Find out how phone number spoofing works, why it’s so widespread, and how to protect yourself if someone misuses or impersonates your number.
It’s surely happened to you before. You look at your phone and see a missed call—from a number that looks completely normal; sometimes you even recognize the area code, other times it’s a number that looks suspiciously similar to a familiar one. You call back, and on the other end is someone who has no idea what you’re talking about—they’ve never called you. That’s when you realize you’ve just encountered phone number spoofing, and someone has “borrowed” someone else’s number to deceive the victim on the other end.
How does it work technically, why is it so easy, and what can you actually do about it?
What Is Caller ID Spoofing
Phone number spoofing (caller ID spoofing) is a technique in which an attacker manipulates the caller ID information so that the victim sees a different number on their display than the one from which the call is actually coming. It’s important to distinguish—this isn’t an attack on your phone, SIM card, or eavesdropping. No one has gained access to your device. Someone has simply exploited the telecommunications system by setting your number as the “sender.”
Why is this technically possible at all?
The telephone network—and this applies to landlines, mobile networks using SS7 signaling, and VoIP alike—was designed at a time when trust between operators was assumed, not fraud. The calling line identification (CLI) is sent as ordinary metadata accompanying the call, similar to the “From:” field in an email.
In practice, it most often works like this:
- VoIP / SIP trunking – a scammer rents a “SIP trunk” from one of dozens of VoIP service providers (often outside the EU, with minimal or no oversight).
- Setting the CLI field – in the configuration of this gateway, the scammer simply specifies which number should be displayed as the caller.
- The call travels through the operators’ network—in the vast majority of cases, individual operators simply forward the calls and their metadata to one another, without verifying whether the sender actually owns the listed number.
- The victim’s phone rings with a foreign—but “trustworthy”-looking—number on the display.
This is precisely why you sometimes see your own number displayed—the attacker has no real reason to choose “random” numbers; instead, they target either numbers that appear trustworthy to the victim (so-called “neighbor spoofing”) or your number directly.
Why It’s a Cheap and Widespread Business
The cost of initiating such a call is negligible—renting a SIP trunk and software for automated dialing costs just a few euros per month, and a single operator can generate thousands of calls this way every day. Slovak mobile operators have observed an increase in security threats targeting customers in recent years, and spoofing is more difficult to eliminate compared to other threats.
What operators are doing about it
Mobile operators are gradually implementing a system to verify the authenticity of calls between each other, which is intended to reduce the number of fraudulent calls. The principle is similar to the international STIR/SHAKEN standard, which digitally signs a call at the originating carrier. The problem is that such a system only works reliably if all carriers in the chain implement it—including those abroad, where most fraudulent calls originate.
Is it possible to find out who’s really behind it?
For the average person, practically not. While carriers do have the actual originating number in their logs, they won’t disclose it to the average user—this data is released only to the police as part of a criminal investigation.
What to Do If You Discover Someone Is Misusing Your Number
- Don’t block yourself—blocking the number on your end solves nothing.
- Notify your carrier—report the situation.
- Document it—record the date, time, and what they told you.
- Don’t share your number publicly unless necessary.
How to protect yourself when you receive a call (from a “spoofed” number)
- Don’t trust the caller ID—it only displays what the caller has told the system.
- If you receive a suspicious call, hang up and call back yourself using a number you’ve looked up yourself, not the “redial” button on your phone.
- Do not provide sensitive information—no bank or government agency will ever ask for your PIN, OTP code, or login credentials over the phone.
- Verify the other party’s identity through another channel—for corporate fraud, the “four-eyes principle” is helpful: transactions above a certain amount must always be approved by a second person through a different channel.
- Report suspicious numbers to your carrier or through spam-detection apps.
Fraudulent calls aren’t just a problem for individuals. They often target businesses, accountants, receptionists, and employees with access to payments and sensitive data. We can help you test your employees’ readiness to handle phishing, vishing, and other forms of social engineering. This may also include hands-on training that shows people how to recognize such scams before they cause damage. You can find more about this service here.
