Fake caller ID: how to know who’s really contacting you

Fake caller ID (also called caller ID spoofing) is a common technique that scammers can use to disguise their real phone number. It’s one of the ways they may try to impersonate your bank, super fund, or a government agency, such as the Australian Bureau of Statistics (ABS). 

Australians lost almost $18 million to text message scams in 2025 alone¹, so understanding how these scams work is an important first step to staying protected.

Scammers often use fake caller ID to disguise their number so they can pose as a trusted organisation and trick you into giving them information they can use for fraudulent purposes.

When phone calls are transmitted over internet-based networks rather than traditional phone lines, caller ID information is often transmitted as part of the call setup process, which gives scammers an opportunity to provide a fake caller ID.

1. A call is initiated through a phone system or internet-based calling service.
2. Caller ID information is attached to the call.
3. The network delivers the caller ID to the recipient's phone.
4. If the caller ID information has been manipulated, the recipient sees a different number than the one actually making the call.

Caller ID spoofing can lead people to answer a call or believe a message because they think it’s from an organisation they trust – such as their bank, investment platform, or other financial institution. 

Scammers may pretend they want to help you – often by claiming they are trying to prevent you from being scammed, or help you to recover money. 

Imagine receiving a message that says you’ve bought something you don’t remember buying – perhaps it’s security software or concert tickets, it could be cryptocurrency, or even a phone.  

You don’t recall buying this item, but the message says you need to call a number urgently to stop or reverse the payment.  

You might get a call from a ridesharing company, asking you to update your credit card details. Then you get a message from your bank, saying scammers are trying to take money out of your account.  

The bank message looks real, as it appears in the same thread as other messages from your bank. It gives you a number to call.  

Or perhaps you've heard the 2026 Census is coming up, and you get a call from the ABS asking you to verify all your personal details so your information can be included.  

What should you do? 

Yes – all these scenarios could be scams. 

Don’t call the number provided. Instead, you should always stop and check the business’ official mobile app or use their official website or portal to obtain their contact number.  

The ABS has even released specific instructions to help people identify when a text message could be from them, and states they will never ask you to click on a link, or provide personal financial details or passwords, or offer a prize for participating.   

Scammers commonly claim people have made a purchase of between $300 and $2,000². They want you to act now and call them to ‘stop’ a purchase that never happened.  

And here’s why it can be confusing: the message itself may appear to come from well-known services such as: 

• Australian Bureau of Statistics 
• Amazon 
• Australia Post 
• PayPal 
• Shop App 
• Google Meet 
• Apple iMessage 
• Norton 
• McAfee  
• Microsoft – and many more.  

Some scammers have even made it seem as though messages are coming from the police in an effort to obtain personal details to conduct fraudulent activity³.

Below are some other scenarios in which scammers may use fake caller IDs to impersonate financial institutions. 

If you call, the scammer may ask for your account or card details. They may ask for your password. They may tell you they have refunded too much money and ask you to send some back. 

They may try to convince you to install remote access software on your device, or even ask you to buy gift cards.

The advice is simple: don’t call the number in the message. Always use the organisation’s official app or website to check whether the claim is real.

Remember: Legitimate organisations, including CFS, will never ask for your password, PIN or one-time passcode to access your computer. 

Scammers who are using caller ID spoofing to disguise themselves as a brand you trust may send you urgent messages, requests for passwords or one-time codes, or attempt to reset access to your account.

You should be especially cautious if you receive:

• unexpected calls or messages that pressure you to act immediately.
• requests for your financial account details, passwords or one-time passcodes.
• verification codes you didn’t request.
• a sudden loss of mobile signal or ‘SOS only’ appearing.
• a text message labelled ‘Unverified’.
• a call from a number that looks familiar, but the caller’s request is unusual.

Plus, if your phone provider unexpectedly contacts you about your number changing, that could also be a warning sign of an account or identity takeover scam.

From 1 July 2026, businesses and organisations that send branded text messages must register with the communications regulator’s new SMS Sender ID Register. 

Many text scams pretend to be from trusted organisations by impersonating their sender ID – so the register is designed to make it easier to tell scam messages from those sent by genuine organisations. 

A sender ID is the name at the top of a text message that tells you who the message is from, such as ‘ATO’, ‘AusPost’ or ‘myGov’. 

If a business does not register its sender ID, branded text messages sent to customers may be labelled ‘Unverified’ and grouped with other unverified messages on your mobile phone. 

If a message comes from a registered sender ID, you can have more confidence it came from that organisation. If it is marked ‘Unverified’, treat it with extra caution. It may be from a legitimate organisation that has not yet registered – or it may be a scammer impersonating a trusted brand.

The register does not mean every scam will disappear. You may still receive messages with fake caller ID, spoofed numbers and suspicious SMS links. 

But if you receive messages asking you to call back to prevent a purchase you don’t recognise, remember: stop, check, and protect. 

Stop: Don’t rush. Scammers rely on urgency. Don’t share passwords, one-time codes, bank details or gift card numbers, and don’t call the phone numbers in any suspicious messages. 

Check: If someone you don’t recognise calls you about a strange transaction, hang up and contact the organisation using details from its official website or app. Don’t rely on the phone number displayed, because caller ID can be spoofed. 

Protect: Use strong, unique passphrases and multi-factor authentication where available. If something feels wrong – such as unexpected verification codes or sudden mobile service loss – contact your bank and mobile provider, change your passwords and monitor your accounts. Act quickly to protect yourself if you have sent money or shared personal information, and be on the lookout for follow-up scams – such as offers to help you recover your money.

If you think you’ve received a scam message, you can report it to Scamwatch, which provides information on recognising, avoiding and reporting scams. 

If you’ve shared personal information or believe your identity has been misused, change your passwords. Call us on 13 13 36 or your financial provider straight away.

Visit IDCARE or call 1800 595 160 for support with identity or cyber-related issues. 

If you have received a suspect message and made payment to a potential scammer, contact your financial institution immediately to ask them to stop any transactions. 

You can report the matter via the Australian Cyber Security Centre’s ReportCyber portal.

You can also make a police report.

CFS members can use our online portal FirstNet to verify any account activity independently. If you're concerned, change your passwords and contact us on 13 13 36. 

We use Multi-Factor Authentication (MFA) to help prevent unauthorised access to your account. That’s why you’ll be asked to verify your identity with a one-time PIN sent to your registered mobile or email.

We monitor your accounts for suspicious activity, especially following recent scam reports targeting super funds. 

Only authorised staff can access our systems. Data is protected by firewalls, intrusion detection, and virus scanners. Physical records are stored securely or safely destroyed.