Spoof Calls: How to Detect a Fake Phone Number

Sixty-eight million Americans lost money to phone scams in 2022, with spoofed caller ID playing a central role in nearly every scheme ^[1]. The number on your screen said it was your bank, the IRS, or even your own area code. It was none of those things. Understanding how spoof calls work is the first step toward not picking up the wrong one.

What Is a Spoof Call?

A spoof call is any phone call where the caller deliberately falsifies the information sent to your caller ID. Instead of displaying the real originating number, your phone shows a number the caller chose: your bank's customer service line, a local business, or a number one digit off from your own.

This is not the same as a blocked or "No Caller ID" call. Spoofing is more deceptive because it actively impersonates a trusted source. Your phone does not ring with a warning. It rings with what looks like a legitimate number.

How Caller ID Spoofing Works

The phone system was never designed for security. Caller ID data is sent alongside the call signal using a protocol called SS7 (Signaling System 7), developed in the 1970s. The receiving network trusts whatever caller ID information the originating network provides. There is no built-in verification.

Modern spoofing is even simpler. VoIP (Voice over Internet Protocol) services let anyone configure outbound caller ID through a web dashboard. Some services market this feature for legitimate uses. A doctor calling from a personal cell but displaying the clinic number, for example. But the same technology is trivially abused by scammers.

Here is what happens in a typical spoof call:

1. The scammer signs up for a VoIP or spoofing service (some cost less than $1 per call)
2. They enter the number they want displayed on your caller ID
3. The call routes through standard phone networks, which pass the fake number to your carrier
4. Your phone displays the spoofed number as if it were genuine

The core problem: Your phone has no way to independently verify that the number shown on caller ID actually belongs to the person calling. It displays whatever it is told.

Why Scammers Spoof Numbers

Spoofing serves one purpose: trust engineering. If a call appears to come from your bank, you are more likely to answer, more likely to follow instructions, and more likely to share personal information.

Common spoofing tactics include:

The FTC received nearly 3 million fraud reports in 2025, with phone calls remaining the top contact method for scammers ^[2]. Neighbor spoofing alone caused a spike in robocalls to an estimated 50.3 billion in the U.S. in 2022 ^[3].

How to Detect a Spoof Call

No single test catches every spoofed call, but stacking these checks dramatically reduces your risk.

1. Do Not Trust Caller ID Alone

This is the foundational rule. Caller ID is an informational convenience, not a security feature. Treat every unexpected call from a sensitive source (bank, government agency, hospital) as potentially spoofed until verified.

2. Hang Up and Call Back on a Known Number

If someone claims to be from your bank, hang up. Find the number on the back of your debit card or on the institution's official website. Call that number directly. Legitimate organizations will never penalize you for verifying their identity.

If it's real, it can wait for a callback. If they pressure you to stay on the line, that is a red flag, not a reason to comply.

3. Listen for Pressure Tactics

Spoofed calls almost always involve urgency. "Your account will be frozen in 30 minutes." "A warrant has been issued for your arrest." "You must verify your Social Security number now." Real institutions do not operate this way. The IRS, for example, initiates contact by mail, never by phone demanding immediate payment ^[4].

4. Check for Silence or a Delay After Answering

Many spoofed calls are routed through auto-dialers. If you answer and hear a brief silence or click before someone speaks, that's a hallmark of a robocall system connecting you to an available scam operator.

5. Use Your Carrier's Spam Detection Tools

All three major U.S. carriers now offer call verification and spam labeling:

These tools use the STIR/SHAKEN framework (explained below) and crowdsourced spam databases to flag suspicious calls. Enable them if you haven't already.

6. Search the Number

Copy the number that called you and search it online. Sites like the FTC's complaint database and community forums often list numbers associated with active scam campaigns. If dozens of people report the same number as fraudulent, you have your answer.

What Is STIR/SHAKEN and Does It Help?

STIR/SHAKEN stands for Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs. It is a set of protocols the FCC mandated for U.S. carriers beginning in June 2021 ^[5].

Here is what it does: When a call originates on a carrier's network, the carrier digitally signs the call with a certificate that attests the caller is authorized to use that number. The receiving carrier checks this signature and assigns a verification level:

• A (Full Attestation): The carrier verified both the caller's identity and their right to use the number
• B (Partial Attestation): The carrier verified the caller's identity but not the specific number
• C (Gateway Attestation): The carrier is just a pass-through and verified nothing

Calls with A-level attestation are more trustworthy. Calls with C-level attestation are more likely to be spoofed.

The limitation: STIR/SHAKEN only works when both the originating and receiving carriers support it. International calls, calls from small rural carriers, and VoIP-originated calls often bypass it entirely. It has reduced spoofing from large U.S. carriers, but it is not a complete solution.

When Spoofing Gets Combined with Deepfakes

Here is where things get more dangerous. Scammers increasingly pair spoofed caller ID with AI-generated voice to impersonate someone you know: a family member, a boss, or a business contact. The spoofed number makes you answer. The cloned voice makes you believe.

In 2023, the FTC warned about a surge in AI voice cloning scams, particularly "grandparent scams" where a deepfaked voice mimics a relative in distress ^[6]. The call comes from what appears to be your grandchild's phone number. The voice sounds exactly right. The emotional pressure is immediate.

This combination, spoofed number plus cloned voice, defeats casual skepticism. It's no longer enough to say "that sounds like them." You need a verification step that exists outside the call itself.

If you receive a call from someone you know asking for money or sensitive information, hang up and contact them through a different channel. Text them, call them on a number you already have saved, or reach out on a platform where you normally communicate.

If you suspect a voicemail or recorded call uses a cloned voice, you can check the audio. Run it through Witness at witness.vision/scan. Free, no account required. The tool analyzes audio for artifacts of AI generation that the human ear cannot reliably detect.

What to Do If You've Been Scammed by a Spoof Call

Acting quickly matters.

1. Contact your bank or financial institution immediately if you shared account details or authorized a payment
2. Report to the FTC at reportfraud.ftc.gov
3. Report to the FBI's IC3 at ic3.gov if you lost money
4. File a complaint with the FCC at fcc.gov/consumers/guides/spoofing-and-caller-id if the spoofing itself is the issue
5. Freeze your credit with all three bureaus (Equifax, Experian, TransUnion) if you shared your Social Security number
6. Document everything. Save call logs, voicemails, and any text messages related to the scam

The Short Version

Caller ID is a label, not a lock. Anyone can put any number on it for a few cents. Your defense is not better caller ID. It is a habit of independent verification. Never act on a call without confirming through a separate channel. And when voice cloning enters the picture, trust your verification process over your ears.

If something sounds off, or sounds too perfect, verify the media before you trust it. You can check suspicious audio or video at witness.vision/scan.