Caller ID spoofing: when scammers use a real number

Caller ID is a label, not proof. With the right software, a caller can make almost any number appear on your screen: a number in your area code, your bank's customer service line, a police department, even your own cell. That's called spoofing, and it's behind a huge share of scam calls.

How spoofing works

Most calls now travel over the internet for at least part of their trip, and the systems that place them let the caller fill in the number that gets sent as caller ID. Legitimate businesses use this to show their main number instead of an individual desk line. Scam call centers use it to show whatever number you're most likely to answer.

The common types

• Neighbor spoofing: the call shows your own area code and exchange, such as (312) 555-01xx if your number is (312) 555-0123, so it looks like someone local, maybe a school or a neighbor.
• Official spoofing: the call shows a real number belonging to a bank, a government agency or a well-known company. Searching the number "confirms" it's real, which is exactly the point.
• Your own number: the call appears to come from you. It's a cheap trick to grab your attention.
• Random numbers: robocallers rotate through thousands of numbers that belong to real people who have no idea.

Is spoofing illegal?

Not always. Under the Truth in Caller ID Act, spoofing is illegal when it's done to defraud, cause harm or wrongfully obtain anything of value. A doctor calling from a personal cell and showing the office number is fine. A scammer showing your bank's number to steal from you is not, and the FCC has issued fines in the hundreds of millions of dollars for spoofed robocall campaigns.

What STIR/SHAKEN does

STIR/SHAKEN is a system that lets the phone company that starts a call digitally vouch for the caller ID, so the company delivering it can check the signature. The FCC required voice providers to use it on their internet-based networks, with the main deadline in June 2021. It makes spoofing harder to hide and helps carriers trace and block shady calls.

It doesn't catch everything. Calls passing through older networks or arriving from overseas may lose or never have a signature, and a perfectly signed call can still be a scam from a real, cheaply bought number. So a "Verified" label is a good sign about the number, not about the person.

How to protect yourself

• Trust how the call started, not the number. If someone calls you, you can't be sure who they are. Hang up and call the organization back on a number you look up yourself: the back of your card, a statement, the official website.
• Real agencies don't call with threats. The IRS, Social Security and police don't call demanding immediate payment by gift card, wire or crypto.
• Don't press keys or answer questions on a call you weren't expecting.
• Screen unknown callers so strangers have to say who they are first. See how to block numbers.

What it means on ShadyCall

Because numbers can be spoofed, a number page can show reports from scam victims even though the real owner never called anyone. The carrier and city we show come from where the number's exchange was originally assigned, so they say nothing about where a spoofed call actually came from. When reports are mixed ("it's a real dentist" next to "fake bank fraud call"), spoofing is the usual explanation. You can see numbers reported as spoofed.

My number is being spoofed: people say I called them

1. Don't panic. It's not your fault, and it doesn't mean your phone was hacked. Spoofers don't need access to your phone.
2. Don't call everyone back. If a few people call you angry, tell them briefly that your number was spoofed and you didn't call.
3. Update your voicemail greeting for a while: "If you got a call from this number, it was spoofed. I didn't call you."
4. Tell your carrier. They can't always stop it, but reports help them trace the source.
5. File an FCC complaint at fcc.gov/complaints, which has a specific option for having your own number spoofed.
6. Add a report to your own number on ShadyCall saying it was spoofed, so people who look it up see your side.

Spoofing campaigns usually move on to new numbers within days or weeks. Changing your number is rarely necessary.

Common questions

Can I tell a spoofed call from a real one?

Not reliably from the screen. Look at what the caller wants instead: urgency, threats, secrecy, and unusual payment methods are the giveaways.

Why did I get a call from my own number?

Someone spoofed it to get you curious. Don't answer; if you do, hang up without pressing anything.