Who’s Really on the Line? Exploring Caller ID Spoofing and Its Detectability

Spoofing Legality

The FCC's Truth in Caller ID Act rules any spoofing done with the intent to defraud is illegal. Anyone guilty of spoofing in this way can face a $10,000 fine for each violation. That's federal, however, and states might have their own laws on spoofing. For example, Arkansas prohibits all spoofed calls except by law enforcement or public safety. So if you're thinking about spoofing your phone number, you want to consider your intentions as well as your state's laws. According to the FCC, there are legal uses for spoofing, like when a doctor calls a patient from her personal mobile phone and displays the office number rather than the personal phone number or a business displays its toll-free call-back number. Spoofing is not just an issue for phone numbers; email addresses can also be spoofed for scam purposes.

Caller ID Spoofing Scam Examples

Here are some popular spoofing scams: Not every scam is listed here, but they are the most common caller ID spoofing scams. Calls from your bank asking for personal information, like your account numbers, account PINS, etc. Calls listed from 911 or other public service offices near you (like your local police department) that ask for personal information (like your SSN). Numbers similar to yours (neighbor spoofing) asking for personal information. Phone numbers you might recognize, but strangers use social engineering to use facts about you to learn more personal information. Scammers can use your phone number to spoof calls and get your number blocked; in that case, you can let callers know that your number has been spoofed as well as notify anti-scam parties and your carrier.

Recognize Spoofing

Here are some signs that a number is not what it seems: Look for unusual numbers, like unfamiliar area codes or numbers that seem off. Most carriers identify numbers that have been used in previous scams or numbers that are frequently reported as "Scam Likely". Be wary of calls from known contacts that seem strange or ask for personal information. These might start with a general greeting (Sir or Madam) instead of your real name. If someone calls you from an agency or company asking for personal information, hang up and call the number on the website to make sure you're talking to the right number.

What to Do If You Answer a Spoofed Call

Keep yourself safe by doing the following: Hang up immediately if you suspect the call is spoofed. Don’t provide personal information including Social Security numbers, mother's maiden names, passwords, or other identifying information. Do not use "Yes" as that could be recorded and used fraudulently. Do not press any additional buttons, even if the caller says that pressing it will remove you from the calling list as this is another way to identify targets. Report the call to your phone provider or a consumer protection agency. Block the number to avoid future calls.

Reasons for Spoofing

Protecting your privacy can be a good reason for spoofing. Like in the example the FCC provided, a doctor calling a patient and displaying the business number instead of their cell phone number is akin to protecting their privacy; the doctor may not want the patient to have their cell phone number. Many spoofing services cost money, but some, like SpoofCard, offer a free trial so you can see how the service works before committing.

Using Spoofing Services

Open the spoofing app and tap Get free credits or Sign up. Since Spoofcard offers a free trial and is the easiest to use, we will use that app. When you first open the app, you'll need to enter your real phone number and sign-in information, then create a PIN, and agree to the terms.

Enter the number you want to show as the caller ID in the "Number to Display" field. If you don't know a number to spoof as, tap the dice icon for a random number.

Enter the number you want to call and tap Call. The person that you're calling will see the number you entered as the "Display Number" instead of your actual number. This is a fantastic solution if you're out of the office but need to contact a patient/client without giving them access to your mobile number; spoofing your number as the office number makes it look like you're calling from the office instead of your cell phone. SpoofCard offers additional features, like going straight to voicemail with your spoofed number. This is a great option if you don't want to chat with the person you're calling, but simply need to pass on information. It also costs one credit instead of charging a credit per minute.