Caller ID Spoofing Explained: How Scammers Fake Any Phone Number
Critical Warning: Never trust the number on your screen. If your phone says "Barclays" or "Met Police" are calling, it does NOT mean it is true. Scammers can display any name or number they choose.
For decades, we were taught to trust Caller ID. If the local area code popped up, it was a local call. If the bank's number popped up, it was the bank. Sadly, those days are over.
Spoofing is the act of disguising a phone number to mimic a trusted source. It is the telephone equivalent of a forged letterhead. Today, a scammer sitting in an overseas call center can make your phone ring with a number that looks like it is coming from your local town hall, your GP surgery, or even your own house.
How Does It Work?
It relies on Voice over IP (VoIP) technology—making calls over the internet. When you set up a VoIP system, you can often manually input the "Outgoing Caller ID" digits.
Why Scammers Do It:
- Local Trust: You are more likely to answer a call from your own area code (e.g., 0161 for Manchester) than an "Unknown" or international number.
- Authority: By spoofing the official number of HMRC or a bank (which you might have saved in your contacts), they bypass your suspicion immediately.
- Evasion: By constantly changing their number, they avoid being blocked.
The "Neighbor" Spoof
Have you ever received a call from a number that looks almost identical to yours?
Example: Your number is 07700 912 345. The scammer calls you from 07700 912 346.
This is deliberate. They know that when you see a number that starts with the same 6-7 digits as yours, your brain subconsciously recognizes it as "familiar" or "local," making you more likely to pick up.
What is "Number Cloning"?
Sometimes, scammers will pick a random real number to spoof—and it might be yours.
If you suddenly start receiving angry texts or calls from strangers asking "Why did you call me?", your number has likely been spoofed. The scammer is using your ID to call thousands of people.
What to do: Sadly, there is little you can do but wait. Scammers usually cycle through numbers quickly. It typically stops within 24-48 hours. If it persists, you may need to change your number.
How to Spot a Spoofed Call
- 1. Call Quality: VoIP calls from overseas often have a slight delay or "crackly" quality, even if the number looks local.
- 2. The "Hang Up and Call Back" Test: If the caller claims to be from your bank or the police, tell them: "I am going to hang up and call you back on the official number."
Important: Wait 5 minutes before calling back, or use a different phone line. Scammers can sometimes keep the line open (landlines only), so you think you are dialing a new number but are still speaking to them.
Common Spoofing Methods Explained
Scammers use different spoofing techniques depending on their goal. Understanding each method helps you recognise the specific threat:
| Spoofing Method | How It Works | Commonly Used For | Detectable? | Defence |
|---|---|---|---|---|
| VoIP Header Spoofing | Modifying SIP packets before they reach the phone network | Bank fraud, police impersonation | No (on caller ID display) | Hang up and call back test |
| Neighbour Spoofing | Caller ID matches the first 6-7 digits of your own number | Generic scams, robocalls | Yes (number looks familiar but is not in contacts) | Do not answer. Let it go to voicemail. |
| SIM Swap Spoofing | Criminal convinces your provider to port your number to a new SIM | Account takeover, 2FA interception | Yes (phone suddenly loses service) | Call provider immediately if phone loses signal unexpectedly |
| SMS Spoofing | Fake text appears in the same thread as genuine bank messages | Phishing links, fake fraud alerts | Sometimes (look for poor grammar, links) | Never click links in texts. Call official number. |
| CLI Overstamping | Genuine caller ID is overlaid with a fake display name | "HMRC","Police","NHS" appearing on screen | No (on basic caller ID) | Remember: genuine orgs don't cold-call for personal details |
Spoofing Risk by Caller Type
Not every unfamiliar number is spoofed. The chart below helps you assess how likely a call is to be spoofed based on who the caller claims to be:
Estimated likelihood that a call from this claimed source is spoofed, based on Action Fraud and Ofcom reporting data.
What to Do If Your Number Is Being Used for Spoofing
If angry strangers are calling you asking why you called them, your number has been spoofed. Take these steps immediately:
- Do not change your number immediately — scammers cycle through numbers quickly. Most spoofing incidents resolve within 24-48 hours.
- Record a new voicemail greeting explaining: "If you received a call from this number, it was likely spoofed by a scammer. I did not call you."
- Report it to your mobile provider — they can log the incident and may provide additional support.
- Report it to Action Fraud at actionfraud.police.uk or call 0300 123 2040.
- Check your accounts — ensure your phone account and linked services have not been compromised.
- If it persists beyond 48 hours, contact your provider about changing your number.