A little known telecommunications industry secret has been exposed in a big way. Just like email… telephone caller ID relies on the origination source to identify itself. Yes, The number that shows up on your caller ID isn’t the gospel truth - it could be a complete fake or a misrepresentation and that fact has a huge impact on court cases where caller ID data is used to prove stalking, harassment, and proof of consorting with drug dealers and other known criminals.

Who let the cat out of the bag? It all started innocently enough with the release to the open source Asterisk Voice over IP (VoIP) PBX software for Linux based operating systems. Asterisk is the powerful backbone to many popular VOIP solutions. Asterisk has a feature which allows the custom configuration of the phone number which is displayed on Caller ID. After all the caller ID is transmitted from the origination phone system so why not make that a customizable feature? This helps companies who have many outgoing phone lines display one unified number in which callers can return a phone call. Then along came a company called Spoof Card which uses this technology in an interesting way. Spoof Card allows a user to call a phone number (virtual calling card) and then input the phone number they wish to call and also input the phone number they wish to have appear on the caller ID, the call then connects.

Spoof Card’s market niche seems to be for prank calling and practical jokes. It even has a feature which allows you to disguise your voice. There have been reports of numerous illegal activities using spoof card including voice mail tampering (since some voice mail systems recognize administrative users by their Caller ID) and harassment.

Spoof Card makes Caller ID spoofing obtainable to the average person, and there soon could become an epidemic of illegal activities involving fraud, creative spoofers could pretend to be a bank, a collection agency, or a police officer, and fraudulently steal your money or identify. The call could even originate from a correctional institution pay phone and the victim would be none the wiser.

A warning to would-be criminals. Using Spoof Card or other means of spoofing Caller ID info can be traced. Phone companies are capable of tracing calls to their real source.

Here is how you can protect yourself against Caller ID spoofing:

1. Make sure your voice mail system *always* prompts for a password. Call your phone or wireless carrier to find out how to do this.

2. Never give out credit card or checking account information to someone calling you. If you want to make a payment over the phone for a service or to a collection agency, make sure you call them. To be even safer make sure you make payments over the Internet on an encrypted website, in person, or using the mail.
3. Never give out personal information over the phone to someone calling you. If a person identifies themselves as from a government agency or a police officer, call that agency and verify their credentials.

4. Don’t believe your Caller ID. It’s a useful tool but, it’s not foolproof.

APA Citation:
Smith, Nathan. M. (2007). Spoof Card Proves Caller ID isn’t Gospel.
Retrieved May 16, 2008, from http://www.computer-forensic-technician.com/wordpress/spoof-card-proves-caller-id-isnt-gospel/.