What Is Caller ID Spoofing?
Caller ID spoofing is a technique that displays a phone number different from the actual source on the recipient's screen. Known as "Caller ID Spoofing" in English, it exploits VoIP (Voice over IP) technology to display any arbitrary number. By spoofing legitimate area codes or toll-free numbers, scammers create a false sense of trust. Numbers like 03, 06, and 0120 are frequently targeted for spoofing.
According to the National Police Agency, fraud losses involving caller ID spoofing amount to hundreds of billions of yen annually. Spoofing techniques grow more sophisticated each year, making it impossible to judge a call's legitimacy by the displayed number alone. Caller ID spoofing countermeasures can help you stay informed about the latest tactics.
How Caller ID Spoofing Works Technically
Caller ID spoofing is achieved by manipulating the SIP (Session Initiation Protocol) headers used in VoIP. The caller number is specified in the "From" header, which can be freely set by the sender.
In the traditional analog phone network (PSTN), the caller number was assigned automatically by the telephone exchange, making spoofing difficult. With VoIP, however, the caller can set any number via software, dramatically lowering the technical barrier. Some overseas VoIP providers do not verify caller numbers at all, creating a breeding ground for spoofing.
Tools Used for Spoofing
SIP client software, VoIP gateways, and overseas spoofing services are commonly abused. In some countries, "Caller ID Spoofing Services" are offered legally, and the lack of international regulatory consistency complicates the problem. Books on number spoofing countermeasures can be useful for educating family members.
Common Spoofing Scam Tactics
Impersonating Government Agencies
Scammers spoof the numbers of city halls, tax offices, pension offices, or courts to carry out refund fraud or extract personal information. They create urgency with claims like "You have unpaid taxes" or "There is an issue with your pension." Government agencies never request money transfers over the phone.
Impersonating Financial Institutions
By spoofing a bank or credit card company's real number, scammers claim "Unauthorized use has been detected" or "Your account will be frozen." They extract account numbers, PINs, card numbers, and one-time passwords from panicked victims. Financial institutions never ask for PINs or one-time passwords over the phone.
Impersonating Customer Support
Spoofing the support numbers of major carriers or e-commerce sites, scammers claim unpaid bills or account suspension. They typically demand payment via electronic money or prepaid cards.
Impersonating Police
By spoofing a police station's main number, scammers claim "Your account is being used for criminal activity" or "An arrest warrant has been issued." Police never instruct people to transfer funds over the phone.
Spoofing Family or Friends' Numbers
Spoofing a victim's family member's number and claiming an emergency - such as an accident or legal trouble - to demand urgent money transfers. Because the displayed number appears to be a family member's, victims are less likely to be suspicious.
How to Detect Caller ID Spoofing
While it is impossible to detect spoofing with 100% certainty, the following tips can help prevent victimization:
- Call back on the official number: If you receive a suspicious call, hang up and call back using the number listed on the organization's official website or documents. This is the most reliable way to detect spoofing.
- Be suspicious of requests for personal information: Legitimate financial institutions and government agencies never ask for PINs, passwords, or national ID numbers over the phone. Keep this in mind as a basic principle of phone number privacy.
- Watch for urgency tactics: Phrases like "Act now or your account will be frozen" or "Legal action will be taken today" are classic scam scripts.
- Check the number on a lookup service: Use phone number lookup services to check reviews and reports about the calling number.
- Pay attention to the payment method: Requests for payment via electronic money, prepaid cards, or cryptocurrency are almost certainly fraud.
- Notice unnatural call quality: Background noise, unnatural pauses, or delayed responses may indicate a spoofed call center.
Technical Countermeasures and Carrier Initiatives
STIR/SHAKEN Framework
Carriers are implementing STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs), a caller authentication technology that cryptographically verifies caller ID legitimacy. The originating carrier attaches a digital signature to the caller number, and the receiving carrier verifies it. Verified calls are displayed as "Authenticated," while unverified calls trigger a warning. Mandatory in the US since 2021, Japan's Ministry of Internal Affairs and Communications is also exploring adoption.
Spam Call Filters
Smartphone spam call filter apps cross-reference incoming numbers against databases of known spoofed and scam numbers, automatically warning or blocking suspicious calls. Carrier-provided spam prevention services are also effective.
Network-Level Carrier Measures
Major Japanese carriers are strengthening network-side detection and blocking of fraudulent caller IDs, including number verification at international gateways, bulk call detection, and blocking of known scam numbers.
Legal Regulations in Japan
Japan's Telecommunications Business Act regulates caller ID spoofing. Fraudulent spoofing violates this law, and when used for fraud, the Penal Code's fraud provisions (up to 10 years imprisonment) also apply.
However, enforcing Japanese law against spoofed calls originating overseas remains challenging. International investigative cooperation frameworks are being developed, but technical and legal hurdles persist. The Ministry of Internal Affairs and Communications is strengthening international coordination to address overseas spoofing.
What to Do If You Are a Victim
If you fall victim to fraud using caller ID spoofing, take the following steps immediately:
- Contact your financial institution: If money was lost, contact the recipient bank to request an account freeze. Under Japan's 振り込め詐欺救済法 (Bank Transfer Fraud Relief Act), you may be able to recover funds if a balance remains in the criminal's account.
- File a police report: Submit a report at your nearest police station. For non-emergencies, call #9110.
- Call the consumer hotline: Dial 188 to reach a specialist advisor.
- Preserve evidence: Save call recordings, call logs, SMS screenshots, and transfer receipts.
- Change compromised credentials: If you disclosed PINs or passwords, change them immediately. If credit card numbers were shared, request a card reissue.
Summary - Never Trust a Displayed Number at Face Value
Caller ID spoofing technology continues to evolve, and you cannot judge a call's legitimacy by the displayed number alone. If you receive a suspicious call, always call back on the official number. Share the principle of "if someone asks for personal information over the phone, suspect fraud" with your entire family. Also review how to handle anonymous calls, bank transfer fraud prevention, and how to report scam calls.