Caller ID Spoofing

Caller ID spoofing is the deliberate falsification of the number or name displayed on a recipient's phone, so an incoming call appears to come from a trusted source — the company's IT help desk, a bank's fraud department, a government agency, or a colleague's mobile. It is a form of spoofing that attacks the one authentication signal most people apply to a phone call: the screen says who is calling.

How it works

Caller ID was never designed as a security control. The displayed number is asserted by the originating carrier or system, and VoIP services and open-source PBX software let a caller set it to almost any value — a capability with legitimate uses (a company showing its main switchboard number for all outbound calls) that transfers directly to attackers. Spoofing services and apps make it point-and-click, and no access to the impersonated line is needed: spoofing a number is not the same as hijacking it.

In practice, caller ID spoofing is the delivery mechanism for vishing: the fraud-department call that reads out a real-looking number, the fake IT support call ahead of an MFA reset, the "executive" ringing finance about an urgent transfer — increasingly combined with voice cloning to fake the voice as well as the number. The same trick strengthens smishing, where a forged sender ID can slot a malicious text into the genuine thread between a bank and its customer. Regulatory responses such as STIR/SHAKEN call authentication in the US have reduced illegal robocall spoofing but do not stop targeted attacks, especially across international routes.

How to defend against it

Treat the inbound channel as unauthenticated, because it is. The organizational rule worth writing down: identity is never established by caller ID, and any unexpected call requesting credentials, MFA codes, payments, or account changes is verified by hanging up and calling back on an independently known number — from the directory, not from the caller's mouth or the incoming display. Help desks and finance teams need hard verification procedures that do not bend to urgency, and employees need to rehearse the scenario, not just read about it: voice-channel lures belong in your simulation program alongside email. Our guide to vishing and smishing attacks covers the full playbook.