Why You Cannot Blindly Trust Caller ID
When your mobile phone or landline rings, the name or telephone number appearing on the screen is called the Calling Line Identification (CLI). Most telephone subscribers assume this display is verified by the telephone company. In reality, under legacy telecom routing, CLI is simply an unauthenticated text field transmitted over signaling protocols.
The Mechanics of Spoofing
Caller ID spoofing occurs when an originating caller deliberately alters the information sent to your display to conceal their true identity. The rise of Voice over Internet Protocol (VoIP) made spoofing trivial. When a call is placed through a SIP (Session Initiation Protocol) trunk, the caller’s PBX or softphone software transmits a message containing fields such as From: and P-Asserted-Identity:.
Unless an intermediate carrier strictly enforces origination screening, any numeric string can be inserted into these fields. Fraudulent call centers use software scripts to automatically inject numbers before placing outbound robocalls.
Common Spoofing Tactics
- Neighbor Spoofing: Attackers display the same area code and local three-digit prefix as your own number, exploiting your natural instinct to answer local calls from neighbors, schools, or local tradespeople.
- Brand & Bank Impersonation: Scammers display the exact customer service or fraud alert number printed on the back of your credit card. When you see the official bank number, your suspicion drops.
- Government & Law Enforcement Impersonation: Displaying official numbers from tax authorities (such as the IRS or HMRC), social security administrations, or police departments to create psychological panic.
The Industry Countermeasure: STIR/SHAKEN
To combat widespread spoofing, telecommunications standards bodies (ATIS, SIP Forum, and the IETF) created the STIR/SHAKEN cryptographic authentication framework:
- STIR (Secure Telephone Identity Revisited): A suite of IETF protocols (RFC 8224, RFC 8588) defining digital certificates and JSON Web Tokens (known as PassPORt) that cryptographically sign call metadata.
- SHAKEN (Signature-based Handling of Asserted information using toKENs): The operational framework defining how service providers implement STIR in IP networks.
Attestation Levels Explained
When an originating carrier signs an outbound call, it issues one of three attestation levels:
- Full Attestation (A): The carrier knows the customer placing the call AND verifies that the customer has the legal right to use the specific telephone number displayed.
- Partial Attestation (B): The carrier verifies the customer originated the call on their network, but cannot confirm the customer is the authorized owner of the displayed number.
- Gateway Attestation (C): The carrier received the call from an international gateway or untrusted third-party transit network and has no visibility into the caller or the number's authenticity.
Limitations of STIR/SHAKEN
While STIR/SHAKEN has made substantial progress in the US, Canada, and parts of Europe, it is not a complete panacea:
- Analog and Legacy TDM Networks: Traditional copper landlines cannot transmit digital SIP tokens.
- Cross-Border Calls: Many international carriers do not participate in mutual certificate validation, causing cryptographic signatures to be stripped at international gateway boundaries.
- Attestation Theft: Attackers occasionally compromise legitimate corporate PBX systems to place calls with Level A attestation.
The Golden Security Rule: Never authenticate an incoming caller based solely on the number on your screen. If someone claims to be your financial institution, utility company, or government agency, hang up and initiate an outbound call using a publicly verified telephone number.