Phone Spoofing Explained: What It Is and How to Stop It

Can you trust your caller ID anymore? When your phone rings and displays a familiar number, you might assume it’s someone you know. But what if that familiar face on your screen is actually a scammer in disguise?

Phone spoofing has become one of the most widespread threats facing smartphone users today. Telecoms software firm, Hiya, flagged 12.5 billion suspected spam calls in Q1 2025 — that’s a staggering 137 million every single day.

The trust we once placed in caller ID is rapidly eroding. 60% of consumers say phone spam has increased in the last year, and scammers are getting more sophisticated by the minute.

But here’s the thing: you don’t have to be a sitting duck. Understanding what phone spoofing is and how to protect yourself can save you from financial loss, identity theft, and serious privacy violations.

Understanding how phone spoofing works can help you better protect yourself. The process exploits fundamental weaknesses in our phone system’s infrastructure that date back decades.

The Legacy Problem

In the traditional Public Switched Telephone Network (PSTN) that still operates behind many landlines, the caller’s number is simply a data field that networks largely leave unchecked. There’s minimal verification to ensure the number being transmitted actually belongs to the person making the call.

This trust-based system made sense in the 1960s when phone networks were closed systems operated by regulated monopolies. But as technology evolved and anyone could access phone networks, this lack of verification became a massive security vulnerability that persists today.

While the PSTN is being gradually phased out globally, these spoofing vulnerabilities remain active in many current phone systems. If you still have a traditional landline or receive calls from people who do, you may be affected by this legacy security gap.

Modern VoIP Vulnerabilities

Today’s Voice over Internet Protocol (VoIP) systems have unfortunately made spoofing even easier. Attackers can simply rewrite the SIP “From:” header in their calls, and cheap gateway services make this process trivial for anyone with basic technical knowledge.

You can buy spoofing services online for as little as $10 per month. Some services even offer user-friendly apps that let scammers type in any number they want to display on your caller ID.

STIR/SHAKEN: The Partial Solution

The telecommunications industry has introduced STIR/SHAKEN technology — a system that adds digital signatures to verify caller ID information. The FCC mandated this technology in June 2021, requiring phone companies to implement call authentication.

However, there’s a concerning trend in the data. STIR/SHAKEN coverage fell to 40.4% of calls by June 2025, down from a 49% peak in October 2024. This means significant gaps remain in our protection against spoofed calls, particularly for international calls and smaller carriers.

Phone Spoofing: The Real-World Impact

The consequences of phone spoofing extend far beyond annoying interruptions. The financial and personal toll is devastating.

The Financial Damage

56.2 million U.S. adults were hit by spam and scam calls in 2023. The average loss per victim was $452, totaling a staggering $25.4 billion in damages.

But the numbers only tell part of the story. Take Avalon Grimes, who lost her life savings to a spoofed “bank” call. The scammer used her bank’s actual phone number to display on her caller ID, making the call seem completely legitimate.

The Rise of AI Voice Spoofing

The threat has evolved beyond simple number spoofing. Up to 25% of UK scam calls now use AI-generated voices, making it even harder to detect fraud. These deep-fake voice scams can mimic family members, colleagues, or authority figures with frightening accuracy.

Signs You’re Dealing with Phone Spoofing

Recognizing spoofed calls can save you from falling victim to scams. Here are the telltale warning signs:

Your Own Number Calls You

If your phone displays your own number as the incoming call, that’s an immediate red flag. This is impossible under normal circumstances and indicates spoofing.

Neighbor Spoofing Patterns

Multiple calls from numbers with your exact area code and prefix, especially if you don’t recognize them, often indicate neighbor spoofing attempts.

Urgent Action Demands

Legitimate businesses rarely demand immediate action over the phone. Be wary of callers who pressure you to:

• Transfer money immediately
• Purchase gift cards
• Provide personal information “to verify your account”
• Click links or download apps

Poor Call Quality from “Official” Sources

If someone claiming to be from your bank or a government agency has poor call quality, it’s suspicious. Official organizations typically use high-quality phone systems.

Database Reports

If you search the calling number online and find multiple reports of spam or scam activity, trust those warnings.

How to Stop Phone Spoofing: 8 Effective Methods

While you can’t completely eliminate spoofed calls, you can dramatically reduce their impact with the right combination of tools and strategies.

The key is layering multiple defenses—from built-in smartphone features to smart behavioral choices—to create a comprehensive shield against these attacks.

1. Use Built-in Smartphone Protections

iPhone Users

Navigate to Settings → Apps → Phone → Silence Unknown Callers. This feature automatically sends calls from unknown numbers to voicemail, while still allowing calls from your contacts, recent outgoing calls, and Siri suggestions to ring through.

Fig 1. Enabling the Silence Unknown Calls feature on iPhone.

Android Users (Pixel devices)

Google Pixel phones offer Call Screen and Hold for Me features. Call Screen uses Google Assistant to answer unknown calls and provide a transcript of the conversation before you decide to take the call.

Fig 2. The Call Screen feature on Google Pixel devices.

2. Look for Verified Calls

Both iPhone and Android devices can display “Verified Call” checkmarks for calls that have been authenticated through STIR/SHAKEN technology. However, this feature depends on your carrier’s implementation.

3. Carrier-Level Defenses

Your phone carrier is your first line of defense against spoofed calls, and all major US carriers now offer spam protection services. While the quality varies, these services are usually free or low-cost and worth enabling.

Verizon offers Call Filter Free for spam detection and risk labels, with Call Filter Plus ($2.99/month) adding auto-blocking and neighborhood filtering for those annoying same-area-code spam calls.

T-Mobile provides Scam Shield protection at no extra cost. Their system is particularly effective, having blocked 19 billion scam calls in 2023 alone.

AT&T includes Call Protect for fraud alerts and basic blocking with most plans, plus Call Protect Plus ($3.99/month) for enhanced caller ID and reverse number lookup.

To activate these services, you typically need to dial a short code, use your carrier’s app, or enable them through your online account. The free versions catch most obvious spam calls, though premium tiers offer more advanced filtering.

4. Third-Party Call-Blocking Apps

When built-in protections aren’t enough, third-party apps can provide more aggressive filtering using crowd-sourced databases of known spam numbers. These apps rely on millions of users reporting unwanted calls to build comprehensive block lists.

Some examples are:

• Truecaller
• Hiya
• RoboKiller

These apps work by maintaining massive databases of known spam numbers and using machine learning to identify new threats. They can be highly effective, but they do require access to your call logs to function properly.

5. Let Unfamiliar Numbers Go to Voicemail

If it’s important, legitimate callers will leave a message. You can then call back using the official number from the company’s website rather than the number that appeared on your caller ID.

This simple strategy stops most scam calls in their tracks. Scammers rely on immediate interaction and rarely leave voicemails because it creates evidence of their criminal activity.

6. Register with Do Not Call Services

Do Not Call registries are government services that require telemarketers to stop calling registered numbers.

• United States: Register with the National Do Not Call Registry
• United Kingdom: Sign up for the Telephone Preference Service

While these services won’t stop criminals, they can significantly reduce legitimate telemarketing calls, making it easier to spot the suspicious ones.

7. Report Spoofed Calls

Help authorities track down scammers by reporting suspicious calls. Your reports contribute to databases that help protect other consumers:

• US: Use ReportFraud.ftc.gov
• UK: Report to Action Fraud
• SMS spam: Forward to 7726 (SPAM)

8. Monitor Your Device

Scammers often use spoofed calls as part of larger attacks that may include malware or spyware installation.

Regular device scans with an app like Certo AntiSpy can detect if your phone has been compromised through these secondary attacks. Spyware and malware can give criminals access to your contacts, making their spoofing attempts more convincing by using real information about your relationships and financial accounts.

Fig 3. Detecting spyware with Certo AntiSpy.

What to Do If Your Number Is Being Spoofed

Discovering that scammers are using your phone number can be frustrating and concerning. You might start receiving angry calls from people claiming you called them, or your friends might ask about suspicious calls they received from your number.

Immediate Actions

1. Record a new voicemail message explaining that your number is being used fraudulently. Use a message like: “Hi, you’ve reached [Your Name]. If you received a suspicious call from this number, please know that scammers are illegally using my phone number. I did not call you. Please hang up on any suspicious calls and report them to the authorities.”

2. Change your voicemail PIN and enable two-factor authentication on all accounts associated with your phone number. Scammers sometimes try to access voicemail boxes to gather more personal information for future attacks.

3. Contact your carrier to report the spoofing and ask them to investigate any unusual outgoing traffic from your account. While they can’t stop the spoofing directly, they can flag your account and potentially identify if your actual line has been compromised.

Monitor for Misuse

Keep a close eye on your accounts for signs that the spoofing is part of a larger attack:

• Check your phone bills for unexpected charges, premium SMS costs, or calls you didn’t make.
• Monitor your credit reports for new accounts or inquiries you didn’t authorize.
• Watch your financial accounts for unauthorized transactions.
• Review your social media for posts or messages you didn’t send.

Document Everything

Keep records of:

• Screenshots of angry texts or voicemails from people claiming you called them.
• Dates and times when you learned about spoofing incidents.
• Any suspicious activity on your accounts.
• Communication with your carrier about the issue.

This documentation can be helpful if the spoofing leads to more serious problems or if law enforcement needs to investigate.

Consider a Number Change (Last Resort)

Changing your phone number should be your last resort, as it requires updating all your accounts and contacts. Most spoofing incidents are temporary, with scammers moving on to other numbers within days or weeks.

However, consider changing your number if:

• The spoofing continues for weeks or escalates.
• You’re receiving threats from angry victims.
• The spoofing is linked to other identity theft.
• Your career or business is being affected.

Current Regulations and Industry Response

Governments and telecom companies worldwide are fighting back against phone spoofing, but progress is inconsistent, and scammers continue to adapt quickly to new defenses.

United States Actions

In February 2024, the FCC banned AI-generated robocall voices, making it illegal to use artificial intelligence to generate voices in robocalls without explicit consent. This landmark ruling came in response to the surge in deepfake voice scams targeting elderly victims with fake family emergency calls.

The agency continues to enforce STIR/SHAKEN requirements and impose hefty fines on violators. Recent penalties have reached unprecedented levels, with one robocaller fined $300 million for illegal spoofing activities.

United Kingdom Progress

Starting January 29, 2025, all UK providers must block calls from abroad that spoof UK landline numbers. This means international calls displaying UK geographic numbers (like 020 for London) are automatically rejected since these numbers cannot legitimately originate from overseas.

Ofcom is also exploring alternatives to STIR/SHAKEN that could work better with the UK’s mixed phone system infrastructure, including blockchain-based verification systems.

Advanced Mobile Protection Features

Apple’s upcoming iOS 26 introduces automatic Call Screening that intercepts unknown calls and asks callers to identify themselves before your phone rings. Google Pixel devices have offered Call Screen since 2018, with automatic screening of suspicious calls and spoofed numbers.

International Cooperation

Countries are increasingly working together through joint task forces to trace and prosecute international robocall operations. The US and Canada have recent successes shutting down major spoofing centers, while the EU is developing unified standards for call verification.

Research and Development

Researchers are exploring new “Caller ID Verification” systems that could provide challenge-response verification across different phone networks. Other promising technologies include blockchain-based caller verification and machine learning systems that detect spoofing patterns.

Wrapping Up

Phone spoofing isn’t just an annoyance — it’s a gateway to serious financial and personal harm that affects millions of people every year. The criminals behind these attacks are becoming more sophisticated, using AI voices and detailed personal information to make their scams nearly indistinguishable from legitimate calls.

But you’re not defenseless. The combination of built-in smartphone features, carrier protections, third-party apps, and smart behavioral choices can dramatically reduce your risk. The key is layering these defenses and staying skeptical of unexpected calls, especially those demanding immediate action.

Remember that legitimate organizations will never pressure you for immediate payment over the phone, ask for sensitive information without proper verification, or demand payment through gift cards or wire transfers. When in doubt, hang up and call back using official numbers from company websites.

If you’re still unsure whether suspicious activity on your phone might be related to spoofing attacks or other security threats, running a quick scan with Certo can give you peace of mind in minutes.

Frequently Asked Questions

Is phone spoofing illegal?

Yes, in the US the Truth in Caller ID Act makes it illegal to transmit misleading caller ID information with intent to defraud, cause harm, or obtain something of value. Violations can result in fines up to $10,000 per illegal call.

Can spoofing affect text messages too?

Yes. SMS spoofing involves manipulating text message headers to display fake sender information, similar to voice call spoofing.

Will using a VPN or changing my SIM card stop spoofing?

No. Phone spoofing happens at the network level, not on your device. VPNs and SIM changes won’t prevent scammers from spoofing your number or calling you with spoofed numbers.

How do I know if a call is verified?

Look for a green checkmark or “Verified Call” label on your phone’s display. However, not all legitimate calls will show this verification due to incomplete industry implementation.