Spoofing: why the number and the sender you see prove nothing

One thing we have taken for granted since telephones existed: that the name or number on the screen tells you who is calling. It is an old, deep habit, and today it is the most exploited weak point of all.

Spoofing is faking the sender. It is not breaking into someone’s account: it is far simpler, and it is why a scam that would have raised eyebrows ten years ago now sails through.

Why it is possible

The answer is not that these systems are badly built, but that they are old.

Telephony and email were born in a world of a few operators who all knew and trusted one another. In that world the sender did not need verifying, only carrying: nobody had an interest in lying. Those rules still sit underneath our phones, with fifty years of patches on top.

So the number on your display is not something the network verifies, it is something the caller declares. And the sender of a text message is, in the same way, a label travelling with it.

The four things that get faked

The phone number. The most profitable kind, because the number is what people trust most. It puts your bank’s number, a government office or the police on your display.

The text message sender. A message can present itself with a name rather than a number. And here is the detail that catches everyone out: phones group messages by the sender label, not by who actually sent them. A fake text with the same label therefore lands inside the genuine thread from your bank, right below the authentic codes. Position in the thread proves precisely nothing, and that is the most important line in this article.

The email sender. Two levels here: the display name, which the app shows large while the real address stays small or hidden, and the lookalike domain, an address that resembles the right one (an extra letter, a hyphen, a different ending).

The website. A page copied exactly, on an address that resembles the real one. And it is the destination of all three of the above.

What changed: the Italian anti-spoofing filter

This is a piece of recent good news, and worth knowing about wherever you live, because other regulators are watching it. Italy’s communications authority required operators to block calls arriving from abroad while displaying an Italian number, in two stages: from 19 August 2025 for landline numbers, and from 19 November 2025 for mobiles too.

The first figures show how big the problem was. In the first eleven days of the mobile stage, between 19 and 30 November 2025, the authority counted 49.3 million blocked calls carrying counterfeit Italian mobile numbers, around 56 per cent of everything arriving from abroad with an Italian number on the display. This was not a fringe pathology: it was half the traffic.

What the filter does not block, which is the part to know

Stop at the good news and you risk the wrong conclusion, namely that an Italian number is now a guarantee. It is not, for four reasons.

Calls originating inside the country. The obligation covers calls arriving from abroad. Anyone operating domestically, through an internet-based switchboard, can still set a false number.

Roaming. The filter has to let through people genuinely abroad with their own SIM, otherwise it would block millions of holidaymakers. That necessary exception is a door left ajar.

Real numbers used badly. The check looks at whether the number exists and where the call came from, not who is behind it. A properly assigned number, used from inside the country, is valid as far as the network is concerned.

The shift to foreign prefixes. This effect is documented by the authority itself: after the mobile filter, calls from abroad showing an Italian number collapsed, while those showing a foreign number almost quadrupled. The traffic moved to where the filter does not reach.

In April 2026 the same authority adopted a further measure, introducing three-digit short numbers as the identifier for call centres and businesses making legitimate calls, precisely because a short number cannot be replicated from abroad. It is the right direction, but today it is a framework with a technical working group implementing it, not something a reader can already rely on.

And email? SPF, DKIM and DMARC

Three systems exist against forged mail, and it is worth understanding what they actually check, because the confidence they inspire is broader than the protection they give.

SPF checks that the message came from a server authorised for that domain. But it checks the technical address used during delivery, not the one you read.

DKIM adds a cryptographic signature: it proves that some domain took responsibility for the message and that it was not altered along the way. It does not say that domain is the one you see written.

DMARC ties the previous two to what you actually read, the domain in the “From” field, and lets the domain’s owner say what should happen to messages failing the checks. Thanks to these three, impersonating exactly a big organisation’s domain is now hard.

The point to take away, though, is different: these checks do not see the display name and do not see lookalike domains. A message presenting itself as your bank from some random address, or coming from bank-customer-security.com, can pass every check impeccably, because that domain is authentic: it simply belongs to someone else. An authentication tick says “this message really came from the domain it claims”, not “this domain is who you think it is”.

For lettered text-message senders, Italy has run a public register of authorised sender IDs since 2023, with an obligation on operators to block those arriving from abroad. A quick way for the recipient to check whether a sender ID is genuine, however, is not something you can rely on today.

When it combines with phishing

On their own, spoofing and phishing are half a scam each. Spoofing supplies the credibility, phishing supplies the staged scene in which you hand something over. The scams working right now use both, often across two channels so each reinforces the other.

The fake-bank-officer sequence is the example to keep in mind:

1. A text message flags a suspicious payment and slips inside the genuine thread from your bank, because the sender label is the same.
2. Minutes later the phone rings and the bank's number is on the display. The caller is polite, competent, and says they have just blocked that payment.
3. To "secure your account" they walk you to a page that copies the bank's, or have you read the codes out loud.
4. What you type or dictate is used at that moment on the real site: the payment you are authorising is not the one you were told about.

Every element you would verify with was faked before you thought to verify. Which is why the classic advice, “check that it really is the bank”, is no longer enough.

Two habits that cost little

First: your bank’s official number saved in your contacts, under the right name. If they really do call, you see it; and when you are the one calling, you are not hunting for it in a hurry while somebody makes you anxious.

Second: when a message asks you to do something immediately, look at it from another device. Opening the bank’s app on a computer, or going to the official site instead of following the link, breaks the chain the scam has put you in.

For the rest of the story, what happens after you follow the link, I cover the mechanism in phishing: what it really is and why it works, and the steps to take if it has already happened in I clicked a scam link.