The IRS Never Calls Like That — But the Number Said Otherwise

In 2019, the Department of Justice announced the takedown of a massive India-based call center scam that defrauded U.S. victims out of hundreds of millions of dollars. The callers impersonated IRS agents, and their secret weapon was simple: spoofing caller ID to display the actual IRS phone number on victims' screens. Thousands of people paid up — not because they were gullible, but because every trust signal pointed to legitimacy.

That operation wasn't a one-off. The FBI's Internet Crime Complaint Center (IC3) has consistently flagged caller ID spoofing as a key enabler of social engineering attacks. If you think your organization or your family is immune, I'd urge you to keep reading. Spoofing caller techniques have gotten cheaper, easier, and far more targeted since that takedown.

This post breaks down exactly how spoofing caller attacks work, the real damage they cause, and what practical steps you can take right now to protect yourself and your organization.

What Is a Spoofing Caller Attack?

A spoofing caller attack happens when a threat actor deliberately falsifies the information transmitted to your caller ID display. The goal is to make the call appear to come from a trusted source — your bank, a government agency, your CEO, or even a number in your own area code.

The technology behind it is disturbingly accessible. VoIP services and SIP trunking providers allow callers to set any outbound caller ID they want. Dedicated spoofing services sell this capability for pennies per call. There's no exploit needed, no malware involved. It's a feature of the telephone system being weaponized.

How It Differs From Robocalls

Robocalls are automated. Spoofing caller attacks are often live, human-operated social engineering. The attacker has done homework. They know your name, maybe your account number, and they're ready to manipulate you in real time. That human element makes these attacks dramatically more effective than a pre-recorded message.

The $4.88M Lesson: Why Spoofing Caller Scams Keep Working

IBM's 2024 Cost of a Data Breach Report pegged the global average cost of a data breach at $4.88 million. Social engineering — which includes vishing (voice phishing) enabled by caller ID spoofing — was among the top initial attack vectors. I've seen this play out firsthand in incident response work.

Here's what actually happens in a typical corporate spoofing caller attack:

  • The attacker spoofs the caller ID to display the company's IT help desk number.
  • They call an employee, claim there's a security incident, and demand immediate credential verification.
  • The employee, seeing a familiar number and hearing urgency, hands over their username and password.
  • The attacker uses those credentials to access internal systems, deploy ransomware, or exfiltrate data.

Multi-factor authentication can slow this down, but attackers have adapted. They'll social-engineer the MFA code in real time, or use SIM-swapping to intercept SMS tokens. The spoofed caller ID is just the door opener.

Real Tactics Threat Actors Use Right Now

Neighbor Spoofing

Attackers spoof a number with your same area code and prefix. You're far more likely to answer a call that looks local. The FTC has documented this tactic extensively and noted its effectiveness in bypassing consumer skepticism.

Authority Impersonation

Government agencies, banks, and hospitals are the most commonly spoofed entities. The attacker leverages the authority of the organization to create fear and urgency. "This is Agent Williams from the Social Security Administration. Your SSN has been compromised and will be suspended unless you verify your identity now."

Internal Help Desk Spoofing

This is the corporate nightmare scenario. The attacker spoofs your organization's own IT support line. Your employees have been trained to call that number for help — seeing it on caller ID feels completely safe. This tactic has been linked to high-profile breaches, including social engineering attacks against major tech companies in recent years.

Callback Scams

The attacker leaves a voicemail from a spoofed number and waits for you to call back. When you do, you reach the attacker's infrastructure — a fake bank IVR system, a fake government office. You initiated the call, so your guard is even lower.

How Can You Tell If a Caller Is Spoofing Their Number?

This is the question everyone asks, and the honest answer is: you often can't tell from caller ID alone. That's the whole point of the attack. But there are reliable warning signs:

  • Urgency and threats. Legitimate organizations don't threaten arrest or account suspension over the phone without prior written notice.
  • Requests for sensitive data. Your bank already has your account number. The IRS doesn't ask for gift card payments.
  • Pressure to stay on the line. Scammers don't want you to hang up and verify independently.
  • Callback test. Hang up and call the organization directly using a number from their official website. If it was real, they'll know about it.

The callback test is the single most effective defense against any spoofing caller attack. It costs you 60 seconds and can save you everything.

The STIR/SHAKEN Framework: Does It Actually Help?

The FCC mandated the STIR/SHAKEN caller ID authentication framework for major carriers. It assigns a cryptographic signature to calls, verifying that the calling number hasn't been tampered with. In theory, this should kill spoofing.

In practice, it has gaps. Smaller carriers and international calls often aren't covered. Attackers have shifted to VoIP origination points that bypass the framework. STIR/SHAKEN has reduced some high-volume robocall spoofing, but targeted, sophisticated spoofing caller attacks still get through. Don't rely on your carrier to protect you.

Protecting Your Organization: What Actually Works

Security Awareness Training That Covers Vishing

Most security awareness programs focus heavily on email phishing and barely mention phone-based attacks. That's a critical gap. Your employees need to experience simulated vishing scenarios, understand spoofing caller techniques, and practice the callback verification habit.

I recommend starting with a comprehensive cybersecurity awareness training program that covers social engineering across all channels — not just email. Voice-based attacks deserve equal attention.

Phishing Simulations That Include Voice Scenarios

Running phishing awareness training for your organization should go beyond email click rates. The best programs incorporate vishing simulations, teaching employees to recognize pressure tactics and verify caller identity before sharing any information.

Implement a Verification Protocol

Establish a clear policy: no sensitive information is ever shared on inbound calls. If IT calls an employee, the employee should hang up and call back on a verified number. If the CFO's office calls requesting a wire transfer, there's a secondary verification channel — a Slack message, an in-person confirmation, something the attacker can't spoof.

Zero Trust Applies to Phone Calls Too

The zero trust security model isn't just for networks. Apply it to communications. Never trust a caller based solely on their displayed number. Verify identity through an independent channel every time sensitive actions are requested.

What CISA and the FBI Recommend

CISA's guidance on cybersecurity best practices emphasizes that organizations should treat phone-based social engineering with the same seriousness as email phishing. The FBI IC3's annual reports consistently rank social engineering among the costliest attack categories, with losses in the billions annually.

Both agencies recommend layered defenses: employee training, verification procedures, MFA on all accounts, and rapid incident reporting when a suspected spoofing caller attack occurs.

Your 5-Minute Action Plan

You don't need a six-month project to start defending against spoofing caller attacks. Here's what you can do this week:

  • Brief your team. A 10-minute standup on caller ID spoofing awareness costs nothing and shifts behavior.
  • Institute the callback rule. No sensitive actions on inbound calls without independent verification.
  • Enroll in training. Get your organization into a structured security awareness program that covers vishing, credential theft, and social engineering holistically.
  • Report incidents. File spoofing complaints with the FTC and FBI IC3. This data drives enforcement.
  • Enable MFA everywhere. Even if an attacker gets a password through a spoofed call, MFA adds a critical barrier.

Spoofing caller attacks exploit the one thing technology can't easily patch: human trust. The caller ID system was built in an era when trust was reasonable. That era is over. Train your people, verify every call, and treat your phone with the same suspicion you'd give an unexpected email from a stranger.