4

This question already has an answer here:

To be specific the main problem is that I want to detect if the caller ID of the incoming cal I get is real or spoofed? Most VoIP servers now allow their clients to use any caller ID they want. Also, before the caller hears the ring no authentication is made by the operator (for example, Vodafone or O2) to check if the caller ID is valid or spoofed.

I found something an Android app called CallerDec that has ability to check if the caller ID is valid only if the caller (not attacker) has also installed CallerDec by a verification call.

But it is not enough and it won't work if the real caller hasn't installed that app. Many banks now allow full access to someone's account by just verifying the caller ID of the caller and the debit or credit card number associated with that caller ID. I am sure they must be aware of caller ID spoofing and have some special process for identifying spoofing.

There is a proprietary service TrustID available for business users that guarantee to detect if a caller ID is spoofed or real but as it is closed source we can't know how it works.

marked as duplicate by WhiteWinterWolf, Neil Smithline, Alexander O'Mara, Anders, Iszi Jul 5 '16 at 19:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 3
    There are not much countermeasures against caller ID spoofing. Best countermeasure is not to rely on it and consider it an "untrusted data". – user1164108 Feb 8 '15 at 18:08
  • Can you mention some of the countermeasures? – Ashish Feb 8 '15 at 18:14
  • Are you sure than banks verify caller ID and not simply the phone number itself? – schroeder Feb 8 '15 at 22:13
  • @schroeder I didnt say all banks verify that. Some banks verify AccountNumber+call in PIN, some verify CardNumbe+ATM PIN+ExpiryDate. But there are some banks (eg. BOA) that only verifies caller ID of the user & card number. If the card no.entered by caller on the IVR is associated with the phone no. of the caller (means the caller ID) then the caller is given access to that account. But they must be using some technique/system to verify spoofed call cuz no bank would ever setup this kind of verification.. – Ashish Feb 9 '15 at 0:38
  • 1
    CallerID and phone number are completely different things. Spoofing a phone number is going to be difficult because it is used to route the calls. CallerID is what is easily spoofed. – schroeder Feb 9 '15 at 0:45
3

Although I have no firsthand experience, I've read of this being done by forwarding calls to a toll-free number, which then (by virtue of being toll-free) receives the true calling number through ANI (which is distinct from Caller ID and which supposedly cannot be spoofed) and finally forwards back to the original number.

For example, the TrapCall service mentioned here appears still to be in operation: http://www.nytimes.com/2009/03/15/us/15call.html

  • This won't work if is a call from VoIP – Freedo Feb 9 '15 at 6:31
  • @freedom, is that true as a blanket statement, or might it depend on the VoIP provider's implementation? I've seen anecdotal evidence that it will not work with callers from some VoIP providers, but it seems like a clever provider might be able to look at the Caller ID supplied by a client for an outbound call. If the caller ID matches a DID associated with the same account, couldn't it send it out as the ANI? (I admit that I don't know anything about SS7.) – Scott Dudley Feb 9 '15 at 14:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.