Caller-ID spoofing and smishing texts are two different problems with two different solutions. Most organizations treat them as one. Here’s how to address each layer.
Every organization that communicates with customers by phone is now a potential target for two related but distinct forms of attack. In the first, scammers spoof the organization’s caller ID so that victims see a trusted number on their screen. In the second, attackers distribute fraudulent phone numbers through phishing sites, fake business listings, text messages, and ads, tricking customers into calling a number the attacker controls. Both attacks use the organization’s name. Both result in fraud. And most organizations treat them as a single problem when they are not.
The scale of the infrastructure behind these attacks became visible when a coalition led by the UK Metropolitan Police dismantled iSpoof, a platform that allowed subscribers to spoof caller IDs and impersonate organizations. Over 12 months, iSpoof facilitated 10 million fraudulent calls globally. Scammers posed as representatives of Barclays, HSBC, Lloyds, NatWest, and Nationwide. Losses exceeded £100 million. The platform had 59,000 registered users, and at its peak, 20 people per minute were being contacted by someone impersonating their bank. iSpoof was a single platform. It was not the only one.
The problem has only accelerated, and it is not confined to banking. The FTC reported $2.95 billion in imposter scam losses in 2024, and the APWG’s Q1 2026 data shows why: phone-based phishing now accounts for 33% of all attacks, up from 5.9% just two quarters earlier. In January 2026, the New Jersey Department of Health warned residents about scammers spoofing the department’s own caller ID to extract personal information. When a state health agency is being impersonated alongside banks and retailers, the problem has outgrown any single industry’s response.
The organizations feeling this most acutely tend to be the ones whose service model depends on phone communication. They are also the ones least likely to have the resources to address it.
Why phone spoofing and smishing require different solutions
The frustration sounds like one problem: “people are getting scammed using our name by phone.” But it is actually two distinct problems with different root causes, different solution sets, and different vendors.
Problem one: caller-ID spoofing. A scammer makes a call that displays the organization’s real phone number on the recipient’s screen. The recipient answers because the number matches what they have saved for their bank, utility, healthcare provider, or government agency. This is a telecom-layer problem, closely related to the broader rise of vishing attacks. The spoofed number is injected at the carrier network level using VoIP infrastructure, and the organization whose number is being displayed has no visibility into it and no ability to stop it directly.
Problem two: smishing and fraudulent phone number distribution. A scammer sends a text message or builds a phishing page, a fake business listing, a fraudulent ad, or a social media post that includes a phone number controlled by the attacker. The victim calls or texts that number, believing it belongs to the organization. This is a brand impersonation problem. The fraudulent number is planted on web infrastructure that can be detected, reported, and removed.
Most organizations conflate the two because the outcome looks the same: a customer or constituent was deceived by someone using the organization’s name. But the solutions are completely different, and no single vendor covers both.
What helps with caller-ID spoofing
Caller-ID spoofing is a telecom infrastructure problem, and the solutions are primarily telecom infrastructure solutions.
STIR/SHAKEN call authentication is the industry framework designed to address this. Mandated by the FCC, it allows voice service providers to digitally verify that a caller’s displayed number matches their actual identity. When implemented fully, calls receive attestation levels (A, B, or C) that indicate the carrier’s confidence in the caller’s legitimacy. The challenge is that STIR/SHAKEN depends on carrier implementation, and implementation has been uneven. Legacy TDM networks cannot support the protocol, and the FCC has acknowledged that carriers sometimes lack the information to distinguish legitimate calls from spoofed ones.
Branded calling solutions go a step further. Services from providers like TransUnion, First Orion, and Hiya allow organizations to digitally sign their outbound calls so that recipients see the organization’s verified name, logo, and reason for calling, rather than just a phone number. This does not stop the spoofed call from being made, but it gives the recipient a visual indicator to distinguish the legitimate call from the fraudulent one.
Carrier reporting remains a necessary but limited step. Institutions and their customers can report spoofed numbers to carriers via the 7726 shortcode (“SPAM”) and file complaints with the FCC. America’s Credit Unions and the Bank Policy Institute have both pressed the FCC for stronger enforcement, including firm deadlines for legacy network migration and meaningful penalties for improper call attestations.
Customer and constituent education is the final layer on the telecom side. Organizations cannot prevent the spoofed call from arriving, but they can educate the people they serve on what they will and will not ask for by phone. The most common attack pattern, where the caller asks for one-time passcodes or login credentials under the guise of verifying identity, exploits the fact that many organizations do communicate with customers by phone, making the fraudulent call harder to distinguish from the legitimate one.
What helps with smishing and fraudulent phone numbers
The second problem, fraudulent phone numbers distributed through web infrastructure, is where brand protection intersects with phone fraud.
Attackers do not just send smishing texts. They plant fraudulent callback numbers across phishing sites, fake business listings on platforms like Google Maps, paid search and social ads impersonating the organization’s help line, social media posts posing as customer support, and forum replies on Reddit and Trustpilot offering “official” assistance. A single campaign typically distributes the same number across several of these surfaces simultaneously.
For this layer, the solution is not telecom infrastructure. It is working with brand protection providers that detect fraudulent content where the number appears and remove it before customers encounter it. The capabilities that matter: scanning at scale across web, social, ad, and business-listing platforms; extracting phone numbers from phishing content using OCR and content analysis; linking individual numbers to the broader campaign infrastructure so removal targets the entire operation rather than a single artifact; and managing carrier reporting, FCC complaints, and hosting-provider takedowns as a coordinated response.
The Bottom Line
Phone spoofing and smishing exploit the channel many organizations depend on most for customer communication. They are also two different problems that require two different solutions, and no single vendor covers both. Caller-ID spoofing is a telecom problem: STIR/SHAKEN, branded calling, and carrier reporting. Smishing and fraudulent phone number distribution is a brand impersonation problem: detecting and removing the web infrastructure where those numbers appear. The organizations addressing this effectively are the ones that recognize the split and staff both layers accordingly. The ones still struggling are trying to solve a telecom problem with a warning on their website, or a web infrastructure problem with carrier complaints alone.
Key Takeaways
Caller-ID spoofing is a telecom-layer problem. Solutions include ensuring STIR/SHAKEN A-level attestation on your outbound calls, adopting branded calling solutions that display your verified name and logo, reporting spoofed numbers through carrier channels and the FCC, and educating customers on what you will and will not ask for by phone.
Smishing texts link to fraudulent infrastructure (phishing sites, fake business listings, spoofed ads) that can be detected and removed. A brand protection partner that scans for your organization’s name across web, social, ad, and listing platforms can identify these campaigns and handle takedowns before customers reach them.
Because it is two problems, not one. Caller-ID spoofing operates at the telecom layer and requires carrier-level solutions. Smishing operates through web infrastructure and requires brand-protection-level solutions. No single vendor covers both, and most organizations conflate the two.
The APWG found that the telecom channel is now involved in 33% of all phishing attacks (Q1 2026). The FTC reported $2.95 billion in imposter scam losses in 2024. Government impersonation via spoofed numbers rose 31% in 2025. The iSpoof platform alone facilitated 10 million fraudulent calls in 12 months before being dismantled.
Ask whether the vendor covers caller-ID spoofing, smishing infrastructure, or both. For the telecom layer, evaluate STIR/SHAKEN support and branded calling. For the web infrastructure layer, evaluate detection coverage (web, social, ads, business listings), campaign-level linking, and managed takedown including carrier reporting and FCC filing.
