A call from an official-looking number. A convincing explanation. Someone who already knows your name and a few personal details.

It can feel genuine, especially when the caller says your money is at risk and you need to act quickly.

But criminals can disguise the number that appears on your phone, making a scam call look as though it comes from an organisation you trust. This is known as number spoofing.

At TST, we’re sharing a reminder of how these scams work, what to look out for and why taking a moment to check a caller’s identity matters.

What is number spoofing?

Number spoofing is when a caller changes the caller ID displayed on your phone to hide where the call is really coming from.

Instead of seeing the actual number, you might see one associated with a bank, a public body or a genuine business. Ofcom warns that criminals use this technique to make their calls appear trustworthy.

The number displayed on your screen is not proof of who is calling.

Even if it matches an organisation’s published phone number, you still need to check any unexpected request for sensitive information or money independently.

How do these scams work?

The number is only one part of the deception. The caller also needs a story that makes you believe them.

For example, someone impersonating a police officer might claim they are investigating a crime and have found your personal details on a suspect’s device. They may provide a supposed crime reference number or transfer you to another person claiming to be a detective.

The conversation can sound organised and official. But the purpose is to create enough trust — and enough worry — for you to follow their instructions.

They may then ask about your banking arrangements, savings or cryptocurrency holdings, or claim you need to move money to protect it.

A request to transfer money to a “safe account” is a major warning sign.

The same approach can be used by callers pretending to represent banks, telecoms providers and other familiar organisations. The story changes, but the pressure to act is often similar.

What if they already know things about you?

Knowing your name, address or other personal details does not make a caller genuine.

Information may be available publicly or have been exposed in a previous data breach. Criminals can use those details to make an invented story feel more believable.

Think of it this way: a caller knowing something about you does not prove anything about them.

The same applies to a confident tone, an official-sounding job title or a reference number. None of these replaces an independent identity check.

Warning signs to watch for

Be cautious if an unexpected caller:

• Says your money is in danger and you must act immediately.
• Asks for passwords, PINs or one-time security codes.
• Requests cryptocurrency wallet credentials or recovery phrases.
• Tells you to transfer money to another account for “protection”.
• Discourages you from speaking to your bank, colleagues or family.
• Insists you stay on the line or follow instructions before checking their identity.
• Uses a reference number or personal information as proof that you should trust them.

You do not need to prove that a call is fraudulent before ending it. If something feels wrong, stop the conversation and check.

What should you do?

End the call and verify it independently

Contact the organisation through a number you have obtained yourself, such as one on its official website, your bank card or an account statement.

Do not use a number supplied by the caller or rely on the number shown in your recent calls. Ofcom recommends using independently checked contact details when verifying a suspicious approach.

Keep sensitive information private

Do not disclose passwords, PINs, security codes or cryptocurrency recovery phrases to an unexpected caller.

If someone says you need to move money to keep it safe, end the call and contact your bank directly.

Tell someone

If you are unsure, speak to a colleague, friend or family member before taking action.

For businesses, staff should know who to contact internally about suspicious calls, particularly those involving payments, account access or company information.

A quick conversation can interrupt the pressure a scammer is trying to create.

A reminder for business owners and teams

These calls can reach anyone, including employees answering company mobiles or office phones.

Make sure your team understands that a familiar number is not an identity check. Requests involving money, confidential information or account changes should be verified through an established contact route.

Give staff permission to pause, question and escalate a request, even when the caller sounds authoritative.

It is also worth sharing this reminder with friends and family who may be less familiar with spoofing. Knowing what to expect can make a convincing call easier to challenge.

What if you have already responded?

If you have made a payment or shared financial information, contact your bank immediately using a trusted number.

If you have disclosed business login details or allowed access to a device, tell your IT support team straight away. Explain what happened and keep any relevant messages, phone numbers and call details.

Suspicious mobile calls and texts can be reported to your mobile provider through 7726. Suspicious emails can be forwarded to report@phishing.gov.uk.

If you believe you have been a victim of fraud, report it through the appropriate fraud reporting service. In England, Wales and Northern Ireland, this is Report Fraud; in Scotland, contact Police Scotland on 101.

Pause before you trust the number

Spoofing works because it makes an unfamiliar caller appear familiar.

A genuine-looking number, personal details and an urgent story can be a persuasive combination. Taking a moment to hang up and check independently can help protect your money and information.

Concerned about unusual calls or activity involving your business telecoms? Get in touch with TST to discuss your concerns and the next steps.

Visit www.tst.uk.net/contact