Number Spoofing Scam UK: How to Spot Fake Caller ID and Stay Safe
Scammers can make any number appear on your phone. Here's how to recognise when you're being spoofed — and what to do about it.
What is this scam?
Number spoofing is when a scammer uses technology to make their phone number appear as something else on your caller ID. Instead of seeing an unknown number, you see your bank's official number, your mobile provider's customer service line, or a government department like HMRC. The scammer then calls you pretending to be from that organisation, asking you to confirm personal details, provide passwords, click links, or transfer money. Because the caller ID looks legitimate, most people trust the call enough to engage.
The scammer might claim there's suspicious activity on your account, an unpaid tax bill, or a problem with your broadband. Number spoofing is illegal in the UK, but it's cheap and easy for criminals to do using apps and services available online. Millions of UK residents receive spoofed calls every month, and many fall victim because the fake caller ID removes the obvious warning sign of an unknown number.
Warning signs to look for
- They ask you to confirm sensitive details like passwords, PINs, or security codes — legitimate organisations never ask for these over the phone.
- They create urgency by claiming your account is locked, there's fraud detected, or you owe money immediately.
- They ask you to transfer money, buy gift cards, or install remote access software to 'fix' a problem.
- The caller struggles with English or sounds like they're reading from a script, even though they claim to be from a major UK organisation.
- They won't let you hang up and call the organisation back — they'll say the line will be closed or claim you need to stay on the phone.
- The number on your caller ID matches a real organisation, but something about the call feels wrong or the person can't answer basic questions about your account.
- They email you a link or document during or after the call and ask you to open it immediately to 'verify' something.
- They request permission to access your computer or phone remotely using software like TeamViewer or AnyDesk.
How this scam works step by step
The scam typically starts when your phone rings and the caller ID shows a number you recognise — perhaps your bank, energy company, or HMRC. You answer because it looks legitimate. The scammer greets you and immediately creates a sense of alarm by claiming there's suspicious activity on your account, an unpaid bill, or a security problem. They'll ask you to confirm personal details like your name, date of birth, or account number — details you might give because you believe you're speaking to the real organisation. Once they have your trust, they escalate the request.
They might ask for your full card details, online banking password, or a one-time security code sent to your phone. Some scammers ask you to move money to a 'safe account' or buy iTunes or Google Play cards to resolve the issue. Others request remote access to your computer to show you 'evidence' of the problem, then steal data or install malware. Throughout the call, they keep you focused on the fake urgency and won't let you hang up to verify independently.
By the time you realise it's a scam, the scammer has your sensitive data, has accessed your accounts, or has taken your money.
How to verify if it is genuine
If you receive a call from what appears to be your bank, utility company, or government body, never trust the caller ID alone. Hang up immediately — do not stay on the line. Wait at least five minutes, then use a phone number you know is correct to call the organisation back. For banks, use the number on your debit or credit card. For utilities, check your latest bill. For HMRC, visit the official gov.uk website. Legitimate organisations will never ask you to confirm passwords, full card details, or security codes over the phone.
If the original caller claimed you have a problem with your account, the real organisation will confirm this when you call back. If they don't, it was a scam. Be wary of calls that create extreme urgency or threaten legal action. Check our guides on ISP Impersonation Scams UK: BT, Sky, Virgin Media and Openreach Fraud Calls and Bank Text Messages Not Arriving? How to Fix It and Spot Scams for more specific verification steps for common spoofing targets.
What to do if you have already interacted
If you've already given out information or money, act quickly. First, if you provided your card details, contact your bank immediately by calling the number on the back of your card — not a number the scammer gave you. Ask them to cancel the card and monitor your account for unauthorised transactions. If you shared your online banking password, log into your account now and change the password to something completely new. If you provided security codes (like those sent via SMS), contact your bank as these may be used to reset your password or transfer money.
If you transferred money directly, contact your bank within 24 hours and ask them to recall the payment — banks can sometimes reverse transactions if caught quickly. If the scammer had remote access to your computer, run a full antivirus scan and consider changing all your passwords from a different device. If you've sent money via gift cards or similar, contact the retailer immediately with the card details. Document everything: the caller ID number, date, time, and exactly what happened. Report it to Action Fraud (see reporting section below) as soon as possible.
Reporting this scam in the UK
Report spoofed calls to multiple organisations simultaneously to maximise the chance of action. Call Action Fraud on 0300 123 2040 or report online at actionfraud.police.uk — provide the fake caller ID number, time of call, and what the scammer claimed. If the scam involved a phishing link or email, forward it to the NCSC Suspicious Email Reporting Service at report@phishing.gov.uk. If you received a spoofed SMS text message, forward the message to 7726 (spells SPAM) — your mobile network will investigate. Contact your bank's fraud team directly using the number on your card.
Report the incident to Citizens Advice consumer helpline on 0808 223 1133 if you need support or have lost money. If the scammer impersonated your bank, energy company, or internet provider, contact that organisation's fraud team as well — they track spoofed numbers and help protect other customers. Keep records of all reports and reference numbers. These reports build a picture of spoofing trends, help authorities take action against scammers, and protect other UK residents.
Frequently asked questions
Can my bank or HMRC actually call me with a spoofed number, or is it always a scam?
Your bank or HMRC can call you, but they will not ask for passwords, security codes, or card details over the phone — ever. If a call asking for these details appears to come from a trusted organisation, it's always a scam. Hang up and call the organisation back using a number you know is correct.
I gave money to a number spoofing scammer. Can I get it back?
If you transferred money within 24 hours, contact your bank immediately and ask them to recall the payment — banks can sometimes reverse transactions. If you sent money via gift cards, cryptocurrency, or money transfer services like Wise, recovery is much harder because these transactions can't be reversed. Report it to Action Fraud and your bank, but be prepared that the money may not be recoverable. Acting quickly is critical.
How do scammers actually spoof phone numbers to make them appear as real organisations?
Scammers use cheap apps and services available on the dark web or overseas that let them enter any phone number they want to display on caller ID. This is called VoIP (voice over internet protocol) spoofing. The technology is simple and illegal to use for fraud in the UK, but it's hard to police because much of it operates overseas. This is why trusting caller ID alone is dangerous.
What's the best way to report a spoofed call in the UK?
Report to Action Fraud on 0300 123 2040 or actionfraud.police.uk, forward the spoofed SMS to 7726, and report the scammer's fake caller ID number to your mobile network. If a phishing link was involved, email report@phishing.gov.uk. Contact your bank's fraud team directly if your banking details were at risk. These organisations share data, so reporting to one helps protect others.