How CLI spoofing works
During a standard telephone call, the recipient sends the caller so-called CLI (Calling Line Identity): the number displayed on the screen. In digital networks, this number is merely a data parameter and can be set to any value in certain situations.
The attacker exploits this feature to appear as a different caller. Typical scenarios:
- Pretending to be a bank or government agency number for the purpose of fraud through social engineering.
- Falsifying a customer or business partner's number.
- Calls to employees impersonating management or a colleague: so-called vishing.
How anti-spoofing works
Operators and telephone service providers are implementing anti-spoofing measures at the network level. The basic principle involves verifying whether the caller actually owns or is authorised to use the number they present. If the number does not match the range assigned to that operator or SIP trunk, the call may be blocked or arrive without a displayed number.
Operators in the Czech Republic are demonstrably blocking calls from spoofed numbers originating from unverified sources. The mechanisms vary between operators and the situation is gradually evolving, cooperation among operators in this area is increasing.
Anti-spoofing and your business numbers
For business telephony, anti-spoofing has two levels:
- Protection of incoming calls - The operator's network filters some spoofed numbers, so employees are less exposed to phone-based attacks.
- Protection of your number - An attacker can spoof your company's number and call customers in its name. Correctly configuring CLI on the SIP trunk ensures that your legitimate outgoing calls pass the operator's verification.
It is important to set the outgoing CLI precisely to your company's assigned numbers. Attempting to display a number from another range may cause your call to be blocked or flagged as suspicious. You can configure the correct CLI on VirtualniUstredna.cz directly in the administration panel.
What to do if someone is impersonating your number
If customers report receiving calls from your number despite you not having made any calls, this may be CLI spoofing. In such cases:
- Inform your operator. They may record the incident and cooperate with the operator on the attacker's side.
- Warn customers that your number has been misused and advise them not to trust unexpected calls requesting sensitive information.
- Consider implementing multi-factor authentication for sensitive operations: a phone alone is not sufficient as the sole verification method.
Frequently Asked Questions
Can an attacker forge my company number?
Technically yes, CLI spoofing allows any number to be displayed. Operators block it in many cases, but it is not 100% protection. If customers report suspicious calls from your number, contact your operator and inform the customers.
How do I know if someone is spoofing my incoming number?
You will not reliably notice this during the call itself. Calling back the displayed number usually reveals that the actual owner of the number did not make the call. Operators deploy anti-spoofing at the network level, but filtering is not absolute.
Can anti-spoofing affect my outgoing calls?
Yes, if you send calls with a CLI that does not match your allocated number range, the operator may block them. Therefore, it is important to set the outgoing CLI exactly to the numbers assigned to your company and not attempt to display numbers you do not own.