How callers fake the number you see, and how networks check it
Caller ID spoofing is when a caller makes your phone show a number that is not theirs, often your bank's. It works because the number travels with the call as a line of data that the caller's own phone system fills in, and for decades networks passed it on unchecked. Today the United States and France make operators sign the number and check the signature, and the United Kingdom, Germany and Belgium block or hide calls from abroad that show a number from home. The rules change often: we last checked every fact on this page on 30 October 2026.
Purple: the call and its sealKey
- Purple: the call and its seal
- Dashed: internet and radio
With checks · your country's networks check the number
Press a button, or click the caller's monitor, the bank or your mobile.Press a button, or tap the caller's monitor, the bank or your mobile.
The same calls with the checks networks run today and without them. Each country checks in its own way.
Anatomy of caller ID spoofing: one call from a room abroad, through a provider and across the border, to the check at your operator and your mobile. The switch shows the same network without the checks. The drawing is not to scale.
-
Follow one call
Press Play to watch the call, or scroll down and the drawing follows you one step at a time. Try it, under the drawing, makes your own call.Press Play to watch the call, or Next to go one step at a time. Try it, under the drawing, makes your own call.
-
Step 1 of 6
The caller types the number
The caller sits abroad at a computer that runs a phone system. Its settings have a field for the number the call will show, and they type in your bank's number. The software does not check that the number is theirs. That is on purpose. A call centre that phones for a business shows the business's number, not its own.
Why can a caller set any number?
In an internet call the shown number sits in a line of the call's opening message, the From field. The standard says the caller's own equipment fills it in, and the network at the other end has no way to tell whether it is true.
Every call carries two numbers. The network number tells operators where the call came from. The presentation number is the one you see. They are usually the same, but a business may show a shared number instead, so callers can phone back. The caller does not need to own or rent the number they show.
Sources: IETF: RFC 3261, SIP: Session Initiation Protocol (2002); IETF: RFC 8224, Authenticated Identity Management in the Session Initiation Protocol (2018); Ofcom: Tackling scam calls from abroad, statement (2026)
-
Step 2 of 6
Their provider puts the call on the network
The phone system hands the call over the internet to a provider, which puts it on the phone network. This is the first place anyone could check. A provider that knows its customer and the customer's numbers can vouch for the number with a digital signature, a seal on the call. A provider abroad that has never seen your bank's number cannot sign it honestly.
What does the seal say?
The seal is a short signed token, called a PASSporT, that travels with the call. It names the calling number, the number called and the time, and the provider signs it with a certificate that proves it may sign for phone numbers.
In the United States the system is called STIR/SHAKEN, and the provider also says how sure it is. A means it knows the customer and that the customer may use the number. B means it knows the customer but not the number. C means it only passed the call on from somewhere else.
A seal is not proof of honesty. The Federal Communications Commission found that one provider, Lingo Telecom, had given the top grade, A, to 3,978 spoofed robocalls that carried an AI-faked voice of Joe Biden, then president.
Sources: IETF: RFC 8225, PASSporT: Personal Assertion Token (2018); IETF: RFC 8588, PASSporT extension for Signature-based Handling of Asserted information using toKENs (SHAKEN) (2019); Federal Communications Commission: Enhancing STIR/SHAKEN to combat illegal robocalls, draft notice (2026)
-
Step 3 of 6
The call crosses into your country
From the provider the call passes from network to network until it enters your country through an international gateway. It still shows your bank's number, a number from your country, though it comes from abroad. That mismatch is the clue most European countries now use. A seal rarely survives this trip, and a seal from abroad would not be trusted anyway.
Why are calls from abroad harder to check?
A seal only helps if every network on the way keeps it and the last one trusts whoever signed it. Signing schemes are national, and the American one was designed for a single country. Many international routes still run through older links or border equipment that builds the call's message anew, and the seal is lost.
The Federal Communications Commission calls robocalls from abroad one of the most vexing challenges it faces, because it cannot reach the callers or the foreign providers that carry them.
Sources: IETF: RFC 7340, Secure Telephone Identity Problem Statement and Requirements (2014); European Conference of Postal and Telecommunications Administrations: ECC Report 338, CLI spoofing (2022); Federal Communications Commission: Targeting gateway providers to combat illegal robocalls, fact sheet (2021)
-
Step 4 of 6
The check at your operator
Before your phone rings, the call reaches your operator, and what happens there depends on where you live. In France a call that shows a French number without a valid seal is cut off. In the United Kingdom and Belgium, a call from abroad that shows a home number is blocked. In Germany its number is hidden, so you see no caller ID instead of your bank's. Without these checks, the call goes on as the caller typed it and rings your phone as Your bank.
Does a check stop every fake call?
No. Mobile numbers are the gap. A call from abroad with a home mobile number may be a customer on holiday, so the rules let those through or hide the number after a check. France has hidden unsigned French mobile numbers from abroad since 1 January 2026, and the United Kingdom will show them as withheld from 15 July 2027.
Callers also move to other channels. Belgium's regulator sees fraudsters turn more and more to apps such as WhatsApp, where operators can do nothing.
Sources: Arcep: Appels frauduleux depuis l'international, communiqué de presse du 2 décembre 2025 (2025); Ofcom: Tackling scam calls from abroad, statement (2026); BIPT: Telecomsector onderschept 103 miljoen frauduleuze oproepen in de eerste helft van 2026 (2026)
-
Step 5 of 6
Now the real bank calls
Now a second call starts. The real bank phones you from its own number. Your phone shows the number a call carries, or the name you saved for it, so the screen says Your bank. The fake call shows exactly the same when nothing stops it, because the phone has only the number to go on. With the checks on, the bank's number is signed and passes the check.
Do people trust the number on the screen?
Most do. In 2022, 93% of mobile users in the United Kingdom said they look at the number on the screen to decide whether to answer.
Where the number looks local, more people pick up. In 2026, 24% of UK phone users said they were likely to answer an unknown UK mobile number, against 8% for an unknown number from abroad.
Sources: Ofcom: New Ofcom rules to fight fake number fraud (2022); Ofcom: Tackling scam calls from abroad, statement (2026)
-
Step 6 of 6
You call back on a number you know
If a call says it is your bank, hang up and call the number on the back of your card or on the bank's website. The network sends your call to the number you dial, so it reaches the real bank. A caller can fake the number you see, but not the number you call.
What if I call back the number on the screen?
You reach whoever really owns that number. Germany's regulator notes that the real owner of a spoofed number gets the angry call-backs, though they had nothing to do with the calls.
Still, regulators advise against it. You cannot tell from the screen whether the number is the bank's real one or one the caller controls, so dial a number you looked up yourself.
Sources: Bundesnetzagentur: Rufnummernmanipulation (2026); European Conference of Postal and Telecommunications Administrations: ECC Recommendation (23)03 on international incoming calls with national numbers (2023); Ofcom: What to do about a scam call, text or message (2026)
Caller ID spoofing in numbers
93 in 100
In 2022, 93 in 100 mobile users in the United Kingdom said they look at the number on the screen to decide whether to answer a call.
-
74 million
In the first half of 2026, Belgium's five largest operators detected or blocked more than 74 million spoofed calls, more than seven in ten of the fraudulent calls they stopped.
BIPT: Telecomsector onderschept 103 miljoen frauduleuze oproepen in de eerste helft van 2026 (2026)
-
19,000
In 2025 France's telecoms regulator received more than 19,000 reports of spoofed numbers, up from 531 in 2023. Spoofing is now the most common reason people write to it.
Arcep: Usurpation de numéros, communiqué de presse du 29 janvier 2026 (2026)
How it came to be
- 1994
Caller ID crosses networks
On 8 March the Federal Communications Commission adopts rules that make carriers pass the caller's number on to other networks, so caller ID works between them.
- 2006
A first way to sign the number
The Internet Engineering Task Force (IETF) publishes RFC 4474, the first standard for signing who an internet call comes from.
IETF: RFC 4474, Enhancements for Authenticated Identity Management in SIP (2006)
- 2010
Faking the number becomes a crime
On 22 December the United States signs the Truth in Caller ID Act. Showing a false number with intent to defraud or cause harm becomes unlawful. Showing another number for a good reason stays legal.
US Congress: Truth in Caller ID Act of 2009, Public Law 111-331 (2010)
- 2018
The seal gets its standard
In February the IETF publishes RFC 8224 and RFC 8225: a signed token, the PASSporT, carried in the call's own message. The American STIR/SHAKEN system is built on them.
IETF: RFC 8224, Authenticated Identity Management in the Session Initiation Protocol (2018)
- 2021
Signed calls in the United States
By 30 June American voice providers must sign calls with STIR/SHAKEN in the internet parts of their networks. From 28 September, networks refuse calls from providers missing from the Robocall Mitigation Database.
- 2022
Germany hides foreign calls with German numbers
From 1 December, a call from a foreign network that shows a German number reaches you with its number hidden. Mobiles roaming abroad are exempt.
Bundesnetzagentur: New regulations to protect against number spoofing (2022)
- 2024
France cuts unsigned calls
From 1 October, French operators cut off calls to landlines that carry a French number without a valid seal. Calls to mobiles follow on 1 January 2025.
What the rules say
No single rule covers Europe. The European Electronic Communications Code treats caller ID as a service and says nothing on spoofing, so each country picked its own check. Most aim at the same clue: a call from abroad that shows a number from home.
-
United States: sign the number and check it
The TRACED Act of 30 December 2019 told the Federal Communications Commission to require STIR/SHAKEN. The FCC set 30 June 2021 for the internet parts of every provider's network. The provider that starts a call signs it, and the one that delivers it checks the seal.
-
France: cut a call that is not signed
A 2020 law makes operators authenticate any French number shown as the caller and stop the call when they cannot. They do it with a shared signing scheme, the number authentication mechanism (MAN). A call from abroad that shows a French number other than a mobile one, without a valid seal, is cut off.
-
United Kingdom: block a UK number that comes from abroad
Ofcom's rules make providers block calls with a number that is invalid or cannot be dialled. Since 15 May 2023 that includes calls from abroad that carry a UK number as their network number, and since 29 January 2025 calls from abroad that show you one. Ofcom decided in 2024 not to require call signing for now.
-
Germany: hide a German number that comes from abroad
Section 120 of the Telecommunications Act lets a call show a German number only if it is handed over from the German network. Since 1 December 2022 at the latest, a call from abroad with a German number arrives with its number hidden, and you can reject hidden calls easily and free of charge. Mobiles roaming abroad are exempt.
-
Belgium and the Netherlands
A Belgian royal decree of 12 May 2024 makes operators block calls from abroad that show a Belgian number: landline numbers from 1 September 2024, and mobile numbers from 1 December 2024 once they have checked the caller is not roaming. In the Netherlands the telecoms act bans spoofing, and the regulator, the Authority for Consumers and Markets (ACM), supervises it. A draft law to limit the use of Dutch numbers from abroad went to public consultation from July to October 2026.
BIPT; Overheid.nl; Internetconsultatie; European Conference of Postal and Telecommunications Administrations
Most of these rules follow one European template, a 2023 recommendation from the European Conference of Postal and Telecommunications Administrations: block calls from abroad with a home landline number, and check mobile numbers for roaming first.
Where Voxbi fits
Voxbi, a cloud phone system hosted in the European Union, shows your business number on calls from desk phones, laptops and mobiles, and Mixvoip, which owns Voxbi, provides the numbers.
See it in Voxbi