Your phone rings. The number on screen has your area code, the same first three digits as your own number, and no name attached. Probably a neighbour, or the garage you called last week. You answer, and it's a call centre on the other side of the world reading from a script.
The number was real. It just wasn't theirs. That's caller ID spoofing, and the same trick is being used, right now, by the dental clinic down the road so that when the receptionist calls you back from her mobile, you see the clinic's number instead of her personal one.
Same technique. Completely different intent. Sorting out which is which is what this post is about.
What caller ID spoofing actually is
Caller ID spoofing means showing a phone number that isn't the one the call is really coming from.
That's it. There's no hacking or clever exploit and nothing broken into. The number your phone displays is simply a piece of information the calling system provides, and it can be set to almost anything.
Why it's so easy
Caller ID was never built to be checked. When the feature was designed in the 1980s, the only people who could place calls into the phone network were phone companies, and they were assumed to be telling the truth. So the system was built to display the number it was given, not to verify it.
That assumption held right up until anyone with an internet connection could make phone calls. The number is just one field in the message that sets up the call, and changing it is a setting in ordinary phone software, the same setting every business phone system has.
So there's no flaw to patch. There's a forty-year-old design meeting a world it wasn't designed for.
Spoofing only changes what the person you're calling sees. Your phone company still knows where the call came from, and so do investigators and law enforcement.
The legitimate half
Most number-swapping happening today is legitimate, and Spoofey allows all of these:
- A call centre where fifty staff all show the company's main number instead of fifty different desk lines.
- A clinic showing its reception number, so if you miss the call and ring back, someone actually answers.
- A plumber or electrician showing their business number rather than their personal mobile.
- A friend of yours changing his phone number to a different one for a prank call to you.
- Hiding your phone number for security purposes, like at a DV Shelter.
- A doctor calling a patient after hours from their own phone, displaying the practice number.
Where the line is
In the US, the rule is the Truth in Caller ID Act. Showing a misleading number is illegal when it's done with intent to defraud, cause harm, or wrongfully obtain something of value, with penalties reaching $10,000 per violation. Enforcement cases against big scam-calling operations have run into the hundreds of millions.
The important word there is intent. Displaying a different number isn't the offence. Displaying it to make someone think you're their bank is.
Other countries draw the line in their own places, and some are stricter about showing numbers you have no right to use: Canada, the UK, and the EU all have their own rules. Don't assume the US version applies where you are.
How it gets abused
Pretending to be someone official. The call shows a real bank fraud line, a tax office, or a utility. The number is genuine, which is what makes it convincing. Then comes the request: read me the code you just received, move your money to a "safe account," install this app so I can help you.
Spoofey bans this, all bank/hospital/government lines cannot be spoofed on our platform.
Local-looking numbers. The call shows your area code and your prefix so it feels familiar. It's a numbers game to get more people to pick up. Don't call them back, a returned call just confirms your number is active.
Your number on someone else's calls. Occasionally it works in reverse and strangers start ringing you, angry about calls you never made. There's no switch to turn it off, but it usually stops within days or weeks when the operation moves on to other numbers.
The defence is the same for all three: treat the number on your screen as information, not proof. If a call asks for money, a code, or access to anything, hang up. Then ring the organisation back on a number you found yourself, on your card, a statement, or their website. Never a number the caller gave you.
Doesn't the "verified" checkmark stop this?
Partly. STIR/SHAKEN is a system where the caller's phone company digitally signs the number, and the receiving company checks that signature before your phone rings. It's made mass impersonation harder and it makes calls easier to trace afterwards.
But it only confirms one thing: that the caller is allowed to use that number. It doesn't know anything about what they're going to say. Someone running a scam from a number they legitimately own passes the check with full marks.
A verified badge means the number is real. It doesn't mean the caller is.
What Spoofey allows
Spoofey lets you choose the number shown on your outgoing calls, inside clear limits.
Allowed: any number you have a genuine reason to use: a second line of your own, your business's main number, a call-back number your customer would recognise.
Blocked: banks, credit unions and payment companies; government agencies and tax authorities; emergency services; and anything aimed at fraud, harassment, or getting money, passwords, or account access out of someone. Attempts are refused and the accounts behind them are closed.
Treat that list as a floor, not a permission slip. The legal test is still intent, and it applies to everything the platform does allow. And if what you actually want is privacy, asking about a Marketplace listing without handing a stranger your personal number, there are three straightforward ways to do that, none of which involve pretending to be someone else.
!faq !faq-q What is caller ID spoofing in simple terms? !faq-a Showing a phone number that isn't the line the call is really coming from. It's a setting in phone software rather than a hack, because caller ID was built to display whatever number it's given without checking it.
!faq-q Is caller ID spoofing illegal? !faq-a In the US it depends on why you're doing it. Showing a number you legitimately use is lawful and completely routine in business. Showing a misleading number in order to defraud someone, cause harm, or get something of value is illegal under the Truth in Caller ID Act, with penalties up to $10,000 per violation. Other countries have their own rules, some stricter.
!faq-q Why would an ordinary business do this? !faq-a So that callbacks reach the right place. A clinic showing reception, a call centre showing the main line, a tradesperson showing their business number instead of a personal mobile, in each case the number displayed is one they own and answer.
!faq-q Someone is using my number to make scam calls. What can I do? !faq-a Unfortunately you can't block it at the source, because the calls never pass through your line. Report the number to us so we can blacklist it from being used as caller ID on Spoofey specifically, report it to your phone company and to the FCC, and consider recording a short voicemail greeting explaining your number is being spoofed. These campaigns usually move on within days or weeks. Don't answer or return calls from the numbers involved — see our fuller answer on this for more detail.
!faq-q Can I tell whether a call is spoofed before I answer? !faq-a Not reliably. A verified badge only means the number was checked, not that the caller is honest, and plenty of ordinary calls arrive without one for boring technical reasons. Treat any unexpected call asking for money or codes as suspect, whatever it displays.
!faq-q Does *67 count as spoofing? !faq-a No. *67 hides your number rather than replacing it with a different one, so the other person sees "No Caller ID" instead of something misleading. It's a standard feature your phone company provides and it's perfectly legal. !faq-end
The truth is that the technique is neutral. The clinic making callbacks convenient and the scammer impersonating a bank are doing exactly the same thing to the phone network. The only difference is what they're trying to achieve, which is precisely why the law targets intent rather than the tool.
