CLI spoofing means presenting a caller ID you are not entitled to use. Presenting a number you own or are authorised to use is normally lawful, but spoofing to deceive is illegal in many countries, and regulators such as the FCC in the US and Ofcom in the UK now require carriers to verify, screen or block calls with untrustworthy caller IDs. Carriers and call centers need to know these rules because non-compliant traffic is blocked and can lead to fines.
Legitimate number presentation versus spoofing
A business often sends calls through several carriers while showing one main number, or a call center shows its client's number. This is generally allowed when the caller has the right to use the number and it can be called back. Spoofing is presenting a number you have no right to use: someone else's number, a random number, or a number made to look local to the person called. Your caller ID choices start with the route type, see CLI vs non-CLI routes and local CLI routes.
United States
- Truth in Caller ID Act: prohibits transmitting misleading or inaccurate caller ID with intent to defraud, cause harm or wrongfully obtain anything of value. The FCC can fine violators up to $10,000 per violation, and has issued forfeitures in the tens and hundreds of millions of dollars for large spoofed campaigns.
- STIR/SHAKEN: voice providers must sign calls on IP networks with an attestation level that says how well they know the caller's right to use the number. Details in STIR/SHAKEN explained.
- Robocall Mitigation Database: providers carrying US traffic, including foreign providers that send calls using US (NANP) numbers into the US, must file a certification and mitigation plan with the FCC. US providers may not accept such traffic directly from providers that are not listed.
- TCPA: automated and prerecorded voice calls need prior consent in many cases. Since a February 2024 FCC declaratory ruling, AI generated voices count as "artificial" voices under these rules.
United Kingdom
- Under Ofcom's General Conditions and CLI guidance, providers must make sure calls carry a valid, dialable caller ID that identifies the caller, and must block calls with invalid or non-dialable numbers.
- Since 29 January 2025, UK providers have been expected to identify and block calls from abroad that present a UK landline or non-geographic number, with limited exceptions such as UK mobile users roaming abroad.
- Ofcom has since moved to extend protection to calls from abroad that spoof UK mobile numbers. Check Ofcom's current guidance for the exact obligations and dates before routing traffic to the UK.
Other countries apply their own rules, from caller ID authentication frameworks to blocking of international calls with local CLIs. Treat this as a general overview, as of 2026, and check the regulator of each destination you serve.
What this means for wholesale traffic
| Situation | Risk |
|---|---|
| Calls to the US from a provider not in the Robocall Mitigation Database | US carriers must refuse the traffic |
| International call showing a UK landline number | Likely blocked by UK networks |
| Random or rotating caller IDs | Blocked, labelled as spam, or answered far less |
| Number the caller cannot prove it may use | Low attestation, blocking, possible enforcement |
| Call center using client numbers without documented authorisation | Traffic rejected during carrier checks |
Good practice for buyers and carriers
- Use only numbers you own or have written authorisation to present, and keep that evidence.
- Send caller IDs in full E.164 format, and make sure they can be called back.
- Tell your carrier your traffic type honestly, especially for dialer traffic and campaigns.
- Carriers: screen incoming traffic for invalid, unallocated and suspicious caller IDs, apply know your customer checks, and include in contracts the right to block non-compliant traffic. See KYC between carriers.
- Watch for Wangiri and other fraud that relies on misleading caller IDs.
VoIPMatcher sources VoIP termination from carriers that need to know your traffic type and caller ID practice. Describe them in your request and we match you with a suitable route: request a VoIP route.
Frequently asked questions
Is caller ID spoofing illegal?
It depends on intent and country. In the US, the Truth in Caller ID Act prohibits misleading caller ID used to defraud, cause harm or wrongfully obtain anything of value. Showing a number you own or are authorised to use, such as your main business line, is generally lawful. Many countries also require a valid, dialable number.
How can carriers detect CLI spoofing?
Carriers screen incoming calls for caller IDs that are invalid, unallocated, too short or inconsistent with the route, such as international calls showing a domestic landline. In the US they also check STIR/SHAKEN signatures and attestation levels. Know your customer checks and call pattern analysis help spot accounts that invent or misuse numbers.
How can a business stop its number being spoofed?
You cannot fully stop others from presenting your number, but you can limit the damage. Sign your calls with full attestation where STIR/SHAKEN applies, publish which numbers you call from, register your numbers with call analytics services where available, and report spoofing of your numbers to your carrier and the regulator.
Can a call center show its client's number?
Generally yes, if the call center has documented authorisation from the client to present that number and the number can be called back. Carriers increasingly ask for that evidence during onboarding. Without it, traffic can get low STIR/SHAKEN attestation in the US, be blocked, or be rejected during carrier checks.
What is the fine for caller ID spoofing in the US?
The FCC can fine up to $10,000 per violation under the Truth in Caller ID Act, and it has proposed or issued penalties in the tens and hundreds of millions of dollars for large spoofed robocall campaigns. Other federal and state rules, such as the TCPA, can add further liability for unwanted automated calls.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.