Caller ID spoofing: is it legal and how can I stop it?

While spoofing may be bothersome or even disruptive to your everyday life, it is not illegal unless employed with malicious intent or unless it ultimately resulted in your harm. And some spoofing is legitimate.  An example of legitimate caller ID spoofing can be seen in the sharing economy. Companies such as Lyft or Rover mask calls in order to protect the information of their employees and their customers.

Businesses can also fall victim to spoofing. In 2018, a company in West Springfield, Massachusetts received about 300 scam calls in one hour. Without enough resources to handle all the calls, the spoofing attack ultimately hurt business operations for the company.  

Any U.S. citizen who believes they are a victim of caller ID spoofing can file a report with the FCC Consumer Complaint Center. The FCC imposes a fine of up to $10,000 per violation. 

Learn how to recognize fraudulent caller ID spoofing.

You are best served by learning how to recognize scams that use spoofing for yourself in order to avoid them entirely. Utilize these tips to help you:

• Be skeptical of generic greetings, such as ones that address you with “Dear customer,” as opposed to your real name.

• Avoid answering unknown numbers, as scam callers will regularly use unknown numbers.

• Pay attention to the caller’s tone of voice, and avoid giving information to a caller who seems pushy or demanding. This is a tactic employed by scammers to make matters appear urgent, thereby manipulating the human agency to react. 

• Be wary of the reason a caller gives you for needing your personal information. If the caller says they need it for an event you have never previously heard of, hang up immediately. 

• Don’t stay on the phone line. Trust your gut if you have any concerns regarding the legitimacy of the caller. Hang up immediately.

If you happen to fall victim to a spoofing attack then it is time to contact a government agency capable of investigating the incident and enforcing fraud statutes and fines.

Don’t bother tracing spoofers.

Though spoofers can sometimes be traced by your telephone company, it is often a time-consuming process. Tracing spoofers by yourself may take even more effort and time. In either scenario, the process is not guaranteed to yield accurate results. 

Some of the ways in which people attempt to trace spoofers include performing a basic web search on the phone number, calling the number that is calling you, and calling the official number of the company the caller says they are from. Each of these techniques should be used with caution, as you do not want to accidentally reveal information in the process. 

Performing a basic web search may allow you to cross-reference the number the caller is using and who the number actually belongs to. On occasion, this may reveal others who have received a similarly fishy phone call from a certain number. However, the better the scammer, the more likely they are to use new phone numbers after people start catching on to a specific one. 

Another way to identify whether the caller is legit is to call the number on a separate phone while you have them on the line. If the line is engaged, they may not be a scammer. For any caller who identifies themselves with a certain company, be sure to look up that company’s official phone number. This can be done either through a web search, a phone book, or a statement, if it is a company you have an account with.

Protect your personal information.

Many of the tactics used by scammers are employed to gauge your vulnerability. Scammers want to know how receptive you are to revealing information so that they target the right people. Each of the tips mentioned below will help you protect your personal information and avoid being the target of caller ID spoofing:

• Don’t answer calls from unknown numbers. If you do, hang up immediately. 

• Don’t hit any buttons. If the caller asks you to, hang up immediately. 

• Don’t answer any questions, especially ones regarding your personal information. 

• Never reveal personal information, such as your Social Security number, mother’s maiden name, passwords, or credit card numbers.

• Don’t assume they are who they say they are. If you receive a call from somebody representing a company or a government agency, hang up and call back the phone number on the company or agency’s website. This will help verify the caller. 

• Don’t put your trust into the caller until you can assure they are who they say they are.

• Don’t panic. Social engineers will see this as vulnerability and try harder in their attempts to manipulate you into revealing personal information.

• Set a password for your voicemail account. A scammer could hack into your voicemail if it is not properly secured with a password.

Notifying the FCC, the FTC, or even your local police department may ultimately be your best bet at protecting your personal information. Other best practices for stopping unwanted calls include filtering calls and blocking spam numbers. Filtering or blocking a number is different for iOS users and Android users, but both essentially involve pulling up your settings, and then selecting some sort of “block contact” option. Your carrier may also provide additional methods of stopping unwanted calls, such as Verizon Mobile’s Call Filter app. 

People repeatedly targeted by spoofing scams may want to contact their carriers to change their phone number. Some carriers, such as Verizon Mobile, allow customers to pick a new number online for free. Customers can simply login to the My Verizon app and change their mobile number. While this may temporarily stop your phone from receiving any further scam calls, it is not foolproof. The steps mentioned above detailing how to prevent attacks must be followed now more than ever.