Virtual Telephone Numbers & CDR Forensics: Analyzing Vumber SIP Call Forwarding in Investigations

Commercial virtual Direct Inward Dialing (DID) services allow a single cellular handset or landline to terminate traffic from multiple disposable area codes without swapping physical SIM cards. Originally highlighted in an Appalachia High Intensity Drug Trafficking Area (HIDTA) Intelligence Support Center bulletin examining vumber.com, virtual number proxies introduce distinct asymmetries into wireless carrier Call Detail Records (CDRs) that telecommunications analysts must recognize during toll correlation and pen-register investigations.

How Commercial Virtual DID Forwarding Operates

Services such as Vumber provision public switched telephone network (PSTN) numbers from Competitive Local Exchange Carrier (CLEC) blocks and bind them to a subscriber's existing cellular or VoIP endpoint. Under Vumber's classic consumer tier ($9.95 per month for a primary virtual line plus $3.95 per month for each supplemental virtual number), a single target handset can simultaneously receive calls across multiple regional area codes while rotating disposable numbers on demand—offering three free number swaps followed by nominal $1.95 reassignments.

Unlike traditional carrier call forwarding configured inside a mobile switching center (MSC), over-the-top virtual number platforms sit between the PSTN and the subscriber's wireless carrier as a Session Initiation Protocol (SIP) Back-to-Back User Agent (B2BUA). Through a web-based dashboard, the account holder can dynamically alter call disposition rules per caller: bridging the call live to their handset, shunting specific numbers to cloud voicemail, playing an out-of-service SIT tone, returning a busy signal, or streaming a custom pre-recorded audio prompt.

Inbound vs. Outbound Asymmetry in Cellular Toll Records

When an investigator subpoenas standard cellular toll records solely from the target's wireless provider (such as Verizon, AT&T, or T-Mobile) without recognizing an intermediary virtual DID layer, the resulting call graph appears deceptively fragmented. As documented through technical disclosures to the Appalachia HIDTA ISC, the forwarding bridge creates two starkly different signatures depending on call direction:

Recognizing the Two-Stage Dial-Through Pattern

The single highest-signal indicator of virtual number usage inside a raw cellular toll dump is asymmetric contact reciprocity. In normal peer-to-peer mobile communication, Person B's handset exhibits both incoming and outgoing CDR entries for Person A's 10-digit number. When Person B routes outbound calls through a two-stage virtual bridge to conceal their true cellular MSISDN from Person A, the wireless carrier switch only sees Leg 1—the call setup from Person B's phone to the Vumber access/virtual number. The post-answer Dual-Tone Multi-Frequency (DTMF) digits that Person B punches in to reach Person A travel in-band (or via RFC 2833 RTP events) directly to the Vumber switch and are never logged as dialed digits by the cellular carrier.

Consequently, as the HIDTA analysis emphasized, whenever a virtual DID appears repeatedly as a dialed destination on a subject's toll records, analysts must evaluate two distinct hypotheses:

1. The Subject Is the Virtual Account Subscriber: The target is dialing their own virtual number as a gateway trunk to place outbound masked calls or check cloud voicemail. In this case, dozens of unrelated incoming callers will appear in the cellular CDR with zero direct return calls to their numbers, coinciding instead with outbound calls to the single Vumber DID shortly thereafter.
2. The Subject Is Calling Another Party's Virtual Number: An external associate is using Vumber to insulate their true handset from the target. Here, the Vumber DID appears on outbound calls from the target, while return calls from that associate also display the same Vumber DID as the incoming caller ID.

Carrier Lookup & Subpoena Chaining Methodology

Because virtual number platforms lease wholesale DID blocks from underlying Tier-1/Tier-2 CLECs (such as Bandwidth.com, Level 3/Lumen, Peerless Network, or Neutral Tandem/Inteliquent), running a Local Exchange Routing Guide (LERG) or NPAC dip on a suspect phone number will initially return the wholesale CLEC rather than the retail virtual-number reseller.

Step-by-Step Attribution Workflow

• Step 1 — LERG & RespOrg Identification: Query the 10-digit NPA-NXX-XXXX against NPAC/LERG to identify the Operating Company Number (OCN) holding the block. Serve an administrative or grand jury subpoena on the wholesale CLEC to identify the downstream wholesale customer or VoIP reseller leasing that specific DID during the relevant UTC date range.
• Step 2 — Request Full ISUP Signaling Columns on Wireless Tolls: When serving legal process on the target's cellular carrier, explicitly request full switch-level CDRs—including Redirecting Number, Original Called Number, and Call Forwarding Indicator columns—rather than condensed retail billing statements. Many MSCs preserve the intermediate virtual DID inside the SS7 IAM header even when displaying the originating caller's ANI on the handset screen.
• Step 3 — Serve Targeted Legal Process on the Virtual Number Provider: Once a DID is traced to Vumber (historically headquartered at 27 W. 20th Street, New York, NY 10011; compliance desk documented via President Cliff Wener in the HIDTA bulletin), legal process under 18 U.S.C. § 2703 should request all linked virtual DIDs (including retired/rotated numbers), the forwarding destination handset history, two-stage outbound leg CDRs showing true DTMF-dialed destinations, web portal management login IP addresses, and payment instrument metadata.