Caller ID Spoofing Explained: Why Local Numbers Lie
Caller ID spoofing is when a caller makes your phone display a number that is not really theirs. It is cheap and common, which is why a local-looking number proves nothing. Canadian carriers have had to authenticate caller ID on internet-based calls since November 30, 2021, but that check is incomplete, so verify every unexpected call yourself.
What caller ID spoofing is
The CRTC defines caller ID spoofing as callers hiding or misrepresenting their identity by displaying fictitious or altered phone numbers. The number on your screen is information sent by the calling system. On a traditional phone line the carrier filled it in, but on many internet calling platforms the sender can type in any number they like.
Spoofing has legitimate uses. The CRTC points out that police services and domestic abuse shelters may hide where a call comes from, and many businesses show their main office number when staff call from a different line. Scammers use the same feature to borrow the number of a bank, a government office or a random person in your area.
Common forms include:
- Neighbour spoofing: the fake number matches the first six digits of yours, so it looks local.
- Mirroring: the call appears to come from your own number.
- Borrowed identity: the caller ID shows the real number of a bank, the CRA or the police.
Why does a local-looking number prove nothing?
Because the caller chooses what you see. A scammer overseas can display a Toronto, Calgary or Halifax number as easily as their own. A local number only tells you which number was put in the caller ID field. It says nothing about where the call came from or who is on the line.
What carriers do about it
Canadian regulators have added several layers since 2019.
Blocking malformed numbers. The CRTC required carriers to block, by December 19, 2019, calls whose caller ID is longer than 15 digits or cannot be dialled, such as 000-000-0000. This catches the crudest fakes.
STIR/SHAKEN. From November 30, 2021, the CRTC required phone companies to authenticate and verify caller ID on internet protocol (IP) based voice calls using a framework called STIR/SHAKEN. The originating carrier signs the call to say whether it knows the customer is entitled to use that number, and the receiving carrier checks the signature. In the US, the FCC set a June 30, 2021 deadline for the same framework.
Does STIR/SHAKEN stop spoofed calls?
It reduces them but does not stop them. It only covers calls carried over IP networks, so calls passing through older equipment or from abroad may arrive unverified. The CRTC also notes that how the result appears on your screen varies by provider and depends on your phone, so a missing mark is common and not proof of fraud.
A verified mark means a carrier vouched for the number, not for the honesty of the person calling. A scammer using their own real number can still pass.
What you can do
The most reliable defence does not depend on technology. If a call asks for money, codes or personal information, end it and call the organization back on a number you looked up yourself. The CRA, for example, tells people not to verify a callback number during the call or rely on the number shown on caller ID.
A reverse lookup can also catch some spoofs. On TrustOrNah’s phone lookup, a number whose prefix is not assigned to any carrier cannot be a real caller. A mismatch is another sign: a “bank” calling from a prefix held by a mobile carrier, or a “government office” on a line labelled as likely VoIP. Reports from other people who received calls from the same number help too.
A lookup cannot prove a call is genuine. If a scammer spoofs a real bank number, the lookup will show the bank’s carrier, because the number really does belong to the bank. That is why calling back on a number you trust matters more than any screen.
What if scammers are spoofing my number?
You will usually find out when strangers call back angry about calls you never made. There is no way to stop someone from typing your number into a calling platform. Tell your carrier, keep a note of the dates, and let callers know your number was spoofed. Spoofing does not give anyone access to your phone line or your account.
Changing your number is rarely needed. If the callbacks keep coming for weeks, ask your carrier about call-management features or a new number.
What to do now
- Treat every unexpected caller ID as unverified, including numbers that look local or match your bank.
- Hang up on any call that asks for money, a one-time code or your SIN, and call back on a number you found yourself.
- Look up the number to check its carrier, line type and reports before you return a call.
- Report fraud to your local police and the Canadian Anti-Fraud Centre at 1-888-495-8501.