Are You iSpoof-Proof? Number Spoofing Scams & How to Stop Them

Number spoofing scams, also known as caller ID spoofing, are a growing form of telephony fraud where criminals deliberately falsify the phone number displayed on a recipient’s device to impersonate trusted organisations such as banks, government bodies, or businesses. These attacks are often used in phishing-style calls to trick individuals into revealing sensitive information or transferring money by exploiting trust in familiar caller IDs.

Common techniques include neighbour spoofing, robocalls, and SMS spoofing — all relying on disguising the true origin of communications. Modern spoofing is enabled by VoIP and easy-to-access digital tools, and the scale of the issue is significant, with large fraud networks operating globally.

Prevention strategies include not sharing personal data with unsolicited callers, independently verifying organisations via official numbers, reporting suspicious activity, and using real-time mobile intelligence and verification solutions to detect and block fraudulent calls before they reach users.

Are you iSpoof-proof? Number spoofing scams and how to stop them

A cybercriminal who devised a multi-million pound fraud operation in the UK and worldwide has been sentenced to more than 13 years for running the website iSpoof — a platform which provided number spoofing services for users globally.

An additional 169 cybercriminals were also arrested as part of the investigation.

At its peak, 20 potential fraud victims were called every minute using the website software, which could only be downloaded via the dark web. Payments could also only be made using Bitcoin in an attempt to ensure anonymity for the estimated 59,000 users.

The UK was a major target for cybercriminals, with around 35% of calls targeted towards British phone numbers — second only to the USA (40%).

What is number spoofing?

Number spoofing is a technique used by scammers to change the phone number that appears on a caller ID display. It involves changing the caller ID information to make it appear as if the call is coming from a different number, often one that is familiar to the person being called. The aim is to gain the trust of the person and trick them into providing sensitive information or transferring money.

Although this tactic is commonly called number spoofing, it is also often referred to as caller ID spoofing or voice phishing.

Unlike email scams or other types of online fraud, number spoofing attacks usually rely on the scammer contacting your customers directly, so they can build trust and ascertain personal information.

Understanding number spoofing

Spoofing scams are technologically facilitated through VoIP (Voice over Internet Protocol) services that allow fraudsters to mask their real phone numbers by displaying a different number on the recipient’s caller ID. This is often executed via software or a specialised service that obfuscates the origin of the call.

Common types of spoofing

• Neighbour spoofing: scammers mimic local numbers, often duplicating the first six digits of your own number to increase the likelihood that you answer the call.
• Robocall spoofing: automated calls programmed to deliver pre-recorded messages with the caller ID disguised as local businesses or trusted organisations.
• Text message spoofing: similar tactics applied through SMS, where text messages are sent from a number that appears to belong to a legitimate source, often prompting urgent action from the unsuspecting recipient.

Recognising number spoofing scams

Key indicators include incongruence in the information provided during the call with what you know, requests for immediate financial transactions or personal information, and pre-recorded voices or oddly timed delays indicating a robocall setup. A robotic, emotionless voice or a caller who fails to interact naturally can be a significant red flag.

The dangers of spoofing scams

Victims of spoofing scams can face extensive financial loss, identity theft, and a breach of personal security, which may take years to fully rectify. Instances include unauthorised purchases, funds transferred under false pretences, and personal data being exploited to open new accounts or gain further illegal access to financial services.

How do number spoofing scams work?

Number spoofing scams typically involve the scammer pretending to be someone they are not, such as a representative of a government agency or a financial institution. They may tell the person being called that they owe money or that there has been suspicious activity on their account. Alternatively, they may offer a prize or ask for personal information such as credit card details. Other common tricks include charity scams, employment scams and medical scams.

Once the scammer has gained the trust of the person being called, they will try to obtain sensitive information or money. They may ask the person to provide this information over the phone or to transfer money to a specified account. In some cases, they may even ask the person to buy gift cards and provide the card details over the phone.

Common number spoofing scams

How fraudsters position themselves tends to vary — and the more insights they have into a customer’s personal details, the better they can make their calls and fake numbers seem credible.

Insurance scams

Insurance scams use number spoofing in several ways to trick victims into giving away personal information or making payments for fake insurance policies or claims. One common tactic is for scammers to use spoofed phone numbers to impersonate insurance companies or agents, using a legitimate company’s number or one that appears to be from a known insurance provider. Once they have gained the victim’s trust, they may request personal information such as credit card details or other payment information.

Insurance scammers also use number spoofing to target individuals who have recently filed a legitimate claim, offering to help them with it before requesting payment for their services or trying to obtain additional personal information.

IRS scam calls

IRS scam calls are a type of phone scam where fraudsters pretend to be representatives from the Internal Revenue Service (IRS) and try to trick people into revealing personal information or paying fake tax bills. Cyber criminals use phone number spoofing to make it seem like they are calling from a genuine IRS number. These calls can have a high success rate as they are designed to create panic — causing the targeted victim to act out of fear.

The IRS does not initiate contact with taxpayers by phone or email, and will never threaten to bring in local police or other law enforcement agencies to arrest someone for non-payment of taxes.

Bank scams

Telephone and online banking are a common target for number spoofing scams. Fraudsters call banking customers using fake numbers to try to find out personal information — account details and personal identification details — allowing them to commit fraud using these details. This type of scam is particularly prevalent in the banking industry as fraudsters know that people are often more likely to trust a call from their bank, and they are also able to target large amounts of potential funds.

Using VoIP, fraudsters can manipulate the caller ID system to display a fake phone number — making it appear as if the call is coming from the victim’s bank or another legitimate financial institution. Another method is “neighbour spoofing”, where the fake number displayed is similar or identical to the victim’s own area code and exchange, making it more likely they will answer.

Phone number spoofing — the red flags to look out for

Although phone number spoofing scams are becoming increasingly prevalent and sophisticated, there are several key red flags to watch for:

• Suspicious calls from unknown numbers: if you are receiving an increasing number of calls from unknown, withheld, or private numbers, it’s possible your number is being targeted by scammers.
• Automated calls with recorded messages: a strong indicator of targeting. Important information from your bank or other institutions is never communicated by recorded message and you will always be asked to confirm your identity before any discussion with your actual bank.
• Urgent demands for personal information: if you are repeatedly being asked for personal information, sometimes across multiple channels such as phone and email, this can be an indication of fraudulent activity.
• Threats of legal action or arrest: scammers are known for making threats against the customers they target, even advising that law enforcement will become involved through failure to make payment.
• Demands for payment via gift cards or wire transfers: trusted companies and organisations will only ever ask customers to make payment through relevant, official channels — never gift cards or wire transfers to individual users.

How do scammers spoof numbers?

Phone number spoofing is a deceptive technique used by fraudsters to manipulate caller ID information, making it appear as though a call or message is coming from a trusted source. Scammers exploit this method to impersonate banks, government agencies, and well-known businesses.

Techniques used to spoof phone numbers

• VoIP (Voice over Internet Protocol) spoofing: fraudsters use VoIP technology to modify caller ID information before making a call. Many VoIP services allow users to configure their outbound caller ID manually, making it easy for scammers to disguise their true identity.
• SIP (Session Initiation Protocol) trunking exploits: SIP trunking, which enables voice calls over the internet, can be manipulated to insert fraudulent caller ID information into outgoing calls. Scammers exploit weaknesses in telecom protocols to make their calls appear to originate from legitimate businesses or local numbers.
• Caller ID spoofing software and apps: numerous spoofing applications and online services enable scammers to change their displayed phone numbers at will. These tools are readily available and often marketed as harmless, but they are frequently misused for fraudulent activities.
• SIM farms and GSM gateways: some fraudsters use SIM farms — collections of multiple SIM cards connected to automated dialers — to make thousands of calls while displaying different numbers. This method helps evade spam detection and makes it harder to track the origin of scam calls.
• Compromised PBX systems: hackers infiltrate business phone systems (Private Branch Exchange — PBX) to reroute calls and inject spoofed numbers. This allows scammers to use legitimate business infrastructure to place fraudulent calls without raising suspicion.

Legal background and protections

In many jurisdictions, the law explicitly prohibits the use of misleading or inaccurate caller IDs for harmful or deceptive purposes. For instance, in the United States, the Truth in Caller ID Act of 2009 outlaws such practices.

Despite existing laws, enforcement can be challenging, especially when calls originate from international locations or are routed through multiple networks, complicating traceability and jurisdictional authority.

What are the impacts of number spoofing scams on businesses?

When a business’s customers are targeted by online scammers, this can escalate quickly if cyber criminals are left to operate with impunity. The consequences can be both short-term in the form of fines for improper fraud prevention, and longer-term damage to the business that can be costly and time-consuming to resolve.

• Damage to corporate reputation: even if a business is not directly at fault, customers being targeted by number spoofing scams can damage future business reputation. If customers no longer trust an organisation, they can be quick to leave in favour of a different provider — particularly true for financial providers or companies tasked with safely storing large amounts of sensitive customer information.
• Financial losses: phone number spoofing scams can have a significant negative impact through financial losses, from the loss of business a dent in reputation can bring through to large fines issued to companies in regulated industries that don’t keep data safe and secure.
• Customer identity theft: once a customer’s information has been compromised it can be extremely difficult to make it private again. Customers will have to spend time and effort changing their details where possible — a headache for customers and businesses alike.
• Emotional distress and lack of customer trust: falling victim to a phone number spoofing attack can cause significant emotional distress and lasting mistrust. Given the efforts businesses take around customer onboarding, this mistrust can quickly undo those efforts.

How to prevent number spoofing scams

There are several sets of authoritative data which companies can use to cross-reference the phone numbers engaging with their business. This data is provided by organisations such as Mobile Network Operators (MNOs) and government bodies, depending on the country where the phone number is registered. It can be accessed globally and in real time, meaning you are only ever milliseconds away from the latest validation data.

This allows your business to:

• Eliminate surcharges from origin-based rating fraud
• Prevent domestic and international call-back fraud costs
• Seamlessly access real-time data when needed
• Eliminate up-front investment in hardware and software

Our TeleShield product can be integrated into existing business processes to provide enhanced information on whether a number has been assigned by a service provider to a customer or has recently been ported. This information can be used to shield a company from a wide range of telephony fraud.

The future of mobile number data in fraud prevention

As number spoofing techniques become more sophisticated, the role of mobile number data in preventing these scams will likely expand. Future advancements may include more intricate data analysis techniques that can predict and prevent spoofing activities before they reach the consumer. Additionally, as global data privacy and security laws evolve, so will the strategies to utilise mobile number data.

Proactive steps to protect personal information

Keeping personal and financial information secure is critical. Avoid sharing sensitive details over the phone unless you are certain of the caller’s identity and have initiated the call yourself. Regularly update passwords and account information, enable two-factor authentication on vulnerable accounts, and be vigilant about monitoring transaction histories for any unauthorised activity.

How to handle and report spoofing incidents

If you suspect a spoofing scam:

• Do not provide any personal information.
• Hang up and call the official number of the organisation the caller claimed to represent.
• Report the call to the relevant authorities — the FTC for US residents, the Canadian Anti-Fraud Centre (CAFC) in Canada, or Action Fraud in the United Kingdom.

Conclusion

Phone number spoofing, telephony fraud and other online scams are a serious risk to businesses and their customers. As tactics become increasingly complex it’s important that organisations take measures to reduce this risk and remain compliant with the fraud prevention measures required in their industries.

Call spoofing scams rely on social engineering tactics which are manipulative and can cause real damage to a brand’s integrity when customers become victims of online fraud such as phishing text messages, fake debt collectors, insurance scams, romance scams and other types of fraudulent calls.

There are now several additional security measures your business can implement to offer greater protection through additional transparency and insight around phone number data. For helpful advice on flash calls, you can read our related article.