Caller ID Spoofing: Why a Scam Call Can Show a Real Number, and What to Do

What caller ID spoofing is

Caller ID spoofing means someone deliberately falsifies the information sent to your caller ID display to hide who they are. The FCC’s guide to caller ID spoofing describes it that way and lists what scammers usually choose to show: a local number, or the number of a company or government agency you already know and trust.

The most common version is called neighbor spoofing. The call shows up with your own area code, and the FTC notes in its page on blocking unwanted calls that scammers often match the first six digits of your number, betting that you are more likely to answer a call that looks like it comes from someone nearby. The FTC adds a detail that matters later in this guide: the faked name and number often belong to a real person who has no idea someone is misusing them.

Two things look similar and are not spoofing. A call that shows Unknown, Private or no number at all comes from someone who chose not to share their number, which the FCC says is legal and is not spoofing. And some spoofing is legitimate: the FCC gives the example of a doctor calling a patient from a personal cell phone while showing the office number, or a business showing its toll-free callback line. What makes it a problem is the intent behind it.

Why a scam call can show a real number

A scam call can show a real number because caller ID displays the number that arrives attached to the call, and for most of the history of the phone network nothing checked that number before it reached you. The number may belong to a real bank, a real sheriff’s office or a real neighbor, and the person calling may have nothing to do with any of them.

The FCC only required phone companies to put a caller ID checking system in place on their internet-based networks in 2020, with a deadline of June 30, 2021, according to its page on caller ID authentication. That system is still expanding, and parts of the network that run on older technology cannot use it yet. So a borrowed number can still get through, sometimes with a label and sometimes without one.

Here is how that looks from the receiving end. The following scene is invented, and the kind of call it describes is real.

That example is one form of a wider pattern, where someone borrows the name of an agency, a company or a relative to get paid. The guide to impostor scams covers the stories these callers tell.

Is caller ID spoofing illegal?

Spoofing is illegal in the United States when it is done to defraud, cause harm or wrongly obtain anything of value. That rule comes from the Truth in Caller ID Act of 2009, which is now part of federal law at 47 U.S.C. 227(e).

The FCC’s rule that carries it out, 47 CFR 64.1604, is broader than many people expect in three ways:

• It covers text messages as well as voice calls.
• It applies to people outside the United States when the person receiving the call or text is inside the country.
• It covers anyone who causes the false caller ID to be shown, directly or indirectly.

The FCC’s spoofing guide says anyone spoofing illegally can face penalties of up to 10,000 dollars for each violation. The law turns on what the caller was trying to do, so a borrowed number is not a crime by itself. The law punishes the caller after the fact, so it does not keep the call from reaching you.

Why verified and spam labels help but do not stop it

The labels your phone shows, such as a check mark, the word Verified, or Spam Likely, come from caller ID authentication and from your carrier’s call analysis. They are useful signals, and they do not stop spoofing on their own.

The FCC calls the authentication framework STIR/SHAKEN. The phone company that places the call signs the number, and the company that delivers it checks that signature, so your carrier can confirm the call really comes from the number on the screen. The FCC says this reduces the effectiveness of spoofed calls and helps carriers decide what to block and label. It does not claim the system ends spoofing, and it lists the reason: the framework only works on internet-based networks, and providers still using older equipment have to upgrade or build another solution first.

What your screen shows also depends on your carrier and your phone model. The checks you can run on a number before calling it, and what each one proves, are in how to check who owns a phone number.

What hang up and call back means in practice

Hanging up and calling back means ending the call and reaching the organization through a number you found yourself, not one the caller gave you and not the one on your screen. The FCC’s advice is to call the number on your account statement, in the phone book, or on the company’s or agency’s own website.

Spoofing adds a detail that is easy to miss. Tapping the number in your recent calls list can go one of two ways. If the caller used their own line, you redial the scammer. If they borrowed a real number, you reach the real owner, who knows nothing about the call. You cannot tell which from the screen, so neither outcome confirms anything. Look the number up yourself, on the back of your card, inside the company’s app, or on a bill.

The FCC also notes that a legitimate organization will usually send you something in writing before it calls, especially when it wants a payment. A surprise call that needs money or a code today is the kind of call worth ending. The way these conversations are built, and the requests that should end one, are covered in how phone call scams work.

If the call already went further than you wanted, this is the order that usually helps most:

1. If you paid or shared bank details, call your bank or card issuer right away, on the number printed on your card or inside its app. Say the payment was made because of a fraudulent call. What can be done depends on how you paid and how fast you report it, and the FTC’s phone scam guide walks through each payment method.
2. If you gave a password or a login code, change that password now, and anywhere else you used the same one.
3. If you gave your Social Security number, go to IdentityTheft.gov, the FTC’s site that builds a recovery plan for you.
4. Write down the number on the screen, any callback number, and the date and time, then report the call as described below.
5. Be wary of anyone who calls later offering to recover the money. The FTC warns that this is usually a second scam.

What to do if your own number is being spoofed

If strangers call or text to ask why your number called them, your number is most likely being spoofed, and the FCC says it usually does not last long: scammers switch numbers often, and within hours they are likely to stop using yours. You did not make those calls, and nobody needed access to your phone to put your number on someone else’s screen.

The FCC’s spoofing guide suggests a few things, and the rest follow from how the calls work:

• Tell callers what is happening. If you answer one of the angry callbacks, explain that your number is being spoofed and that you did not call them. Many of them received a scam call and are trying to trace it, so a short, calm answer usually ends it.
• Change your voicemail greeting for a few days to say that your number is being used by scammers and that you are not calling anyone. The FCC suggests exactly this.
• Set a password on your voicemail if you do not have one. The FCC warns that some voicemail services let anyone in who appears to be calling from your own number, so a spoofed call could reach your messages.
• Tell your carrier if your own calls start showing as spam. The FCC encourages phone companies that block or label calls to give callers a way to fix a wrong label, so ask your carrier how to request a review.
• File a complaint with the FCC under Unwanted Calls/Texts, with the sub-issue “my own number is being spoofed,” on the FCC Consumer Complaint Center. That category also covers a number that is being blocked or labeled as spam.

Changing your number is rarely the first step, given that the FCC expects the scammers to move on. Watch for a different problem, though. If your phone suddenly loses service, or you get texts about a SIM change you did not ask for, someone may have moved your number to their device, which is not spoofing. That situation needs a call to your carrier right away, and the steps are in what to do about a SIM swap.

Can you stop spoofed calls?

You cannot stop someone from spoofing a number, but you can cut down how many of those calls reach you and how far they get when they do. The FTC calls call blocking and call labeling your best defense against unwanted calls.

Blocking the specific number that called you helps less than usual with spoofed calls, because the next call arrives from a different number, often another real one. The settings that help more are the ones that filter by pattern: your carrier’s spam filtering, a call-blocking app, or your phone’s option to silence callers who are not in your contacts. Where those settings live on each phone, and what they leave out, is in how to block unknown numbers on Android and iPhone.

On the call itself, the FCC’s advice is to hang up rather than press a button to be removed from a list, which scammers use to find people who answer, and not to answer questions, especially ones that can be answered with yes or no.

The National Do Not Call Registry reduces sales calls from real companies, and the FTC is clear that it will not stop scammers from making illegal calls.

How to report a spoofed call

Report spoofed calls to the FTC, and to the FCC when the problem is your own number or a pattern of illegal calls. Neither agency will get your money back from a report, but both use the reports to go after the people behind the calls.

• No money lost: use the reporting form at DoNotCall.gov.
• Money lost, or you know something about who called: report it at ReportFraud.ftc.gov.
• Your own number is being spoofed, blocked or labeled as spam: file with the FCC Consumer Complaint Center, under the sub-issue for your own number.

The FTC asks for four things, and it wants the number on your caller ID even if you think it was faked: the number that received the call, the number shown on caller ID, any number you were told to call back, and the date and time. It releases the reported numbers to the public each business day, which feeds the blocking and labeling tools carriers use. The FCC does not resolve individual complaints and uses them for enforcement under the Truth in Caller ID Act, as its guide to stopping unwanted robocalls and texts explains.

If money moved, the full sequence, including the bank and what recovery realistically looks like, is in how to report a scam and try to recover your money.

Caller ID spoofing FAQ