The phone rings and somebody at the other end is annoyed: “You just called me.” You did not. Your number was on their display all the same. An hour later the next one, then the one after that.
What happened has a name: caller ID spoofing. Somebody is making advertising calls – or worse – and entering your number as the sender. The people called see your number and ring you back.
Why this is technically so easy
Caller ID is not a check but a claim made by the caller. With internet telephony it is a field in the call setup that can be filled in like the sender on an envelope. The call does not run over your line or your provider – it runs over somebody else’s computer that asserts your number.
How you notice it is happening to your company
- Return calls from strangers who say you called them – and who do not appear in your own call list.
- Complaints about advertising calls that nobody in your company made.
- New entries on number-rating sites, complaining about harassment.
- A blocked switchboard for no visible reason – the return calls arrive in a bunch because the campaign ran in a bunch.
- Calls from your own number arriving from outside. That is the clearest case: a line does not call itself over the public network.
What your company can do
It cannot be prevented – there is no switch for it, because the forgery happens at a provider you have nothing to do with. What helps is the order of what comes next, and it starts on the same day.
- Documentdate, time, what the caller reports
- Reportcomplaint to the telecoms regulator
- Providerinform your own provider, put it on record
- Policewhere fraud is suspected, report it as well
1. Document – from the first return call
For every return call note the date, the time and what the caller reports: what they were offered, which number was on their display, when it happened. That collection later becomes your evidence that the calls were not yours – towards the regulator, towards customers and, if it comes to that, in court.
2. Report it to the regulator
In Germany the Federal Network Agency is responsible for number misuse and is the only route that stops anything. It can have numbers disconnected and impose fines of up to 300,000 euros. It publishes the measures it has taken on a rolling basis; the edition of 29 September 2026 lists 9,978 numbers across 179 pages. Report every incident, even a small-looking one: proceedings grow out of many similar complaints, not out of one.
3. Inform your own provider
Your provider cannot stop the forgery – it happens outside their network. They can put it on record, and they can see whether your number is turning up unusually often as the target of return calls. Ask explicitly whether your own line might be compromised: a hijacked SIP account looks exactly the same from the outside.
4. Prepare your own people
This is the step that saves the most trouble and is forgotten most often. Whoever answers the phone should know the sentence: *“Our number is currently being misused. We did not call you, and we have reported it to the regulator.”* A note on your home page and on the answering machine takes further pressure off the switchboard.
And what a phone system can do
Recognise a forged number as forged: it cannot. That is not a property of a product but the state of the German network – without attestation there is nothing to verify. Anyone promising you “spoofing detection” is selling a feeling.
What can be proven is the contradiction: that a number shown cannot exist at all. Haus iT Caller ID checks that at the moment the phone rings – in the panel that sits next to the call in Webex.
It is checked against the official register of area codes and against the number ranges nobody calls from:
- The area code does not exist – it is in no official register.
- There is a 0 after the area code – a subscriber number never begins with a zero.
- The emergency number 110 or 112 as the caller – nobody ever dials out from those. That is exactly the trick behind the “call from the police”.
- A barred number range – 0137, 0900 and 118xx are destinations, not lines.
- The number is on the regulator’s enforcement list – with the date of the order and the category.
For that, the official list is downloaded and matched in-house, not queried at a service. That is not a technical detail but a condition: a live query would send your caller’s number to a third party. In a law firm or a medical practice, even the fact of who is calling is protected – German law makes no exception for convenience features. This way no number of yours leaves your house.
When your own number appears as the caller
The most dangerous case is somebody posing as your own company: *“IT here, we just need your password.”* At the moment the phone rings this cannot be decided – the phone system does not yet know which route the call came in by. The following night’s call records do.
That is why this finding is not in the ringing card but in a list in the portal: calls that arrived over the public line while showing a landline number belonging to your company. Internal calls, call forwarding and your own mobile numbers do not count – a company mobile calling in from the road is the normal case.
Frequently asked questions
Why do I get return calls from people I never called?
Because somebody entered your number as the sender. Caller ID is a claim made by the caller, not a check performed by the network – with internet telephony it is a field that can be filled in freely. The people called see your number and ring you back. The term for it is caller ID spoofing.
Can I stop my number being misused?
No. There is no switch and no block for it, neither at your provider nor on your phone system. The forgery happens at a foreign provider you have no relationship with. What you can do begins afterwards: document it, report it to the regulator and prepare your staff.
What is the point of reporting it to the regulator?
It is the only route that stops anything. In Germany the Federal Network Agency can have numbers disconnected and impose fines of up to 300,000 euros. It publishes the measures it has taken as a running list. A single complaint rarely works at once – many similar ones lead to proceedings.
Am I liable for advertising calls made in my name?
You are not liable for somebody else’s calls. You do carry the damage, though: angry callers, negative entries on number-rating sites and a blocked switchboard. That is why documentation pays – it is your evidence that the calls were not yours.
Why does my phone not detect the forged number?
Because a phone number carries no signature. In the United States carriers have had to attest caller ID cryptographically since 2021 (STIR/SHAKEN); Germany has no equivalent. A correctly formed, existing foreign number is therefore indistinguishable from a genuine one.
Do I have to change my number?
As a rule, no. The wave ends when the campaign ends – usually after days or a few weeks. Changing your number costs stationery, website, directories and customers who can no longer reach you. It is the last resort, not the first.