Caller ID Spoofing: How It Works and the Law

If you run outbound campaigns at any volume, you have thought about caller ID. You have probably also watched your answer rates drop and wondered whether your numbers are getting flagged — or whether someone else is spoofing numbers in your area code and poisoning the well for everyone. Caller ID spoofing is one of the most misunderstood topics in telecom. Legitimate caller ID management gets confused with illegal spoofing, and spoofing gets confused with every other kind of phone fraud.

This article is written by SIPNEX, an FCC-licensed carrier that holds its own STIR/SHAKEN Service Provider certificate. We sign outbound calls with our own cryptographic keys. What follows is the carrier side of the problem: what happens in the signaling, what the law prohibits, and how an originating carrier decides how far to vouch for a calling number.

What caller ID spoofing actually is

Caller ID spoofing is presenting a phone number on an outbound call that does not belong to you or that you are not authorized to use. At the technical level, it is trivially easy. When your PBX or dialer places a call over a SIP trunk, it constructs a SIP INVITE message. That message contains a From header and often a P-Asserted-Identity header, and depending on the carrier, the calling number shown to the recipient is taken from one or the other. Your system sets both values. If your carrier does not validate them, you can put anything there — any 10-digit number, whether you own it or not.

Before STIR/SHAKEN existed, there was no standardized mechanism for carriers to verify whether the calling number in the From header actually belonged to the caller. The originating carrier trusted its customer. The terminating carrier trusted the originating carrier. The recipient’s phone displayed whatever number it received. The entire system ran on trust, and that trust was exploited at industrial scale by robocallers, scammers, and fraud operations.

The distinction between spoofing and legitimate CID management matters. If you operate a call center and you display your main business number on outbound calls instead of individual agent DIDs, that is not spoofing — you own that number and you are authorized to use it. If you rotate through a pool of DIDs that your carrier provisioned to your account, that is not spoofing — those are your numbers. If you present a number you found on the internet, bought from a shady DID broker, or simply invented, that is spoofing regardless of your intent.

The technical mechanism is the same in both cases — your system sets the From header. The difference is authorization. Do you have the legal right to present that number? Did your carrier verify that right before signing the call? Those two questions determine whether you are managing caller ID or spoofing it.

The law: Truth in Caller ID Act and FCC enforcement

The primary federal law governing caller ID spoofing is the Truth in Caller ID Act, codified at 47 U.S.C. § 227(e). The statute makes it illegal to “cause any caller identification service to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value.”

Three elements must be present for a violation: the caller ID must be misleading or inaccurate, the transmission must be knowing (not accidental), and there must be intent to defraud, to cause harm, or to wrongfully obtain something of value. This means that accidentally displaying a wrong number due to a misconfigured PBX is not a federal offense — though it may still trigger carrier-level consequences. Deliberately presenting a bank’s phone number to trick consumers into sharing account information is a clear violation.

The statute sets FCC forfeitures of up to $10,000 per violation, or three times that for each day of a continuing violation, with a total cap of $1,000,000 on a continuing violation that stems from one act or failure to act. Willful, knowing violations can also bring criminal fines. The Commission has pursued both robocall operations and the carriers that carried their traffic, and a carrier that lets spoofed calls through is exposed alongside the caller.

The 2024 New Hampshire primary robocalls show both sides. The consultant behind the spoofed, AI-voiced calls drew a $6 million forfeiture under the Truth in Caller ID Act (FCC 24-104). Lingo Telecom, the originating provider for many of those calls, had signed them at A-level by relying on its customer’s certification instead of independently confirming the right to use the calling number. It agreed to a $1,000,000 civil penalty and a compliance plan (DA 24-790). FCC rules also bar providers from accepting calls directly from a provider whose filing does not appear in the Robocall Mitigation Database (47 CFR § 64.6305(g)).

State laws add additional layers. Florida, for example, makes it a first-degree misdemeanor to enter false information into a caller ID system with intent to deceive, defraud, or mislead the person called, and spoofing used to commit another crime raises that crime’s classification (Fla. Stat. § 817.487). If you operate nationally, check state rules with counsel, not just the federal statute.

How STIR/SHAKEN fights spoofing at the carrier level

STIR/SHAKEN is the technical framework that finally gives the telephone network a way to verify caller ID claims. Here is how it works from the carrier’s perspective.

STIR (Secure Telephone Identity Revisited) is the IETF work on cryptographic signing of caller ID. SHAKEN (Signature-based Handling of Asserted information using toKENs) is the implementation framework developed by ATIS and the SIP Forum for deploying STIR on production SIP networks. Together they allow the originating carrier to make a verifiable, cryptographic assertion about the calling number.

When SIPNEX originates a call, we evaluate the calling number against our records. Is this DID assigned to the customer placing the call? Did we provision it or verify it through a port? Based on that evaluation, we assign an attestation level.

The levels come from the ATIS SHAKEN standard (ATIS-1000074). A (full) means the signing carrier knows the customer and has verified that customer’s right to use the calling number. B (partial) means it knows the customer but has not verified the number. C (gateway) means it can identify where it received the call from but cannot authenticate the call’s source, such as traffic arriving through an international gateway. The carrier signs with its private key and attaches an Identity header, so the terminating carrier can check the signature against the signer’s certificate. Our A-level vs B-level attestation guide covers each level in detail.

The key point for operators: a carrier that follows the standard cannot give A-level attestation to a number the caller has no right to use, because it has not verified that association. The Lingo case shows what happens when a carrier signs A-level on a customer’s word instead. Terminating carriers and call-labeling engines can read attestation as one input, alongside calling patterns and complaint data. No carrier has published a specific answer-rate gap between the levels, so treat attestation as a trust signal, not a guaranteed lift.

FCC rules have required voice service providers to implement STIR/SHAKEN on their IP networks since June 30, 2021, subject to certain extensions and exemptions. As signing spreads, an unsigned or weakly attested call stands out more — though how each terminating carrier treats it is that carrier’s own decision.

What legitimate operators need to know

If you are running legal outbound campaigns — collections, insurance, solar, political, appointment setting — you are not spoofing. But you need to understand the system to protect yourself.

Use numbers you are authorized to use. Every DID you present as outbound caller ID should be a number provisioned to your account by your carrier or verified through a completed port. If you are using DIDs from a third-party source that your carrier has not verified, you are operating in B-level territory at best, and you invite a review from your carrier.

Get A-level attestation from a direct carrier. If your provider does not sign calls itself, the provider that does sign them may have no direct relationship with you and no way to verify your numbers, which limits it to B-level at best. Moving to a direct carrier like SIPNEX that holds its own STIR/SHAKEN certificate means your calls get signed at A-level for the DIDs we provisioned or verified, because we have the direct customer relationship.

Monitor your numbers proactively. Register with the Free Caller Registry at freecallerregistry.com. Hiya, TNS, and First Orion each score calls on their own, so check how your numbers display on each network. If a number starts getting flagged, fix the calling behavior behind it rather than swapping in fresh numbers. Hiya advises against rotating numbers because rotation makes a caller look less trustworthy, not more.

Understand that reputation is per-number and per-carrier. Your CID reputation is not just about your behavior. If the previous owner of a recycled DID was a robocaller, that number may already be flagged when you receive it. If your carrier has a poor network reputation because it allows spoofed traffic from other customers, your calls may be treated with suspicion even if your own behavior is perfect. The carrier you choose affects your reputation before you dial a single call.

How SIPNEX handles caller ID verification

We take a straightforward approach: verify before signing.

When we provision DIDs to your account, those numbers are added to your trunk’s authorized caller ID list. When you place a call presenting one of those DIDs, our signing infrastructure checks that list and signs at A-level.

If you port numbers to SIPNEX, authority is established through the porting process (the Letter of Authorization and the losing carrier’s validation). Once the port completes, those numbers join your authorized list and receive A-level attestation.

If you present a number that is not in your authorized list — a number we did not provision and you have not ported — we sign at B-level, as the attestation standard requires. That protects our certificate’s reputation and your long-term calling health at the same time.

If calling patterns look like illegal spoofing — presenting numbers that belong to banks, government agencies, or other businesses, or cycling through large blocks of unverified numbers — the account is reviewed and service can be suspended. Our Acceptable Use Policy prohibits misrepresenting caller identity and cites the Truth in Caller ID Act. FCC rules also require providers to take “affirmative, effective measures” to keep new and renewing customers from originating illegal calls (47 CFR § 64.1200(n)(4)).

This is the practical difference a carrier-owned certificate makes. Our reputation as a signer is our own asset, so we have a direct incentive to keep our network clean. A provider that relies on someone else’s certificate has less at stake in how your specific traffic is signed.

Frequently asked questions

SIPNEX is an FCC-licensed carrier with its own STIR/SHAKEN Service Provider certificate. We verify number authority before signing and we sign at A-level for every DID we have provisioned or verified. Request a dialer-grade trunk.