Your phone rings. The screen shows the number printed on the back of your debit card. A calm voice from the "fraud team" says someone is trying to spend £900 in a shop in Leeds. You check the number again. It really is your bank's. So you keep talking.
That moment of checking the number and feeling reassured is exactly what the scammer planned for. The number was genuine. The call was not.
Here is the idea we want you to leave with: caller ID is a claim, not a proof. The number on your screen is information the caller's system sends along with the call. Most of the time it is honest. When it isn't, your phone has no way to tell you.
How spoofing works, without the jargon
When a call is made, the network passes along a number to display, a bit like the return address written on an envelope. Businesses rely on this legitimately: a call centre working for your energy supplier can show the supplier's main number rather than the number of the desk it is calling from.
The same flexibility lets a criminal write any return address they like. Internet phone systems make it cheap, and calls routed in from abroad have historically been the easiest way to slip a fake UK number past the checks.
Spoofing isn't limited to calls. Text messages can appear in the same thread as genuine messages from your bank or a delivery firm, because the sender name is also just a label. That is why a scam text sitting under last month's real one proves nothing.
What Ofcom has done about it
The UK has tightened the rules in two steps, and it helps to know which gap each one closes.
| Rule | What it covers | Status |
|---|---|---|
| Blocking calls from abroad showing a UK landline number | Calls entering the UK from overseas networks that display a UK landline number, with limited exceptions | In force since 29 January 2025 |
| Calls from abroad showing a UK mobile number | Calls that appear to come from a UK mobile roaming abroad; the caller ID should be withheld unless the number can be verified | Rules finalised by Ofcom in 2026, with networks given time to put them in place |
| Numbers that shouldn't be making calls | Networks are expected to block calls from invalid or unallocated numbers and numbers flagged "do not originate" | Part of Ofcom's guidance to providers |
The first step made a visible difference. When BT rolled out this kind of blocking voluntarily before it became mandatory, it reported stopping up to a million calls a day in the first month. Ofcom's research explains why the mobile gap matters: in February 2025, a quarter of people said they were likely to answer an unrecognised UK mobile number, compared with fewer than one in ten for an international number.
What the rules can't fix
What nobody tells you about the blocking rules is that they mostly target calls entering the UK from abroad. They are much less effective against a scammer using a UK-based phone service, or a number that genuinely belongs to someone other than the organisation they claim to be. And no rule can stop a caller who displays nothing suspicious at all and simply lies about who they are.
In practice, this means:
- A call showing your bank's number is more likely to be genuine than it was a few years ago, but still not certain.
- A call from an ordinary-looking UK mobile or 0333 number tells you almost nothing about who is behind it.
- A text in your bank's message thread can still be fake.
So the defence can't depend on spotting the fake number. It has to work even when the number looks perfect.
The one habit that beats every spoofed call
If you only do one thing, do this: never deal with an unexpected call about money on that call. End it and contact the organisation yourself, on a number you already trust.
- Hang up politely. A genuine fraud team will not mind. "I'll call the number on my card" is a normal thing to say.
- Use a number you found yourself: the back of your card, your statement, the official app or the website you type in yourself - never a number the caller gives you.
- For banks, dial 159. The Stop Scams UK service connects you to banks covering more than 99% of UK current accounts, and 159 never calls you.
- Wait a moment or use another phone before calling back, in case the line was held open.
- Check what the organisation says. If there was no fraud alert, you now know the first call was the scam.
This habit is dull, and that is its strength. It doesn't require you to be a good judge of voices, accents or technical details. It works against a spoofed number, a genuine number used by a criminal and a caller with no number at all.
Red flags that matter more than the number
Scammers change numbers constantly. Their script changes much less. Watch for what the caller wants:
- Moving money to a "safe account" - no genuine bank asks you to do this.
- Reading out a one-time passcode sent by text. That code is your signature on a payment, not a security check.
- Installing an app so they can "secure" your device.
- Keeping the call secret from branch staff or family.
- Pressure to act before you can hang up and check.
Any one of these is enough to end the call, whatever number is on the screen. The same logic applies to messages: a text "from your son" on a new number is spoofing of a different kind, which we cover in our guide to the Hi Mum scam.
If you think you've been spoofed
If you shared details or moved money, call your bank immediately using 159 or the number on your card. Banks and payment firms must reimburse most victims of authorised push payment scams under rules that took effect in October 2024, but acting fast still matters.
Then report it. In England, Wales and Northern Ireland, report to Report Fraud, the service that replaced Action Fraud. In Scotland, call Police Scotland on 101. You can forward the number that called you to 7726 as a text, and look it up on Who Rang to see whether others have had the same call.
If someone is using your number to make spoofed calls, people may ring you back angry. It isn't something you can switch off yourself. Tell your network, keep a note of the calls and, if it continues, consider asking for a new number.
Frequently asked questions
Can scammers really use my bank's actual phone number?
Yes. The number shown is supplied with the call and can be faked. Ofcom's blocking rules have made it harder for calls from abroad, but a matching number still isn't proof the call is genuine.
How do I know if a call is spoofed?
Often you can't tell from the call itself. The reliable test is to hang up and contact the organisation on a number you find yourself, such as the one on your card or 159 for your bank.
Is caller ID spoofing illegal in the UK?
Showing a different number isn't always unlawful - businesses do it legitimately. Using a false number to deceive people is misuse, and the scam behind it is fraud.
Does blocking the number help?
Only a little. A spoofed number can be changed in seconds, so blocking one rarely stops the next call. The habit of hanging up and calling back yourself protects you far better.
The bottom line
A familiar number on your screen is a claim made by whoever is calling. Ofcom's rules have made faking UK numbers from abroad harder, but no rule makes caller ID trustworthy enough to act on. When an unexpected call is about your money, end it and call back on a number you found yourself.