Spoofing happens when someone manipulates a caller ID to display a number other than their own. Scammers who spoof to commit fraud may face fines of up to $10,000 per violation. But what if your number is the one they hijack? Surprisingly, one of the most effective actions is inaction: Simply wait for the spoofer to move onto a new phone number. For additional security, follow these spoof-specific cleanup tips.
Spoofing occurs when a person hides behind a phone number that’s not assigned to the phone they’re calling from.
Specifically, spoofing scams involve someone who pretends to be calling from your same area code. Criminals bank on the fact that people typically answer local numbers more often than they do those from out of town.
But what happens when it’s your number that’s been stolen and used to spoof others?
Is spoofing illegal?
Anyone transmitting misleading or inaccurate caller ID information “with the intent to defraud, cause harm or wrongly obtain anything of value” has broken the federal law put forth in the Truth in Caller ID Act. A single violation carries a Federal Communications Commission (FCC) fine of up to $10,000.
On the flip side, spoofing can be perfectly innocent (and thus legal).
For example, a teacher might spoof their school’s landline number when they call a student’s guardian from their mobile phone. Doing so protects their privacy and creates a healthy boundary with the guardian. In that case, no crime was committed.
How spoofers get your number
The majority of consumer complaints the Federal Communications Commission (FCC) receives annually center around unwanted phone calls, spoofed calls included.
According to the Federal Trade Commission (FTC), in the first half of 2024 alone, victims reported losing $454 million to fraud initiated by phone calls.
It makes sense that scammers reach for the phone to connect with their victims; people carry their phones everywhere and may answer calls with little guard up. Scammers could score your personal phone number in a variety of ways:
Data breaches: Your number is leaked when a company you do business with gets hacked.
Public-domain farming: You listed your number on your social media profiles, personal or business websites, and more.
Fine print: When you accept a company’s terms of agreement — like when you signed up for a store rewards card — the fine print may state that they can share your information with third parties.
Identity theft ring: A thief steals your personal information and sells it to another thief.
Phone call pickups: You answered a scammer’s call in the past and your number was tagged as a “live” line.
What spoofers can do with your number
Scammers can get a lot of mileage from just having your phone number, even if they don’t access your other personal information like your full name, birthdate, or more.
Scammers with a “live” number may try to:
Fake being local: In general, people are more inclined to answer local calls. Telemarketers call it “local presence dialing” and tout spoofing local numbers as the best way to improve answer rates, increase call-back rates, and capitalize on a particular geographic consumer base from another location. Marketers even buy apps to access banks of unassigned local numbers to take advantage of the trick. Industry regulators call it “neighbor spoofing.”
Perform a SIM card swap: A scamming spoofer poses as you, calls your carrier, and asks the service rep to remotely transfer all the information from your old SIM card to “your new device.” (SIM card stands for “subscriber identity module.” A phone carrier uses a SIM card to match your phone plan with your device.) With a SIM swap, a spoofer not only can steal more information but also target your contacts.
“Smish” your contacts: Using your number, the bad actor spoofers send texts embedded with links to your contacts. Because the message appears to come from you, your contacts open the links and are exposed to malware and/or financial schemes.
How to tell your number has been spoofed
Like most forms of identity theft, you typically learn you’re a victim when the consequences roll in. Some signs your number has been spoofed include:
Strangers call you, irate for “you” having spoofed them
Your voicemail gets clogged with messages from callers returning “your” call
Your phone bill indicates calls you never made and charges you never incurred
Friends and family ask why “you” blocked their numbers
You can’t unlock your phone or access messages
What to do if your number has been spoofed
If your phone number gets appropriated by a scammer, counter their move. Contact your carrier and follow the company’s processes for identity theft reporting and restoration.
Beyond that, the FCC recommends you take these additional precautions:
Enable your carrier’s blocking and privacy settings. Contact your carrier to get their most up-to-date defensive settings to fight spoofing.
Spoof your own number with a spoofing app. The less your real number is out in the world, the less likely it is to get stolen.
Change your passwords, PINs, and login details associated with the number.
Update your call settings so any calls come from and go to your contacts only.
Implement multi-factor authenticationand switch to email as your preferred method of authentication.
Limit access to your voicemail with a PIN or password.
Cease answering incoming calls from anyone you don’t know and send such calls roll to voicemail; only call the legitimate ones back. If you do pick up an unrecognized call, don’t say anything and don’t press any buttons.
Aside from following the tips above, Lifewire suggests that you wait it out. Once you either lock out the spoofer, or your number ceases to open doors for them, they will drop it and move on to the next number to exploit; the cycle usually plays out over two weeks.
Identity theft is made easier by spoofing, but we've got you covered with spoof-proof solutions for a safer future.
