Caller ID spoofing: why your bank's real number just called you (and it wasn't your bank)
Scammers can make any number appear on your screen — including your bank's official helpline. Here's how caller ID spoofing works, why telecoms allow it, and the one rule that beats it every time.
You get a call. Your phone shows “HDFC Bank”. The caller knows the last 4 digits of your card. Everything checks out — except it’s a scam, and the number on your screen isn’t really who’s calling.
How spoofing actually works
When a call reaches your operator, it arrives with a Caller Line Identification (CLI) field — essentially a text label of who’s calling. On old copper phone networks that field was set by the switch at the origin, but on today’s VoIP-based systems any outbound gateway can write any number into the CLI field. There is almost no verification step in between.
Fraud operations rent VoIP trunks with permissive CLI, feed them a fake caller ID (often a real bank helpline, sometimes a Delhi police number, sometimes your own number), and fire out thousands of calls an hour. India’s STIR/SHAKEN-equivalent rollout is in progress but coverage is still uneven — especially for calls landing from outside the country.
What you cannot rely on
- The name on your screen (“SBI”, “RBI”, “Delhi Police”).
- The exact digit-for-digit match with a helpline printed on your card.
- Truecaller/PhoneLookup tags alone — a spoofed call inherits the real number’s reputation.
What you can rely on
The one rule that beats every spoofed call:
Never act on an inbound call. If it’s real, it will still be real when you hang up and call the institution back on a number you looked up.
This rule works because the direction of the call matters. When you dial out to a number printed on the back of your card, the call cannot be spoofed — you know exactly who is on the other end. When the call comes to you, you can never be sure.
Reporting spoofed calls
Forward the SMS (if any) to 1909, file the number on sancharsaathi.gov.in under the Chakshu portal, and tag the number on PhoneLookup so the community sees it on the next search. Even for spoofed calls the reports help — the same fraud operation tends to reuse the same spoofed identity for weeks.