Someone is spoofing my business phone number: what one office learned

By the VentureTel team · Facts current as of November 2026 · About VentureTel

Short answer: If people say your business called them when nobody there did, your number is most likely being spoofed: someone is putting it on their own caller ID. Your number still belongs to you, and those calls never pass through your phone system. Here's how it played out for one of our customers, what to watch for, and why the industry's caller ID checks still miss some fake calls.

"Someone keeps calling him from your number"

A small professional-services office we work with got an upset call from a family member of one of their clients. The client kept getting calls that showed the office's number on caller ID, and he wanted to know why.

The front desk had already checked. Nobody in the office had called him. The staffer assumed the office number had been "jacked" and called us.

Our engineer explained that the number hadn't been hijacked and still belonged to the office. Someone was spoofing it, putting the office's number on calls made from their own equipment. "It's illegal, but it's doable," he told her.

Spoofed calls never touch our system, so there's nothing on the office's line to stop. Only the phone company that delivered the call to the person receiving it can start tracing it back up the chain.

Afterward, our team went through several days of the office's call records. There was only one real call to that client, a short ring with no answer, and every outbound call matched our own records. The account had not been compromised.

The staffer said it was the first case like this she'd heard of. The client, she said, "isn't the type to get phished," which is exactly why he kept asking.

Why this one stood out

Most spoofed calls are random: a robocaller borrows a local-looking number, dials thousands of people, and moves on. The FCC notes scammers usually switch numbers quickly, often within hours.

This was different. The calls went to a real client, again and again, using the number of a business he actually works with. To our team, that suggests the client's contact information leaked somewhere along the way, often in old breach data that keeps getting reused. "With AI in the mix, you have to be even more vigilant," our engineer said.

What businesses should watch for

• People say you called, but you didn't. The classic sign of spoofing. Note the date, time and anything they remember about the call.
• The same client is targeted repeatedly. Repeat calls to a real customer deserve a closer look than random spam.
• Calls that do show up in your own call history. Spoofed calls never appear in your logs. If the complained-about calls are in your records, or you see unexpected international calls or devices you don't recognize, contact your phone provider right away. That's a different problem.

How to prepare your team

• Give the front desk a calm answer: "We didn't call you. Someone is faking our number on caller ID. Please don't share personal or payment information with those callers."
• Check the records. Ask your phone provider to confirm whether the calls came from your account.
• Use a temporary greeting. The FCC suggests a voicemail message saying your number is being spoofed. VentureTel can set up a temporary "we didn't call you" greeting at no charge and switch it back once things quiet down.

Helping your customers

Whether and how to tell clients is a decision for your business to make internally, with your own advisors (legal, marketing, IT and so on). Some things to consider:

• A brief, calm heads-up can help people stay careful. A poorly worded one can cause worry or suggest your systems were hacked.
• If one client reports calls, a personal call back may be enough. If several do, you may want your IT provider to take a closer look.
• It can help to remind clients how you really contact them, and that if a call feels off, they can hang up and call you back at the number they already know.

Anyone who got one of these calls can file a complaint with the FCC at fcc.gov/complaints.

What the phone industry is doing: STIR/SHAKEN

The FCC requires voice providers to use a caller ID authentication framework called STIR/SHAKEN in their internet-based (IP) networks. The originating provider digitally "signs" the caller ID, and the receiving phone company checks it. The signature carries a trust level: the highest means the provider knows its customer and has verified their right to use the number; the lowest is used when the provider has no relationship with the caller, as at an international gateway. VentureTel has implemented STIR/SHAKEN for our customers' outbound calls.

Why it still isn't 100%

• It only works on IP networks. STIR/SHAKEN can't cross older, non-IP phone networks. The FCC requires providers still using that equipment to upgrade or work toward a non-IP solution, but calls passing through those segments can still arrive unsigned.
• Calls from overseas. Calls entering from foreign networks through a gateway may arrive with only the lowest trust level.
• A signature isn't a block. It tells the receiving phone company how much the originating provider vouches for the number. Carriers use that, with other analytics, to decide whether to label or block a call.

The system makes spoofing harder and easier to trace, but it can't stop a scammer from putting your number on their own calls.

FAQ