Stop Call Spoofing

TL;DR

Call spoofing happens when someone changes their caller ID to hide their number or pretend to be someone else. It’s often used for scams. This guide shows you how to block spoofed calls, report them, and protect yourself.

Blocking Spoofed Calls

1. Check Your Phone’s Built-in Features: Most smartphones have some built-in call blocking options.
   • Android: Open the Phone app, tap the three dots (menu), and select Settings. Look for options like ‘Caller ID & spam’ or ‘Block numbers’. You can often block unknown callers or recent numbers.
   • iPhone: Go to Settings > Phone > Blocked Contacts. You can manually add numbers here, but it doesn’t automatically block spoofed calls. Use the ‘Silence Unknown Callers’ feature (iOS 13 and later) which sends calls from numbers not in your contacts directly to voicemail.
2. Use a Call Blocking App: Several apps can help identify and block spam/spoofed calls.
   • Truecaller: A popular app that identifies callers and blocks spam. It relies on community reporting.
   • Hiya: Similar to Truecaller, offering caller ID and blocking features.
   • RoboKiller: Uses answer bots to waste scammers’ time. (Paid service).
3. Contact Your Phone Provider: Many phone companies offer free or paid services to block unwanted calls.
   • BT Call Protect: BT offers a call screening service.
   • Vodafone Scam Shield: Vodafone provides features to block nuisance calls.
   • Sky Talk Shield: Sky has options for blocking and filtering calls.

Reporting Call Spoofing

1. Report to Action Fraud: This is the UK’s national reporting centre for fraud.
   • Visit Action Fraud or call them on 0300 123 2040.
   • Provide as much detail as possible about the call, including the number (even if it’s obviously fake), date, and time.
2. Report to Ofcom: The UK’s communications regulator.
   • While Ofcom doesn’t investigate individual calls, they use reports to understand the scale of the problem and take action against companies breaking regulations.
   • Use their online complaints form.

Protecting Yourself

1. Don’t Answer Unknown Numbers: If you don’t recognise the number, let it go to voicemail.
2. Be Wary of Requests for Personal Information: Legitimate organisations will rarely ask for sensitive information (bank details, passwords) over the phone.
3. Hang Up Immediately: If a caller asks for personal information or tries to pressure you, hang up right away.
4. Check Your Voicemail Greeting: Avoid including too much personal information in your voicemail message.
5. Be Careful with Online Forms: Don’t enter your phone number on suspicious websites.

Technical Considerations (For Server Administrators)

If you run a server that makes outbound calls, ensure you are following best practices to prevent spoofing:

1. Implement STIR/SHACKLE: These protocols verify the caller ID information.
   • STIR (Secure Telephone Identity Revisited) and SHAKLE (Signature-based Handling of Asserted information using tokens) are standards designed to combat call spoofing.
   • Your VoIP provider may offer STIR/SHAKLE support; check with them.
2. Verify Caller ID: Ensure the caller ID you’re sending is legitimate and matches your organisation.
3. Monitor Outbound Calls: Regularly review outbound call logs for suspicious activity.