CLI Spoofing
Definition
Caller Line Identification spoofing: the caller forges the Calling Party Number sent in the SS7 IAM or SIP From header so the receiver's phone displays a chosen number. Used in vishing scams that impersonate TRAI, DoT, banks or police.
- Full name
- Caller Line Identification spoofing
- Mechanism
- Forged Calling Party Number in SS7 IAM or SIP From header
- Common use
- Vishing impersonating banks, TRAI, DoT, police
- Layer affected
- Signalling, not the voice content
Common questions
Can the true origin of a spoofed call still be traced?+
Often yes, since carriers retain call detail records at the originating gateway even when the displayed number is forged, so investigators working with the telecom operator can trace the actual trunk or SIP account that injected the call, though this typically needs a legal request and cooperation across carriers.
Why is CLI spoofing effective against victims who know their bank's real number?+
It exploits trust in caller ID display rather than any weakness in the victim's judgement, since the forged number can exactly match the bank's genuine published number, making the call indistinguishable from a real one until the content of the call itself is questioned.
Related terms
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- Phreaking
- Tone-based exploitation of the public switched telephone network, pioneered in the 1960s and 1970s. The 2600 Hz tone, generated by a toy...
- QRJacking
- Physical replacement or overlay of a legitimate merchant QR (typically a UPI QR at a shop counter) with a fraudster's QR pointing...
- SIM Swap
- Fraud pattern where the attacker convinces the telco to port the victim's MSISDN to a SIM the attacker holds. Once active, the...
- TRAI 24-Hour Cool-Off
- Telecom Regulatory Authority of India directive (2018 and tightened thereafter) requiring that after a SIM swap the new SIM cannot be used...