Caller ID Spoofing: Why the Number on Your Screen Can Lie

Caller ID shows whatever information the caller’s system sends, and scammers can fake it. The FTC says scammers can make any name or number show up on your caller ID. That’s called spoofing. A call that shows your bank, a government agency or a local number is not proof of who is calling. To check, hang up and call back on a number you look up yourself.

What spoofing is

The FCC defines spoofing as a caller deliberately falsifying the information sent to your caller ID display to disguise their identity. Two versions are common:

• Neighbor spoofing. The call appears to come from a local number, so you are more likely to answer.
• Trusted-name spoofing. The call shows the number of a company or government agency you already know and trust.

If you answer, the FCC says, scammers use scripts to try to steal money or personal information. Social Security warns that scammers spoof official government phone numbers and even the numbers of local police departments.

Is it legal?

Under the Truth in Caller ID Act, FCC rules prohibit sending misleading or inaccurate caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value. Illegal spoofing can bring penalties of up to $10,000 for each violation.

Not all spoofing is illegal. The FCC gives examples: a doctor calling a patient from a personal mobile phone and showing the office number, or a business showing its toll-free callback number. Hiding your number so it appears as “unknown” is also legal, and is not spoofing.

Why it matters for older parents

Spoofing is what makes many impostor scams work. A parent sees the bank’s name or a police department number and lowers their guard. Then the caller says there is an emergency, money is at risk or an arrest is coming.

You may not be able to tell right away that a call is spoofed. The FCC says to be very careful about any request for personal information.

What to do when a call looks official

The FCC and FTC suggest these steps:

• Don’t trust the screen. Treat the name and number on caller ID as unverified.
• Don’t answer unknown numbers. If you do answer one, you can hang up right away.
• Don’t press buttons to “stop getting calls.” The FCC says scammers use this to find targets.
• Don’t answer yes-or-no questions from a caller you don’t know.
• Hang up and call back using the number on your account statement or on the company’s or agency’s official website.
• Expect mail first. The FCC says a real organization usually sends a written statement before calling, especially about a payment.
• Never give out account numbers, Social Security numbers, passwords or similar details on an unexpected call.

Two more protections

• Set a voicemail password. The FCC warns that some voicemail services allow access when you call from your own number, and a hacker could spoof your number to get in.
• Ask about call blocking. The FCC allows phone companies to block robocalls by default based on reasonable analytics. If a call is labeled “spam” or “potential scam,” the number may have been spoofed.

How to report a spoofed call

• File a complaint with the FCC at consumercomplaints.fcc.gov.
• Report the scam to the FTC at ReportFraud.ftc.gov. The FTC asks you to include the number that got the call, the number on your caller ID and any number you were told to call back.
• If money was lost, report it at ic3.gov and call the bank on the number on the back of the card.

Because caller ID can lie, the number alone can’t tell a parent who is calling. FamilyDefender checks unknown calls while they happen and can warn the parent and alert family when a call looks risky.