Caller ID spoofing prevention checklist for companies
Caller ID spoofing works because people treat the number on the screen as proof. Network measures such as STIR/SHAKEN or national blocking rules reduce some spoofed calls, but they do not tell an employee who is actually speaking – see STIR/SHAKEN vs. caller identity verification. Protection therefore comes from processes that still hold when the number, the name and even the voice look right.
Use this checklist to review your organisation. Each item is something you can decide, configure or test; tick it off only when it is written down and the responsible team knows it.
1. One rule everyone knows
- A written rule: no money, data, codes or access changes on the basis of an inbound call alone – regardless of displayed number, name or seniority.
- The rule names the independent channel: callback on a number from the directory, HR system, contract or vendor master data – never a number the caller provides.
- Employees know they will never be blamed for ending a call and calling back, including with executives.
- Your company never asks employees or customers for passwords or one-time codes by phone, and says so publicly.
2. IT help desk and account recovery
- Password resets, MFA device changes, recovery-number changes and new privileges require a callback on file, approval through an existing factor or a second approver.
- Knowledge questions (employee ID, manager’s name, start date) are not accepted as the only check.
- Executive, administrator and finance accounts need a stronger process with second-person confirmation.
- “All factors lost” follows a separate, slower process with identity proofing and notification to the user’s other channels.
- Every reset is logged with who verified it and how; the user is notified afterwards.
- Agents have prepared scripts for refusing urgent requests politely.
Full process: help desk caller verification before password and MFA resets.
3. Payments and bank-detail changes
- New beneficiaries and changed bank details are confirmed through contact data already on file, not data from the request.
- Payments above a defined threshold or outside the normal process need two people.
- “Confidential” or “urgent” requests from executives follow the same process as all others.
- Suppliers know how you will contact them about bank-detail changes – and how you will not.
Full process: verifying payment requests by phone.
4. Executives and their assistants
- Executives and assistants know that their voices and numbers are the most likely to be imitated.
- A procedure exists for verifying a surprising request “from the CEO”, including outside office hours.
- Where teams use code words or challenge questions, they are agreed in person, rotated and never sent by e-mail or chat.
Background: deepfake CEO fraud and verifying high-risk calls.
5. Telephony and provider settings
- You know whether your provider signs your outbound calls (for example with STIR/SHAKEN) and at which attestation level per number range and platform.
- You know how the provider treats unsigned, invalid and international calls, and which national rules apply to your routes.
- Internal calls are distinguishable from external calls displaying internal numbers (for example by showing directory names only for genuinely internal calls).
- Unused number ranges are not left active, and every platform allowed to display your numbers is documented.
- Call logs needed for investigations are retained for a defined period in line with data-protection rules.
6. Protecting your own numbers from misuse
- Your official contact numbers are published on your website and in customer communication, together with what you will never ask for by phone.
- For outbound calls to customers, you have considered branded calling or a verified caller name where it is available.
- There is a contact point for customers and partners who receive suspicious calls in your name.
- You know how to report misuse of your numbers to your provider and, in Germany, to the Bundesnetzagentur.
7. Training and testing
- New employees in finance, HR, IT support and assistant roles learn the callback rule in their first week.
- Training covers spoofed numbers, cloned voices and urgency tactics with realistic examples – see how to detect deepfake voice calls.
- With management approval, you run announced or controlled call simulations and review the results without blaming individuals.
- The process is reviewed at least once a year and after every incident.
8. When a suspicious call happens
- Employees know where to report it immediately (security team, help desk or a fixed contact).
- The report captures date and time, displayed number, called number, request and any follow-up messages.
- If credentials were disclosed or changed, affected accounts are secured and sessions revoked.
- If money was transferred, the bank is contacted at once and the police informed.
- Affected colleagues, customers or suppliers are warned through a channel you trust.
How to use this checklist
Assign one owner per section, mark open items and set a date for each. Most items cost nothing but a decision. Start with sections 1 to 3: they close the gaps attackers use most often.
What Identity Phone is building
Identity Phone is in development for business customers. Planned capabilities include verified caller identity between colleagues, help-desk verification before credential resets and an audit trail of flagged calls. They are not available yet and we do not yet have independently verified performance results. Companies can join the waitlist for early access.