Join Us

Fake caller ID – how to know who’s really contacting you

Fake caller ID (also called caller ID spoofing) is a common technique that scammers can use to disguise their real phone number. It’s one of the ways they may try to impersonate your bank, super fund or a government agency, such as the Australian Bureau of Statistics (ABS).

Australians lost almost $18 million to text message scams in 2025 alone¹, so understanding how these scams work is an important first step to staying protected.

How scammers use fake caller ID to impersonate financial institutions

Scammers often use fake caller ID to disguise their number so they can pose as a trusted organisation and trick you into giving them information they can use for fraudulent purposes.

How caller ID spoofing works

When phone calls are transmitted over internet based networks rather than traditional phone lines, caller ID information is often transmitted as part of the call setup process, which gives scammers an opportunity to provide a fake caller ID.

A call is initiated through a phone system or internet based calling service.
Caller ID information is attached to the call.
The network delivers the caller ID to the recipient’s phone.
If the caller ID information has been manipulated, the recipient sees a different number than the one actually making the call.

Why is it so effective?

Caller ID spoofing can lead people to answer a call or believe a message because they think it’s from an organisation they trust, such as their bank, investment platform or other financial institution.

Scammers may pretend they want to help you by claiming they are trying to prevent you from being scammed or help you to recover money.

Common fake caller ID scenarios targeting Australians in 2026

Imagine receiving a message that says you’ve bought something you don’t remember buying, perhaps it’s security software or concert tickets, it could be cryptocurrency or even a phone.

You don’t recall buying this item but the message says you need to call a number urgently to stop or reverse the payment.

You might get a call from a ridesharing company, asking you to update your credit card details. Then you get a message from your bank, saying scammers are trying to take money out of your account.

The bank message looks real, as it appears in the same thread as other messages from your bank. It gives you a number to call.

What should you do?

Could these calls or messages be fake?

Yes, all these scenarios could be scams.

Don’t call the number provided. Instead, you should always stop and check the business’ official mobile app or use their official website or portal to obtain their contact number.

Scammers commonly claim people have made a purchase of between $300 and $2,000². They want you to act now and call them to ‘stop’ a purchase that never happened.

And here’s why it can be confusing: the message itself may appear to come from well known services such as:

Australian Bureau of Statistics
Amazon
Australia Post
PayPal
Shop App
Google Meet
Apple iMessage
Norton
McAfee
Microsoft – and many more.

Some scammers have even made it seem as though messages are coming from the police in an effort to obtain personal details to conduct fraudulent activity³.

Below are some other scenarios in which scammers may use fake caller IDs to impersonate financial institutions.

Scenario	Impersonated entity	Claim scammers might make	Red flag to watch for
Super fund security check	Super fund	“We’ve detected suspicious activity on your account — please verify your details now”	Legitimate funds do not request passwords or PINs by phone
ATO tax debt	Australian Taxation Office	“You owe a tax debt and will be arrested unless you pay immediately”	ATO never demands immediate payment by phone or threatens arrest
Bank fraud team	Major Australian bank	“Your account has been compromised — we need your one-time code to reverse the transaction”	Banks never ask for your one-time passcode over the phone
NBN or telco technician	NBN Co or your telco	“Your internet connection has been hacked — give us remote access to fix it”	No legitimate telco will call you unsolicited to request remote access

What happens if you call the scammer’s number?

If you call, the scammer may ask for your account or card details. They may ask for your password. They may tell you they have refunded too much money and ask you to send some back.

They may try to convince you to install remote access software on your device or even ask you to buy gift cards.

The advice is simple: don’t call the number in the message. Always use the organisation’s official app or website to check whether the claim is real.

Remember: Legitimate organisations will never ask for your password, PIN or one time passcode to access your computer.

How to tell if a call is using a fake caller ID?

Scammers who are using caller ID spoofing to disguise themselves as a brand you trust may send you urgent messages, requests for passwords or one time codes or attempt to reset access to your account.

Signs a message is a scam

You should be especially cautious if you receive:

unexpected calls or messages that pressure you to act immediately.
requests for your financial account details, passwords or one-time passcodes.
verification codes you didn’t request.
a sudden loss of mobile signal or ‘SOS only’ appearing.
a text message labelled ‘Unverified’.
a call from a number that looks familiar but the caller’s request is unusual.

Plus, if your phone provider unexpectedly contacts you about your number changing, that could also be a warning sign of an account or identity takeover scam.

What changed on 1 July 2026? Registered SMS Sender IDs

From 1 July 2026, businesses and organisations that send branded text messages must register with the communications regulator’s new SMS Sender ID Register.

Many text scams pretend to be from trusted organisations by impersonating their sender ID, so the register is designed to make it easier to tell scam messages from those sent by genuine organisations.

A sender ID is the name at the top of a text message that tells you who the message is from, such as ‘ATO’, ‘AusPost’ or ‘myGov’.

If a business does not register its sender ID, branded text messages sent to customers may be labelled ‘Unverified’ and grouped with other unverified messages on your mobile phone.

How will this help you to avoid being scammed?

If a message comes from a registered sender ID, you can have more confidence it came from that organisation. If it is marked ‘Unverified’, treat it with extra caution. It may be from a legitimate organisation that has not yet registered, or it may be a scammer impersonating a trusted brand.

The register does not mean every scam will disappear. You may still receive messages with fake caller ID, spoofed numbers and suspicious SMS links.

But if you receive messages asking you to call back to prevent a purchase you don’t recognise, remember: stop, check and protect.

What it means to stop, check and protect

Stop: Don’t rush. Scammers rely on urgency. Don’t share passwords, one time codes, bank details or gift card numbers and don’t call the phone numbers in any suspicious messages.

Check: If someone you don’t recognise calls you about a strange transaction, hang up and contact the organisation using details from its official website or app. Don’t rely on the phone number displayed, because caller ID can be spoofed.

Protect: Use strong, unique passphrases and multifactor authentication where available. If something feels wrong, such as unexpected verification codes or sudden mobile service loss, contact your bank and mobile provider, change your passwords and monitor your accounts.

Act quickly to protect yourself if you have sent money or shared personal information and be on the lookout for follow up scams, such as offers to help you recover your money.

How to report suspected scam messages or calls

If you think you’ve received a scam message, you can report it to Scamwatch, which provides information on recognising, avoiding and reporting scams.

If you’ve shared personal information or believe your identity has been misused, change your passwords. Call us on 13 13 36 or your financial provider straight away.

Visit IDCARE or call 1800 595 160 for support with identity or cyber related issues.

If you have received a suspect message and made payment to a potential scammer, contact your financial institution immediately to ask them to stop any transactions.

You can report the matter via the Australian Cyber Security Centre’s ReportCyber portal.

You can also make a police report.

^{¹ New rules for businesses sending text messages, Business.gov.au, published 8 May 2026.}

^{² Scam alert: Fake purchase callback scams, ScamWatch, published 14 July 2026.}

^{³ Police warn of caller ID spoofing scams, Queensland Police, published 17 June 2026.}

^{Source: Colonial First State}