Scam Calls: How Caller ID Spoofing Works and What to Do

The name on your phone’s screen when it rings is not the result of a check. It is a label that travels with the call, and on many networks the caller gets to write it. That is how caller ID spoofing works: a scammer sets the display to your bank’s fraud line, a tax office or a number from your own neighborhood, and you answer a stranger who already looks familiar.

The US Federal Trade Commission (FTC) warns that scammers can make any name or number show up on your caller ID, so a familiar name on the screen proves nothing about who is calling.¹ Whoever the screen says is calling, the safe routine does not change:

1. Treat the name on the screen as a claim, not proof
2. Hang up when a call asks for money, codes or details
3. Call back on a number you look up yourself
4. On a landline, wait or use another phone before calling back
5. Turn on your phone company’s call blocking or labels
6. Report the call, and the number it showed

It’s the same “verify another way” rule that covers scam text messages and how to report them, applied to a ringing phone. For what to set up on your accounts and devices, see the core habits behind every scam defense.

What is caller ID spoofing, and is it illegal?

Caller ID spoofing is deliberately changing the number or name shown to the person being called, so the call seems to come from someone else. The US Federal Communications Commission (FCC) defines it this way and says it is not always illegal: what matters is the purpose. Its examples of legal uses include a doctor calling from a personal mobile who shows the office number, and a business showing its toll-free call-back number. Hiding your own number, so it shows as unknown, is not spoofing.²

The weakness is built into how caller ID works. The service sends the calling number to your phone while the call is being set up, and the name you see is often looked up from a database by the receiving phone company, using that number.³ Internet calling moved control of the number toward the caller. Some internet phone services let customers type the number they want shown into a settings page, and free software makes faking it cheap. One detail makes this worse: if the incoming number matches one in your contacts, some phones show the name you saved for it.⁴

So if a scammer copies the number you saved as “My Bank”, your phone says “My Bank”, in your own words. The display feels like confirmation, but nobody checked anything.

What the law says varies by country:

• In the US, the Truth in Caller ID Act bans misleading caller ID sent to defraud, cause harm or wrongly obtain anything of value; the FCC’s guide, reviewed in 2024, says penalties can reach US$10,000 per violation.²
• In Canada, the CRTC requires telemarketers to identify themselves accurately and says, in guidance updated in 2023, that spoofing breaks that rule.⁵
• In the UK, Ofcom’s 2024 guidance to phone companies says the number shown must be one the caller was assigned or has permission to use.⁶

Elsewhere, look up your own telecoms regulator. No law helps while the phone is ringing, though: treat the screen as the caller’s own claim.

Three tricks: local numbers, your own number and trusted names

Spoofed calls tend to take one of three shapes, and Canada’s CRTC names them: “neighbouring”, where the number matches the first six digits of yours so it looks local; “mirroring”, where the call shows your own number; and impersonation, where it shows the number of a known company or government body.⁵

Local-looking numbers come first. The FTC says scammers copy your area code and often the first six digits of your number, betting that you’ll answer a call that seems to come from nearby. The number they borrow often belongs to a real person who has no idea it is being used.⁷ So a local-looking number is no reason to pick up. A call showing your own number is the same trick turned inward: still just a label, so treat it like any unknown caller.

Trusted names are the third shape, and the one aimed most directly at your money. The call shows your bank’s real number. The caller says your account is under attack and asks you to move your money into a “safe account” that the scammer controls. The government version threatens arrest unless you pay at once. Northern Ireland’s official advice site describes both scripts.⁸

Myth

If the number on my screen matches my bank's, it is my bank.

Fact

Caller ID shows what arrives with the call. Northern Ireland's official advice warns that scammers can copy an organization's number so it appears on your display.

How can I tell if a call from my bank is real?

You can’t tell from the call itself, because the number can be genuine and the caller can know your name. Europol, the EU’s police agency, warns that fraudsters find basic details about you online, so knowing them proves nothing. What gives a scam away is what the caller asks you to do, and Europol’s checklist for bank calls is short: your bank will never ask for your card PIN or online banking password, and it will never ask you to transfer money to another account.⁹

Picture the call. “This is your bank’s fraud team. We’ve stopped a suspicious payment, but your account is still at risk. Please don’t hang up.” Every line is built to keep you on the phone and stop you checking. A real fraud team loses nothing if you hang up and ring the number on your card.

In the UK there is a shortcut: 159, a number run by Stop Scams UK, an industry body, which it says connects customers of more than 99 percent of UK retail bank current accounts to their own bank, and which it says cannot be spoofed.¹⁰ Elsewhere, use the number on the back of your card or in your bank’s app.

What to do when a call might be spoofed

These steps draw on regulators’ advice from several countries.

1. Treat the name on the screen as a claim, not proof

You can’t check a caller ID from your end. Let the request, not the display, decide how far you trust the caller: confirming an appointment is one thing, asking for your card number another.

2. Hang up when a call asks for money, codes or details

The FCC advises against answering questions, especially ones that can be answered “yes” or “no”, and against pressing a button to “stop the calls”: scammers use that trick to find people who respond.²

3. Call back on a number you look up yourself

Use the number on your statement, your card or the organization’s own website, never one the caller gives you, because that number can lead straight back to the caller.

4. On a landline, wait or use another phone before calling back

Northern Ireland’s official advice warns that scammers can keep a landline connection open after you hang up, so your “new” call goes straight back to them. It suggests waiting 20 minutes, or using a different phone if you can.⁸

5. Turn on your phone company’s call blocking or labels

The FTC describes call labeling that shows “spam” or “scam likely” on screen, and says some labels and blocks are free while others cost money. It also warns that not all scam calls get flagged.⁷ Ask your provider what it offers.

6. Report the call, and the number it showed

Report the number that showed on your screen, even if you think it was fake, along with any number you were told to call back and the date and time. The FTC says these details help it and its partners trace the callers.⁷

When a call might be spoofed

• Treat the name or number on the screen as a claim, not proof
• Hang up if the caller asks for money, a code, a PIN or a password
• Call back on a number from my card, statement or the official website
• On a landline, wait or use another phone before calling back
• Check which call blocking or labels my phone company offers
• Report the call, the number it showed and any call-back number

If you already paid or gave details away

If you gave a caller card details or moved money, call your bank straight away on a number you trust, using a different phone if the scam call came to your landline. Your bank can tell you whether a payment can still be stopped or reversed. If the caller collected personal details such as your date of birth or ID numbers, follow the first steps after identity theft.

Then report the call. Each country has its own route:

Should I answer calls from unknown or local-looking numbers?

The FCC’s advice is not to answer calls from unknown numbers, and to hang up straight away if you do.² Letting a call go to voicemail is a middle way: a real caller can leave a message, and you can call back on a number you have checked.

That habit has a cost if you are expecting a call from a clinic or a school, which may come from an unfamiliar number. Answer if you like, but apply the same rule: if the caller asks for money or personal details, hang up and ring the organization’s main number.

A real fraud team loses nothing if you hang up and ring the number on your card.

Check your voicemail regularly, so that real messages aren’t missed.

What if scammers are spoofing your own number?

If strangers ring you to ask why you called them when you didn’t, scammers are probably showing your number on their calls. The FCC’s advice, if you do answer one of these calls, is to explain that your number is being spoofed and that you didn’t call them, and to consider a voicemail greeting that says so. It notes that scammers switch numbers often, so they usually stop using yours within hours. It also warns that some voicemail services let in anyone calling from your own number without a password, so set one if you haven’t.² Tell your phone company too.

Does STIR/SHAKEN stop spoofed calls?

STIR/SHAKEN does not stop spoofed calls on its own. It is a system, required by the FCC in the US since 2021, in which the phone company where a call starts digitally signs the caller ID and other companies verify that signature before the call reaches you.¹² It makes faking a number harder on internet-based networks, but it cannot vouch for the person speaking.

Your phone may never show any of this. Canada’s CRTC, which also requires the system, says that not every call can be authenticated, for example when part of the route is not fully internet-based, and that only smartphones can display the result.⁵

The system checks the phone company’s word about the number, not the caller’s identity or intent. The UK’s regulator, Ofcom, decided in February 2024 not to adopt STIR/SHAKEN at that time.¹³ A tick beside a number suggests the number probably wasn’t faked. It does not tell you that the person on the line works where they say they do.

One of Ofcom’s main measures targets calls that enter the UK showing a faked UK number.

The study

Limited evidence

How UK networks began blocking faked landline numbers from abroad

Since 29 January 2025, UK phone companies must block calls from abroad that falsely show a UK landline number, with a few legitimate exceptions. Ofcom reported that BT, trying the measure voluntarily, kept up to one million such calls a day out of its network in its first month.¹⁴

That count shows how much spoofed traffic a network filter can catch, but it is BT’s own figure, not an independent study, and the rule covers one route only. Calls from inside the country fall outside it, and so did calls showing a UK mobile number, which Ofcom said in January 2025 it was still working on.

How much of this advice has been tested?

None of it in trials. The hang-up-and-call-back routine is backed by consistent guidance from regulators and police agencies in the US, Canada, the UK and the EU, and we did not find any study measuring whether it cuts losses.

Success is also invisible: a scam call that ends because someone rang their bank leaves no record, so the routine’s effect may never show up in official figures. Set that against its cost, which is a few minutes on hold.

The bottom line

Caller ID shows what arrives with the call, and a scammer can choose it, so a familiar name or number proves nothing. Judge an unexpected call by what it asks for: money, a PIN, a password or details are reasons to hang up. Then call back on a number you looked up yourself, from another phone if the call came to your landline.