Attacker            Callback Service           CPS               Bob
 --------------------------------------------------------------------
 Place call to Bob ---------->
  (from 111.555.1111)
                             Store PASSporT for
                             CS:Bob ------------->

 Call from Attacker (forged CS caller-id info)  -------------------->

                             Call from CS ------------------------> X


                                                <-- Retrieve PASSporT
                                                           for CS:Bob

                        PASSporT for CS:Bob ------------------------>

                                         [Ring phone with callerid =
                                            111.555.1111]