What caller ID spoofing is
Caller ID spoofing means deliberately sending a false number or name with a call. The original phone network trusted whatever the calling side said, and internet calling made it cheap and easy to set any number. Scammers use it to look local, to look like a bank or agency, or simply to avoid being blocked.
Is caller ID spoofing illegal?
Under the federal Truth in Caller ID Act, it's illegal to send misleading caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value. Some spoofing is lawful. A doctor calling from a personal phone may display the clinic's main number, and businesses often show one outgoing number for many lines. What matters legally is intent.
Common spoofing tricks
- Neighbor spoofing: the number shares your area code and exchange, so it looks like someone nearby.
- Institution spoofing: the caller ID shows the real number of a bank, police department or government office.
- Your own number: you get a call from yourself. That points to spoofing, and it doesn't mean your phone was hacked.
- Innocent bystanders: a real person's number is used, and they start getting angry callbacks.
What STIR/SHAKEN call authentication does
STIR/SHAKEN is a set of technical standards that lets phone companies digitally sign calls on internet-based networks. The originating provider attests to how well it knows the caller, and the receiving provider checks the signature. The FCC required large voice providers to put it in place on their IP networks from June 2021, with deadlines for smaller providers following.
| Attestation | What the originating provider is saying |
|---|---|
| A (full) | We know this customer and they are authorized to use this number |
| B (partial) | We know this customer, but can't confirm they're authorized to use this number |
| C (gateway) | The call reached us from elsewhere, such as an international gateway, and we can't vouch for its source |
When a call passes with full attestation, some phones and carriers display a check mark or "Verified" label.
What STIR/SHAKEN can't stop
- It doesn't judge intent. A scammer using a number they legitimately rent can get full attestation, so "Verified" only tells you the number wasn't spoofed.
- Calls that pass through older, non-IP equipment can lose their signature along the way.
- Calls entering the US from abroad often get only gateway-level attestation.
- It doesn't block calls by itself. Carriers use attestation as one input to their spam filters.
A call showing your bank's name and a check mark can still be a scam if the criminal is using a number of their own. Never act on caller ID alone. Hang up and contact the organization on a number you trust.
What to do if your number is being spoofed
If strangers are calling you back about calls you never made, your number is probably being used by a spoofer. There's little you can do to stop it, and it usually moves on within days. Record a voicemail greeting explaining that your number is being spoofed and that you didn't call. Tell your carrier, which may be able to help with the volume of callbacks. Don't change your number unless the problem persists.
How to report spoofed calls
Report spoofed robocalls and sales calls at donotcall.gov. Report scam attempts at reportfraud.ftc.gov. The FCC also accepts consumer complaints about spoofing through its complaint center on fcc.gov. For practical blocking steps, see block spam calls, and for the scripts spoofed calls usually follow, see common phone scams.
Spoofing questions
Why did I get a call from my own number?
Someone spoofed it. Your phone almost certainly wasn't hacked. Don't answer such calls or press any buttons.
What does the check mark next to a call mean?
It means the call passed STIR/SHAKEN with full attestation, so the provider vouches that the caller may use that number. The caller can still be a scammer.
Can I stop someone spoofing my number?
Usually not directly, and it often moves on within days. Record a voicemail greeting explaining the situation and tell your carrier.