Phone number spoofing: why blocking does not work and what your business can do instead

A customer calls you back after a missed call, but nobody at your company called them. Or the other way around: a customer receives a call that claims to be from your business, with your number on screen, while you know nothing about it. Both situations have the same cause: number spoofing. With ordinary calling software, a caller can simply type in which number appears on the recipient's screen, and almost any number can be misused, including yours.

For organisations that talk to customers by phone, this is not only a problem for the person whose number is being misused. It affects trust in phone contact in general, and with it, trust in the calls that genuinely do come from you.

How spoofing actually works

The signalling protocol that phone networks use to pass on caller numbers is decades old and was never designed with verification in mind. Calling software, often tied to internet telephony, lets the caller freely set the displayed number. Some of the abuse runs through small foreign VoIP providers where an account can be created without a real number, proof of identity, or a subscription. That is where the structural gap sits. As long as such providers do not check who is calling and with which number, spoofing stays possible, regardless of what Dutch providers do on their end.

That is also why spoofing has persisted for years without ever being fully solved. The problem does not sit with a single provider you can hold accountable, but in the structure of international call traffic itself. Cyber specialists point out that a watertight technical fix is not on the horizon for now, and that changing the behaviour of callers and recipients matters at least as much as technology does.

Why blocking solves nothing

An obvious reaction is to block the number that called. That does not work here, because the displayed number is not the number that actually placed the call. A spoofed number also cannot receive calls itself, which is a useful test. If a call looks suspicious, hang up and call back yourself on the number you already know, for example your bank's or supplier's, instead of pressing call back.

Large Dutch providers maintain blocklists, mainly for frequently spoofed bank numbers. According to cyber specialists, those lists are often incomplete. They are not always updated quickly, and with some providers such a list is easy to bypass.

What the regulator can and cannot do

Spoofing is prohibited in the Netherlands under the Telecommunications Act. The Authority for Consumers and Markets can act against parties that misuse Dutch or European numbers, for example by having an abused number withdrawn once misuse has been established. Once parties operate outside the European Union, that authority stops, and a significant share of the abuse starts exactly there. A bill that would tighten number policy has been in the works for some time: it is meant to clarify more precisely who may use which number in the call chain, and to restrict the use of Dutch numbers from abroad. Until that bill is actually in force, practice on this point remains vulnerable.

For organisations, this means you cannot wait for legislation or regulators to solve the problem. Much of the responsibility for protecting customers from confusion about who is really calling sits with the organisation itself.

What it means for your customer contact

Suppose scammers use your business name or number to call customers about an outstanding invoice or an expired subscription. The damage is not limited to the direct victim. Customers who experience this, or hear about it from colleagues or the news, grow wary of every call that claims to come from you, including the legitimate calls from your own customer service or sales team. That costs you response speed on genuine calls, and in the worst case it costs you reputation with customers who no longer dare to pick up.

The same applies the other way around. If your customer service still calls from loose consumer apps or varying numbers, a customer cannot tell that apart from a spoofing attempt. A recognisable, consistent number, paired with a predictable way of calling, is therefore not a marketing detail but a tool for holding on to trust.

What you can do now

A few measures are within reach. Set up outbound calling through a professional telephony environment with one fixed, registered number per team or department, instead of loose apps or personal phones with varying caller ID. Announce phone contact in advance where possible, via email or text, so a customer can verify an incoming call before answering it. Agree on a fixed rule within the team: never ask for a password, a payment, or software installation over the phone, and state that explicitly to customers too, for example on the website and in the confirmation email after an order. When in doubt, explain that anyone can always call back on a known number instead of trusting an incoming call.

Organisations that set up their telephony professionally, with a clear number structure, a steady partner for management, and a clear protocol for the team, make it easier for customers to tell a genuine call apart from a spoofed one. Zarioh is happy to think along about a telephony setup that supports that trust alongside everyday convenience.