Can a telephone caller be authenticated?

Question

If we assume that the human element is unable or not skilled enough to discover a phishing attempt (or some other malicious endeavor that can be perpetrated verbally), what forms of defense can be deployed to aid in the authentication of a telephone call?

Specific example - if a telephone call is coming from a spoofed number:

• Can it be detected?
• Can it be prevented?

Primarily interested in the userland (or the equivalent enterprise) context, meaning "below" the provider. Although any musings or explanations that involves or references the provider would certainly be interesting, even if not directly useful.

Media where I live enjoys claiming you can't "defend" against these types of attacks/spoofs using strictly technical means -- are they right?

Answer 1

In the plain old telephone system (and also avionic communication systems) authentication is built into the communication.

Key exchange is also done previously by meeting people. (In case of avionics by meeting pilots and the command center operators).

Authentication itself is done by human ear by recognizing the human voice.

(I am pretty serious. You cannot encrypt safety-critical hardware in avionics. A malfunction may happen in the air. The "safest" way is not to encrypt at all.)

Answer 2

The "regular" phone calls are not capable of that unless you are willing to ask the other person a password every time they get in touch with you. Using VoIP and various apps you can involve asymmetric key cryptography and such to authenticate and secure calls.

Answer 3

By the time your phone has received the call, "authentication" has already happened and failed to catch the spoof. Your phone trusts your phone company, which is telling it that the caller is calling from a number. Other than that, phones don't perform authentication against the other number, simply because there is no system in place that actually proves a number's "identity", like certificates for internet connections. The only technical deterrent for scam callers I am aware of is downloading an application with a blacklist of numbers that either warns the user or automatically drops the call if it is coming from a blacklisted number. It seems that scammers tend to spoof one number and use that for their cold calls, so this is actually pretty effective, but probably would not work against a scam targeted at the particular phone user (since they would use a fresh spoofed number).