Number theft (spoofing) — Why the number displayed proves nothing

Number theft, or telephone spoofing, consists of falsifying the caller ID transmitted with a call to display on the recipient's screen a number that is not that of the sender. The number displayed is therefore never proof of identity. This is the technical basis of most credible telephone scams, from fake bank advisors to fake police officers.

Why it is technically possible

The telephone network was designed at a time when only a few trusted operators could make calls. The caller ID is a simple declarative field, transmitted by the transmitter with the call. With IP telephony, any actor with operator access can fill in this field at their convenience. Historically, nothing verified that the declared number actually belonged to the caller.

This is what allows a scammer to display the exact number of your bank's fraud department, or that of the gendarmerie brigade in your municipality. The victim has no way, when the phone rings, to distinguish this call from a genuine call.

What France has put in place since 2024

The law of July 24, 2020, known as the Naegelen law, imposed on operators a number authentication mechanism (MAN), based on the STIR/SHAKEN protocols already deployed in the United States and Canada. The principle is that of a chain of trust between operators.

1. 1
   The operator signs the call

   Each operator using French numbers holds an electronic certificate, obtained from the APNF, which identifies it to other operators. By digitally signing a call, he certifies that the caller number used is legitimate and takes responsibility for it.

2. 2
   The recipient's operator verifies the signature

   The proof of authenticity travels throughout the call and can be checked by both the terminating operator and the transit operators. If the signature is missing or cannot be validated, the operator is required by law to block the call.

3. 3
   A gradual deployment

   Unauthenticated call interruption is effective for calls to landlines from 1^er October 2024, and for calls to mobiles since January 2025. Arcep also adopted changes to the numbering plan in November 2025 to consolidate this chain of trust.

Why scam calls continue despite everything

The MAN is an important advance, but it addresses the technical origin of a call, not its intention. Three limitations explain why your loved one still receives scam calls.

1. An authenticated call may be fraudulent. A scammer who calls from a number he actually owns – prepaid SIM card, number rented from a complacent operator – passes authentication without difficulty. The call is technically legitimate and fundamentally malicious.
2. International remains a weak point. A share of fraudulent calls come from platforms located outside France, where the chain of trust is more difficult to establish. This is precisely why regulations have been strengthened on unauthenticated French numbers from abroad.
3. The manipulation does not depend on the number. The heart of the scam is the conversation: the manufactured emergency, the request for a code, the instruction to call another number. No network mechanism analyzes the content of the exchange.

If your number is stolen

You receive callbacks from people you've never called, sometimes reprimands. Your line is not hacked and you are not responsible: a third party is simply displaying your number. Here are the useful gestures.

• Report the theft via I alert Arcep, the telecoms regulator's reporting service, and notify your operator.

• Warn your loved ones, especially older ones: calls may appear to come from you. This is the mechanism of fake loved one in emergency.

• Don't change your number in a hurry. Spoofing campaigns are generally temporary, and changing numbers has a high practical cost for an uncertain benefit.

• File a complaint if there is harm — for example if your number has been used to defraud people around you.

The only reflex that always works

Since the display can be tampered with, verification cannot start from the incoming call. It must always start from a number that you already have: the one written on the back of your bank card, on a contract, on an official letter, or 17 for the police and gendarmerie. Hanging up and then calling back yourself is the action that neutralizes spoofing, whatever the scenario. Conversely, calling back the displayed number or a number dictated during the call leads directly to the fraudster or his accomplice.

Kin-Guard's approach to spoofing

Since the number displayed is not reliable, Kin-Guard does not base its decision on it. The assistant answers unknown calls on behalf of your loved one, asks for the identity and reason of the caller, then analyzes the conversation: artificial urgency, request for confidential information, instructions to call another number, pressure not to talk about it. It's the behavior of the caller that decides, not their ID. The call is only transmitted if it is legitimate.

Frequently asked questions

Article written by Charlie BART, founder of Kin-Guard. Published on August 2, 2026.

Sources: Arcep — Landline or mobile phone number theft: what should I do? · Arcep — Number authentication: operators’ obligations · law no. 2020-901 of July 24, 2020 (Naegelen law).

Also read