What is spoofing?
Definition
Spoofing is disguising where a call, text or message really comes from by faking the sender information, such as the number on your caller ID, so you trust it and respond.
- Category
- Attacks
- Also called
- caller ID spoofing, email spoofing, neighbor spoofing
- Last updated
Spoofing means someone falsifies the sender details you see. The FCC defines caller ID spoofing as deliberately falsifying the information transmitted to your caller ID display to disguise the caller's identity. The same idea applies to email addresses, text messages and websites.
Spoofing on phones
A scammer calls and your screen shows a local number, your bank's number or a government office. It's not real. Scammers do this to get you to answer, and to make a fake pitch seem believable. Because the number is fake, calling it back often reaches someone else or nobody. The FTC warns that a local-looking number can come from anywhere in the world.
Is spoofing illegal?
Not always. The FCC says rules under the Truth in Caller ID Act prohibit transmitting misleading or inaccurate caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value. Violators can face penalties of up to $10,000 per violation. There are legitimate uses, such as a business showing its main number instead of an outbound-only line.
A typical case: your phone rings and shows your own area code and the first digits of your number. You pick up, and it's a recorded message about your car's warranty.
Other kinds of spoofing
- Email spoofing fakes the "from" address so a message looks like it came from a person or company you know.
- Text spoofing does the same with sender names or numbers on messages.
- Website spoofing copies a real site's look to collect passwords.
Spoofing vs. phishing
Spoofing is the disguise. Phishing is the scam you're pulled into, and spoofing is one tool it uses. A spoofed email or text that asks for your password is phishing.
How to protect yourself
- 1
Don't trust caller ID alone
A name or number on screen can be faked. If a caller claims to be from your bank or a government agency, hang up and call the number on your statement or the official website.
- 2
Don't give out personal information on calls you didn't start
Never share passwords, account numbers or one-time codes with an unexpected caller.
- 3
Hang up on robocalls and don't press keys
The FTC says that responding to an illegal robocall, even to opt out, tends to bring more calls.
- 4
Use call blocking and screening
Your carrier may offer call blocking tools, and phones have built-in screening for unknown callers.
- 5
Report spoofing
Report it to the FCC at fcc.gov/complaints and to the FTC at ReportFraud.ftc.gov. If you think your own number is being spoofed, the FCC has guidance on what to expect and do. Serus finds where your phone number is listed online and removes it, which shrinks the pool of lists scammers use.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What does spoofing mean?
Spoofing means faking the sender details of a call, text or email so it appears to come from someone else, usually to gain your trust.
Why am I getting calls from my own number?
That is usually neighbor spoofing or number spoofing: the caller picks a number that looks like yours to get you to answer. Your number hasn't necessarily been hacked. Don't answer, and report it.
Is spoofing the same as hacking?
No. Spoofing falsifies what's shown to you. It doesn't require breaking into your phone or account.
Can spoofing be stopped?
Not entirely. Carriers use technology called STIR/SHAKEN to verify caller ID information, which the FCC describes as the main standard for deterring spoofing. It reduces it but doesn't end it, so stay cautious.
Sources
Something wrong or out of date? Tell us and we'll re-check it.