What the number on the screen really is
When a phone rings, the number shown is not a verified fact. It is information supplied by the network that is carrying the call, and in many systems the caller or the equipment they use can set which number gets presented. Caller ID spoofing is simply the practice of presenting a number other than the one the call truly came from.
This is not always wrong in itself. Businesses commonly present a main switchboard number even when calls are made from many lines, and some services show a different number for privacy. Scammers use the same flexibility to show a bank’s number, a government number, a local number or even your own number.
Why spoofing is possible
Telephone networks grew up as systems of trusted operators passing calls between each other. For a long time there was little need to check whether a presented number was genuine. Internet-based calling made it cheap and simple to generate calls from anywhere in the world and to choose the number displayed.
Many countries have introduced measures that let carriers authenticate calls and flag or block those with a clearly false origin. Such systems help, but coverage is uneven: calls that cross networks and borders may not carry the checks along, and some calls are labelled “verified” while others are not labelled at all. A missing warning therefore does not mean a call is safe, and a verified label does not prove the caller is honest, since a real number can still be used by a criminal.
Why a familiar number proves nothing
Because the display can be changed, a number you recognise is not evidence. Several tricks build on that:
- Impersonating your bank or a public body. The screen shows the number printed on your card or an official website, and the caller claims to be a fraud team.
- Neighbour spoofing. The call appears to come from a number with the same first digits as yours, on the assumption that you will be more likely to answer.
- Calls that appear to come from you. Seeing your own number can be unsettling and is meant to be.
- Contacts and relatives. If someone has gained access to a contact list, or simply guessed, the caller can appear to be a person you know.
Related tricks include “one-ring” calls that hang up immediately to prompt a call back to a costly number, and messages that appear in an existing thread of genuine texts, as covered under smishing attacks.
Common call scripts
The names vary but the structure follows the usual hook, story and pressure, as laid out in online scams in general.
- The bank fraud team. The caller says suspicious activity was detected and asks you to move money to a “safe account”, read out a code or install an app. A genuine bank does not ask you to move your money to protect it.
- The official body. A caller claims to be from a tax office, police or immigration service and says you owe money or face arrest, with payment demanded by gift card or transfer.
- The tech support call. Someone claims your computer is sending error messages, as discussed in tech support scams.
- The delivery or utility call. An automated voice says a delivery or service has a problem, and asks you to press a key.
- The family emergency. A voice says a relative is in trouble. Voice cloning can make this more convincing.
- The prize or survey call. A recording promises a reward in exchange for personal details.
Robocalls are often just filters: if you press a key or speak, the system learns the number is active and a live person may follow.
Warning signs during a call
- You are told to act immediately or stay on the line.
- You are told not to hang up, not to tell anyone or not to call the organisation back.
- The caller asks for a PIN, full password, one-time code or remote access to your device.
- Payment is requested by gift cards, cryptocurrency or transfer to a new account.
- The caller asks you to read out a code that has just been sent to your phone. That code is typically a login or payment approval for your account, which is why two-factor authentication codes should never be shared.
What to do
- Do not rely on the displayed number, and do not give personal or financial details to an inbound caller.
- End the call. It is not rude to hang up on an unexpected request.
- Call back on a number you find yourself, such as the one on your card, a statement or the organisation’s official website. If possible, use a different phone, or wait a few minutes and listen for a dial tone first, since in some cases the line may stay connected after the caller hangs up.
- Ask a person you trust, particularly if you feel rushed.
- Use your phone’s built-in tools. Many phones can silence unknown callers or filter suspected spam, and carriers may offer blocking services. These reduce nuisance calls but are not complete protection.
- Do not pick up and press keys on a recorded message that you did not expect.
If you have already acted
If you gave out card details or moved money, contact your bank straight away using a number you trust. If you shared passwords or codes, change them and review your accounts. If you installed software on request, disconnect from the internet and seek help. The steps in scam recovery steps cover reporting and next moves. Telling relatives is worthwhile too, since people who have been called once are often called again.