Caller ID Spoofing and STIR/SHAKEN: What Small Businesses Should Know
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A summary of FCC consumer and policy pages on caller ID spoofing and caller ID authentication (linked below), checked October 28, 2026. It is general information, not legal advice.
Two things can go wrong with caller ID for a small business. Scammers can fake your number, so strangers call back angry about calls you never made. And your legitimate calls can show up with a warning or not get answered. Both connect to the same FCC rules.
What spoofing is
The FCC's caller ID spoofing page defines spoofing as a caller "deliberately falsif[ying] the information transmitted to your caller ID display to disguise their identity." A common version is neighbor spoofing: the call shows a number that looks local, or similar to your own, so you're more likely to answer.
When spoofing is illegal, and when it isn't
Under the Truth in Caller ID Act, the FCC says its rules prohibit sending misleading or inaccurate caller ID "with the intent to defraud, cause harm or wrongly obtain anything of value." Illegal spoofing can bring penalties of up to $10,000 per violation.
The FCC also says spoofing is not always illegal. Its examples of legitimate use include a doctor calling from a personal mobile phone while showing the office number, or a business showing its toll-free callback number. Blocking your number so it shows as "unknown" is not spoofing.
If you make telemarketing calls, the FCC's rules require you to transmit a number (and, if possible, a name) for the business, plus a number people can call during business hours to ask not to be called again. See our guide to Do Not Call rules.
What STIR/SHAKEN does
STIR/SHAKEN is the industry's caller ID authentication framework. On its call authentication page, the FCC explains that calls crossing internet-protocol (IP) phone networks can have their caller ID "signed" as legitimate by the originating carrier and validated by other carriers before they reach the person you're calling. That lets the receiving phone company check that the call really comes from the number displayed.
What the FCC has required:
- In 2020, it required voice providers to implement STIR/SHAKEN in the IP parts of their networks by June 30, 2021.
- Since then, it has extended the obligation. Most providers now must use it, including gateway providers that bring in calls from abroad.
- Because STIR/SHAKEN works only on IP networks, providers on older technology must either upgrade or work on a non-IP authentication solution.
- All providers must file in the FCC's Robocall Mitigation Database.
What it means for your outgoing calls
Authentication supports carriers' blocking and labeling decisions, according to the FCC. The spoofing page adds that phone companies may block robocalls by default based on "reasonable analytics," and that the FCC has encouraged blocking providers to give callers a way to fix wrongful blocking.
Practical steps:
- Ask your provider whether it signs your outgoing calls through STIR/SHAKEN. This is especially worth asking if you use a VoIP or cloud phone service, or an app that places calls on your behalf.
- Show a number you actually control, such as your main line or your toll-free number, rather than a random one.
- If your calls show "Spam Likely," see our guide to business calls marked Spam Likely for the registration and remediation steps.
If scammers are spoofing your number
The FCC's advice if people call saying your number appeared on their caller ID:
- Explain that your number is being spoofed and that you did not make the calls.
- Consider a voicemail greeting that says the same thing.
- Expect it to pass. The FCC says scammers usually switch numbers frequently, often within hours.
Protect your voicemail too. The FCC warns that some voicemail services let anyone in who calls from your own number, so a spoofer could get into your messages. Set a voicemail password. You can file a complaint at the FCC's Consumer Complaint Center.
Train whoever answers your phones
Spoofed calls also target businesses, often pretending to be a bank, a vendor or a government agency. The FCC's tips apply at the front desk: don't give out account numbers or passwords on an unexpected call, hang up and call back on a number from a statement or the official website, and be wary of pressure to act immediately. Payment-change requests deserve the same caution. See business email compromise and payment-redirect scams.