Caller ID spoofing and what STIR/SHAKEN can, and cannot, prove

What is caller ID spoofing?

Caller ID spoofing means displaying a number that is different from the number actually making the call. It can make a call appear to come from a local number, a business, or someone you know. The FCC’s spoofing overview explains that caller ID can be manipulated and that consumers should be cautious with unexpected calls.

What does STIR/SHAKEN do?

STIR/SHAKEN is a caller-ID authentication framework used by telephone providers. It can help show whether a provider could verify the number used for a call, but it does not mean the person or organization behind the call is trustworthy. The FCC expressly notes that improved caller-ID information does not make a call legitimate; see its STIR/SHAKEN consumer guidance.

Attestation levels (A, B, or C) are still the signing provider’s own assertions about what it knows. An “A” (full) attestation means that provider claims it can identify the customer and that the customer is authorized to use the displayed number, not that an independent authority checked the caller. Providers can get that wrong. In 2024 the FCC settled with Lingo Telecom for a $1 million civil penalty after Lingo applied A-level attestations to spoofed generative-AI robocalls while relying on a customer’s certification instead of verifying the number itself. See Consent Decree DA-24-790 and the earlier Notice of Apparent Liability (FCC 24-60).

What is the safer response to an unexpected call?

• Do not use a callback number supplied during the unexpected call, text, voicemail, or pop-up.
• Find the organization’s contact information on a statement, card, official app, or verified website.
• Do not share a password, one-time code, Social Security number, or bank information because a caller sounds convincing.
• When possible, ask the organization to leave a voicemail with a direct extension and verify through its main number.

Should I automatically block every unknown call?

Not necessarily. Automatic blocking can hide wanted calls from a new doctor, school, pharmacy, or delivery provider, and no setting can promise perfect protection. Begin with labels or screening, review filtered-call lists, and learn the trade-offs in the call-screening options guide. The Privacy Guide for U.S. households covers related account and privacy safeguards.