II: Summary of Federal Agencies’ Enforcement Actions Involving Telephone Calls that Allegedly Used Spoofed Caller ID

Appendix II: Summary of Federal Agencies’  Enforcement Actions Involving Telephone  Calls that Allegedly Used Spoofed Caller ID alleged conduct. We selectively mention spoofing in this column to provide additional context for  some of these cases.

Appendix III: GAO Contact and Staff Acknowledgments

Andrew Von Ah, (202) 512-2834 or VonahA@gao.gov.

In addition to the individual named above, other key contributors to this  report were Alwynne Wilbur, Assistant Director; David Goldstein, Analyst- in-Charge; Mark Canter; Joshua Cicala; Jennifer Clayborne; Kristen  Farole; Jeffery Haywood; Gina Hoover; Delwen Jones; Jenna Lada;  Hannah Laufe; Harold Podell; Cheryl Peterson; and Malika Rice.

Robocalls and other unwanted calls consistently rank among the top consumer complaints to FCC and FTC.

Robocallers often use a fake caller ID—a practice known as “spoofing”—to disguise their identities and gain credibility. Spoofing schemes have deceived people into providing financial information or buying falsely advertised products, costing them millions of dollars each year.

We looked at what federal agencies are doing to protect consumers. We found the 3 agencies involved are investigating and prosecuting scammers, educating the public, and supporting a new industry-developed system to detect spoofing—scheduled to roll out by year’s end.


Medicare: CMS Should Provide Beneficiaries More Information about Substance Use Disorder Coverage

Behavioral health disorders often go untreated, potentially leading to negative health consequences. Behavioral health disorders include substance use or mental health disorders. Medicare provides coverage for behavioral health services. The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act enacted in 2018 included a provision for GAO to examine Medicare behavioral health services and how beneficiaries are informed of coverage and treatment options.

This report (1) describes the utilization of behavioral health services by Medicare beneficiaries and the types of providers furnishing these services, and (2) examines how CMS provides information to beneficiaries about their coverage for behavioral health services. To describe service utilization and provider types, GAO analyzed 2018 Medicare claims data, the most recent data available. To examine how CMS shares information with beneficiaries, GAO reviewed CMS requirements for providing coverage information to beneficiaries, reviewed CMS publications, and interviewed CMS officials.

GAO's analysis of Medicare claims data shows that in 2018 almost 5 million beneficiaries used behavioral health services—services for mental and substance use disorders. This represented about 14 percent of the more than 36 million fee-for-service (traditional) Medicare beneficiaries and reflects about $3.3 billion in spending. Additionally, about 96 percent of all behavioral health services accessed by Medicare beneficiaries in 2018, the latest data available, were for a primary diagnosis in one of five behavioral health disorder categories. (See figure.) Mood disorders, such as depression and bipolar disorders, accounted for 42 percent of services. SUD services accounted for about 7 percent of all services accessed by beneficiaries. Further, two-thirds of behavioral health services were provided by psychiatrists, licensed clinical social workers, and psychologists in 2018.

The Centers for Medicare & Medicaid Services (CMS), the Department of Health and Human Services' (HHS) agency that administers Medicare, uses various approaches to disseminate information to Medicare beneficiaries about coverage for behavioral health services. As part of these efforts, CMS mails out Medicare & You —the most widely disseminated source of information on Medicare benefits—to all Medicare beneficiaries every year. GAO reviewed the fall 2019 and January 2020 editions of Medicare & You. While the January 2020 edition describes a new coverage benefit for beneficiaries with opioid use disorders, neither edition includes an explicit and broader description of the covered services available for substance use disorders. Both HHS and CMS have stated that addressing substance use disorders is a top priority. Given that coverage for substance use disorders is not explicitly outlined in Medicare's most widely disseminated communication, Medicare beneficiaries may be unaware of this coverage and may not seek needed treatment as a result.

In 2017, an estimated 56.8 million adults had a behavioral health  disorder—that is, a substance use or mental health disorder. When  these disorders go untreated, the individual may suffer potential  consequences such as worsening health, reduced educational  attainment, loss of employment, and involvement with the justice system.

Treatment for behavioral health disorders can help individuals reduce or  stop substance use, manage their symptoms, and improve their quality of  life. Behavioral health services include an array of options, ranging from  less to more intensive, and may include prevention services, screening  and assessment, outpatient treatment, inpatient treatment, and  emergency services for mental health and substance use conditions.  Prescription drugs may also be included as part of treatment.

Medicare covers services for the treatment of behavioral health disorders  under Medicare Parts A and B, or Original Medicare, and under Medicare  Advantage (MA), Medicare’s private plan alternative. The Centers for  Medicare & Medicaid Services (CMS), within the Department of Health  and Human Services (HHS), administers Medicare and provides  information to beneficiaries about the behavioral health services covered  by Medicare. Annually, CMS must send information to all Medicare  beneficiaries about available benefits, and MA plans must send  information regarding benefits and available providers, among other  information, to their enrollees.

The Substance Use-Disorder Prevention that Promotes Opioid Recovery  and Treatment for Patients and Communities Act (SUPPORT Act)  included several provisions to expand access to behavioral health  services under Medicare. These include providing coverage for opioid  treatment programs for beneficiaries with opioid use disorder (OUD), as  well as expanding access to telehealth services for the treatment of  substance use disorders (SUD) or co-occurring mental health disorder.  The SUPPORT Act also included a provision for GAO to examine  Medicare behavioral health services and how beneficiaries are informed  of available coverage and treatment options. In this report we  1.  describe the utilization of behavioral health services by Medicare  beneficiaries, and the types of providers furnishing these services;  and  2.  examine how CMS provides information to beneficiaries about  Medicare’s coverage for behavioral health services.

To describe the utilization of behavioral health services by Medicare  beneficiaries and the providers furnishing these services, we analyzed the  2018 Medicare Part B claims file, the latest data available at the time of  our analysis. We focused only on claims for Medicare beneficiaries in  fee-for-service Medicare because similar reliable information was not  available for beneficiaries enrolled in MA. From the 2018 Part B data, we  isolated the behavioral health services provided in 2018 and analyzed these behavioral health services as a share of total Part B services and  expenditures. We also analyzed the behavioral health services by  diagnosis, type of service, provider type, and beneficiary demographic.  We conducted our analysis at the service level: a single service or  multiple services may be delivered during a single visit to a provider. For  example, a beneficiary may receive a general consultation and  psychotherapy during one visit, and the provider would bill both services  to Medicare for that visit. We selected the behavioral health services  included in our analysis based on the service codes (which describe the  type of service provided) and diagnosis codes (which describe the  primary condition related to the service) associated with each claim. Our  analysis focused on services delivered by health care providers that can  diagnose, treat, or otherwise care for an individual, and excluded  behavioral health-related services provided by other types of providers,  such as services performed by lab facilities. For all service codes other  than psychiatry, services were only included if the beneficiary’s primary  diagnosis was a behavioral health condition. We defined behavioral  health conditions as those in the Mental and Behavioral Disorders range  of the International Statistical Classification of Diseases and Related  Health Problems, 10th Revision (ICD-10).

To assess the reliability of the behavioral health services claims data, we  obtained information from knowledgeable CMS officials regarding the  accuracy of the information, and we performed checks to identify missing  or incorrect data. Based on these steps, we determined that the data  were sufficiently reliable for the purposes of our reporting objective.

To examine how CMS provides information to beneficiaries about  Medicare’s coverage of behavioral health services, we reviewed CMS’s  requirements for providing coverage information to beneficiaries. We also  obtained statistics from CMS officials about the usage of the publications,  online content, and telephone support tools used to provide coverage  information to Medicare beneficiaries. In addition, we interviewed CMS  officials, advocates for Medicare beneficiaries and behavioral health  issues, and provider associations. To understand the information made  available to beneficiaries in MA plans, we interviewed officials with the  five largest MA plans that cover about two-thirds of all MA enrollees. To  assess the information made available to Medicare beneficiaries on  coverage for behavioral health services, we compared CMS’s Medicare  publications, and their descriptions of behavioral health benefits, to HHS’s  and CMS’s current strategic priorities related to treatment for SUDs.

We conducted this performance audit from May 2019 to May 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Medicare beneficiaries with behavioral health conditions have a diverse  range of conditions, of different severity, requiring different types of care.  Beneficiaries with mild behavioral health conditions—such as mild  depression—may require less complex care than beneficiaries with  serious behavioral health conditions—such as schizophrenia—or with  multiple interacting behavioral or physical health conditions.  Subpopulations of Medicare beneficiaries also may face different  behavioral health challenges. For example, dual-eligible beneficiaries— individuals eligible for both Medicare and Medicaid—are three times more  likely to have been diagnosed with a major psychiatric disorder than non- dual beneficiaries.

Medicare covers services for the diagnosis and treatment of behavioral  health conditions, which includes the inpatient care covered by Part A and  the physician services and outpatient care covered by Part B. Key  behavioral health services in Medicare Part B include  visits with a physician or other covered provider, partial hospitalization program services, annual depression screening, alcohol misuse screening and counseling, psychotherapy,   screening, brief intervention, and referral to treatment services, and behavioral health integration services.

Dual-eligible beneficiaries may be able to access additional behavioral  health services through Medicaid that are not available through Medicare.

Medicare covers behavioral health services delivered by a range of  providers, including psychiatrists and physicians, clinical psychologists,  licensed clinical social workers (LCSW), nurse practitioners, physician  assistants, and clinical nurse specialists.

In order to bill for services provided to Medicare beneficiaries, providers  must enroll with CMS. Providers who do not want to enroll in the  Medicare program may “opt out” of Medicare. Behavioral health providers  have among the highest opt-out rates, with over 7,000 psychiatrists,  psychologists, and LCSWs opting out of Medicare, representing nearly  one-third of all providers who opted out of Medicare in 2017.  Beneficiaries may still see these providers but must enter into a private  contract with them. Medicare will not pay for any services furnished by  providers who have opted out, so in these cases, beneficiaries must pay  the provider’s entire charge out of pocket. According to researchers,  psychiatrists have low participation rates across all forms of insurance,  including Medicare, which may be explained, in part, by the  reimbursement rates for time intensive treatments, low supply and high  demand for psychiatry services, and high administrative burdens for solo  practitioners to participate in insurance programs.

Provision of Information to Medicare Beneficiaries

CMS is required by law to provide information annually to Medicare  beneficiaries about their coverage, including benefits and limitations on  payment. Various factors affect how beneficiaries receive and process  information about behavioral health conditions and their coverage options  for behavioral health services. According to HHS, low health literacy is a  key barrier that impacts individuals’ ability to comprehend health-related  information. Moreover, researchers have found that low health literacy is  associated with poor physical and mental health. More specific  challenges facing individuals with behavioral health conditions include the  stigma surrounding behavioral health conditions that may discourage  individuals from seeking help or treatment. According to advocates for  Medicare beneficiaries and individuals with behavioral health conditions,  some individuals may have caregivers or other support for finding  information and engaging in decision-making about their behavioral  health care.

According to CMS, one-third (36 percent) of Medicare beneficiaries in  2019 were enrolled in MA plans, which CMS pays on a monthly capitated  basis to deliver all covered services needed by an enrollee. MA plans  contract with provider networks to deliver care to Medicare beneficiaries  and must meet CMS’s network adequacy standards. MA plans may  employ care management and utilization management strategies. Care  management may include case managers or care coordinators who work  with enrollees and providers to manage the care of complex or high-risk  enrollees, including those with behavioral health conditions. According to  the MA plan officials we interviewed, prior authorization—a utilization  management strategy—may be employed for high-cost treatments.  Officials from all five MA plans told us that they may have difficultly  recruiting behavioral health providers to participate in their network. One  study found access to psychiatrists to be more limited than any other  physician specialty in MA plan networks, with 23 percent of psychiatrists  in a county included in network on average, compared to 46 percent of  physicians in a county across all physician specialties in 2015.

Nearly One in Seven Medicare Beneficiaries Used Behavioral Health Services in 2018; Most Services Were Provided by Psychiatrists, Social Workers, and Psychologists

Fourteen Percent of Medicare Beneficiaries Used Behavioral Health Services in 2018, Totaling More than $3 Billion in Spending

Our analysis of Medicare claims data shows that in 2018 approximately 5  million beneficiaries used behavioral health services through Medicare  Part B. This represented about 14 percent of the more than 36 million fee- for-service (traditional) Medicare beneficiaries, and CMS paid providers  about $3.3 billion for approximately 39.3 million behavioral health services  in 2018. (See fig. 1.)

Our analysis of claims data also shows that among Medicare  beneficiaries who used behavioral health services in 2018, utilization of  the services varied significantly. (See fig. 2.)

The average number of services used by Medicare beneficiaries who  used behavioral health services in 2018 was eight, while the median  was three.

Nearly half of all such beneficiaries used between two and seven  behavioral health services during the year.

Nearly one-third (30 percent) of beneficiaries using behavioral health  services used one behavioral health service during the year.

The 11 percent of beneficiaries who were the highest behavioral  health service users used 19 or more behavioral health services (the  90th percentile) during 2018, and accounted for about half of all  Medicare expenditures on behavioral health services.

Our analysis also found that the services beneficiaries received largely  fell into two broad categories in 2018: general patient consultations (53  percent of services) and psychiatry services, including psychotherapy (43  percent of services). Other services, such as central nervous system  assessments and drugs administered by providers, accounted for about 5  percent of services.

Beneficiaries receiving behavioral health care were largely diagnosed  with a condition in at least one of five diagnostic behavioral health  conditions categories, each of which contain multiple specific diagnoses.  In 2018, 96 percent of all behavioral health services were for a primary  diagnosis within one of these five categories. For example, the mood  disorder category, which includes diagnoses such as depression and  bipolar disorder, accounted for 42 percent of services provided. (See fig.  3.)

Medicare claims data for 2018 show that some Medicare beneficiaries  used behavioral health services to obtain treatment for SUDs. Seven  percent of the behavioral health services in 2018 were for SUDs.  Moreover, Medicare beneficiaries with SUDs represented 11 percent of  beneficiaries using behavioral health services. On average, Medicare  beneficiaries with SUDs used five behavioral health services in 2018,  which is less than the number of behavioral health services used on  average by all beneficiaries with a behavioral health diagnosis.

Overall, beneficiaries under age 65 and dual-eligible beneficiaries were  disproportionately represented among users of behavioral health services  compared to the Medicare population. (See fig. 4.) In 2018, while  beneficiaries under age 65 constituted 16 percent of all Medicare  beneficiaries, they represented 34 percent of the Medicare beneficiaries  who used behavioral health services and accounted for 42 percent of all  behavioral health services paid for by Medicare that year. Similarly, while  dual-eligible beneficiaries, many of whom are under age 65, constituted  20 percent of all Medicare beneficiaries, they represented 39 percent of  the Medicare beneficiaries who used behavioral health services in 2018  and accounted for 45 percent of all behavioral health services paid for by  Medicare. Finally, women constituted about 55 percent of all Medicare  beneficiaries in 2018 and represented 62 percent of the beneficiaries who  used behavioral health services that year.

Two-Thirds of Behavioral Health Services Were Provided by Psychiatrists, Licensed Clinical Social Workers, and Psychologists in 2018

Our analysis of Medicare Part B claims shows that in 2018 two-thirds of  behavioral health services (67 percent) were delivered to Medicare  beneficiaries by behavioral health specialists: psychiatrists, psychologists,  and licensed clinical social workers (LCSW). (See fig. 5.) Psychiatrists  provided the most behavioral health services (31 percent), followed by  LCSWs (19 percent), and psychologists (17 percent). A range of other  providers delivered the remaining one-third of behavioral health services,  including advanced practice providers (16 percent), primary care  physicians (11 percent), other physicians (5 percent), and other providers  (1 percent).

As figure 5 shows, beneficiaries who were relatively high users of  behavioral health services received a greater share of services from  behavioral health specialists compared to all Medicare beneficiaries who  used behavioral health services. Approximately three-quarters of services  (78 percent) provided to the highest service users (those in the 90th  percentile with 19 or more services per year) were delivered by  behavioral health specialists: psychiatrists (31 percent), LCSWs (25  percent), and psychologists (22 percent). However, this pattern did not  hold for Medicare beneficiaries with SUDs. Our analysis showed that  beneficiaries with SUDs received 20 percent of their behavioral health  services from a behavioral health specialist, and the other 80 percent of  services were delivered by providers who did not specialize in behavioral  health.

See appendix I for additional information on Medicare behavioral health  utilization.

CMS Uses Various Approaches to Provide Coverage Information to Beneficiaries, but Annual Mailing Does Not Include Explicit Information on SUD Treatment Coverage

CMS Uses Various Communication Approaches to Provide Information to Medicare Beneficiaries on Coverage for Behavioral Health Services

According to CMS officials, the agency’s overall strategy for providing  information to beneficiaries about coverage of behavioral health services  involves a variety of communication and outreach approaches. For  example, CMS disseminates information to beneficiaries through written  and online publications, Medicare.gov, scripted answers to questions  through 1-800-MEDICARE, and social media.

CMS is required by law to provide information to beneficiaries about  coverage under Medicare. CMS annually mails out the Medicare & You  handbook to all beneficiaries, and according to CMS officials, it mailed the  handbook to 42.6 million households in 2018. The information provided  in the publication includes descriptions of benefits and services, a  summary of cost sharing, and the types of providers Medicare covers.  According to CMS officials, Medicare.gov also includes information about  covered benefits and a provider directory, although some may not be  accepting new Medicare patients. According to CMS officials, the most  comprehensive source of information on coverage for behavioral health  services is contained in the publication Medicare & Your Mental Health  Benefits, which is also available at Medicare.gov.

We obtained statistics from CMS officials on the frequency with which  Medicare beneficiaries requested copies of Medicare & You or the  agency’s other publications or accessed the agency’s web-based tools to  obtain information on Medicare coverage, including coverage for  behavioral health services. The most frequently accessed in 2018 were  Medicare & You, Medicare.gov, and the “What’s Covered?” smartphone  application. (See table 1.) These sources of information cover Medicare  more broadly and provide information about Medicare benefits in general,  rather than those dealing specifically with behavioral health.

Like CMS, MA plans use different approaches to provide information to  the beneficiaries enrolled in MA plans, including publications, phone calls,  and websites. According to officials from the five MA plans in our review,  MA plans use multiple modes of communication to meet the preferences  of their enrolled populations. MA plans are required to provide information  to each enrollee at the time of enrollment and annually thereafter; for  example, MA plans must share information about providers reasonably  available to enrollees. MA plans are also required to provide marketing  materials to CMS for review to ensure the adequacy and accuracy of the  information in the materials. Two of the MA plans in our review offer  digital health tools to their enrollees. One plan offers a tool that allows  enrollees to communicate with case managers, and another plan provides  enrollees access to test results, the ability to refill prescriptions and  schedule appointments, as well as resources for patient education.

According to CMS officials, the agency also uses other strategies for  providing information to beneficiaries about coverage of behavioral health  benefits. CMS officials stated that it partners with stakeholders to assist  beneficiaries and caregivers seeking help with behavioral health  conditions. For example, CMS officials described webinars and  workshops it conducts to educate partners and stakeholders who educate  and counsel Medicare beneficiaries. According to agency officials, the  webinars cover a range of topics related to Medicare benefits and  coverage, including behavioral health. The officials also told us that CMS  partners with state health insurance programs to provide information  about Medicare, including information to help Medicare beneficiaries  understand their coverage. CMS officials also stated that the agency  conducts public awareness and outreach campaigns to provide  information to beneficiaries.

CMS’s Annual Mailing to Beneficiaries Does Not Include Explicit Information on Medicare Coverage for SUD Treatment

Medicare & You—the most widely disseminated source of information on  Medicare benefits and coverage—does not provide explicit information  about coverage of services for beneficiaries with SUDs, although HHS  and CMS have identified addressing SUDs as a top priority. We reviewed  the fall 2019 edition of the Medicare & You publication and found that,  while it does provide information on Medicare coverage for behavioral  health services, it does not contain an explicit description of the services  that may be covered for treatment of SUDs. CMS officials noted that  printing the almost 43 million hard copies of the fall 2019 edition of  Medicare & You started in July 2019, several months before the rule  implementing expanded OUD coverage under Medicare was finalized.  In December 2019, CMS officials updated the 2020 edition of Medicare &  You to include information on the expanded OUD treatment authorized by  the SUPPORT Act, which were finalized in November 2019, and became  effective in January 2020. According to CMS officials, as of December  2019, this updated version was available on Medicare.gov, and CMS  officials told us it will be sent to all individuals who become eligible for  Medicare throughout calendar year 2020. We reviewed the updated 2020  web version of Medicare & You and found that a reference to opioid  treatment was included; however, explicit information about Medicare’s  coverage for other SUDs was not added.

Although information on Medicare’s coverage for treating OUD is  important, OUD represents only a subset of the SUDs for which Medicare  beneficiaries may need treatment. Further, several of the advocates we  interviewed noted that Medicare beneficiaries would benefit from clearer  and more specific information about SUD coverage. According to data  from SAMSHA, about one in 10 SUD cases is related to an OUD, while  the rest are related to non-opioid substances.

We asked CMS officials why the additions to Medicare & You relate only  to OUDs, and they explained that it is the only distinct Medicare benefit  category for substance abuse treatment. Officials also stated that while  there is no category in Medicare & You for other SUDs specifically, the  publication does note some related benefits, such as for counseling and  services for behavioral issues, alcohol misuse screening, and behavioral  health integrative services. However, the alcohol misuse screening  benefit is specifically for beneficiaries who do not meet the criteria for  alcohol dependency and covers brief counseling in a primary care setting.  The description of behavioral health does not specify that SUDs are a  behavioral health condition.

The absence of information on Medicare’s coverage for SUDs in  Medicare & You is inconsistent with HHS and CMS strategic priorities  related to treatment for SUDs. The Department of Health and Human  Services’ Fiscal Year 2018-2022 Strategic Plan includes among its  strategic objectives reducing the impact of SUDs through treatment.  Additionally, CMS has made addressing SUDs a top priority and has a  stated commitment to treat SUDs, including OUDs. Beneficiaries lacking  information on coverage of SUDs may be less likely to seek treatment.

HHS and CMS have made addressing SUDs a priority. However, in its  most widely disseminated publication on Medicare coverage and benefits,  CMS does not provide explicit information about the program’s coverage  for SUD treatment services. As a result, beneficiaries with SUDs may not  be aware of this coverage and may not seek needed treatment.

We are making the following recommendation to CMS:  The Administrator of CMS should ensure that the Medicare & You  publication includes explicit information on the services covered by the  Medicare program for beneficiaries with a SUD. (Recommendation 1)

We provided a draft of this report to HHS for review. HHS concurred with  our recommendation, and provided written comments that are reproduced  in app. II, and technical comments, which we have incorporated as  appropriate. In its written comments, HHS stated it would explore  opportunities to modify the Medicare & You handbook to ensure  beneficiaries with substance use disorders are aware of the services  covered by Medicare. HHS also reiterated some of the situations under  which substance use disorder may be covered under Medicare, as well  as its communication strategies and tools to ensure that beneficiaries and  providers are aware of all of the services available under Medicare.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Health and Human Services, the  Administrator of CMS, and other interested parties. In addition, the report  will be available at no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or at CosgroveJ@gao.gov. Contact points for our  Office of Congressional Relations and Office of Public Affairs can be  found on the last page of this report. Other major contributors to this  report are listed in appendix III.

Appendix I: Additional Tables on Behavioral Health Utilization among Medicare Beneficiaries, 2018

To produce the tables below describing the utilization of behavioral health  services by Medicare beneficiaries and the providers furnishing these  services, we analyzed the 2018 Medicare Part B claims file, the most  recent data available at the time of analysis. Our analysis only includes  Medicare beneficiaries in fee-for-service Medicare because similar  reliable information was not available for beneficiaries enrolled in  Medicare Advantage.

Appendix II: Comments from the Department of Health and Human Services

In addition to the contact named above, Lori Achman (Assistant Director),  N. Rotimi Adebonojo (Analyst in Charge), Todd Anderson, Sauravi  Chakrabarty, Kelly Krinn, Rich Lipinski, Drew Long, Diona Martyn, Vikki  Porter, and Caitlin Scoville made key contributions to this report.

In 2018, almost 5 million Medicare beneficiaries used behavioral health services that the program covers. These include treatments for mental health and substance use disorders.

Medicare wants to expand access to substance use disorder treatment, but some beneficiaries may not know these services are covered. Medicare’s coverage of these treatments is not explicitly outlined in the Medicare & You publication—the most widely disseminated source of information on Medicare coverage for beneficiaries.

We recommended that Medicare include explicit information on covered services for beneficiaries with substance use disorders in this publication.