- Spoofing is illegal when done to defraud, cause harm, or wrongfully obtain anything of value. The FCC can impose up to $14,432 per violation, and fined one spoofer $6,000,000.
- FCC records show 60,873 calls through one provider from more than 2,812 U.S. caller IDs, many spoofing bank fraud and customer-service numbers. A bank's customers were defrauded of funds.
- In a bank-industry analysis cited by the FCC, more than half of 12,900 calls spoofing 47 large brands still carried A- or B-level authentication.
- Brands have options: providers may block calls that display a number used only for inbound calls, at the number holder's request.
What spoofing looks like from the brand’s side
A customer’s phone shows your fraud department’s number. The caller knows your name, sounds like your staff, and asks the customer to confirm a code or move money. To the customer, you called. That is the business model of caller ID spoofing: borrowing the trust a brand has built in its numbers.
The FCC’s own records show how it plays out. In a case decided on April 2, 2026, the Commission found that one provider carried 60,873 calls bearing more than 2,812 U.S. caller IDs from a foreign provider, many of them spoofing the fraud-prevention and customer-service numbers of Bank of America, Chase, and other institutions. The investigation began when a bank complained that callers were spoofing “the Financial Institution’s fraud reporting number contained on the back of the bank’s debit cards,” and that some customers had been defrauded of funds. The case is covered in our analysis of the FCC’s proposed fines.
Authentication has not solved it
STIR/SHAKEN was designed to flag calls with false caller ID. Yet in an American Bankers Association analysis cited by the FCC in May 2026, more than half of 12,900 calls that illegally spoofed numbers belonging to 47 large banks, retailers, and healthcare providers received A-level or B-level attestation. Why that happens is covered in our analysis of attestation.
What the law says
The Truth in Caller ID Act rule makes it illegal for anyone, in the U.S. or abroad when the recipient is in the U.S., to knowingly cause misleading or inaccurate caller ID to be transmitted “with the intent to defraud, cause harm, or wrongfully obtain anything of value.”
The penalty falls on the spoofer. The damage falls on the brand. FCC rules allow up to $14,432 per violation, and in September 2024 the FCC imposed a $6,000,000 forfeiture on the person behind spoofed AI robocalls to New Hampshire voters, which displayed a local political operative’s number without that person’s knowledge or consent. None of it restores the customers’ losses, the complaints, or the spam labels that land on the real number.
The FCC is also asking whether to prohibit spoofing of U.S. numbers on calls that originate abroad, and has proposed that gateway providers mark foreign-originated calls (FCC 25-76). Both remain proposals.
What brands can do
- Protect inbound-only numbers. FCC rules allow a provider to block calls that purport to come from a number when the number’s subscriber asks, because the number is used only for inbound calls. Fraud and customer-service lines printed on cards are prime candidates.
- See the spoofing. A brand cannot protect numbers it does not know are being abused. Monitoring shows which numbers are spoofed, when, and through which networks.
- Build evidence. Carriers, traceback investigators, and regulators act on documented calls, not complaints.
Questions to answer now
Brand and fraud leaders should be able to answer the following with confidence:
| # | Question for your leadership team | When |
|---|---|---|
| 1 | Which of our numbers are being spoofed right now, and how would we know? | Now |
| 2 | Which of our numbers only ever receive calls, and have we asked carriers to protect them? | Now |
| 3 | How quickly do customer reports of calls we never made reach our fraud team? | This quarter |
| 4 | Could we hand a carrier or investigator evidence of where spoofed calls enter the network? | This quarter |
Answering these questions takes visibility into your numbers across the network. The VoiceAlerts team can show you in a free 30-minute briefing.
Key dates
| Date | Milestone |
|---|---|
| Sep 30, 2024 | FCC imposes a $6,000,000 spoofing forfeiture over AI deepfake election robocalls. |
| Oct 29, 2025 | FCC proposes marking foreign-originated calls and asks about banning foreign spoofing of U.S. numbers. |
| Apr 2, 2026 | FCC proposes a $4.5 million fine in a case involving spoofed bank numbers. |
| May 21, 2026 | FCC cites industry data on attestation of spoofed brand calls (FCC 26-32). |
How VoiceAlerts helps
VoiceAlerts monitors how your numbers and brand are spoofed, impersonated, and labeled across the U.S. voice network, captures the calls that use them, and gives you evidence carriers and investigators can act on.
- Spoofing of your numbers, including inbound-only lines
- Captured calls that impersonate your brand
- Evidence carriers and investigators can act on
Common questions
Is caller ID spoofing illegal?
Under the Truth in Caller ID Act rule, 47 CFR 64.1604, it is illegal to knowingly cause misleading or inaccurate caller ID information to be transmitted with the intent to defraud, cause harm, or wrongfully obtain anything of value, including from outside the U.S. when the recipient is in the U.S.
What are the penalties for illegal spoofing?
FCC rules allow a forfeiture of up to $14,432 per violation. In September 2024, the FCC imposed a $6,000,000 forfeiture on the person behind spoofed AI deepfake robocalls to New Hampshire voters.
Can a business stop calls that spoof its number?
FCC rules allow a provider to block calls that purport to come from a number when the number's subscriber asks, because the number is used for inbound calls only (47 CFR 64.1200(k)(1)). Monitoring shows which numbers are being spoofed and where the calls come from.
How can VoiceAlerts help a brand whose numbers are spoofed?
VoiceAlerts monitors how a brand's numbers and name are spoofed and labeled across the U.S. voice network, captures the impersonation calls, and produces evidence carriers and investigators can act on.
Sources
- docs.fcc.govFCC 24-104: Steve Kramer, Forfeiture OrderReleased September 30, 2024
- docs.fcc.govFCC 26-22: Voxbeam Telecommunications, Notice of Apparent Liability for ForfeitureReleased April 2, 2026
- docs.fcc.govFCC 26-32: Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKENReleased May 21, 2026
- docs.fcc.govFCC 25-76: Advanced Methods to Target and Eliminate Unlawful Robocalls, Further Notice of Proposed RulemakingReleased October 29, 2025
- ecfr.goveCFR: 47 CFR 64.1604, Prohibition on transmission of inaccurate or misleading caller identification information
- ecfr.goveCFR: 47 CFR 1.80, Forfeiture proceedings
This article is for general information and is not legal advice. Proposed rules can change before adoption; check the FCC record for the final text.
