Caller ID Spoofing Explained: Why Local Numbers Lie

Caller ID spoofing is when a caller makes your phone display a number that is not really theirs. It is cheap and common, which is why a local-looking number proves nothing. Canadian carriers have had to authenticate caller ID on internet-based calls since November 30, 2021, but that check is incomplete, so verify every unexpected call yourself.

What caller ID spoofing is

The CRTC defines caller ID spoofing as callers hiding or misrepresenting their identity by displaying fictitious or altered phone numbers. The number on your screen is information sent by the calling system. On a traditional phone line the carrier filled it in, but on many internet calling platforms the sender can type in any number they like.

Spoofing has legitimate uses. The CRTC points out that police services and domestic abuse shelters may hide where a call comes from, and many businesses show their main office number when staff call from a different line. Scammers use the same feature to borrow the number of a bank, a government office or a random person in your area.

Common forms include:

  • Neighbour spoofing: the fake number matches the first six digits of yours, so it looks local.
  • Mirroring: the call appears to come from your own number.
  • Borrowed identity: the caller ID shows the real number of a bank, the CRA or the police.

Why does a local-looking number prove nothing?

Because the caller chooses what you see. A scammer overseas can display a Toronto, Calgary or Halifax number as easily as their own. A local number only tells you which number was put in the caller ID field. It says nothing about where the call came from or who is on the line.

What carriers do about it

Canadian regulators have added several layers since 2019.

Blocking malformed numbers. The CRTC required carriers to block, by December 19, 2019, calls whose caller ID is longer than 15 digits or cannot be dialled, such as 000-000-0000. This catches the crudest fakes.

STIR/SHAKEN. From November 30, 2021, the CRTC required phone companies to authenticate and verify caller ID on internet protocol (IP) based voice calls using a framework called STIR/SHAKEN. The originating carrier signs the call to say whether it knows the customer is entitled to use that number, and the receiving carrier checks the signature. In the US, the FCC set a June 30, 2021 deadline for the same framework.

Does STIR/SHAKEN stop spoofed calls?

It reduces them but does not stop them. It only covers calls carried over IP networks, so calls passing through older equipment or from abroad may arrive unverified. The CRTC also notes that how the result appears on your screen varies by provider and depends on your phone, so a missing mark is common and not proof of fraud.

A verified mark means a carrier vouched for the number, not for the honesty of the person calling. A scammer using their own real number can still pass.

What you can do

The most reliable defence does not depend on technology. If a call asks for money, codes or personal information, end it and call the organization back on a number you looked up yourself. The CRA, for example, tells people not to verify a callback number during the call or rely on the number shown on caller ID.

A reverse lookup can also catch some spoofs. On TrustOrNah’s phone lookup, a number whose prefix is not assigned to any carrier cannot be a real caller. A mismatch is another sign: a “bank” calling from a prefix held by a mobile carrier, or a “government office” on a line labelled as likely VoIP. Reports from other people who received calls from the same number help too.

A lookup cannot prove a call is genuine. If a scammer spoofs a real bank number, the lookup will show the bank’s carrier, because the number really does belong to the bank. That is why calling back on a number you trust matters more than any screen.

What if scammers are spoofing my number?

You will usually find out when strangers call back angry about calls you never made. There is no way to stop someone from typing your number into a calling platform. Tell your carrier, keep a note of the dates, and let callers know your number was spoofed. Spoofing does not give anyone access to your phone line or your account.

Changing your number is rarely needed. If the callbacks keep coming for weeks, ask your carrier about call-management features or a new number.

What to do now

  • Treat every unexpected caller ID as unverified, including numbers that look local or match your bank.
  • Hang up on any call that asks for money, a one-time code or your SIN, and call back on a number you found yourself.
  • Look up the number to check its carrier, line type and reports before you return a call.
  • Report fraud to your local police and the Canadian Anti-Fraud Centre at 1-888-495-8501.

Questions people ask

Is caller ID spoofing illegal in Canada?

It depends on the purpose. The CRTC's Telemarketing Rules prohibit telemarketers from spoofing or hiding their numbers, and using a fake number to defraud someone is fraud. The CRTC also recognizes legitimate uses, such as police services or domestic abuse shelters hiding where a call comes from. In the US, the Truth in Caller ID Act makes spoofing with intent to defraud or cause harm illegal.

Can a spoofed call show my bank's real phone number?

Yes. A scammer can set the caller ID to the number printed on the back of your card, which makes the call feel safe. The CRA gives the same warning about its own numbers and tells people not to trust the number on their caller ID. Hang up and call the bank yourself using the number on your card.

Will the National Do Not Call List stop spoofed calls?

No. The National Do Not Call List, run by the CRTC, applies to legitimate telemarketers, who must check it before calling. Scammers who fake their caller ID are already breaking the rules and ignore the list. Registering still cuts down legal sales calls, which makes the remaining unexpected calls easier to spot.

Why do I get calls from numbers that look almost like mine?

That is neighbour spoofing. The CRTC describes it as changing the caller ID to match the first six digits of your own number, so the call looks like it comes from your area or even your building. People answer local numbers more often, which is the whole point of the trick.

Check a number or email

Report