What Is Caller ID Spoofing?
Caller ID spoofing is a technique that displays a phone number different from the actual source on the recipient's screen. Known as "Caller ID Spoofing" in English, it exploits VoIP (Voice over IP) technology to display any arbitrary number. By spoofing legitimate area codes or toll-free numbers, scammers create a false sense of trust. Numbers like 03, 06, and 0120 are frequently targeted for spoofing.
National Police Agency figures for 2024 recorded 21,043 cases of the organized fraud category known in Japan as tokushu sagi, with losses of 71.88 billion yen, and in 79.0% of those cases the tool used to deceive the victim was a telephone. Caller ID spoofing is one of the tactics that abuse such calls, and the displayed number alone is never enough to judge whether a call is genuine.
How Caller ID Spoofing Works Technically
Caller ID spoofing is achieved by manipulating the SIP (Session Initiation Protocol) headers used in VoIP. The caller number is specified in the "From" header, which can be freely set by the sender.
In the traditional analog phone network (PSTN), the caller number was assigned automatically by the telephone exchange, making spoofing difficult. With VoIP, however, the caller can set any number via software, dramatically lowering the technical barrier. Some overseas VoIP providers do not verify caller numbers at all, creating a breeding ground for spoofing.
Tools Used for Spoofing
SIP client software, VoIP gateways, and overseas spoofing services are commonly abused. Providers that let the caller set any number they like also operate overseas, and the fact that the rules differ from country to country makes the problem harder to tackle.
Common Spoofing Scam Tactics
Impersonating Government Agencies
Scammers spoof the numbers of city halls, tax offices, pension offices, or courts to carry out refund fraud or extract personal information. They create urgency with claims like "You have unpaid taxes" or "There is an issue with your pension." Government agencies never request money transfers over the phone.
Impersonating Financial Institutions
By spoofing a bank or credit card company's real number, scammers claim "Unauthorized use has been detected" or "Your account will be frozen." They extract account numbers, PINs, card numbers, and one-time passwords from panicked victims. Financial institutions never ask for PINs or one-time passwords over the phone.
Impersonating Customer Support
Spoofing the support numbers of major carriers or e-commerce sites, scammers claim unpaid bills or account suspension. They typically demand payment via electronic money or prepaid cards.
Impersonating Police
By spoofing a police station's main number, scammers claim "Your account is being used for criminal activity" or "An arrest warrant has been issued." Police never instruct people to transfer funds over the phone.
Spoofing Family or Friends' Numbers
Spoofing a victim's family member's number and claiming an emergency - such as an accident or legal trouble - to demand urgent money transfers. Because the displayed number appears to be a family member's, victims are less likely to be suspicious.
How to Detect Caller ID Spoofing
While no method detects spoofing with complete certainty, the following habits make a suspicious call easier to notice:
- Call back on the official number: If you receive a suspicious call, hang up and call back using the number listed on the organization's official website or documents. Calling the displayed number back reaches whoever actually holds it rather than the person who called you, so you can check whether the caller was who they claimed to be. The Telecommunications Carriers Association also advises ending a suspicious call and calling back to verify it.
- Be suspicious of requests for personal information: Legitimate financial institutions and government agencies never ask for PINs, passwords, or national ID numbers over the phone. Keep this in mind as a basic principle of phone number privacy.
- Watch for urgency tactics: Phrases like "Act now or your account will be frozen" or "Legal action will be taken today" are classic scam scripts.
- Check the number on a lookup service: Use phone number lookup services to check reviews and reports about the calling number.
- Pay attention to the payment method: Requests for payment via electronic money, prepaid cards, or cryptocurrency are almost certainly fraud.
- Notice unnatural call quality: Background noise, unnatural pauses, or delayed responses may indicate a spoofed call center.
Technical Countermeasures and Carrier Initiatives
STIR/SHAKEN Framework
STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs) is a caller authentication technology for carriers that cryptographically verifies caller ID legitimacy. The originating carrier attaches a digital signature to the caller number, and the receiving carrier verifies it. Verified calls are displayed as "Authenticated," while unverified calls trigger a warning. The framework is deployed by carriers in the United States.
Spam Call Filters
Smartphone spam call filter apps cross-reference incoming numbers against databases of known spoofed and scam numbers, automatically warning or blocking suspicious calls. Carrier-provided spam prevention services are also effective.
Network-Level Carrier Measures
In Japan, the Telecommunications Carriers Association has set up a study group on caller ID spoofing and issued a guideline on countermeasures against spoofed caller ID display, alongside a guideline on applying the government policy for preventing the transmission of a different telephone number. Both reach beyond carriers that hold assigned telephone numbers to resellers and call-forwarding service providers, and they set out how carriers should handle caller ID.
Legal Regulations in Japan
On April 21, 2008 the Ministry of Internal Affairs and Communications published its policy on the application of the ordinance for preventing the transmission of a different telephone number, and carrier practice for sending caller ID is organized around it. Where a spoofed number is used to deceive someone into handing over money or property, the fraud provisions of the Penal Code apply, carrying imprisonment of up to 10 years.
However, enforcing Japanese law against spoofed calls originating overseas remains challenging. Technical and legal hurdles remain, which is why the habit of never taking a displayed number at face value is such an important line of defense.
What to Do If You Are a Victim
If you fall victim to fraud using caller ID spoofing, take the following steps immediately:
- Contact your financial institution: If money was lost, contact the recipient bank to request an account freeze. Under Japan's Furikome Sagi Kyusai Ho (Bank Transfer Fraud Relief Act), you may be able to recover funds if a balance remains in the criminal's account.
- File a police report: Submit a report at your nearest police station. For non-emergencies, call #9110.
- Call the consumer hotline: Dial 188 to reach a specialist advisor.
- Preserve evidence: Save call recordings, call logs, SMS screenshots, and transfer receipts.
- Change compromised credentials: If you disclosed PINs or passwords, change them immediately. If credit card numbers were shared, request a card reissue.
Summary - Never Trust a Displayed Number at Face Value
Caller ID display can be manipulated technically, so you cannot judge a call's legitimacy by the displayed number alone. If you receive a suspicious call, always call back on the official number. Share the principle of "if someone asks for personal information over the phone, suspect fraud" with your entire family. Also review how to handle anonymous calls, bank transfer fraud prevention, and how to report scam calls.