Who's Calling Me? Why Caller ID Spoofing is a growing concern.

Have you answered a call lately thinking it was from someone you knew, only to find out it was a telemarketer or robodialer? You are not alone. Caller ID tells us who is calling, or at least from what number they are calling--but Caller ID is not always reliable.  With a surprisingly small amount of effort, almost any one can pretend to be calling from a number wholly unrelated to them or anything they might be doing.  It's called Caller ID Spoofing, and as VoIP services continue to advance in the marketplace, Caller ID Spoofing is advancing right alongside.

What is Caller ID Spoofing?

Caller ID spoofing is the act of altering the phone number you present to when making a call. This is actually a longstanding feature of telecom services that predates Voice Over IP.  Legacy PBX systems have long inserted a specific origination number into outbound call sessions, and legacy telecommunications circuits support this--it is commonly known as "Enterprise Trunking", or "Enterprise SIP Trunking" on modern VoIP connections.  Because the origination number is specifically inserted, the PBX system can easily insert just about any number selected, and phone networks will almost always allow the call to proceed normally.  Enterprise SIP Trunking becomes Caller ID Spoofing when the number is inserted specifically to conceal the caller's identity, or to otherwise deceive the callee.

Spoofing can be a crime

There are circumstances where Caller ID Spoofing is illegal.  For example, if Caller ID is falsified in order to commit some form of fraud, the Truth in Caller ID Act (PL 111-331) makes that falsification a crime all on its own.

Where is spoofing "lawful"?  In general, Caller ID Spoofing is lawful when the purpose itself is not illegal or criminal.  Ride sharing services such as Uber and Lyft use the masking of caller ID to facilitate prospective drivers and riders communicating without sacrificing valued privacy. Many small businesses will want a specific number applied to all outbound calls, to ensure that returned calls are handled in a preplanned fashion--at Aruna Communications, part of onboarding a customer is determining what number they wish to have on their outbound calls, and that number is not always one that we host.

Then there is the grey area where Caller ID Spoofing is of questionable propriety.  Telemarketers use Caller ID Spoofing as a way to circumvent number blacklists and call blocking apps.  To the extent that telemarketing itself is a legal and legitimate activity, the law generally considers the spoofing to also be legal and legitimate.  The extent to which the spoofing in such cases is ethical and proper is at best problematic.

Spoofers pretend to be near you

On the legacy PSTN phone network, numbers have geographic significance.  The first six digits of a phone number, known as the NPA-NXX number, identify which incumbent exchange carrier central office supports that phone number.  Thus, if you have a legacy landline phone and phone number, your neighbors are going to have numbers that look similar, because those first six digits will often be the same.  Similarly, cellular companies obtain large blocks of phone numbers, and so any number whose first six digits matches your cellular number very likely is also supported by your cellular provider. As a general rule, we are more likely to answer numbers that appear close to our own--which gives telemarketers an incentive to spoof with numbers close to the called number.

Don't know who it is? Just don't answer.

The old adage of not talking to strangers is still sound advice.  If you do not recognize a number--or, more probably, your Google contacts doesn't have the number associated with someone--the best and safest approach is to just let the call go to voicemail. If you do not take such calls, you will not be tricked into revealing personal information that could lead to identity theft or otherwise have to contend with the dark side of spam calls.

Have you been spoofed?

Chances are, you have been spoofed just today, and more than once.  It happens that frequently.  Whether the spoofing can be prevented depends on what is happening--whether or not the call itself is in some fashion illegal, or if the caller's behavior is potentially harassing.  If you feel the caller has crossed the line, and you feel your privacy rights have been violated, you have the option to file a complaint with the FCC.

Caller ID Spoofing is somewhat inevitable, given the trend in telecommunications towards Voice Over IP and away from geographically-driven phone services. Still, every business and every consumer has both a basic right of privacy and a right not to take unwanted calls--and aggressive Caller ID Spoofing can easily infringe on both of these rights.  When that happens, know that there are options above and beyond just blocking the phone number itself (although everyone should do at least that much). Customers should not be afraid to utilize these options