Your phone rings. The number starts with your area code, and the next three digits match your own number. It looks like a neighbor, a local clinic, maybe your kid's school. You pick up, and a recording tells you about your "final notice" on a car warranty you never bought.
Nobody in your town placed that call. The number on your screen was made up by the caller. This is caller ID spoofing, and it is the reason "just check the number" no longer works as a scam test.
This guide covers how spoofing works, why scam calls so often look local, what the carriers' anti-spoofing system can and cannot do, when spoofing is illegal, and what you can do about it.
Caller ID feels like a fact about the call, something the phone network measured. It isn't. It is a field of data that travels with the call, and whoever starts the call fills it in.
On the old landline network, the phone company that connected your line set that field, and it was hard to fake. Internet calling (VoIP) changed that. A VoIP system lets the caller set the outgoing number in software, because businesses need it: a call center with 200 agents wants every call to show the company's main number, not 200 different lines.
So the same feature that lets your pharmacy show its main number lets a scammer show yours. There is no technical difference between "set the caller ID to our main line" and "set the caller ID to a random number in the 312 area code". The difference is only in intent.
A spoofing robocall campaign usually needs three things:
The call then hops between carriers, often across borders, before it reaches your mobile operator. Each hop passes along the caller ID it received. By the time your phone rings, nobody along the chain has checked whether the number belongs to the caller.
People ignore numbers from far away and answer local ones. Scammers know this, so many campaigns display a number with the same area code as yours, and often the same next three digits. This is called neighbor spoofing.
We wanted to know how common this really is, so we checked our own data. DialCode ingests the FTC's public Do Not Call complaint feed every day. In the first half of October 2026, US consumers filed about 110,000 complaints. Setting aside toll-free numbers and the few area codes we could not map to a state, we were left with 81,617 complaints about calls from regular US area codes. In 54% of them, the area code of the reported number belonged to the same state as the person complaining.
If scam callers picked numbers at random, the area code and the complainant's state would match about 5% of the time. A match rate ten times higher means the caller IDs were picked to look local. Some of those calls will be real local businesses breaking telemarketing rules, but the scale makes the pattern hard to miss.
The same data shows the other side of spoofing: numbers are disposable. Those 110,000 complaints were spread over 94,823 different numbers, and 88,043 of them (93%) were reported exactly once. A campaign shows a number for a few calls, then moves to the next one. This is why blocking a single scam number rarely stops the calls: the next call comes from a different "neighbor".
Spoofing is not a scam on its own. It is the disguise. Common disguises include:
The opposite also happens. Calls that really come from abroad sometimes display a domestic number so they look local. And the wangiri one-ring scam depends on a real premium-rate number, because the scammer earns money only when you call it back.
Since June 30, 2021, the FCC has required the large US phone companies to support STIR/SHAKEN on their internet-based networks. Smaller carriers got extra time, and the FCC has kept tightening the rules since then. Canada has a similar requirement. The name is two acronyms stacked together, but the idea is simple: the carrier where a call starts digitally signs it, and the carrier at your end checks the signature.
The signature carries one of three attestation levels:
Your carrier uses this signature, along with call patterns like thousands of short calls in a minute, to decide whether to show a green check mark, a "Spam Likely" or "Scam Likely" label, or to block the call outright.
STIR/SHAKEN has real limits:
The honest summary: STIR/SHAKEN made it harder to spoof at scale through big US carriers, and it gave investigators a trail to follow. It did not make caller ID trustworthy.
In the United States, it depends on the intent. The Truth in Caller ID Act of 2009 makes it illegal to transmit misleading caller ID information "with the intent to defraud, cause harm, or wrongfully obtain anything of value". The FCC can fine up to $10,000 per violation.
Some spoofing is legal. Examples:
Spoofing to scam people is not legal, and the FCC has issued large fines for it:
Collecting these fines is another story. Many operators are offshore or have no assets. The enforcement mostly matters because it pushes the carriers that carry the calls to drop these customers.
Most of the time you cannot tell from the number alone. That is the point of spoofing. Some patterns give it away:
If you want to know what a number is, look it up. The country code pages show where a prefix belongs and what scams are reported from it. For US numbers we also show complaint counts from the FTC and FCC feeds. Just remember that a clean record does not prove a call is real. A spoofed call can show a number that has never been reported, or the real number of an innocent business.
Don't trust the caller ID, trust the channel. If "your bank" calls, hang up and call the number on the back of your card. If "the IRS" calls, don't call back the number they gave you. This one habit defeats almost every spoofing scam, because the scam only works while you stay on the call they started.
Don't press keys to "opt out". Pressing 1 or 9 tells the dialer your line is live and answered by a person. Your number gets more calls, not fewer.
Don't call back one-ring missed calls from abroad. See the wangiri scam.
Turn on your carrier's free call filter. AT&T ActiveArmor, Verizon Call Filter and T-Mobile Scam Shield all have free tiers that label or block calls flagged as likely spam.
Use the phone's built-in filters. On iPhone, "Silence Unknown Callers" sends calls from numbers not in your contacts straight to voicemail. Android has "Filter spam calls" in the Phone app settings. Both cut most robocalls, but you will also miss real calls from numbers you haven't saved, so check voicemail.
Block foreign calls if you never get them. Our guide on how to block international calls covers carrier options and phone settings.
Report it. In the US, report unwanted calls at donotcall.gov and spoofing at fcc.gov/complaints. The reports become the public complaint data that carriers, researchers and services like ours use to spot campaigns.
Sometimes it works the other way: strangers call you back asking why you called them. A scam campaign is using your number as its caller ID. Your phone has not been hacked, and you did not do anything wrong.
What helps:
Yes. Any VoIP system can display any number, including yours. This is why you sometimes get calls "from yourself". It does not mean anyone has access to your phone or account.
No. If you call a spoofed number back, you reach whoever really owns that number, often a confused stranger or a business. The scammer is not on that line. This is also why calling back is not a reliable way to check a call.
It reduces it on calls that stay on internet-based networks of US and Canadian carriers. It does not cover calls that pass through older networks, and it does not stop scammers who get real numbers from cooperative carriers. Treat a "verified" mark as a hint, not a guarantee.
In the US, yes, as long as it isn't used to defraud, cause harm or wrongfully get something of value. Showing a company's main number from an agent's line is normal and legal. Telemarketing rules still apply on top of that.
Because scammers pick local-looking numbers on purpose. In our analysis of FTC complaints from October 2026, 54% of complaints about calls from regular US area codes came from the same state as the number shown. If the numbers were random, that share would be about 5%.
Yes. SMS sender IDs can also be faked, especially messages that show a name instead of a number. The rule is the same: don't use contact details from the message itself, go to the official app or website yourself.
Usually not much. Spoofing campaigns rotate numbers constantly. In our FTC data, 93% of reported numbers were reported only once. Carrier filters and your phone's unknown-caller settings do more than blocking numbers one by one.
Data note: the complaint figures come from the FTC's public Do Not Call complaint data for October 1-16, 2026, aggregated by DialCode per reported number. The same-state share compares the state of each complainant with the state of the reported number's area code. Toll-free numbers and area codes we could not map to a state are excluded.
From IRS impersonation to pig butchering, here are the top phone scam categories the FBI and FTC are tracking right now - and the new tactics you h...
A single missed call from a country you've never visited. You're curious. You call back. That's the entire scam - and it can cost you $20 in seconds.