Caller ID Can Lie: Protecting Your Business Phone Lines from Spoofed and AI-Voice Calls

Caller ID can be faked, and the voice on the line can now be generated by AI. For a business, that means the number on the screen and a familiar-sounding voice are no longer proof of who is calling. The fix is a short phone security policy: decide what is never shared by phone, keep a call-back directory of trusted numbers, require a second channel for any request that touches money, data or access, and tighten the settings on your phone system. This guide covers how spoofing works, what call authentication does and does not do, what the law says, and the practical steps for your front desk.

How caller ID spoofing works

Caller ID is information sent along with the call, and the caller's phone system can set it. Spoofing means deliberately sending false caller ID information so the call appears to come from someone else: your bank, a government office, a vendor, a local number or even your own company's main line.

Under the Truth in Caller ID Act, as the FCC explains, spoofing is illegal when it is done with the intent to defraud, cause harm or wrongfully obtain anything of value. There are legitimate uses too. A doctor calling from a personal phone may show the office number, for example. That is exactly why the number alone cannot tell you whether a call is honest.

What STIR/SHAKEN does, and what it does not

STIR/SHAKEN is the caller ID authentication framework that the FCC requires voice providers to use. In simple terms, the provider that starts the call digitally signs it, and the receiving provider checks the signature. That is how some phones display labels such as "Caller verified" or "Spam likely".

It is a real improvement, but it has limits that your staff should understand:

• It confirms that the caller is authorized to use the number. It does not tell you who the person is. The FCC has noted that the framework does not identify who is calling.
• It does not judge the purpose of a call. It looks at routing information, so it cannot tell whether the call is a scam or whether an AI voice will be used once you answer.
• Not every call path is fully covered, so some legitimate calls arrive without a verified label and some unwanted calls still get through.

The FCC has continued to propose rules to strengthen call authentication. Those changes help, but they will never replace a verification habit inside your business.

What the law says about AI voices on calls

In February 2024 the FCC issued a Declaratory Ruling (FCC 24-17) confirming that AI-generated voices count as "artificial" voices under the Telephone Consumer Protection Act. In practice, robocalls that use an AI voice need the called party's prior express consent, and state attorneys general gained another tool to pursue illegal calls.

That is good news, but scammers do not follow the law. Assume that a voice on the phone, even one that sounds exactly like your owner, your accountant or your IT technician, may be synthetic, and build your process so that it does not matter.

The calls businesses receive most often

These patterns show up again and again. None of them depend on a particular company or place; they depend on pressure and trust:

• "IT support" calling about a problem on your computer and asking you to install a remote-access tool or read out a code.
• "Your bank's fraud department" asking you to confirm a transaction, a one-time code or to move funds to a "safe" account.
• A known vendor with "new payment details" for the next invoice.
• A utility or service provider threatening disconnection today unless you pay now.
• Someone claiming to be an official or law enforcement, with a deadline and a threat. The FBI has repeatedly warned about criminals impersonating officials and agencies.
• An "executive" calling an employee with an urgent, confidential request.

A phone security policy for your front desk

Information that is never given by phone

Write a short list and share it with everyone who answers calls:

• Employee schedules, travel plans, home addresses and personal phone numbers.
• Which bank, payroll company, IT provider or software you use.
• Email address formats, system names, or who approves payments.
• One-time codes, passwords and answers to security questions, for anyone, ever.

A friendly "I'm not able to share that, but I can take a message" is always acceptable.

Keep a call-back directory

Maintain a short list of verified numbers for your bank, key vendors, your IT provider, your landlord and your executives. Take the numbers from contracts, invoices or official websites, never from an email signature that just arrived. When a call asks for anything unusual, staff hang up and call back using the directory.

Requests that always need a second channel

Any request by phone to change bank details, send a payment, reset a password or MFA method, share files, or grant access must be confirmed through a second, independent channel: a call-back to the directory number, a ticket in your IT system, or approval by a second person. For payment scams in particular, see our guide to deepfake voice and video scams.

Calls from "your IT department"

Agree with your IT provider on how they will contact you. A good rule: real support work starts from a ticket you can see, and a technician never asks for your password or a code. If a caller claims to be IT and there is no ticket, hang up and call your provider back.

Settings worth reviewing on your phone system

Most business phone platforms, whether a hosted VoIP service or Microsoft Teams Phone, have controls that make spoofed and unwanted calls less effective:

1. Turn on the carrier's spam labeling or call filtering for your main numbers, and show the label to the person answering.
2. Route unknown or anonymous callers to an auto-attendant or voicemail on lines that are not your public sales number.
3. Protect the phone system's admin portal with MFA and limit who can change call forwarding. An attacker who controls forwarding can intercept call-backs.
4. Check the caller name shown for your own outbound numbers with your provider, so customers recognize your calls and are not trained to ignore them.
5. Keep call logs long enough to investigate a suspicious call later.

Recording calls and AI note-takers: consent in Florida

The worry that "AI is recording" also applies to tools your own team uses. Florida law (Section 934.03, Florida Statutes) generally requires the consent of all parties before a private conversation is recorded. If your business records calls or uses an AI note-taker or transcription tool, announce it at the start of the call and make sure your vendor's settings and your policy match. This is general information, not legal advice; ask your attorney about your specific situation.

Train, practice and report

• Run a short session for everyone who answers phones, and repeat it when new people join.
• Practice with a realistic example: a "vendor" asking for new bank details, or "IT" asking for a code.
• Make reporting easy and blame-free. A quick "I got a strange call" message helps protect the whole team.
• Report illegal or spoofed calls to the FCC, scams to the FTC at ReportFraud.ftc.gov, and fraud losses to the FBI's IC3 at ic3.gov.

Core Florida IT helps businesses in Miami-Dade and South Florida secure their phone systems, Microsoft 365 accounts and payment processes, and trains staff to recognize spoofed and AI-voice calls. Request a free IT assessment and we will review your phone setup and verification rules with you. See our cybersecurity services.

Sources

• FCC: Caller ID Spoofing (consumer guide)
• FCC: Combating Spoofed Robocalls with Caller ID Authentication (STIR/SHAKEN)
• FCC: Declaratory Ruling on AI-generated voices under the TCPA (FCC 24-17, February 8, 2024)
• FBI / IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA, December 3, 2024)
• The Florida Senate: Section 934.03, Florida Statutes (interception and disclosure of communications)