What spoofing is
Spoofing is when a caller deliberately falsifies the information sent to your caller ID display to disguise who they are. Scammers pick numbers you are likely to answer: a local number, or the number of a company or government agency you already know and trust. The FTC warns that scammers spoof Amazon's number, for example, and tells you to trust neither the number on your caller ID nor what the caller says.
If a call is labeled “spam” or “potential scam”, or blocked, the number shown may itself have been spoofed.
Neighbor spoofing
Robocallers often display a number that looks like your own, usually with the same first six digits, so the call seems to come from someone nearby. The largest robocall operation the FCC has investigated, which pushed auto warranty offers, used this tactic.
The caller ID copies the first six digits of your own number, so the call looks local.
Example numbers from the range reserved for fiction (555-0100 to 555-0199).
When it is illegal
Under the Truth in Caller ID Act, FCC rules ban transmitting misleading or inaccurate caller ID with the intent to defraud, cause harm or wrongly obtain anything of value. The rule covers texts as well as calls, and callers outside the US when the person called is in the US. The penalty is up to $10,000 per violation, or three times that for each day of a continuing violation, capped at $1,000,000 for a single act.
Spoofing is not always illegal. The FCC's examples: a doctor calling from a personal mobile phone who displays the office number, or a business that displays its toll-free call-back number. Hiding your number, so that the call shows as “unknown”, is also legal and is not spoofing (see No Caller ID calls).
What carriers do about it
STIR/SHAKEN is a set of technical standards that lets phone networks authenticate and verify caller ID for calls carried over Internet Protocol (IP) networks. In 2020 the FCC required voice service providers to put it in place in the IP parts of their networks by June 30, 2021. Because it only works on IP networks, providers still using older technology must upgrade or work on a solution that works without IP.
- 1Caller’s providerAuthenticates the caller ID it sends with the call.
- 2IP networksThe authentication travels with the call. It is lost on older, non-IP links.
- 3Your providerVerifies the caller ID before the call reaches you.
- 4Your screenSome providers mark verified calls. No mark does not mean a scam.
Some providers show the result. On Verizon home phones, a “[V]” means the caller's provider confirmed the number is authentic and not spoofed; Verizon adds that a call without the mark is not necessarily a scam, because it can only verify calls from networks with the same capabilities.
If someone is spoofing your number
If strangers call to say your number showed up on their caller ID, your number has probably been spoofed. The FCC suggests:
- Do not answer calls from unknown numbers; if you do, explain that your number is being spoofed and you did not make any calls.
- Put a message on your voicemail telling callers your number is being spoofed.
- Set a voicemail password: a spoofed home number can otherwise be used to get into your voicemail.
- Report it to the FCC: choose “unwanted calls/texts” as the issue, then “my own number is being spoofed”.
The good news, per the FCC: scammers usually switch numbers often, and within hours they are likely to stop using yours.
What it means for a number lookup
The FTC notes that the faked name and number often belong to a real person who has no idea someone is misusing them. So a number with reports on this site is a number that people saw on their screen, not proof that its owner made the calls. If the reports are about your number, write to contact@beforeyoucallback.com and we will remove the complaint details from its page.
One thing a lookup can flag: a number whose area code or exchange is not assigned at all cannot make calls, so a call showing it had a faked caller ID.