Can Scammers Spoof a Real Person's Phone Number?
Can Scammers Spoof a Real Person's Phone Number?
The call comes in and the screen says it's your mom. Or your bank. Or, in the strangest version of this trick, your own number, calling you.
You know you're not calling yourself. So who is?
Yes, any number, including yours
Short answer: yes. A caller can display any number they want, and "any" includes numbers that belong to real people. Your mom's. Your doctor's office. A government agency. A local business you actually use. If the number exists, it can be borrowed.
This isn't a hack of anyone's phone. Nobody broke into your mom's cell to call you. The number was never attached to the call the way you think it was. It was written on the envelope, and anyone can write anything on an envelope.
Why caller ID can't prove who's calling
Caller ID was built as a courtesy, not a credential. When a call connects, the network mostly trusts whatever number the caller claims to be calling from. There's no identity check on the way in. The system was designed for an era when placing calls required owning real phone infrastructure, so lying about your number wasn't worth much.
VoIP ended that era. Today an auto-dialer can stamp any number on a call for free, in bulk, a different one per call if it wants. The technology that made calling cheap also made lying about who's calling cheap.
So when the screen says it's your bank, what it's really telling you is: the caller chose to show you your bank's number. That's the entire amount of information you actually have.
When your number is the disguise
Here's the side of this that nobody warns you about. The same trick works in reverse, and your number can be the costume.
If you've ever gotten a call or a text from a stranger demanding to know why you called them, you've lived it. Somebody used your number to dial them. They saw a real local number, called it back, and got you. Now you're both confused and neither of you did anything.
You can't stop it. There's no setting on your phone and no request you can file with your carrier that prevents someone from putting your number on their outgoing calls. Most of the time it passes on its own: the caller rotates to a fresh number and the angry callbacks taper off within days. But the underlying capability doesn't go away. Your number is borrowable, permanently, by anyone.
What you can do about it, and where the advice runs out
The standard advice is correct and worth following. If a call claims to be your bank, hang up and call the number on the back of your card. Never trust caller ID when the stakes are real. If your number is the one being spoofed, let the callbacks go to voicemail and wait it out.
Notice what all of that has in common, though. Every piece of it puts the work on you, after the call has already reached you. Verify this. Stay suspicious of that. The call still rang. You still had to make a judgment with a forged label as your only input.
What has to change instead
The flaw isn't that a specific number turned out to be fake. It's that we treat a self-reported label as proof of identity, then act surprised when people lie on it.
A real fix doesn't ask you to get better at spotting borrowed numbers. It stops requiring you to care which number is calling at all. If reaching you required proving you were invited, the number on the screen could say anything and it wouldn't matter. The costume only works because looking trustworthy is currently enough to earn a ring.
This is what Haloa does instead
Haloa requires unknown callers to enter an access code before a call connects. Trusted contacts ring through exactly like they always have, no code, no friction. Everyone else has to know the code, which means a caller spoofing your mom's number gets stopped cold: the number is a costume, but the code isn't in the costume's pockets.
It works in both directions too. When a call shows a real person's number, you're not stuck deciding whether the label is lying. Either the caller can get in or they can't, and the digits on the screen have nothing to do with it.
Caller ID was never an identity system. We just used it like one for fifty years. It's the same reason calls from your own area code aren't really your neighbors, and the same reason blocking the number afterward can't keep up: the number was never the thing proving anything.