Why you cannot trust caller ID, even when it shows your bank's real number

The name and number on your phone screen look like facts. They are closer to a label the call arrived with. This post explains where that label comes from, what the United States’ main fix for fake labels does, and what it does not, using the Federal Communications Commission’s (FCC) own descriptions. It is an explainer, not legal or financial advice, and it does not describe how to fake a number.

Where caller ID comes from

The FCC’s history of the system is short. In the 1980s, advances in technology let the calling side’s phone company send the originating number along with a call, so the receiving company could show it to you. For the first time, consumers could see who was calling before answering. The FCC notes that “scammers and other bad actors” then learned to spoof numbers.

The FCC defines spoofing as a caller deliberately falsifying the information sent to your caller ID display to disguise their identity. The two forms it highlights are neighbor spoofing, where the number looks like your own or a local one, and spoofing the number of a company or government agency you already trust. The FTC adds that scammers can make any name or number appear, “the IRS, a business you know, or even your own number.” Our glossary entry on spoofing covers the term.

Spoofing is not automatically illegal. The Truth in Caller ID Act bars sending misleading caller ID information with intent to defraud, cause harm or wrongfully obtain anything of value, and the FCC gives legal uses such as a doctor’s office number displayed from a personal mobile.

What STIR/SHAKEN is

STIR/SHAKEN is the FCC’s answer to number faking. The name stands for Secure Telephone Identity Revisited and Signature-based Handling of Asserted Information Using toKENs. In plain terms, the phone company that puts a call onto the network “signs” the caller ID, and the phone company that delivers it checks the signature. The FCC says this lets the receiving company verify that a call is from the number displayed.

The FCC adopted rules in 2020 requiring providers to implement it on the internet-protocol (IP) parts of their networks by 30 June 2021, and has widened the obligation since. The signing company also states how much it knows, with an attestation of A (it knows the customer and their right to use the number), B (partial) or C (it is only a gateway for a call that began elsewhere). A call with an A attestation carries the best available assurance that the number has not been spoofed. Calls with B or C are not necessarily spoofed, but lack that assurance.

What it does not do

The FCC is direct about the limits. Its October 2025 proposal says call authentication can help consumers by showing whether a number is spoofed, but “it often does not let them know who is calling.”

Three limits follow from the FCC’s own documents.

• It works only on IP networks. Some calls arrive with no authentication because parts of the national network have not moved to IP. An industry study cited by the FCC found large providers use STIR/SHAKEN on 86% of the traffic exchanged between them, which leaves the rest.
• It checks the number, not the speaker. A verified number tells you the call came from the line it claims. It does not tell you the person on it is honest. Commenters in the FCC’s proceeding noted that many calls with an A attestation are spoofed, fraudulent or otherwise unlawful, and the FCC itself says consumers might wrongly read a green checkmark as proof a call is not a scam.
• Caller names are a separate weak point. The FCC says the older databases that supply the name shown on your screen are reportedly not reliably accurate and are open to manipulation. It has proposed rules for verified caller names. That is a proposal; we did not find a final rule in the sources reviewed.

The FCC also tells consumers that a “local” number does not necessarily mean a local caller.

Why your bank’s real number can still be fake

The FDIC’s Office of Inspector General warns of spoofed calls in which the phone number appears to be the bank’s own name and number. Its warning is aimed at business customers, and the caller says there is fraudulent activity on the account. The OIG adds that consumers may get similar calls. The SEC and FBI describe the same move in investing: impersonators may call “from a spoofed phone number that appears connected” to the firm they are copying. Our page on bank impersonation and safe-account scams shows where this call usually leads.

Scale matters here. The FCC’s proposed penalty against an auto-warranty robocall operation alleged it used 1,051,461 different caller ID numbers in a three-month period, and spoofed hospital numbers, so confused people called the hospitals to complain. Those are allegations, and our case page has the detail. The point is that a number you recognise was cheap to display.

The FTC’s summary is the one to keep: it can be nearly impossible to tell whether caller ID information is real.

The one habit that works

Hang up, then call a number you found yourself. The FCC says to hang up and call the number on your account statement, in the phone book, or on the company’s or agency’s website. The FDIC OIG says to verify by calling the number on the bank’s website and not to redial the number that called. The back of your card is the usual place to find the same number.

Two refinements come from non-US agencies.

• Wait, or use another phone, if you are on a landline. NI Direct says scammers can keep a line open, so a “new” call reaches them, and advises waiting 20 minutes and using a different phone if possible. Consumer Protection BC says this trick affects landlines and not mobile phones.
• In the UK, dial 159. Stop Scams UK describes it as a short code connecting you to your bank, and says it cannot be spoofed or impersonated. See the UK reporting page.

If you have already shared details or moved money, the US reporting page lists where to report. The FCC accepts complaints about spoofing, though it says it does not resolve individual unwanted-call complaints and uses them to inform policy and enforcement.

What we could not verify

We found no source measuring how many bank-impersonation calls arrive showing a genuine bank number, or how often STIR/SHAKEN has stopped one. The FCC’s statements describe what the system is designed to do and where it falls short, not a count of scams prevented. The FCC’s proposals on caller names and foreign call labels are described as proposals only.