What spoofing is
Caller ID spoofing means deliberately sending a false number or name with a call. The original phone network trusted whatever the calling side said, and internet calling made it cheap and easy to set any number. Scammers use it to look local, to look like a bank or agency, or simply to avoid being blocked.
When it's illegal
Under the federal Truth in Caller ID Act, it's illegal to send misleading caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value. Some spoofing is lawful: a doctor calling from a personal phone may display the clinic's main number, and businesses often show one outgoing number for many lines. The test is intent.
Common spoofing tricks
- Neighbor spoofing. The number shares your area code and exchange, so it looks like someone nearby.
- Institution spoofing. The caller ID shows the real number of a bank, police department or government office.
- Your own number. You get a call from yourself. It's a sign of spoofing, not a hacked phone.
- Innocent bystanders. A real person's number is used, and they start getting angry callbacks.
What STIR/SHAKEN does
STIR/SHAKEN is a set of technical standards that lets phone companies digitally sign calls on internet-based networks. The originating provider attests to how well it knows the caller, and the receiving provider checks the signature. The FCC required large voice providers to put it in place on their IP networks from June 2021, with deadlines for smaller providers following.
| Attestation | What the originating provider is saying |
|---|---|
| A (full) | We know this customer and they are authorized to use this number |
| B (partial) | We know this customer, but can't confirm they're authorized to use this number |
| C (gateway) | The call reached us from elsewhere, such as an international gateway, and we can't vouch for its source |
When a call passes with full attestation, some phones and carriers display a check mark or "Verified" label.
What it can't do
- It doesn't judge intent. A scammer using a number they legitimately rent can get full attestation. "Verified" means not spoofed, not trustworthy.
- Older networks are gaps. Calls that pass through non-IP equipment can lose their signature along the way.
- International calls are harder. Calls entering the US from abroad often get only gateway-level attestation.
- It doesn't block calls by itself. Carriers use attestation as one input to their spam filters.
A call showing your bank's name and a check mark can still be a scam if the criminal is using a number of their own. Never act on caller ID alone. Hang up and contact the organization on a number you trust.
If your number is being spoofed
If strangers are calling you back about calls you never made, your number is probably being used by a spoofer. There's little you can do to stop it, and it usually moves on within days. Record a voicemail greeting explaining that your number is being spoofed and that you didn't call. Tell your carrier, which may be able to help with the volume of callbacks. Don't change your number unless the problem persists.
Reporting
Report spoofed robocalls and sales calls at donotcall.gov. Report scam attempts at reportfraud.ftc.gov. The FCC also accepts consumer complaints about spoofing through its complaint center on fcc.gov. For practical blocking steps, see block spam calls.