Spoofed UK numbers — how to spot and report them

CLI spoofing — where a scammer sets the displayed UK caller-ID to a number they don't own — is the single biggest fraud-call vector in the UK in 2026. This guide explains how spoofing works, the four reliable signs that give it away, what Ofcom's industry-wide CLI authentication programme is doing about it, and what to do when you spot one.

#What is CLI spoofing?

Caller Line Identification (CLI) is the number presented to your phone by the originating system when a call is placed. In theory it identifies the calling line; in practice, it can be set to almost any value by the originating PBX, VoIP gateway or international transit carrier. That mismatch — between what the screen says and the line the call actually came from — is spoofing.

Spoofing has both legitimate and illegitimate uses:

#Why scammers love it

Three reasons:

1. Trust transfer. Spoofing a real bank number makes the scam call inherit the bank's brand trust at zero cost.
2. Callback resistance. If the victim hangs up and tries to call the displayed number, they reach the real bank — who confirms 'we have no record of calling you' but by then the scammer has already moved on.
3. Anonymity at scale. A scam operation rotating through 50 spoofed CLIs is much harder to network-block than one using its own consistent caller-ID.

#Four reliable signs of a spoofed UK CLI

1. Ofcom status mismatch

Look up the number on this site. If the status is anything other than Allocated — i.e. Recovered, Free, Reserved or Protected — the number should not be ringing you. The most common spoof pattern is to use a Recovered or Reserved range because those CLIs look superficially real (right length, right prefix) but cannot be traced to a real subscriber.

2. Line-type mismatch

Cross-check the line type the lookup returns against what the caller is claiming:

• 'Bank fraud team' calling from a 070 personal-numbering line → scam (real banks don't use 070).
• 'HMRC' calling from a 0843 service-charge line → scam (HMRC uses 0300).
• 'Microsoft tech support' calling from a UK mobile → scam (Microsoft does not cold-call UK consumers).
• 'Royal Mail' calling from a 0800 freephone line → suspicious (couriers ring from regional 01x or local mobile).

3. Geographic mismatch

A bank that operates from Canary Wharf supposedly calling you from a Glasgow 0141 number — possible (national contact centres are real) but worth verifying. A 'local council' calling from 020 London when you live in Sheffield — definite red flag.

4. The conversation itself

Whatever the CLI says, the script gives it away. Universal red flags from common UK scam patterns:

• Urgency: 'You must act now or your account closes.'
• Requests for one-time codes, full passwords, or PINs.
• Requests to install AnyDesk / TeamViewer / 'a support tool'.
• Requests to move money to a 'safe account'.
• Requests to buy gift cards or vouchers.

#Ofcom CLI authentication — the structural fix

Through 2024-2027, Ofcom is rolling out UK CLI authentication in partnership with the major networks. The technical basis is similar to the US STIR/SHAKEN protocol: each outbound call carries a cryptographic attestation, signed by the originating provider, that the displayed CLI belongs to a legitimate customer of that provider. Receiving networks verify the attestation and can mark unverifiable CLIs as suspicious (or block them entirely).

Until rollout is complete, spoofed CLIs remain common. The four-tell checklist above is your defence.

#How to report a spoofed UK number

1. If money was involved — dial 159 immediately to reach your bank's fraud team safely.
2. Report to LINK0 — online or 0300 123 2040.
3. Forward any related text to 7726 (free).
4. Complain to Ofcom at ofcom.org.uk/complaints if the issue is persistent silent or nuisance calls.
5. Look the number up here so other visitors see your AI internet check.

#Can I check whether a specific UK number is spoofed?

Not with certainty before the call connects (that's what CLI authentication will eventually fix). But you can detect a spoof *after the fact* using the lookup form on this homepage:

• Status returns anything other than Allocated → almost certainly spoofed.
• Range Holder is empty / 'Not in current Ofcom data' → likely spoofed or non-UK.
• Line type doesn't match the claimed caller (070 'bank', 0843 'HMRC') → spoofed.
• AI internet check returns scam-database reports for the exact number → known abused CLI.

#Bottom line

CLI spoofing is the defining UK telecoms fraud problem of 2024-2026, and the structural fix (CLI authentication) is rolling out network-by-network through 2027. Until then, treat caller-ID as a hint, not a fact. The four-tell checklist above plus the safe-callback pattern (hang up, ring back on a number you trust) defeats every current UK spoofing pattern.