Your phone lights up with a number that looks like your own bank's, or a (416) number that is almost yours. The voice says there is a problem with your account and asks you to stay on the line. The screen said it was them, so why wouldn't you believe it?
Because the screen is not a witness. It is a messenger that repeats whatever the call hands it. Here is the position this article defends: caller ID is a name tag the caller wrote for themselves. It is a claim, not a proof. Technology is slowly adding a stamp of approval to some of those claims, and that helps, but no stamp turns a phone call into an identity check. You do that part yourself.
Why the number on your screen can be wrong
Changing the number a call displays is called spoofing. It isn't always a crime or a trick. The Government of Canada's page on caller ID authentication points out that changing a caller ID is not always improper, and that police services and domestic abuse shelters may use it to hide where a call is coming from. A business calling from a switchboard may also show its main line instead of the desk phone. Those are ordinary uses.
The trouble is that the same ability is available to someone who wants you to trust the call. They can show a local area code so you'll pick up, a number you know, or an organization's name. The Canada Revenue Agency lists "spoofed official-looking numbers demanding payment" among the scam examples on its own scam page. In other words, the agency whose name gets borrowed says the display can be faked.
What STIR/SHAKEN changed, and what it didn't
Since November 30, 2021, Canadian telecom providers have been certifying whether a caller's identity can be trusted for calls carried over IP voice networks. That is real progress, and it is meant to make casual spoofing harder.
The same Government of Canada page also lists the limits, and they matter more than the headline:
- Not every call can be verified. It depends on the devices and networks involved, and calls that don't travel fully over IP voice networks can't be checked.
- How a result appears on your screen varies by provider. There is no single sign to learn, and your phone may show nothing at all.
- The page itself says verification does not replace caution: confirm a request before you share personal or banking information.
Our take: treat a verified-call indicator, where your phone shows one, as a small plus, and the absence of one as no information. It speaks to the number, not to the person. A genuine number can still carry a scam script, and a missing label can belong to your child's school calling from a borrowed phone.
Who is actually trusting the screen
Look at the calls that cost people money and you will notice they share one move: they borrow trust from somewhere else. The caller says they are the CRA, a bank's fraud department or a delivery company, and the display, a few details and a confident tone do the rest. The Canadian Anti-Fraud Centre's published top frauds for 2025 include "fraud investigator" calls, with 2,167 reports and $28.3 million in reported losses (Canadian dollars). We can't tell you how many of those used a spoofed number, because the page doesn't say. The point is the category: it exists because "I'm from your bank" gets believed when the screen agrees.
Here's the thing that rarely gets said: a spoofed number doesn't need to fool you completely. It only needs to move you from "ignore this" to "maybe I should hear them out". After that, the script does the work. Which is why a better detector is not the whole answer. The habit is.
Three signals, ranked by how far to trust them
| Signal | What it tells you | How much to trust it |
|---|---|---|
| The number on screen | What the call claims to be | Low. It can be changed |
| A verified-call indicator from your provider | The number can be vouched for, where the call can be verified | Some for the number, none for the caller's intentions |
| Who started the call and what they ask for | Whether the request fits how the organization really works | High. This is the signal the caller can't fake |
Read the last row as the whole strategy. The CRA, for one, publishes what it will never do: demand immediate payment by Interac e-transfer, cryptocurrency, prepaid credit card or gift card, or threaten arrest. A caller who asks for those things has told you what they are, whatever name appeared on your screen.
Cutting the call off: the one habit that works
If you only do one thing, make it this: never verify a caller using the caller. Not the number they give you to call back, not the website they read out, not the "transfer to a supervisor". Everything inside the call is under their control.
- Say you'll call back, and hang up. You don't need to argue or explain. A legitimate caller will understand.
- Find the number yourself. Use the number on the back of your bank card, on a bill, or on the organization's website, typed in by you.
- Use the agency's own verify tool when there is one. The CRA says to end the call first and then check the number with its verify tool before dialling anything you were given. It adds that a real CRA employee who calls will give a name and a callback number.
- Then make the call yourself. Ask whether anyone really contacted you. If they didn't, you have your answer.
This is the honest answer to "how do I know if a call is spoofed": you usually can't tell from the screen, and you don't have to. Hanging up and calling a number you found yourself works on every call, spoofed or not. It costs a minute. It is also the habit that makes a spoofed call pointless, because you never answer the question the display was asking.
What this means for blocking and lists
People sometimes read "caller ID is unreliable" as "nothing helps". That isn't the conclusion. Blocking a number you don't want still stops that number. But a block works on a number, and a number is exactly what a caller can change. If you want to compare notes, Canada Phone Check shows reports from other people for a given number, which is useful as one clue among several, never as a verdict. A call that nobody has reported yet is not a clean call.
The same goes for the National Do Not Call List. It binds telemarketers that follow the rules, and its own exemptions let some organizations, such as registered charities and political parties, keep calling. A caller running a scam isn't interested in rules, so no list can sort them out. That is another reason the signal that matters is the request, not the label.
A short checklist for the next unexpected call
- Did I start this call, or did they?
- Are they asking for money, a code, a password or my SIN?
- Do they want a payment method the CRA says it never uses, such as gift cards, cryptocurrency or an e-transfer?
- Are they rushing me or telling me not to hang up?
- Can I end the call and reach the organization through a number I found myself?
One "yes" to any of the middle three is enough to hang up. If you did hand over information, or money moved, contact your financial institution right away, then report it to your local police and the Canadian Anti-Fraud Centre (1-888-495-8501). For the step-by-step on name and number lookups, see our FAQ on how to identify an unknown caller's name. For a worked example of a call built to panic you, read our line-by-line look at a CRA scam voicemail.
Common questions
Can a call from my own area code or my own number be fake?
Yes. Showing a familiar or local number is among the simplest tricks there is, because people answer numbers that look nearby. Treat a familiar-looking number the same way you treat an unknown one.
Does STIR/SHAKEN mean spoofed calls are blocked?
No. It lets providers certify whether a caller's identity can be trusted, for calls the network can verify. It is one layer of protection, not a guarantee.
If my phone shows a verified mark, can I trust the caller?
Trust the number a little more, not the person. The Government of Canada says verification does not replace caution, so confirm any request for money or personal information before acting on it.
The bottom line
A caller ID is a claim, and a verified mark is a better-supported claim, but neither is an identity check. The reliable defence is not a smarter screen, it is a habit: end the call, find the number yourself and call back. Do that and it stops mattering whose name was on the display.