Post cover image
People on his phone tracking

October 20, 2026

The Caller ID You See Is a Lie: Inside Phone Spoofing and the Two Clever Ways to See Who Is Really…

Pick up your phone right now and look at the last five calls you missed. There is a very good chance that at least one of those numbers…

By Daniel Absi

17 min read

Pick up your phone right now and look at the last five calls you missed. There is a very good chance that at least one of those numbers never dialed you. The name on the screen was fake. The area code was fake. In some cases, the whole number belonged to a stranger who has no idea their line was used.

That is not a conspiracy theory. That is how the phone system has worked for about forty years, and it is the reason your bank, your grandmother, and your pizza place can all appear on your screen when none of them are on the other end.

Phone spoofing is one of the oldest tricks in the cybersecurity world. It is also one of the most misunderstood. In the next few minutes, you are going to learn exactly how it works, how someone could set it up with a free piece of software called Asterisk, why Kevin Mitnick (the most famous hacker in history) could unmask a blocked number in front of a live crowd of 800 people, and the two methods you can use to see who is really calling.

This is not a how-to for scammers. It is a defense briefing. If you understand how the trick works, you stop falling for it.

What Phone Spoofing Actually Is

Caller ID spoofing is the act of changing what shows up on the receiving phone when a call is placed. The caller tells the network, "display this number," and the network, in most cases, politely does what it is told.

That is the part most people miss. The phone number you see is not something your carrier verifies the way a bank verifies a signature. It is a text field that was filled in by whoever placed the call, passed down the line, and shown to you.

Think of it like the "From" address on an email. You can type anything into it. The email still gets delivered. The person on the other end sees whatever name you chose. The phone network does roughly the same thing with the Calling Party Number.

Why the Phone Network Believes a Lie

To understand spoofing, you have to understand a small piece of telecom history.

Caller ID was invented in the 1980s. Back then, every phone call traveled across physical lines owned by one of a few giant trusted carriers. The network had no reason to think a hospital, a police station, or AT&T itself would lie about their own number. So the system was built on trust. Whatever the originating switch sent, the terminating switch displayed.

Then VoIP (Voice over Internet Protocol) arrived. Suddenly, anyone with a laptop, an internet connection, and a few dollars could become their own phone company. They could send a phone call as data packets, format a SIP (Session Initiation Protocol) message exactly how they wanted, and set the "From" field to whatever they liked.

The network, built on trust, kept believing. That is still true in 2026. The industry is slowly moving toward a cryptographic solution called STIR/SHAKEN, which we will get to, but billions of calls still travel every month over infrastructure that does not challenge the caller's claim about their own number.

Phone Spoofing by the Numbers in 2026

Before we go deeper, look at the scale of the problem. These are the figures that explain why phone spoofing is not a side issue in cybersecurity. It is one of the biggest attack vectors in the world.

Americans received 52.5 billion robocalls in 2025, roughly 4 billion per month, and the pace held steady into 2026 with 4.3 billion in June alone, around 13 calls per person that month (YouMail Robocall Index, June 2026).

Total fraud losses reported to the Federal Trade Commission hit a record $15.9 billion in 2025 across 3 million reports.

Imposter scams, which almost always start with a spoofed caller ID, caused $3.5 billion in losses and were the top category of fraud for the fifth straight year (FTC, June 2026).

The median loss when a scam starts with a phone call is around $2,210 for older adults, higher than any other contact method (FTC Consumer Sentinel Network Data Book 2024).

In August 2025, the Federal Communications Commission effectively shut down more than 1,400 phone companies for carrying illegal calls.

A 2026 Truecaller survey found that 30 percent of US adults have received a deepfake voice call, where artificial intelligence was used to clone a voice they would normally trust.

Translation: your phone is now the most dangerous device you own. And the whole trick starts with that lying number on the screen.

Who Was Kevin Mitnick, and Why His Story Still Matters

Before we open the hood on Asterisk, you need to meet the man who did more to put caller ID in the spotlight than anyone else.

Kevin Mitnick was born in Los Angeles in 1963. He got into phone phreaking as a teenager, which was the hobbyist practice of exploring and manipulating telephone systems in the pre-internet era. By seventeen, he had talked his way into a Pacific Bell central office in Hollywood by social engineering the door code from a security guard. By his early twenties, he was breaking into the networks of Digital Equipment Corporation, Motorola, Sun Microsystems, Nokia, and Fujitsu.

He almost never did it for money. He did it for the puzzle.

Mitnick became the first hacker to appear on the FBI's Most Wanted list. He used a combination of genuine technical skill and an extraordinary ability to manipulate people, a discipline now called social engineering, to stay ahead of investigators for years. He spent two years as a fugitive, at one point hacking the FBI's own communications to monitor agents pursuing him. He was eventually caught in February 1995 in Raleigh, North Carolina, after security researcher Tsutomu Shimomura tracked his cellular signal across the city using a handheld detection device.

The part most people do not know is why the judge put him in solitary confinement while awaiting trial. The judge genuinely believed Mitnick could trigger a nuclear launch by whistling tones into a payphone. That is not satire. The urban legend around Mitnick had grown so large that the court physically separated him from any phone, fearing he could "influence" anyone within earshot.

After his release in 2000, Mitnick turned legitimate. He wrote The Art of Deception and Ghost in the Wires, ran Mitnick Security Consulting, and became one of the most sought-after keynote speakers in cybersecurity history. He passed away from pancreatic cancer in July 2023 at age 59.

His relevance to our story comes from a single moment at The Last HOPE conference in New York in July 2008. Mitnick walked on stage, put his iPhone on the projector screen, and announced his own number to the audience. He asked anyone to call him with a blocked number. After twenty seconds of hesitation from a crowd of security professionals who knew better than to expose themselves, one person called. Mitnick's screen showed the real number immediately. His method is explained below, in full technical detail.

How Phone Spoofing Works on Asterisk PBX

Asterisk is a free, open-source PBX (Private Branch Exchange) software package. Businesses use it to run their office phone systems, route calls, and manage voicemail. It is also, by design, extremely flexible about what caller ID it sends out, because real businesses have legitimate reasons to change it. A customer support team wants the main company number to display, not an agent's desk extension. A hospital wants the main switchboard number to show, not a doctor's private line.

That same flexibility is what makes Asterisk one of the most commonly referenced tools in cybersecurity training when demonstrating how spoofing works technically.

Here is the step-by-step at a conceptual level, written so anyone can follow it. This is here to help you understand what defenders see in packet captures and what attackers are actually configuring.

Step 1: You need a SIP trunk.

A SIP trunk is a phone line delivered over the internet by a VoIP provider. Reputable providers like Twilio, Bandwidth, or Vonage will refuse to carry a call with a caller ID that the account does not own. That is where legitimate spoofing stops. Less scrupulous overseas providers do not verify ownership. That is where the illegal variety happens, and it is also where the FCC spent 2025 disconnecting providers wholesale.

Step 2: You configure the trunk in sip.conf.

This file tells Asterisk how to connect to the VoIP provider. A trunk entry looks like this:

[my-trunk]
type=friend
host=sip.example-provider.com
fromuser=youraccount
secret=yourpassword
context=from-trunk

Step 3: You write a dialplan in extensions.conf.

The dialplan is the brain of the PBX. It decides what to do when any number is dialed. The relevant lines look like this:

[outbound]
exten => _1NXXNXXXXXX,1,Set(CALLERID(num)=5551234567)
exten => _1NXXNXXXXXX,n,Set(CALLERID(name)=Local Business)
exten => _1NXXNXXXXXX,n,Dial(SIP/${EXTEN}@my-trunk)

Line by line: if someone dials an 11-digit North American number, set the outbound caller ID number to 5551234567, set the display name to "Local Business," and send the call through the configured trunk.

Step 4: The call goes out.

The receiving carrier sees a SIP INVITE with a "From" header containing 5551234567. If the carrier does not challenge it, that number lands on the recipient's screen. The receiving party has no idea the number was set manually in a configuration file three lines up.

That is the entire mechanism. Four files. A few lines of configuration. A VoIP account that does not ask too many questions. This is why Mitnick told a CBS News reporter that a fifteen-year-old who knows how to write a simple script can find a VoIP provider that spoofs caller ID and set this up in about thirty minutes. The magic is that the VoIP provider allows you to set any caller ID and the other operators trust it, because caller ID is automatically trusted.

A word on legality. In the United States, doing this with intent to defraud, cause harm, or wrongfully obtain anything of value is a federal crime under the Truth in Caller ID Act of 2009, with fines up to $10,000 per violation and up to $1,000,000 per enforcement action. The FCC has pursued individuals and levied those fines. This section exists so defenders understand what they are looking at, not so attackers have a recipe.

STIR/SHAKEN: The Fix That Is Not Quite a Fix

In response to the robocall epidemic, the FCC mandated a cryptographic framework called STIR/SHAKEN. STIR stands for Secure Telephone Identity Revisited. SHAKEN stands for Signature-based Handling of Asserted information using toKENs.

The plain-English version: when a VoIP carrier originates a call, it digitally signs the caller ID with a cryptographic certificate from an authorized certification authority. That signature travels with the call. The terminating carrier checks it. Based on the result, the call receives one of three attestation levels:

A (Full Attestation) means the signing carrier knows the customer and verified they own the number being presented. The call is almost certainly legitimate.

B (Partial Attestation) means the carrier knows the customer but cannot verify that the specific number being presented belongs to that customer.

C (Gateway Attestation) means the carrier is just a transit hop passing the call through and makes no claims at all about the number.

If the attestation is C or missing, the call may show up on your screen labeled "Spam Likely" or "Scam Risk." Your phone carrier's spam filter uses this data, which is one reason those labels have become more common.

STIR/SHAKEN has helped at the margins. It is not a cure. The protocol depends on every link in the call chain behaving honestly. Some smaller domestic carriers received extension deadlines and were late to implement. Non-IP legacy networks were carved out entirely. Overseas providers sign calls with C attestation that US terminating carriers still accept. The FCC removed over 1,200 non-compliant voice providers from its Robocall Mitigation Database in 2025, but the gap between origination and authentication remains wide enough for billions of fraudulent calls to get through every month.

Can You See the Real Number Behind a Spoofed or Blocked Call?

Yes, often. There are two methods, and they exploit entirely different layers of the telephone network. One requires a VoIP account and an Asterisk box. The other does not even need a PBX.

Method 1: The P-Asserted-Identity Header (The Kevin Mitnick Method)

This is the exact technique Mitnick demonstrated at HOPE in 2008. He used Asterisk connected to a SIP trunk from Flowroute. The crowd saw blocked numbers reveal themselves in real time. Here is why it worked and how to replicate the logic.

The hidden field inside every SIP call

When you press star-67 before dialing, your carrier does two things. It replaces your number in the SIP "From" header with "anonymous@anonymous.invalid" and adds a "Privacy: id" header to the packet, which tells every downstream hop to respect your privacy request.

But the SIP standard that defines the Privacy header (RFC 3323, extended by RFC 3325) also defines a second identity field called the P-Asserted-Identity header, often shortened to PAI. This field was designed for a specific purpose: billing and trusted inter-carrier routing. It allows carriers to pass the verified originating number between network nodes that they mutually trust. The number in PAI is not shown to the end user. It is for the machines in the middle.

Mitnick's discovery was that certain SIP trunking providers, including Flowroute at the time, passed the P-Asserted-Identity header to their customers even when the caller had requested privacy. When a caller from the PSTN blocked their caller ID, Flowroute set the From header to "Anonymous" and included the Privacy flag, but it also forwarded the unedited PAI string to its customers. That string contained the real phone number.

The From header said Anonymous. The PAI header said the caller's actual number. Asterisk, configured to read it, showed the truth.

As the Voice over IP Security Alliance documented when analyzing Mitnick's demo, Asterisk was being configured to not respect the privacy headers and instead display the information in the P-Asserted-Identity header, which by RFC 3325 is intended to carry the real identity of the caller within a trusted network relationship.

What the raw SIP packet looks like

When a blocked call arrives at an Asterisk PBX through this kind of trunk, the raw INVITE packet contains both fields at once. A blocked call might look like this:

From: "Anonymous" <sip:anonymous@anonymous.invalid>;tag=abc123
Privacy: id
P-Asserted-Identity: "Caller Name" <sip:+14155551212@carrier.example.com>
P-Asserted-Identity: tel:+14155551212

The From header honors the privacy request. The PAI field does not.

Step-by-step: the Asterisk configuration

This requires a SIP trunk from a provider that passes PAI headers to downstream customers. Some providers still do this by default for reseller-level accounts. Others have closed it. You will need to test your provider.

Step 1. Open your sip.conf file and add the following to your inbound trunk peer definition:

[your-inbound-trunk]
type=friend
host=sip.yourprovider.com
context=from-trunk
trustrpid=yes
sendrpid=pai

The "trustrpid=yes" directive is the critical one. It tells Asterisk to use inbound Remote-Party-ID and P-Asserted-Identity headers as the authoritative caller identity rather than ignoring them. Without it, Asterisk discards PAI entirely and only shows you what the From header says, which for a blocked call is Anonymous. With it, Asterisk processes the PAI field and makes its value available to the dialplan.

Step 2. In your extensions.conf, add dialplan logic that reads and logs the PAI header before any routing happens:

[from-trunk]
exten => _X.,1,NoOp(--- Incoming Call Analysis ---)
exten => _X.,n,NoOp(From header: ${SIP_HEADER(From)})
exten => _X.,n,NoOp(P-Asserted-Identity: ${SIP_HEADER(P-Asserted-Identity)})
exten => _X.,n,NoOp(Privacy flag: ${SIP_HEADER(Privacy)})
exten => _X.,n,Set(PAI_RAW=${SIP_HEADER(P-Asserted-Identity)})
exten => _X.,n,Set(PAI_NUM=${CUT(CUT(PAI_RAW,@,1),:,2)})
exten => _X.,n,NoOp(Extracted real number: ${PAI_NUM})
exten => _X.,n,Dial(SIP/your-extension)

The NoOp lines write every value to the Asterisk console and the log file at /var/log/asterisk/full. When a blocked call arrives, you will see "Anonymous" in the From line and the actual number in the PAI line, printed one below the other.

The CUT logic on the PAI_NUM line extracts the bare phone number from the full SIP URI. The PAI value arrives formatted as "Caller Name" with a URI around it, for example "John Doe" [sip:+14155551212@carrier.example.com](mailto:sip:+14155551212@carrier.example.com). CUT(PAI_RAW,@,1) takes everything before the "@" symbol. CUT(result,:,2) takes the part after the colon, leaving the raw E.164 number like +14155551212.

Real-world practitioners confirm that when a carrier puts the real number in the PAI field while hiding it in the From header, the SIP_HEADER(P-Asserted-Identity) function retrieves the true caller ID, and since Asterisk 1.8 the system handles this automatically once trustrpid is enabled.

Step 3. Reload Asterisk for the changes to take effect:

asterisk -rx 'module reload'

Then watch your Asterisk console live:

asterisk -r

Place a test call with a blocked number. You will see the headers print in sequence.

Why this method has become harder since 2008

Flowroute eventually stopped exporting P-Asserted-Identity on blocked calls to any customer after Mitnick's exploit became widely known and documented. The underlying issue is not provider-specific, however. The problem sits at the interconnection points where calls enter the VoIP network from the public telephone system. Many smaller wholesale carriers, international transit providers, and regional SIP interconnects still pass PAI to downstream customers, either by design for wholesale or reseller accounts, or through misconfiguration.

Enterprise security teams running their own Asterisk boxes that receive traffic from those carriers can use this technique today. The visible caller ID is already known to be manipulated. The PAI is where the honest signal sometimes survives.

Method 2: The Toll-Free ANI Trick (No PBX Required)

The second method exploits a completely different part of the network and requires no PBX, no Asterisk installation, and no SIP configuration. You need a toll-free phone number and a way to receive it.

The difference between Caller ID and ANI

Caller ID, technically called CPN (Calling Party Number), is a service layer. It is the display name and number you see on your phone. The caller decides what goes in it. The network passes it along.

ANI (Automatic Number Identification) is a billing mechanism built into the SS7 signaling backbone that carriers use to settle charges with each other. It is injected by the originating carrier and travels through a separate signaling path from the Caller ID display. It is not the same thing as Caller ID. They are different signals on different paths, and blocking one does not block the other.

The FCC itself notes that while Caller ID can be blocked, ANI cannot be suppressed for toll-free calls, because the receiving party is the one paying for the call and is legally entitled to know who is calling them for billing purposes.

How the exploit works

When you dial an 800, 888, 877, 866, 855, 844, or 833 number, the toll-free subscriber is billed for the call. That billing requires the network to deliver the caller's real number to the subscriber through ANI, regardless of any privacy flag the caller set. The network essentially says: the person calling you has chosen to block their caller ID, but you are paying for this call, so here is who it is.

This creates a simple trap. If you own a toll-free number, any blocked call to that number gives you the real ANI. The caller's privacy setting is irrelevant.

Services like TrapCall, which Kevin Mitnick personally alpha-tested before its launch in 2009, turned this into a consumer product. TrapCall takes advantage of the loophole in telephone systems that allows toll-free numbers to receive the calling party's phone number regardless of whether it is blocked. The service instructs users to set up conditional call forwarding so that declined or missed calls route to TrapCall's own toll-free number. The blocked number is captured through ANI, and the call is forwarded back to the user's phone with the real number now visible, a process that takes about six seconds.

Step-by-step: building your own version

You do not need TrapCall. Any toll-free number you own does the same thing. Here is how to set it up yourself, with or without Asterisk.

The Asterisk version:

Step 1. Obtain a toll-free DID from a VoIP provider. Twilio, Bandwidth, Vonage, and most wholesale SIP carriers offer toll-free numbers for a few dollars per month.

Step 2. Point the toll-free DID at your Asterisk server's inbound context. In extensions.conf:

[from-tollfree]
exten => s,1,NoOp(--- Toll-Free ANI Capture ---)
exten => s,n,NoOp(Caller ANI: ${CALLERID(num)})
exten => s,n,NoOp(Caller name: ${CALLERID(name)})
exten => s,n,Answer()
exten => s,n,Wait(1)
exten => s,n,Hangup()

When a caller with a blocked number dials your toll-free DID, the ${CALLERID(num)} variable in Asterisk is populated from the ANI data delivered by the carrier, bypassing the caller's privacy setting. The real number appears in your Asterisk console and log file.

Step 3. To also forward the call back to yourself (replicating what TrapCall does), replace the Hangup line with a Dial command pointing to your main number:

exten => s,n,Dial(SIP/+15551234567@your-outbound-trunk)

Now the flow is: blocked call arrives on toll-free DID, Asterisk captures the real ANI in logs, call is bridged to your phone. You pick up and the screen shows the unmasked number.

The no-PBX version:

If you do not want to run Asterisk at all, use a cloud VoIP platform that exposes inbound call webhooks. With Twilio, set an inbound webhook URL for your toll-free number. When a call arrives, Twilio sends an HTTP POST to your endpoint with a "From" field populated from ANI. A few lines of Python or Node.js is enough to log it:

from flask import Flask, request
app = Flask(__name__)
@app.route('/incoming', methods=['POST'])
def incoming():
    caller = request.form.get('From', 'Unknown')
    print(f'Real caller ANI: {caller}')
    return '<Response><Hangup/></Response>', 200, {'Content-Type': 'text/xml'}

No PBX. No Asterisk. One endpoint. The "From" field in Twilio's inbound webhook for a toll-free number comes from ANI, not from the caller's Caller ID setting.

What this catches and what it does not

This method reliably unmasks callers who used star-67, permanent line blocking, or any consumer privacy feature that sets the standard Caller ID privacy flag. It works because ANI travels on a carrier-level billing path that the end user's privacy preference cannot touch.

What it does not reliably catch is a caller who directly spoofed their ANI. Spoofing ANI requires access to SS7 infrastructure or a rogue upstream carrier. It is a much more sophisticated attack than the standard caller ID spoofing that consumer scammers use. For the overwhelming majority of harassed, blocked, or anonymous calls, the ANI is honest.

How to Protect Yourself When Caller ID Cannot Be Trusted

Now the part that actually makes you safer.

Treat every incoming phone number as unverified until you prove otherwise. If your bank calls you, hang up and call back on the number printed on your physical card. If the IRS calls, know that they contact people by postal mail first and almost never make unsolicited phone calls. If your "grandchild" calls from an unknown number saying they need bail money, recognize that this is one of the AI voice cloning scams that cost US consumers billions in recent years.

Watch for the red flags that no legitimate caller ever uses. Pressure to act immediately. Requests to keep the call secret. Demands for payment in gift cards or cryptocurrency. Any instruction to stay on the line while you move money. Legitimate banks, government agencies, and businesses do not operate that way.

Enable your carrier's spam filtering. T-Mobile Scam Shield, Verizon Call Filter, and AT&T ActiveArmor are free and use STIR/SHAKEN attestation data to label suspicious calls before they reach you.

If you are receiving harassing calls, document the time, date, and any number shown. File a complaint with the FTC at reportfraud.ftc.gov and with the FCC at fcc.gov/consumers/guides/filing-informal-complaint. Spoofing with intent to harm, defraud, or wrongfully obtain anything of value is a federal crime under the Truth in Caller ID Act. The FCC has proposed fines of $25,000 per violation for individual bad actors and has levied fines approaching $1,000,000 in serious cases.

If you run any phone infrastructure, configure your inbound Asterisk trunks with trustrpid=yes and log all SIP headers by default. The visible caller ID is already the least trustworthy field in the packet. The PAI, the RPID, the Diversion header, and the Call-Info fields often tell you more than the number someone chose to display.

The Bottom Line

The caller ID on your phone is one of the oldest trust assumptions in modern technology, and it was never built to carry the weight you have put on it. The network was designed in a world of giant trusted carriers talking to each other. That world ended with VoIP, but the assumption of trust remained.

Phone spoofing is cheap, it is easy, and it is responsible for billions of dollars in fraud every year. But the same openness that makes the system easy to abuse also leaves fingerprints. The P-Asserted-Identity header that Mitnick read in front of 800 people in 2008 is still transmitted by many carriers today. The ANI that bypasses your privacy flag was always there, waiting for whoever owns a toll-free number to read it.

STIR/SHAKEN is helping at the edges. The real defense is not waiting for the protocol to fix everything. It is knowing the system well enough to never trust the number on the screen by itself.

Now you know how the trick works. Now you know where the truth is hidden. Share this with the people in your life who pick up every call because they are afraid of missing something important. The best social engineering defense has always been the same thing Mitnick himself sold for the last twenty years of his life: awareness.

Disclaimer: The technical configurations described in this article are for educational and defensive purposes. Using caller ID spoofing with intent to defraud, cause harm, or obtain anything of value is a federal crime under the Truth in Caller ID Act of 2009 and can result in fines up to $1,000,000 per enforcement action.

Sources